Strictly Private & Confidential

1. SHARIAH RISK MANAGEMENT IN ISLAMIC BANKING: • CURRENT PRACTICE & CHALLENGES AHEAD • 2019 QUARTERLY ISLAMIC FINANCE PUBLIC LECTURE • 18TH JULY 2019 • KOLEJ UNIVERSITI ISLAM ANTARABANGSA SELANGOR, MALAYSIA Strictly Private & Confidential

2. OUR DISCUSSION FOCUS … SHARIAH RISK MANAGEMENT • SHARIAH GOVERNANCE FRAMEWORK - Effective date 1 January 2011. • Newly revised Shariah Governance Framework is expected to be released soon. • Objectives: • Set out the expectation of BNM on Shariah governance structures, processes and arrangements to ensure that all its operations and business activities are in accordance with Shariah. • Provides a comprehensive guidance to the Board, Shariah Supervisory Council and management of the Bank in discharging its duties in matters relating to Shariah; and • Outlines the functions relating to Shariah review, Shariah audit, Shariah risk management and Shariah research.

3. SHARIAH NON-COMPLIANT INCOME POST IMPLEMENTATION OF BNM SGF Shariah Non-Compliant Income (in RM) Note/ Disclaimer: The data is based on the disclosure made by the selected banks in their 2016 Annual Report The selection of banks above was made randomly as a sample for discussion in the Public Lecture session and other banks which are not included as the sample does not mean they had no Shariah non-compliant income recorded/ disclosed in their respective annual report. .

4. SIGNIFICANCE OF ROBUST SHARIAH RISK MANAGEMENT FRAMEWORK IMPLEMENTATION 2 1 3 4

5. SIGNIFICANCE OF ROBUST SHARIAH RISK MANAGEMENT FRAMEWORK IMPLEMENTATION (cont.) 1 • One step ahead before SNC detection by Shariah Audit & Shariah Review functions • Shariah audit & Shariah review – post event. • Shariah risk management – forward looking approach in managing the possibilities of Shariah non-compliance from occurrence. • Shariah audit & Shariah review can prioritize their annual audit and review plan based on input from Shariah risk management.

6. SIGNIFICANCE OF ROBUST SHARIAH RISK MANAGEMENT FRAMEWORK IMPLEMENTATION (cont.) 2 • Mitigating risk of SNC occurrence – reducing the amount of SNC income – maximizing profit of the bank • In Islamic banks – SNC can happen in all products execution • i.e. deposit, financing, investment, etc. • Why do we need to do purification? How much purification to be done – all ‘profit’ or partially? • For asset management companies – focus need to be given to active breach because passive breach is somehow beyond our control. Due to active breach – Shariah advisor of the fund may instruct for immediate stock disposal and loss to be borne by the fund manager.

7. SIGNIFICANCE OF ROBUST SHARIAH RISK MANAGEMENT FRAMEWORK IMPLEMENTATION (cont.) 3 • Supporting annual Shariah Committee’s Report on the compliance of the bank and its activities • How comprehensive the coverage of Shariah audit and Shariah review in one financial year? • - number of manpower for both Shariah audit and Shariah review • - the size of IFI (branches, HQ departments, subsidiaries, etc.) • Shariah risk management complements this issue. • By using RCSA as one of Shariah risk management tools – every functional area within IFI will do their risk and control assessment systematically on a frequent basis.

8. SIGNIFICANCE OF ROBUST SHARIAH RISK MANAGEMENT FRAMEWORK IMPLEMENTATION (cont.) 4 • Regulatory motivation

9. SHARIAH RISK MANAGEMENT REQUIREMENTS IN MALAYSIA PRINCIPLE 7 of SGF: There shall be a robust Shariah compliance function, comprising review and audit functions, supported byrisk management control process and internal research capacity. Para 7.15 Shariah risk management is a function to systematically identify, measure, monitor and control of Shariah non-compliance risks to mitigate any possible of non-compliance events. Para 7.16 The Shariah risk management control function shall form as part of the bank’s integrated risk management framework. Para 7.17 Due to technicality and complexity in managing the risk of non-compliance to the Shariah, the function shall be performed by risk officers that have suitable qualifications and/or experience in the subject matter.

10. SHARIAH RISK MANAGEMENT REQUIREMENTS IN MALAYSIA (cont.) Para 7.18 Shariah risk management function involves: 1) Facilitating the process of identifying, measuring, controlling and monitoring Shariah non-compliance risks inherent in the bank’s operations and activities. 2) Formulating and recommending appropriate Shariah non-compliance risk management policies and guidelines. 3) Developing and implementing processes for Shariah non-compliance risk awareness in the bank.

11. BUILDING BLOCKS OF SHARIAH RISK MANAGEMENT FRAMEWORK

12. CAUSAL FACTORS OF SHARIAH NON-COMPLIANCE Causal factors of operational risk are also applicable on Shariah risk management… • SYSTEM • EXTERNAL EVENT • PEOPLE • PROCESS • Lack of policy/ procedures • Documentation • Marketing • Control framework • Knowledge/ awareness • Communication • Negligence • System design • System monitoring • System support • Regulation • Outsourcing SAMPLE CASES SNC happens because the document execution checklist did not comprehensively cover different contract scenarios Delay of income purification due to lack of procedures – tainted income being invested in the fund. SAMPLE CASES SNC happens because poor dissemination of Shariah resolution covering relevant functions within IFI. After product briefing, branch manager delayed to brief his branch people of Shariah requirements for new product. SAMPLE CASES System enhancement which caused disability of aqad screen.. Wrong input for system involving Shariah requirements of ta’widh. SAMPLE CASES Reclassification of Shariah compliant securities and failure of IFI to dispose the non-compliant securities. Outsourced function caused Shariah non-compliant due to lack of training/ awareness.

13. CHALLENGES AHEAD