Basel III Pillar 3 Disclosures 2024

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

Commercial Bank International P.S.C

Basel III - Pillar 3 Disclosures -31stDecember 2024

1

The content is classified as Public

3.1 Differences between accounting and regulatory scopes of consolidation and mapping of

3.2 Differences between accounting and regulatory scopes of consolidation and mapping of

3.3 Main sources of differences between regulatory exposure amounts and carrying values in

2

The content is classified as Public

9.7 Qualitative disclosures on banks' use of external credit ratings under the standardised

9.8 Standardised approach - credit risk exposure and Credit Risk Mitigation (CRM) effects (CR4)

28

3

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

Introduction

This document presents Pillar lll Market Disclosure Report for Commercial Bank International ("CBI" or "the bank") prepared in accordance with the requirements and guidelines as prescribed by the Central Bank of the UAE (CBUAE) and other clarifications received from time to time along with the Formal Disclosure Policy of the Bank.

The purpose of this report is to inform market participants of the key components, scope and effectiveness of the Banks risk measurement processes, risk profile and capital adequacy.

The Bank has adopted the Standardized Approach for determining the capital requirements for Credit Risk, Market Risk and Operational Risk. This Pillar lll Report provides details on the risk management process, enabling users to gain a clear understanding of the bank's risk appetite in relation to its main activities and all significant risks.

Pillar lll Disclosures 2024

Pillar lll complements the minimum capital requirements and the supervisory review process. It's aim is to encourage market discipline by developing disclosure requirements which allow market participants to assess specified information on the scope of application of Basel III standards, compliance to minimum capital requirements, particular risk exposures and risk assessment processes. Disclosures consist of both qualitative and quantitative information and are provided at the consolidated level.

As per the CBUAE Basel III capital regulations, minimum capital requirements are monitored at three levels, namely Common Equity Tier 1 (CET1), Additional Tier 1 (AT1) and Total Capital. Additional capital buffers (Capital Conservation Buffer 2.5% and Countercyclical Capital Buffer 0%) introduced are over and above the minimum CET1 requirement of 7%.

1.1 Basel Regulatory Framework

The Basel Accord framework consists of following three main pillars:

• Pillar I - defines the regulatory minimum capital requirements by providing rules and regulations for measurement of credit risk, market risk and operational risk;
• Pillar II - addresses a Bank's Internal Capital Adequacy Assessment Process("ICAAP") for assessing overall capital adequacy in relation to risks other than Pillar I. Pillar II also introduces the Supervisory Review and Evaluation Process ("SREP"), which is used as a tool to assess the internal capital adequacy of banks; and
• Pillar III - complements the other two pillars and focuses on enhanced transparency in information disclosure, covering risk and capital management, including capital adequacy which encourages market discipline and allows market participants to assess specific information.

Verification

The Pillar lll disclosures for the year ended 31stDecember 2024 have been appropriately reviewed by the management and internal audit.

1.2 Group Structure - Information on Subsidiaries

Commercial Bank International P.S.C. (the "Bank") is a public shareholding company with limited liability

incorporated under an Emiri Decree Number 5/91 on 28 April 1991 by His Highness Ruler of Ras Al- Khaimah. The registered office of the Bank is at P.O. Box 793, Ras Al-Khaimah. The Bank is listed on

4

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

the Abu Dhabi Exchange (Ticker "CBI"). The Bank carries on commercial banking activities through its branches in the United Arab Emirates ("the UAE").

Details of the Group's subsidiaries and associates at the end of reporting period is as follows:

Note:

• Under liquidation.
• This associate is accounted for using the equity method in these consolidated financial statements and the net assets of ARZAQ are in deficit position, consequently investment in associate is carried at Nil value..

The consolidated financial statements incorporate the financial information of the Bank and its subsidiaries International Financial Brokerage LLC (the subsidiary - IFB), Takamul Real Estate Company (the subsidiary - TRE) and other entities mentioned in Table 1 above, collectively referred to as the "Group" as of 31st December 2024.

For the purpose of Pillar III capital adequacy reporting, only the financial subsidiaries are consolidated for Capital Adequacy Reporting. Commercial subsidiaries are excluded from consolidated regulatory reporting and therefore Takamul Real Estate LLC and other Commercial entities are deconsolidated for Regulatory capital reporting.

Overview of Risk Management and RWA

2.1 Bank's Risk Management Approach (OVA)

The primary objective of Enterprise Risk Management is to protect the Banks' assets from the various risks the Bank is exposed to and maximize shareholders value. The Bank undertakes a wide variety of businesses and hence is required to be able to identify measure, control, manage, monitor, and report risks in a clear manner.

The important aspects of the Bank's risk management are risk governance, risk architecture, approval mechanism, processes, guidelines, and an elaborate internal control mechanism. The Bank is exposed to key risks: credit risk, investment risk, liquidity risk, market risk, operational risk, and other residual risks like Interest Rate Risk in the Banking Book (IRRBB), Strategic Risk, Reputational Risk, Macroeconomic Risk, Sector and Name Concentration Risk along with Sharia'h non-compliance risk. Special units to handle Fraud Prevention & Monitoring and Information Security are also established under Risk Management Division. The Risk Management Group is handled by experienced team of risk professionals, under the leadership of Chief Risk Officer.

A well-defined risk management framework is in place with the overall responsibility of risk management

5

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

vested with the Board of Directors managed through the Board Risk Committee. The Board of Directors approve the Bank's risk management policies which defines the Bank's risk strategy, which is backed by appropriate qualitative and quantitative parameters, delegation of authorities to the Executive Committee of the Board, Internal Credit Committee and Executives to approve financing exposures. The policies and processes for management of risks have proved to be effective. The risk management framework compliments the International Best Practices, Basel Committee, and Central Bank of UAE guidelines.

The role of the Risk Management Group is to develop and implement the risk policies associated specifically with both quantifiable and non-quantifiable risks arising from the activities of the Bank and manage the day-to-day risks. The risk management function along with the internal audit function of the Bank provides independent assurance that all types of risk are being managed in accordance with the policies set by the Board of Directors. Independent review of the risk management framework is carried out by the Internal Audit.

The risk environment in which the Bank operates changes continuously, caused by a range of factors, from the transactional level to macroeconomic events. The risk environment therefore requires continuous monitoring and assessment. Initiatives under the Bank's Enterprise Risk Management program have been a major catalyst and contributor to the enhancement of risk management practices within the Bank. The risk management framework institutionalized across the Bank is designed to meet these challenges as part of Basel program.

The Bank's Risk Management Principles

Bank's risk management principles define the accountability, independence, structure, and scope of Risk Management.

1. The risk management approach is premised on three lines of defense - risk taking business units, risk control units like Risk, Compliance and Internal Audit.
2. Therisk-taking units are responsible for the day-to-day management of risks inherent in their business activities while the risk control units are responsible for setting-up the risk management frameworks and developing tools and methodologies for the identification, measurement, monitoring, control and testing of risk. Complementing this is Internal Audit which provides independent assurance of the effectiveness of the risk management approach.
3. All major credit proposals of the bank prepared by the credit analyst pool (reviewed and recommended by Corporate Credit) are approved/recommended by Internal Credit Committee (ICC), Board Credit Committee (BCC), and the Board of Directors based on an established credit approval authority matrix. The ICC comprises designated members of the Bank's management and is chaired by the Chief Executive Officer (CEO). ICC comprise of three members; CEO, CCO & Head of Wholesale Banking Group (HWBG). Chief Risk Officer (CRO) is a permanent invitee (anon-voting attendee) to ICC meetings. The CRO assumes the responsibility of providing independent views of the credit applications discussed in ICC meeting. In addition, Risk Management Group provides risk oversight and consultancy to all lines of business for the major risk categories including credit risk, market risk, liquidity risk, operational risk and other industry-specific risks that are discussed under ICAAP framework.
4. Risk Management Group ensures that the core risk policies of the Bank are consistent and current, sets the risk tolerance level through the approved Risk Appetite Framework (RAF) & Policy. Also, Risk Management Group is responsible for the execution of various risk policies

6

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

and related business decisions empowered by the Board.

1. Risk Management Group is functionally and organizationally independent of the business units and otherrisk-taking units within CBI.
2. CBI's Board, through the ALCO, MRC, BRC and EXCOM, maintains overall responsibility for risk oversight within the Bank.

Risk Management Division efforts have been focused on establishing a strong risk governance. Risk communication was enhanced, and we are moving from an analytical function to a strategically oriented activity.

Board and senior management are actively involved in firm-wide risk oversight by integrating risk management activities within the organization. Through embedding risk management within different business units and having in place appropriate and effective policies and procedures, Board and senior management ensure that the employees who are in decision making positions not only understand the underlying risk but also take necessary actions to minimize the risks.

Risk Management Division is responsible for generating and submitting timely and accurate risk reports to senior management. The underlying risks in different areas are analyzed and presented to the senior management for making business decisions. These reports cover analysis on capital management, concentration in terms of products, business lines, counterparties etc., and non- performing accounts. Furthermore, it underlines the areas which require attention and also recommends the changes, if required, in the policies or procedures.

CBI's Risk Governance model is as follows.

7

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

Credit Risk

The Bank has adopted the Standardized Approach for measuring minimum capital requirement for credit risk.

Exposures after application of specific provisions, if any, and / or eligible Credit Risk Mitigants (CRMs), are multiplied by the specified risk weight to arrive at the Risk Weighted Asset (RWA). Off- balance sheet exposures are adjusted using product type specific Credit Conversion Factors (CCF) and/or eligible Credit Risk Mitigants, before determining the RWAs. Similarly, derivatives are considered at their Credit Equivalent Amount before determining RWAs.

Credit policy of the bank has been prepared with the broad objective of meeting the following goals:

• Adhere to the guidelines or policies pronounced by CBUAE; and
• Hold a diversified good quality asset portfolio throughrisk-based lending.

In order to assess the credit risk associated with any financing proposal; the Bank assesses a variety of risks relating to the borrower and the relevant industry. The Bank uses risk rating models and systems for assessing the credit worthiness of borrowers. This assessment considers the following factors:

• borrower's financial position by analyzing its financial statements, history of financial performance, and cash flow adequacy;
• borrower's relative business competitiveness, business strategy, market position and operating efficiency; and
• quality of management by analyzing their track record, payment record and financial conservatism.

The Bank evaluates industry risk by considering:

• Certain industry characteristics, such as position of the industry in the economy, cyclicality and government policies relating to the industry;
• The competitiveness of the industry; and
• Certain industry statistics, including industry growth rate, return on capital employed, operating margins and earnings stability.

CBI's ECL (Expected Credit Loss) calculation methodology and process based on IFRS9 standards and related disclosures are available in Annual Financial Report 2024.

Market Risk

The Bank uses the Standardized Approach to calculate the regulatory capital requirements relating to market risks (covering interest rates, equity, foreign exchange, commodity and options). The scope and charges are restricted to 'trading book' only for the interest rate risk and equity positions. The bank currently does not hold any equity trading positions.

Operational Risk

The Bank has an independent Operational Risk Department under Chief Risk Officer which is tasked with monitoring and controlling the Operational Risks of the Bank. Functions of this department are guided by the Operational Risk Policy and Framework. To institutionalize the assessment and mitigation of operational risks, the Business Environment and Internal Control Framework is established as part of ERM program. The Bank has implemented Business Continuity and Disaster

8

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

Recovery program to reduce the potential Operational risk.

Asset and Liability Management Committee

Asset and Liability Management Committee (ALCO) has been established to provide oversight of asset and liability management within the Bank, ensuring the following:

• Better positioning of Bank's balance sheet in the light of current market trends, opportunities and challenges
• Adequate planning, directing and controlling of the flow, level, mix, cost and yield of Bank's assets and liabilities to ensure liquidity and profit rate risk remain within the approved risk appetite
• Prudent and proactive management of Bank's balance sheet to safeguard from any adverse market movements including liquidity constraints, shift in credit scenarios and capital adequacy

Internal Capital Adequacy Assessment Process (ICAAP)

The oversight for assessment of credit, market, operational, and others risks such as liquidity, concentration, legal, stress testing and reputation risks and the adequacy of capital to meet current and future requirements of the Bank lies with the Bank's Board of Directors.

The Bank's ICAAP model is aligned with the Bank's strategy and addresses capital planning, risk appetite, assessment of all types of material risks, testing the capital requirement under different stress scenarios, capital required for covering all material risks due to current as well as prospective business profile and internal organization and processes to manage the above on an on-going basis.

The ICAAP framework determines the level of capital required to support the Bank's current and projected activities for capital under normal and stressed conditions. The ICAAP report is produced on an annual basis and is duly approved by the Board Risk Committee (BRC) as well as the Sharia's Supervisory Board and the Board of Directors.

a. Comprehensive Risk Assessment under ICAAP Framework

Under the revised ICAAP methodology, the following risk types are identified and measured:

• Risks captured under Pillar 1 of BASEL III (credit risk, market risk and operational risk);
• Risks not fully captured under Pillar 1 of BASEL III (e.g., Residual Risks);
• Risks not considered by Pillar 1 of BASEL III (e.g., Interest Rate Risk in the Banking Book (IRRBB), Liquidity Risk, Business/Strategic Risk, Reputational Risk, Macroeconomic Risk and ConcentrationRisk-Name and Economic Sectors); and
• External factors, including changes in economic environment and regulations. b. Assessment of Pillar 1 and Pillar 2 Risks under BASEL III regime

The bank quantifies its risks using methodologies that have been reasonably tested and deemed to be accepted in the industry as per industry best practices.

Where risks are not easily quantified, due to the lack of commonly accepted risk measurement techniques, expert judgment is used to determine the size and materiality of the risk. The Bank's

9

The content is classified as Public

Commercial Bank International PSC

Basel III - Pillar 3 Market Disclosures - 31stDecember 2024

ICAAP then focuses on the qualitative controls in managing such material, non-quantifiable risks within the established governance framework of the bank. These qualitative measures include the following:

• Adequate governance process through BRC, EXCOM and the Board of Directors;
• Adequate systems, procedures and internal controls;
• Effective risk mitigation strategies; and
• Regular monitoring and reporting through various committees and management forums. c. Stress Testing

The Bank's stress testing program is revamped, and a robust and comprehensive model is put in place for performing the required stress testing exercise. During the year, the Board approved Stress Testing Framework and Policy was put in place. It is embedded in the risk and capital management process. The program serves as a forward-looking risk and capital management tool to understand the Bank's risk profile under extreme but plausible conditions. Such conditions may arise from the macroeconomic, strategic, political, and business environmental factors.

Under the CBI Stress Testing Policy and Framework, approved by the Board and updated during 2024, the potential unfavorable effects of stress scenarios on the Bank's profitability, asset quality, liquidity, risk weighted assets and capital adequacy are modelled. At CBI, the Stress Testing methodology is under constant review by Chief Risk Officer (CRO) to reflect the prevailing regulatory and global best practices along with reflecting the macroeconomic scenarios and is capable of translating the potential risks faced by the Bank into meaningful results.

Specifically, the stress testing program is designed with an objective to assess the resilience, solvency, liquidity, and profitability of the Bank against various stressed events. Depending on the nature of the risk factor, the impact of the stress testing exercise where applicable, are measured on the following indicators of the Bank:

• Assets quality - increase/decrease innon-performing assets measured in terms of ratio to financing assets;
• Profitability - increase/decrease in the accounting profit & loss.
• Capital adequacy - measured in terms of changes in total amount of capital and the Capital Adequacy Ratio (CAR);
• Liquidity position - measured in terms of changes in key liquidity indicators. Liquidity reports are presented to ALCO, Management Risk Committee and Board Risk Committee.

CBI also performed the bottom-up stress testing as required by the CBUAE; the exercise has been validated by external expert. The report was reviewed and accepted by CBUAE.

10

The content is classified as Public