1. Develop, maintain, and periodically review the Enterprise Risk Management framework, Risk Management Policy, Risk Appetite Framework, Operational Risk Procedures, Incident Reporting Procedures, and risk assessment methodologies.
2. Identify and assess operational, financial, strategic, technology, compliance, fraud, reputation, liquidity, and resilience risks across the organization.
3. Maintain organizational risk registers and assessment reports, including risk owners, ratings, mitigation actions, deadlines, and closure status.
4. Develop and monitor key risk indicators, approved risk limits, emerging risk trends, breaches, and overdue corrective actions.
5. Conduct periodic departmental risk reviews, challenge control effectiveness, and advise department heads on assessment, mitigation, ownership, and escalation.
6. Independently monitor customer-fund safeguarding, the adequacy of funds backing outstanding electronic money, and concentration risks involving partner banks and settlement arrangements.
7. Monitor agent and distributor liquidity risks and recommend measures to maintain cash-in and cash-out availability.
8. Assess operational vulnerabilities and monitor failed, pending, duplicate, or incorrectly processed transactions, recommending appropriate mitigations.
9. Maintain incident and operational loss records, review root causes, assess control weaknesses, and track corrective actions to closure.
10. Coordinate risk assessments before implementing new products, services, processes, integrations, system changes, platform upgrades, or change requests.
11. Assess risks related to agents, merchants, distributors, vendors, outsourced services, critical technology providers, and other third parties.
12. Monitor significant technology and cyber incidents and challenge the adequacy of response, recovery, and corrective measures.
13. Coordinate with Compliance on regulatory risk matters and support the assessment and implementation of applicable Da Afghanistan Bank requirements.
14. Incorporate AML/CFT risks into the ERM framework and assist with risk-related regulatory reports, responses, commitments, and remediation tracking.
15. Assess fraud risks across wallets, payments, agents, merchants, and internal processes, and support preventive and detective control initiatives.
16. Coordinate with Internal Audit and Compliance on high-risk findings and remediation while preserving the distinct responsibilities and independence of each function.
17. Prepare monthly and quarterly risk reports for BOM and BOS covering significant exposures, KRI breaches, loss events, trends, and mitigation plans.
18. Promptly escalate critical risks, material concerns, control failures, and breaches of approved risk limits to relevant management and Board committees.
19. Support governance committees with independent risk analysis and recommendations and maintain direct access to the relevant Board committee.
20. Recommend risk appetite, tolerances, and limits for approval by the appropriate governance authority and ensure periodic policy and procedure approvals.
21. Support business continuity planning and assess the adequacy of disaster recovery, crisis response, and operational recovery arrangements.
22. Participate in continuity, disaster recovery, and crisis exercises and track identified gaps and corrective actions.
23. Assess operational resilience risks, including system outages, cyber incidents, liquidity disruptions, and partner failures.
24. Conduct risk and fraud awareness sessions and promote ethical conduct, timely incident reporting, clear accountability, and a strong risk culture.
25. Provide independent monitoring and effective challenge while business departments retain ownership of their risks and operational controls.
