defining control activities at every business level accompanied by top level reviews, effective channel of communication
for the staff and availability of BCP and DRP.

Market and Interest Rate Risk

Market risk is the risk that earnings or capital will be adversely affected by adverse changes in market factors such as
interest rates, volatilities, credit spreads, and equity prices. We are exposed mainly to interest rate risk and liquidity risk.
While we do not have any exposure to equity or equity related instruments, any significant impact on the global capital
markets can affect us through other markets. Interest rate risk is the exposure of our financial conditions to adverse
movements in interest rates. Interest rate risk can pose a significant threat to earnings and capital base. Interest rate risk
arises from mismatches in re-pricing of interest rate sensitive assets, rate sensitive liabilities and rate sensitive off-balance
sheet items. The interest rate risk is managed on a balance sheet level.

In order to manage interest rate risk, most of the interest rates on advances as well as liabilities are fixed in nature and not
subject to market-related resets, to contain any adverse effects. In addition, majority of our advances are for medium-term
tenures with monthly repayments in order to limit the period of impact, if any. A significant portion of our investments
are in SLR securities/ sovereign backed securities and are therefore exposed to limited credit risk.

The Asset Liability Management Committee (ALCO), which comprises heads of all business and functional divisions,
meet regularly and at least every month, to review the extent of exposure to movement in interest rates to the capital
values as well as possible impact on our net interest income. The ALCO also reviews a range of parameters including
compliance with various regulatory limits on treasury portfolio, interest rates offered on deposits, and movements in
assets and liabilities. The Investment Committee and the ALCO function together to manage interest rate risk and maintain
the investment portfolio.

Information Security and Cyber Risk

Cyber risk refers to any risk of financial loss, disruption or damage to the reputation of an organization resulting from the
failure of its information technology systems. Cyber risk could materialize in several ways, including deliberate and
unauthorized breaches of security to gain access to information systems; unintentional or accidental breaches of security;
operational IT risks due to factors such as poor system integrity; and intentional or unintentional actions by employees/
personnel or third-party vendors.

The measures we have adopted to ensure the security and integrity of our data and IT systems include constant monitoring
through our ‘Security Operations Centre’, protection from malware attacks, data loss prevention, disaster recovery,
firewalls, data encryption, multi-factor authentication, secured emailing systems, secured networks, usage of virtual
private networks, change management processes, regular information security audits, application security testing,
vulnerability assessments, penetration testing, information security awareness training for employees and vendors. The
Management Information Security Steering Committee (“MISC”), which meets at regular intervals, reviews our
preparedness to handle information security and cyber security and reports to IT Strategy Committee of the Board. The
MISC comprises senior management and is responsible for approving and monitoring major information security projects
and establishing information security priorities. It also approves standards and procedures, reviews positions of security
incidents and status of information security awareness programs.

Reputational Risk

Reputation risk is the risk of the loss arising from the adverse perception of the image of our Bank by our customers,
counterparties, investors or regulators. This is particularly relevant as our business involves ensuring customers that we
are credible and can offer basic, secure services expected by the customers. This risk typically follows once other risks
materialize. It compounds the effect of other risks, such as strategy, fraud and regulatory risks. Our ongoing risk review
process takes into account reputational risk.

Reputational risks, if materialized, will affect our ability to establish new relationships or services or continue servicing
existing relationships. This risk may expose us to litigation, financial loss, or a decline in our customer base. Reputational
risk exposure is present throughout our Bank and includes the responsibility to exercise abundant caution in dealing with
our customers and the community. We monitor reputational risk on an ongoing basis, by reviewing various relevant
parameters including market perception, stakeholder satisfaction, business service disruption, process failure, employee
satisfaction and financial performance.

Risk Management Architecture

168
