Section 1: Fraud Risk Governance 4 items Section average: —

1. Does the firm have a documented Fraud Policy and risk appetite statement?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

2. Is there a responsible team for overseeing fraud risk management within the bank?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

3. Are losses effectively tracked and reported specific to internal and external fraud?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

4. Is there a formal internal committee overseeing fraud risk governance?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 2: Fraud Risk Assessment 3 items Section average: —

5. Does your company formally identify potential fraud risks?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

6. Does the bank conduct periodic fraud risk assessments?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

7. Is there a standard criteria established to assess the likelihood and impact of fraud risks?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 3: Fraud Prevention Measures 4 items Section average: —

8. Are there procedures in place for Customer Due Diligence (CDD) and Know Your Customer (KYC/KYB)?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

9. Are technology solutions used to monitor transactions for suspicious activity?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

10. Is there a framework in place to identify and prevent internal fraud?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

11. Are employees subject to background checks as part of fraud prevention?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 4: Fraud Detection & Investigation 4 items Section average: —

12. Does the firm have an automated fraud monitoring system?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

13. Are there escalation procedures when suspicious activities are detected?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

14. Does the firm document and investigate fraud incidents?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

15. Are there implemented tools or techniques used for forensic investigations of fraud cases?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 5: Response & Recovery Plan 4 items Section average: —

16. Are immediate actions documented and implemented when fraud is detected?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

17. Does the firm communicate fraud incidents to affected customers?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

18. Are legal, criminal and/or disciplinary actions taken against fraud perpetrators?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

19. Are there processes implemented to recover financial losses due to fraud?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 6: Training & Awareness 3 items Section average: —

20. How frequently does the firm conduct fraud awareness training for employees?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

21. Are there measures in place to educate customers about fraud risks and prevention?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

22. Does the firm encourage employees to report suspected fraudulent activities?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

Section 7: Continuous Improvement & Audit 3 items Section average: —

23. Does the firm use data analytics to refine fraud detection strategies?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

24. Are internal and external audits conducted to evaluate fraud controls?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing

25. Is the fraud strategy regularly updated to address new fraud trends and regulatory changes?

0 Undefined1 Initial2 Managed3 Defined4 Quantitatively Managed5 Optimizing