Risk Management Policy

Purpose

The Risk Management Policy sets out how the Group identifies, assesses, monitors and mitigates key risks in line with Central Bank of Kenya guidelines. The Policy supports prudent risk-taking, regulatory compliance, financial stability, asset protection and stakeholder confidence by ensuring that risk decisions are guided by clear governance, risk appetite, tolerance limits and effective controls.

Scope

The Policy applies to risk management activities across the Group’s business units, subsidiaries and operations. It covers key risk areas including credit, operational, market, ICT, liquidity, compliance, anti-money laundering and business continuity risks, as well as lending, trading, off-balance-sheet exposures, new products and other material activities.

Framework

1. Risk Governance: The Group maintains Board and senior management oversight of risk strategy, risk appetite, policies, limits, exposures and compliance with applicable prudential requirements.
2. Independent Risk Management Function: The Group maintains a dedicated Risk Management Function that is independent from risk-taking units and responsible for supporting effective identification, assessment, monitoring and mitigation of material risks.
3. Risk Management Programme: The Policy provides for a tailored Risk Management Programme covering risk appetite, tolerance limits, policies and procedures for the Group’s activities, including lending, trading and off-balance-sheet exposures.
4. Risk Identification and Mitigation: Key risks, including credit, operational, market, ICT and liquidity risks, are identified, assessed and managed through appropriate controls, limits, mitigation plans and escalation processes.
5. Monitoring and Reporting: The Group uses management information systems to support risk measurement, monitoring and reporting on exposures, breaches, compliance matters and emerging risks.
6. Credit, Compliance and Continuity Controls: The framework includes credit risk controls on portfolio diversification, borrower assessment, repayment capacity, collateral management, internal audits, anti-money laundering measures and business continuity planning.

Roles & Responsibilities

Board of Directors: Provides overall oversight of the Group’s risk management framework, approves risk strategies and limits, reviews new products and ensures that material risks are managed within approved risk appetite and regulatory requirements.

Management: Implements the Policy through risk identification, monitoring, reporting, control implementation, issue escalation and compliance with approved limits, procedures and prudential requirements.

Why It Matters

• Strengthens prudent risk-taking and financial stability.
• Supports compliance with regulatory and prudential requirements.
• Enhances oversight of credit, operational, market, ICT and liquidity risks.
• Protects customers, shareholders, stakeholders and the Group’s assets.
• Reinforces accountability, resilience and sound corporate governance.