1. Seminar on Internal Control INTERNAL CONTROL AWARENESS PROGRAMME PREVENTIVE CONTROLS AT BRANCHES & COMMON AUDIT FINDINGS Prepared by – BRANCH AUDIT 1 & BRANCH AUDIT 2

2. Seminar on Internal Control Operations AreaPreventive Control Cash Management a) Cash Counting & Balancing Presence of Teller & Officer when Buying & Selling of Cash. GN11 tally with GN10 – Cash hold not exceed the allowable limit Surprise cash count at counter twice a month & anytime during banking hours Coins Deposit Machine (CoDM) – Recon. report for QC Machine b) Sharing of ID Staff to keep their passwords confidential and refrain from sharing them with others. (Case) c) Security of Cash At least two authorized personnel supervise the MIP and MIT. Cash count done in secured area & under CCTV coverage. Receipt & cash received need to be presented to KUO and performed in Web BDS / counted in the presence of officer on the same day, i.e. collection of cash off-site premise. d) Dual Control – Vault & Safety Box Segregation of duties & at least two Officers entering the Strong Room. Change of combination number every 6 months. 2

3. Seminar on Internal Control AreaPreventive Control Teller Cash Recycler a) Opening Cash deposit into TCR tally with amount transfer from Chief Teller via Vault-by/ Transfer-in (Drawer) b) Cash-in / Cash-out / Cash-change Cash counting by TCR and figure in Remark (cash-change) tally with transaction amount c) Cash balancing Cash amount in TCR and Drawer tally with GN11 3

4. Seminar on Internal Control 4 AreaPreventive Control Savings / Term-Deposit-I / e-CAiSavings / Term-Deposit-I / e-CAi a) Opening of account Usage of GMPC via MyKad Reader without fail. If faulty, ultra-violet scanning & justification with copy of MyKad & record GMPC as “No” are required. Exception: MyKid / BoD of company / office bearers / committee to obtain Certified True Copy (CTC) of ID/ passport. Completeness of required supporting documents / CIF / PDPA / conduct of account e.g. CTOS & SSM checking before opening of e-CAi account. b) Cash Deposit/ Withdrawal Usage of GMPC without fail. If faulty, ultra-violet scanning is required. Ensure the customers’ presence for verification process. (Case) Withdrawal exceeds authority limit – to obtain Officer’s approval. If limit exceeds in the event of disaster, approval from Head of Region/ SVP Branch Network are required. Error correction is authorized based on valid reason. (Case) c) Dormant/ Closing/ Deceased/ Frozen Reactivation / Closing / Freeze / Unfreeze is authorized by PC / PPC - Usage of GMPC without fail. If GMPC is faulty, ultra-violet scanning is required. Maintenance & monitoring of inactive account before transfer to UMA. All supporting documents are obtained to proof relationship with the deceased customer & to know reason of freezing the account. d) Negotiation rate & Incentive Approval based on eligibility of customer & authority limit for Term Deposit-i account.

5. Seminar on Internal Control 5 AreaPreventive Control ATM/ CDM/ CICO/ Credit Card-iATM/ CDM/ CICO/ Credit Card-i a) Issuance / safekeeping of cards T32-002 (PIN Creation / Verification) & T32-003 (Activation / Approval) before issuing card to customer. No obvious differences between customers’ signature in N87 and PMPC list. Kept in a locked cabinet / strong room & uncollected card to return to Card Centre. b) Security & cash replenishment of ATM Segregation of duties & dual control during ATM cash replenishment – different personnel for key & combination holder & Security Guard are in the presence. Combination number changes at least once every 6 months. Correct posting of G10 (Tunai di ATM/ CDM) / G20 (Sipiutang Replenish ATM), G15 (Lebihan tunai OPA) & rear balancing. c) Customer’s complaints / ATM variances To monitor Cash Not Taken Report (RATM1108) & ATM GL Variance Report (RGL9690) - submit to Variance (KWSI) Dept. every 5 th Adjustment done (BKRM cards) within 1 - 2 days (in premise) or after balancing report obtained from Account Dept. / oursource company (off-premise) – (Case)

6. Seminar on Internal Control 6 AreaPreventive Control Western Union a) Sending & Receiving Money Completeness of supporting documents Transaction performed within approved limit. Immediate transaction posting in Web BDS & WU. G00-017 tally with WUPOS log at EOD. AreaPreventive Control Remittance (RENTAS/ SWIFT/ Demand Draft) a) Sending/ Receiving/ Verification on transaction against supporting documents i.e. Customer ID, Passport, Savings Passbook, ATM Card, Instruction Letter with official seal by Company or Representative Appointment Letter. Sending on behalf - Rubber stamp for Name & ID No. of representative b) Cancellation/ Replacement Verification on authorized signatory against signature in application form.

7. Seminar on Internal Control 7 AreaPreventive Control CTCS / Issuance of Cheque a) Received Cheque / Scanning process - CTCS Checking of physical & genuinity of cheque. O77 - Cheque Received Downloading match with IBS Load report. Chequeworks IBS report successfully updated (Match & Complete = Status 'O'). No variance in RGL9613 – Mismatch / Incomplete. b) Issuance of Cheque Approval from SVP, Branch Network is obtained except the following: 1- Deposit withdrawal 2- Settlement with other bank / co-operation which not allow IBG 3- Payment for LHDN stamp duty 4- Payment for insolvency

8. Seminar on Internal Control 8

9. 9 AreaPreventive Control Pawn-Broking-i a) Application Completeness of Surat Akuan Gadai / CIF / PDPA / Bankruptcy status/ PDS / Credit Information Consent Conduct of acid test on low karat marhun. Availability of Purchase Receipt & Certification of gold from authorized company. Purchase Receipt / Surat Akuan Penggadai is obtained. Seal of gold with the presence of customer. b) Safekeeping of gold Dual control entry to the strong room / CCTV is well-functioned. Use of temporary safe during banking hours. c) Redemption of gold by the right customer Usage of GMPC without fail. If GMPC is faulty, ultra-violet scanning is required. Authorization letter for redemption of gold by third party. d) Auction Final Notice of Claim sent to the customer by courier or register post before the auction based on RAR5410 - List of Account Due for Auction. Evaluation of Tender Committee. Auction not exceed 14 days from Final Notice of Claim. Revaluation on marhun against SAG before auction.

10. Seminar on Internal Control 10 AreaPreventive Control Accounting RecordsAccounting Records a) Trial Balance & Bank Reconciliation Debit and Credit Balance are ACCURATE in nature. Items required should be ZERO balance i.e. code 87000 - System Suspense (000)/ IBS Misc. (001) via RGL 8702 All items are CONSISTENTLY MONITORED i.e. Actual vs Budget Adjustment / Reversal is ACCURATE. b) Sundry Debtors/ Creditors All items >2 months are CONSISTENTLY MONITORED. Refund / Settlement to the RIGHT Customers. Information / details of item are SUFFICIENT (Name & ID No.). To follow-up action taken on the overdue items. c) Transactions by journal Posting of item according to correct accounting treatment and closely supervised by the Officer based on stipulated authority limit. d) MEPS IBG Transactions (RFI / OFI) Return (OFI) – To verify item 22200-560 Sipiutang IBG against ROFI1002 Receiving (RFI) - To inform MyClear if IBG cannot be processed

11. Seminar on Internal Control 11 AreaPreventive Control Branch Management a) Security Panic buttons / Alarms / CCTV are well functioned & covered all critical areas. Guards are well known & trained based on record provided by security company. Server room is secured & provided with split unit of air-condition. Fire extinguisher is adequate & not expired. b) Manpower Quality Management Personnel - service period, job rotation, MC & attendance. Adequacy & relevant of internal / external training. Counter services not exceed standard waiting & service time (QMS system). Customer complaint is addressed in timely manner.

12. Seminar on Internal Control 12

13. Seminar on Internal Control 13 AreaPreventive Control AML / CFT & PDPA a) Opening of accounts & WU/ Remittance transactions Completeness of CIF / PDPA / Conduct of CDD Information of purchase receipt is keyed-in under Remark via M63 b) Suspicious transactions Conduct CDD / EDD & daily monitoring on STR report in BR Portal – Sistem Sokongan c) Handling of High- risk customers EDD is performed with approval from higher authority (Head of Region / Senior Management). d) Cash / cheque deposits RM50k & above Record source of deposit at the reverse side of the deposit slip AML/ CFT & PDPA

14. Seminar on Internal Control 14 Shariah AreaPreventive Control Shariah a) Aqad Non- Compliance Complied with fundamental elements (arkaan) and necessary conditions (shuruut) Aqad documents duly signed by contracting parties b) Bank's image No usage of conventional terminologies in Bank's correspondences, pamphlets, brochures, etc. Level of staff's understanding towards Shariah concepts and principles.

15. Seminar on Internal Control 15

16. Seminar on Internal Control 16 Financing AreaPreventive Control Aslah / Manzili / Naqlu / Tijari / Micro / Falah a) Application Completeness of required supporting documents – to be sighted against original copies. (Case) Meticulous evaluation on customers’ employment / business status, financial strength, cost of living, profit projection, customers’ liabilities (CCRIS), and declaration of other’s income for Debt Service Ratio. Manzili – Credit report from BNM / Credit company (Case) Completeness of CIF / PDPA / PDS / Credit Information Consent and customers’ details. Site visitation to the location of property / project financed. Usage of GMPC via MyKad Reader/ Bio Smart Terminal without fail. If faulty, ultra-violet scanning & justification with copy of MyKad & record GMPC as “No” are required. b) Approval Breach of authority limit obtained higher-up approval. c) Disbursement Perfection /completion of security documents prior to the disbursement. Approval conditions to be duly complied with. Site visitation to verify the completion status of the property/project financed. d) Documentation Scanning process to BIRO duly conducted. Tawarruq – Call customer before Buy/ Sell of Commodity & print certificate BIRO / PAT / PGM / PDC deduction successfully registered. Security documents duly stamped / kept in the fireproof cabinet. (Case) Asset/Property financed is secured by LTHO / Fire Takaful.

17. Seminar on Internal Control 17 AreaPreventive Control 1 Non-Performing Financing 2 months (Manzili) Issuance of Notice of Demand & Termination. 4- 6 months Close follow-up & Issuance of Notice of Demand. 6 months and above Instruction to proceed with Summon / Judgement / Foreclosure proceeding. Bankruptcy account POD issued to the Insolvency Dept. based on RCM5050 & RIF6600. Maintain POD date in JURIS Collect. 2 Financing Review Consistently conducted between the current month and the previous month. To ensure improvement on the NPF’s portfolio on a continuous basis. To evaluate solicitors’ performance in respect to the immediate action/advisory notes on the NPF accounts. 3 Rescheduled Account To evaluate customers’ commitment with respect to the payment of monthly installment prior to the reschedulement process. To closely monitor the NPF accounts with active insufficient payment. Breach of authority limit obtained higher-up approval. 4 Charge/Write Off Account At least Summon has been issued and abide write off approval authority limit. Financing Administration & Recovery

18. Seminar on Internal Control No.Accounting Records 1 Improper monitoring of Branch’s accounting records (Trial Balance / Variances / Sundries). 2 Lack of Monitoring and Follow-up action on long outstanding of unsuccessful IBG transaction 18

19. Seminar on Internal Control No.Savings/ Term Deposit-i 1No follow-up taken by Branch on rejected auto renewal Term Deposit-i account. 2Monitoring and record / remark the reason on Error Correction (EC). 3Incentive payment offered to depositors’ introducer after “Deposit Introducer Program” ended. 4Failure to flag via M34 / stamping on specimen card (deceased customers) during closing Deposit and Savings accounts. 5Borang Pembukaan Akaun Simpanan / Deposit & Contoh Tandatangan not kept in the fireproof cabinet and scanned on the same day of its opening date. 6Closing of other Branch Savings Account not supported with Customer’s Signature Specimen Card. 7Savings passbook not collected by the customers. 19

20. Seminar on Internal Control No.ATM/ CDM/ Credit Card-i 1 Uncollected Credit Cards Were Not Returned To Credit Card Centre. 2 Incomprehensive monitoring on the activation of ATM card (delay/ inactive). 3 Absence of dual control on ATM / CDM Replenishments. 4CO-OP ATM cards was given to non co-op members. 5Use of “Factory Combination Number” as a combination number to access the ATM machines. 6No register to record the floating stock of ATM cards. 20

21. Seminar on Internal Control No.Pawn Broking-i 1 Final notice of claim were sent to customers without using registered postage. 2 Fail / delay to perform acid test (Ar-Rahnu). 3Expired hydrochloric and nitric acids. 4 Key register book not updated for Ar-Rahnu custodian. 5No purchased receipt / sales invoice or certificate of gold authenticity. 6No record the source of Marhun in menu M63: Remarks. 7Gold jewelleries were not arranged according to RAR9011 report. 8Inefficient action on accounts with shortfall status. 9 Expired annual calibration certificate of densimeter machine. 10 Product Disclosure Sheet (PDS) was not used. 11 Plastic seals for security being disposed after redemption by customer. 12 Auctioned Marhun not kept in the Ar-Rahnu box. 13 Acceptance of Marhun from companies not registered with the Bank. 14 Delay in conducting the auction after issuance of Notis Tuntutan Terakhir to customers. 15 Failure of sealing the envelopes of Marhun in front of the customers. 21

22. Seminar on Internal Control No.Western Union 1Inconsistent monitoring on end of day balancing. 2 Transactions were posted in Web BDS at end of the day. 22

23. Seminar on Internal Control No.Cash Management 1Sharing Web BDS password by Operation unit’s staff. 2Improper control on the usage of Temporary Receipt (“Resit Sementara”) 3 No dual control over Strong Room. 4 Strong Room combination code not changed for more than 6 months. 5 GN07 – Details of Balancing Report not printed at EOD. 6 No usage of temporary receipt (Resit Sementara) for cash collection outside the premise for the purpose of savings account opening. 7 Cash collected outside the premise not kept in the strong room at EOD. 23

24. Seminar on Internal Control No.Branch Management 1 Alarm functional test was not done on a regular basis. 2 Time in CCTV Footage at the Branch not consistent with the time specified in Web BDS. 3 No record of CCTV due to faulty. 24

25. Seminar on Internal Control No.AML/ CFT & PDPA 1No/ delay Enhanced Due Diligence (EDD) process and Senior Management approval obtained for High-Risk Customers. 2Incomplete and inaccurate Customer Information File (CIF) & PDPA fields in Web BDS. 3Details of applicant employer name not keyed-in the WUPOS system during Western Union (WU) transactions. 4Western Union application forms were not completed with details of occupation, source of fund, relationship & transaction purpose. 5Usage of old Personal Data Protection Act (PDPA) declaration form. 6Source of cash deposits (more than RM50,000) not stated on the deposit slips. 7Customer Due Diligence (CDD) not conducted upon opening of Current Accounts (eCA-i). 25

26. Seminar on Internal Control No. SHARIAH 1 Wrong Shariah concept used for opening of Savings account. 2 Aqad execution between the Bank and the customers on Tijari financing accounts (Bay’-Inah Without Inter-Condition) not conducted in accordance to the Shariah principles. 3Salient features of contract (Wakalah & Murabahah) in the transaction slips were not completed by the customers. 26

27. Seminar on Internal Control 27 No.FINANCING/ FINANCING ADMIN UNIT 1 Breach of authority limit on financing approval – outside branch operations area & MIA in CCRIS. 2Financing applications were not thoroughly evaluated prior to the approval process. 3 Inadequacy / insufficient information stated in Offer Letter. 4 Negligence in creating introducer information for personal financing application. 5 Lack of awareness on the usage of consent form for Disclosure of Credit Information. 6Weaknesses in receiving / collecting payment through Biro Perkhidmatan Angkasa (“BPA”) 7No checking on the adequacy and presence of Aslah security documents before the documents being kept in the fireproof cabinet. 8Wrong registration on Menu I61. 9Lack of monitoring on no payment since disbursement (NPSD) account. 10Monthly installment for rescheduled account was not properly appraised. 11Scanning on Aslah financing documents as well as submission of images to Biro Perkhidmatan Angkasa (BPA) not conducted within a day after disbursement. 12Wrongly flagged customer financing account to deceased account.

28. Seminar on Internal Control 28 No.FINANCING/ FINANCING ADMIN UNIT 13No Proof of Debt (POD) submission on the charge-off accounts which flagged as bankrupt. 14Recovery actions on Non Performing Financing (NPF) accounts were not conducted in accordance to the status of month-in-arrears. 15Incomprehensive monitoring on manual renewal & insured amount of Houseowner Takaful. 16Incompletion / unknown status of Manzili security documents not reported and updated in RAA5010. 17Property title / takaful claim not been followed-up. 18Process of charge for property financing not consistently monitored to secure individual title. 19 Net Realisable Value (NRV) was not set to zero value for abandoned project / shortfall account. 20Branch failed to ensure that the Form 16A (Charge) of the National Land Code 1965 was executed / signed by chargor (borrower) and presented to the Land Office. 21Imperfection of security documents (Hire Purchase Agreement & Second Schedule) during credit disbursement. 22Absence of security documents for An-Naqlu 2 Financing in the Master File. 23Appropriate action not conducted by Recovery Executive upon vehicle voluntary surrender process 24Hire Purchase Agreement not sent to hirer within 21 days from the agreement date.

29. Seminar on Internal Control No.FINANCING/ FINANCING ADMIN UNIT 25Murabahah Sale Contract and Facility Agreement (with the inception of Tawarruq concept) for Manzili financing accounts were not conducted concurrently during ownership of the commodity. 26Lack of monitoring on accounts which have not been fully disbursed. 27e-Stamps facility not utilized by Branch for stamping Aslah security documents. 28Aslah security documents not sent for stamping within 30 days after issuance of Notis Taksiran from Lembaga Hasil Dalam Negeri (“LHDN”). 29Absence of Stamping Certificate in Aslah Financing Master File. 30Inadequate checking on Rescheduling process via JURIS Collect. 31Improper processing of Micro Financing – No site visit 32Improper handling on financing accounts (deceased customers) with respect to profit reconciliation. 33No cash flow analysis for project financing (Tijari) to determine the actual amount of financing needed for the project to be financed. 34Unaware on the latest procedure regarding new version of security document (“Surat Ikatan Penyerahakan”) for Tijari Financing. 35Inadequate understanding of Documentation Executive in handling Tijari progressive disbursement rendered to full drawdown for one incomplete project of Tijari Account. 36Officer from other Branch appointed as Power of Attorney (PA). 37Wasiat documents not sent to Amanah Raya Berhad (ARB). 29

30. Seminar on Internal Control THANK YOU