The roles and responsibilities of the Board and Board Sub-Committees are summarised below.

Sampath Bank adopts the three-lines-of-defence approach to manage risk within the Bank in line with best practices.

The Bank's comprehensive risk management policy framework is summarised below.

2. Risk Management Process

Sampath Bank's approach to managing risk follows the below common process with adaptations across key risks to capture their specific characteristics. This process is used to manage all key risks across the Bank including, credit risk, liquidity risk, operational risk, market risk, IT risk, legal risk and reputation risk. The adoption of a formal process for risk management enables the Bank to proactively identify, measure, control, monitor and report key risks across different levels of the Bank. This in turn facilitates stakeholder value creation, protects the Bank's competitive advantage, reinforces financial stability, and builds long term resilience. Responsibility for the execution of the risk management process lies with the Risk Management Unit (RMU).

This entails applying an appropriate treatment methodology for each assessed risk while carefully balancing risk reward dynamics. Developing risk control and mitigation strategies is a dynamic process and leads to either accepting, transferring, mitigating or avoiding the assessed risk. This entails a range of strategies, including the introduction of new controls, enhancing existing controls, strengthening contingency plans, and periodically reviewing risk appetite limits among others. Responsibility for arriving at an appropriate treatment strategy for each risk lies with the RMU under the guidance and oversight of the Board Integrated Risk Management Committee (BIRMC). The RMU is ably supported by the business units.

Risk monitoring involves verifying that the Bank’s operations adhere to established risk control protocols and enables ongoing awareness of its risk profile. The RMU is responsible for risk monitoring and collaborates closely with business units to facilitate effective control.

Identified, measured, monitored and mitigated risks are reported to the Senior Management, Board Integrated Risk Management Committee (BIRMC) and the Board of Directors, for timely action and follow up by the RMU.

3. Risk Control Architecture

Sampath Bank’s Risk Control Architecture is approved by the Board and benchmarked to international best practices. Key components of the Bank’s Risk Control Architecture are summarised below.

The Bank’s Risk Appetite Statement specifies the type and amount of risk it is willing to accept in pursuing its strategic goals. Sampath Bank’s Risk Appetite Statement is developed considering regulatory limits, covenant limits, external factors and internal prudential limits and is approved by the Board. The RMU monitors the Bank’s operations on an ongoing basis to ensure its alignment with Board-approved Risk Appetite tolerance limits. The RMU presents its findings in this regard to the BIRMC monthly, to facilitate immediate remedial action in the event of any deviations.

The Risk Appetite Statement and specified tolerance limits are reviewed by the BIRMC at least once a year or more frequently if required. Recommended changes are approved by the Board prior to formal incorporation into the Risk Appetite Limit Framework.

The Bank’s key risk appetite parameters and Board approved tolerance limits as at 31st December 2024 are given below.

---

Effective capital planning and robust capital buffers safeguard a financial institution by providing a cushion to absorb unforeseen losses, prevent insolvency and maintain stability. Consequently, Sampath Bank adopts a proactive approach to capital planning with emphasis on;

• Maintaining sufficient capital to meet minimum regulatory capital requirements.
• Holding sufficient capital to commensurate the risk profile of the Bank.
• Ensuring adequate capital buffers to support the Bank’s strategic objectives.
• Maintaining adequate buffers to absorb unexpected losses arising from various risks and safeguard depositors’ funds.

Sampath Bank’s Board of Directors is responsible for the Bank’s capital management which includes capital planning, monitoring and fulfilling regulatory and Pillar II capital adequacy requirements. The Bank uses a range of tools to ensure adequate capital buffers to support its growth objectives while maintaining stability. These include computing and complying with capital adequacy ratios in line with regulatory requirements and ICAAP among others. The Board approves a comprehensive capital plan annually under the strategic planning process.

3.2.1. Capital Adequacy

Capital adequacy is a key metric used to assess the solvency and stability of a financial institution. The capital adequacy ratio which represents the proportion of a Bank’s capital relative to its risk weighted assets measures a bank’s ability to absorb potential losses arising from credit, market and operational risks during the course of its operations.

Capital adequacy ratios for licensed commercial banks in Sri Lanka are computed based on the Banking Act Direction No. 1 of 2016 and its subsequent amendments which reflect the capital requirements set out under the BASEL III Accord. As a licensed commercial bank, Sampath Bank computes its regulatory capital adequacy ratios in compliance with these regulations. Accordingly, Sampath Bank computes its regulatory capital adequacy ratios under 3 tiers, adopting the Standardised approach for credit risk, Standardised Measurement approach for market risk and Alternative Standardised approach for operational risk.

As at 31st December 2024, the Bank maintained a robust capital position as presented below.

Stress testing is a vital part of the Bank’s risk control architecture. It enables impact assessment on liquidity and capital under a range of “what if” scenarios and the development of robust contingency strategies. Stress Testing is carried out in accordance with the Bank’s comprehensive Stress Testing Policy which sets out the framework and procedures to be followed. The Bank’s Stress Testing Policy is aligned with the BASEL III’s Pillar I and Pillar II requirements and therefore serves as an integral part of the Bank’s ICAAP. The RMU is responsible for carrying out stress testing and the results are reported to the BIRMC and the Board, informing their decisions on risk limits, capital allocations for various risks and managing risk exposures and developing appropriate contingency plans in response to adverse circumstances.

The RMU conducts quarterly stress testing encompassing over 24 stress scenarios across all major risk types. Sensitivity analysis is usually conducted for individual risk types while scenario analysis is conducted for combined, integrated and macro-economic stress tests based on underlying assumptions and parameters. Stress testing is carried out more frequently if the external environment is rapidly evolving. A risk register is prepared on a quarterly basis covering over 750 risk factors and a dashboard summarising the level of risk associated with each risk type is prepared and reported to the BIRMC on a quarterly basis.

Stress testing in 2024 focused on following Stress testing parameters:

4. Risk Awareness Culture

The effectiveness of the IRM Framework relies on a shared commitment to risk awareness and management at all levels of the Bank, encompassing the three lines of defence. At Sampath Bank, effective risk culture is driven by strong Board-level commitment and leadership. Continuous training and capacity building initiatives are implemented across all levels of the Bank under the oversight of the RMU to embed a strong risk focus in the performance of their roles and responsibilities. Policy frameworks are also regularly reinforced to promote their consistent application in daily operations. Internal audit and post-incident reviews further strengthen the risk culture at Sampath Bank.

During the year, the RMU conducted 28 risk related training programmes for employees at different levels of the Bank, while the RMU participated in 50 internal and external workshops to keep abreast of the latest developments in the external environment and effective risk management.

5. Overview of Principal Risks

The principal risks impacting the operations of Sampath Bank have been summarised below and key mitigation strategies implemented during the year under review have been summarised below.

---

The ongoing efforts of the Recoveries Department continued to support the effective management of credit risk at Sampath Bank in 2024. Proactive efforts of the Unit in 2024 mitigated some of the challenges posed by the suspension of parate execution by CBSL from 21st April 2024 to 31st March 2025. Key initiatives implemented by the Recoveries Department in 2024 are summarised below.

Recognising the impact of successive challenges on the SME sector in recent years, the scope of the Business Revival Unit (BRU) was expanded during the year under review. This also enabled the Bank to comply with the CBSL regulations that required all banks to set up a dedicated Business Revival Unit to assist in reviving viable businesses impacted by extraordinary macroeconomic challenges faced by the country in recent years.

The Bank proactively assessed businesses with potential for revival and such customers were provided with advice on both financial as well as non-financial initiatives/remedial action that could be taken for business revival.

Promoting Borrower Recovery and Repayment

Aligning with both the regulatory requirements of Circular No. 2 of 2024 - Guidelines for the Establishment of Business Revival Units in Licensed Banks and the Bank’s own commitment to support business recovery, Sampath Bank expanded the scope of its Business Revival Unit (BRU) in 2024 and strengthened its governance structure.

Accordingly, the BRU was positioned under a Deputy General Manager and a Chief Manager with experience in both retail and corporate credit. These senior officers of the Bank report directly to the Managing Director, enabling the strategic alignment of the BRU’s activities with the Bank’s risk management framework while facilitating the revival of viable businesses. The Board Credit Committee reviews the performance of the BRU on a quarterly basis.

The role of the BRU is two-fold,

• Support business recovery and revival via financial assistance and re-structure/re-scheduling of facilities.
• Financial advisory services which include,
  • Identifying and directing entities towards asset disposal as relevant, downsizing non-viable operations and concentrating on activities in which entities have core competencies, market share and/or profitability.
  • Promoting financial discipline with covenants carefully explained to customers to highlight their potential long term benefits.
  • Sharing market intelligence, connecting with relevant authorities for advice on business activities etc.

The Treasury Department manages the Bank’s liquidity risk with the objective of ensuring that funding commitments and deposit withdrawals can be met when due, while complying with minimum regulatory requirements and maintaining cost-effective market access. The Bank’s liquidity strategy is operationalised through the Board approved ALCO policy and Liquidity Management Policy under the oversight of the Bank’s Asset and Liability Management Committee (ALCO).

Sampath Bank relies on deposit mobilisation as its primary source of funding. Deposits are mobilised from retail, commercial and wholesale clients. To complement these deposits, Bank Treasury actively pursues additional funding avenues both domestically and internationally which includes institutional borrowings and debt instruments.

The Bank adopts the stock and flow approach to measure and manage liquidity risk in line with international best practices. This involves computing and balancing a Bank’s static liquidity position and its dynamic cash inflows and outflows to maintain adequate liquidity levels. The stock approach is used to ascertain the Bank’s static liquidity position by computing a range of balance sheet ratios and comparing it against its risk appetite. The flow approach is used to forecast and manage the dynamic inflow and outflow of funds at a range of points in time enabling the Bank to track cashflow mismatches over a range of specified time periods. The combination of the stock and flow approach enables the Bank to effectively ascertain short- term liquidity needs, emerging liquidity risks and proactively manage liquidity buffers. To ensure sufficient funds to meet obligations in a timely manner, approved treasury limits are tracked in real time through the Treasury limit monitoring system and deviations are reported to the management for review and approval.

The Bank has a robust system in place to manage liquidity and ensure compliance with treasury limits.

Stress testing continued to be an integral part of liquidity risk management at Sampath Bank during 2024. The approved parameters pertaining to the Liquidity Coverage Ratio were stress tested quarterly considering the prevailing economic environment and reported to the BIRMC.

The Bank also has a contingency funding plan in place to address crisis situations. It provides the framework to manage critical situations that lead to liquidity constraints that disrupt the daily operations of the Bank.

Sampath Bank’s Market Risk Management Unit (MRMU) under the oversight of the Board and the BIRMC is responsible for conducting market risk management activities. The MRMU monitors market risk in alignment with the Bank’s comprehensive Market Risk Management Policy framework. It also uses a range of quantitative statistical tools including Value at Risk (VaR) and Present Value Basis Points (PVBP) to manage market risk effectively. This enables a balance between risk and returns, reduces volatility and supports transparent reporting of the Bank’s market risk profile to Corporate Management, the Board and Regulators. Both VaR and PVBP are essential tools and provide insights into potential losses and price sensitivities, respectively.

VaR is a statistical technique used to measure the potential loss in a portfolio over a specified period. The historical simulation method is used for Market Risk VaR calculations, which uses historical market data over a pre-defined period and apply the outcome to the current portfolio.

A summary of the Bank’s market risk management framework is given below.

The Bank has a robust governance framework in place to proactively and effectively manage operational risk.

Sampath Bank's operational risk management framework guides the activities of all those involved in managing operational risk and is designed to enable proactive management of operational risk, build resilience, protect stakeholders and achieve its strategic objectives

Key aspects of operational risk management at Sampath Bank include,

• Identification of operational risks across all business lines and functions and assessment of likelihood and impact of risks using a range of tools and methodologies including RCSA, scenario analysis and stress testing.
• Prompt recording and reporting of operational risk events through the loss events reporting system. Data analysis to identify root causes and trends, to facilitate the enhancement of operational processes and controls to prevent the recurrence of similar events.
• Key Risk Indicators are used to track potential risk exposures in real time. These indicators provide early warning signs allowing the Bank to take pre- emptive action before risks materialise as significant threats.
• Regular monitoring ensures the Bank's operations are within the defined risk appetite.
• Overlook the reviewing of directives, policies and procedures to ensure correct guidelines are followed when preparing the same.
• Implementation of risk mitigation strategies including strengthening operational controls, enhancing process efficiency, staff training, automation of risk management processes and adequate insurance coverage to protect against unforeseen operational losses.
• Adherence to all laws, regulations and guidelines of the CBSL and other regulatory bodies.
• Regular audits and compliance checks are conducted to ensure all operational activities fully comply with regulatory requirements.
• Fostering a strong risk culture across the Bank through regular training programmes, workshops and awareness campaigns.

System simulations were carried out periodically while critical functions were tested quarterly at both disaster recovery sites. Random disaster recovery drills were also conducted where all banking functions were operated through the disaster recovery servers continuously for a long time period to verify proper functioning of disaster recovery servers and sites and familiarising the team. This also provided the team with a comprehensive overview of the Bank’s disaster recovery practices.

The Bank also conducted the annual evacuation drill and required training such as first aid, evacuation in collaboration with the Fire Service Department in November 2024. The entire head office was evacuated within a satisfactory period of time with the assistance of designated fire wardens (BCP coordinators) of the Bank.

Link to strategy

Over 37 years of operations, the Bank has established a strong market position as a leading licensed commercial bank in Sri Lanka through effective leadership, robust risk management, a long-term strategic focus, ethical conduct and a commitment to financial inclusion and corporate responsibility. Therefore, the Bank places strong emphasis on safeguarding its reputation, maintaining its brand image and effectively managing reputation risk.

Reputation risk at Sampath Bank is managed in line with the Bank’s Board- approved Reputation Risk Management Policy. The Bank’s Chief Risk Officer and the Chief Compliance Officer collaborate closely with the Corporate Management including the Senior DGM - Marketing, Customer Care & Card Centre, BCP Director and Business Line Heads to safeguard the Bank’s reputation and to ensure brand building activities are in alignment with established policies and procedures.

Reputation risk management within the Bank also includes active stakeholder engagement to identify potential concerns. Feedback is obtained regularly from operational level staff to anticipate potential risks to reputation. The Bank also proactively monitors traditional media and social media for potential threats to its reputation. A formal procedure for handling and monitoring social media comments, inquiries, posts and complaints is also in place. Furthermore, the Bank operates a 24/7 Customer Care Centre to address customer issues, concerns and complaints swiftly and promptly.

The availability of a Code of Ethics, Anti-bribery and Anti-corruption policy, Communication policy, and Whistleblowing policy applicable to all employees ensure that corporate values and expectations of conduct are clearly communicated throughout the Bank and prevents unethical behaviour.

The Bank is cognisant of the importance of brand building activities in strengthening its reputation within the industry. Therefore, the Bank conducts a brand health study every two years to determine areas that could adversely impact its reputation. Care is also exercised to ensure all brand building activities and marketing communications are aligned with the Bank’s vision and corporate values.

A scorecard is used to assess Reputation Risk drivers to calculate the additional capital requirement under ICAAP process. Regular assessment of Reputational risk is carried out under the Risk Register and the Risk Matrix.

Link to capital