Department: Corporate Secretariat

RESPONSIBLE PERSON POLICY Department: Corporate Secretariat 1

Contents Overview 3 General Principles 4 Fitness 4 Propriety 4 Policies: 4 Entity needs and fitness analysis 4 Identifying responsible person positions 5 Nominating and assessing responsible persons 5 Conflicts of interest 5 Auditors 5 Continuing requirements 5 Privacy and confidentiality 5 Whistleblowing and reporting of concerns 5 Responsible persons not fit and proper 5 Governance 5 Responsibilities 5 Attachment A - Definitions 7 2

OVERVIEW Background This policy sets out the approach established by Bendigo and Adelaide Bank Limited and its regulated subsidiaries for the responsible person requirements of APRA and ASIC. Bendigo and Adelaide Bank ( Bendigo ) is an ADI and Sandhurst Trustees (Sandhurst) is an RSE licensee (each regulated by APRA). Bendigo and Sandhurst are also holders of an Australian Credit Licence (regulated by ASIC) and must comply with the organisational competency requirements under Section 47(1)(f) of the National Consumer Credit Protection Act 2009; and Each of Bendigo, Sandhurst, AB Management Pty Ltd, Adelaide Managed Funds Ltd, Bendigo Financial Planning Ltd, Leveraged Equities Ltd and Pirie Street Custodian Ltd are holders of an Australian Financial Services Licence (regulated by ASIC) and must comply with the organisational competency requirements under Section 912A(1)(e) of the Corporations Act 2001. References to responsible persons in this policy refer to: 1. Responsible Persons under the following prudential standards issued by APRA: Prudential Standard CPS 520 Fit and Proper (ADIs). Prudential Standard SPS 520 Fit and Proper (RSE Licensee). 2. Responsible Managers under the following Regulatory Guides issued by ASIC: Regulatory Guide 206 Credit licensing; Competence and training (ACL holders); and Regulatory Guide 105 Licensing: Organisational competence (AFSL holders). Whilst ASIC and APRA have specified different requirements for determining responsible person positions and individuals, their fitness and proprietary requirements are substantially similar. In each case a fit and proper person must possess the competence, character, diligence, honesty, integrity and judgment to properly perform the duties for a responsible person position. For the purpose of this policy, the regulated entities have determined that: 1. Fitness refers to the skills, knowledge and experience required to perform a responsible person role; and 2. Proper refers to the good fame and character of an individual appointed to a responsible person role. Purpose The purpose of this policy is to ensure that; 1. The interests of customers, stakeholders, shareholders, investors and, in the case of Sandhurst, members and beneficiaries of superannuation funds, are managed and overseen by competent, honest and trustworthy individuals; 2. Regulated entities prudently manage the key risks arising from their business operations by having persons acting in responsible positions who possess the necessary competence and are of good fame and character; 3. The regulated entities satisfy the applicable regulatory requirements relating to responsible persons; and 4. Senior staff in positions of responsibility have, and continue to demonstrate, the required competencies, character, diligence, honesty, integrity and judgment needed for the effective and prudent operation of the business. Responsible person standards and procedures This policy is to be read in conjunction with documented responsible person standards and procedures applicable to (1) APRA s fit and proper requirements and (2) the organisational competence requirements applicable to AFSL and ACL licensees. The documented standards and procedures set out the applicable regulatory requirements together with responsibilities and processes for the ongoing management of responsible persons including: 1. The process to determine required skills, knowledge and experience ( competencies ); 2. The identification of responsible person positions and candidates; 3. The responsible person assessment and appointment processes; and 4. The ongoing requirements that apply to responsible persons and positions. Definitions A table setting out the definitions applicable to this policy is provided at Attachment A. Application This policy applies to, and has been adopted by the Bank. The other regulated entities are also required to adopt this policy. Related Documents 1. Code of Conduct 3

2. Reporting of Concerns Policy GENERAL PRINCIPLES Fitness A regulated entity will ensure that positions of responsibility are held by persons who have, and continue to maintain, the required competencies and are of good fame and character. A regulated entity will ensure that collectively the responsible persons have the required competencies to cover all the regulated business activities. A regulated entity will take all reasonable steps to confirm the information used for the purpose of, or provided in connection with, the fit and proper assessment of responsible persons. Propriety Responsible persons must also act with honesty and integrity and therefore each responsible person, individually, must satisfy the requirements in relation to propriety. The assessment of an individual s fitness and propriety will be based on a consideration of relevant factors determined by the regulated entities. POLICIES Entity needs and fitness analysis For the purpose of ASIC s fit and proper requirements, the regulated entity will identify and document the core competencies, including on a collective basis, required for their licensed business activities by reference to the licence authorisations and taking into account the scope and scale of the business activities. For the purpose of APRA s fit and proper requirements, the regulated entity will prepare an entity needs and fitness analysis setting out the business activities conducted by the regulated entity together with the level of competencies needed, including on a collective basis, to manage risk associated with the business activities take into account the scope and scale of the business activities. These competencies must be reviewed periodically, including at the time of a material organisational restructure, a change in business activity or change in licence authorisations. Identifying, nominating and assessing responsible person positions and responsible persons APRA regulated entities must ensure they prudently manage the risks posed to its business operations and financial standing by having persons acting in responsible positions who are fit and proper. The persons responsible for the management and oversight of the regulated institution need to have the appropriate competencies and act with honesty and integrity. ASIC regulated entities must satisfy the organisational competence requirements applicable to the credit activities authorised under their ACL and / or the financial services activities authorised under their AFSL. ASIC assesses compliance with this obligation by referring to the knowledge and skills of the people that manage the applicable business activities. The responsible managers for an ASIC regulated entity must collectively have the knowledge and skills required to provide the financial services or conduct the credit activities. The regulated entities must identify applicable responsible person positions and appoint appropriate persons as responsible persons in accordance with the applicable regulatory requirements. ASIC and APRA have specified the criteria for identifying the positions required to be nominated as responsible persons. A regulated entity will complete a fit and proper assessment of responsible persons to ensure the individuals meet the competency requirements and are of good fame and character. The assessment is also used to confirm that the collective competencies documented by the regulated entity are held by the nominated responsible persons. Generally, an assessment must be completed before a person is appointed to a responsible person position, unless they hold the position because a regulator has determined that the person is a responsible person. However, APRA regulated entities may also make an interim appointment to a responsible person position without conducting a full fit and proper assessment, for a period of up to 90 days. APRA may agree in writing to extend this period. In determining whether a responsible person meets the fit and proper requirement, consideration will be given to: 1. Whether it would be prudent to conclude that the person possesses the competence, character, diligence, experience, honesty, integrity and judgement to properly perform the duties of the responsible person position; 2. Whether it would be prudent to conclude that the person possesses the education or technical qualifications, knowledge and skills relevant to the duties and responsibilities of the regulated entity; and 4

3. Whether the individual is banned or a disqualified person. The above matters will be determined by an assessment of the responsible person s qualifications, experience and skills against the identified competencies for the particular responsible person role, and a review of probity checks and an individual fit and proper declaration. An annual review of each responsible person will also be completed by the regulated entity to ensure the responsible persons maintain the competencies applicable to their role and business responsibilities and continue to be of good fame and character. A regulator may use its discretion to determine that a person is a responsible person. In these circumstances, a person may be classified as a responsible person prior to a fit and proper assessment being conducted. Conflicts of interest For APRA regulated entities, if a person has a conflict of interest, that person will not be appointed to, or permitted to hold, a responsible person position with the regulated entity unless the regulated entity is satisfied that the conflict will not create a material risk that the person will fail to perform properly the duties of the position. The assessment includes a declaration that there are no actual or potential conflicts of interest that are likely to influence the person s ability to carry out his or her role and functions with appropriate probity and competence. Auditor For each APRA regulated entity, a fit and proper assessment must be completed in relation to the external auditor. This includes a confirmation from the lead auditor that he or she meets the additional specific requirements prescribed by APRA. Continuing requirements All responsible persons are required to satisfy the required standard for fitness and propriety on a continuing basis. The responsible person status will be cancelled for any responsible person who: 1. Is unable to continue to meet the minimum fitness or propriety standards; 2. Transfers to another position that is not identified as an responsible person position; or 3. Ceases their employment. Ongoing training and education requirements apply to ACL responsible persons. Privacy and confidentiality It will be necessary for a regulated entity to obtain personal information about both employees and nonemployees in order to decide whether a person satisfies fit and proper requirements under this Policy. A proposed appointee to a responsible person position must provide a privacy consent to the collection and use of personal information under this policy. Whistleblowing and reporting of concerns The regulated entities have consented to persons notifying, including to APRA, a concern that this policy or fit and proper regulatory requirements have not been complied with. All reasonable steps will be taken to ensure that no person making such disclosures in good faith is subject to, or threatened with, a detriment because of any notification in purported compliance with the requirements of this policy Responsible persons not fit and proper The regulated entities will take the necessary steps to ensure that a person is not appointed to, or continue to hold, a responsible person position for which they are not fit and proper. If a proposed candidate for a responsible person position does not met the minimum fitness or propriety requirements, the candidate will not be recommended as a responsible person. If a regulated entity considers, or has reason to suspect, that a responsible person no longer meets the fitness or propriety requirements, the company secretary will take the necessary steps to ensure the regulated entity remains compliant with this policy. This may include requiring that the responsible person complete additional training as necessary or any other action deemed appropriate. GOVERNANCE Roles and Responsibilities The following table sets out the main accountabilities, roles and responsibilities under this Policy. Secretariat Make available a copy of this Policy and associated standards and procedures to any nominated responsible person as soon as practical after the candidate is nominated; Co-ordinate fitness and propriety assessments of NEDs prior to appointment; Co-ordinate fitness and propriety assessments of other responsible persons (other than 5

Responsible Persons Managing Director Governance & HR Committee Chairman Board Implementation and Review NEDs) prior to nomination; Co-ordinate the annual assessments of responsible persons; Report on the completion and outcomes of the assessments; In conjunction with the relevant executive management, determine and document the core competencies required by regulated entities, both collectively and for responsible person roles; Lodge all responsible person notifications with the relevant regulator; and Ensure necessary responsible person and organisational competency records are maintained for the required timeframes. Comply with this Policy and any associated procedures; Notify corporate secretariat in the event they are unable to meet the minimum fitness or propriety requirements of this Policy; Undertake any required training including any additional training requested by a regulator or by the Board or Managing Director; Provide all requested information and supporting documents to enable fit and proper assessments to be completed; Consent to the collection and use of any information to comply with this Policy and legislative requirements; Consent to the provision of information to a regulator with regard to the fit and proper assessment or for any other purposes covered by this Policy. Ensure each regulated entity continues to have responsible persons with the necessary competencies to operate the business; Ensure fit and proper assessments for responsible persons (other than NEDs) are satisfactorily completed and review the outcome in determining the appropriateness of responsible persons appointment; Approve the nomination of responsible persons who are not NED s; Determine action to resolve any responsible person competency gaps. Oversee the implementation of this policy and ensure adherence to this policy and associated procedures; Ensure that there are processes for the assessment of fitness and propriety of NEDs; Recommend the appointment of NED s to the Board. Perform the annual assessment of the other NEDs. Monitor compliance with this Policy; Monitor changes to this policy; Approve the appointment of NEDs (for recommendation to shareholders). Perform the annual fit and proper assessment for the chairman. This policy is effective from the dates approved by the Bendigo and Sandhurst boards. An overview of the steps involved in implementing this Fit and Proper Policy and responsibilities for implementation is set out in Attachment B to the Policy. Corporate secretariat will ensure that periodic reviews of this policy (a minimum two year review cycle applies) are completed. Compliance with the policy A copy of this policy (and the supporting standards and procedures) will be made available to all nominated responsible persons. It is the responsibility of nominated responsible persons to comply with the requirements of this policy and associated standards and procedures. Approval This policy was approved on 4 March 2014. 6

Attachment A Definitions The following expressions have the meaning set out below. Expression ACL ADI AFSL APRA ASIC Meaning Australian Credit Licence Authorised Deposit Taking Institution Australian Financial Services Licence Australian Prudential Regulation Authority Australian Securities and Investments Commission Disqualified Person (1) a disqualified person under the SIS Act; (2) a disqualified person under the Banking Act 1959; (3) a disqualified person under the Insurance Act 1973; (4) a person who is disqualified from managing corporations under the Corporations Act 2001, or similar equivalent overseas legislation. Group Personal information Regulated Entities Bendigo and Adelaide Bank Limited and its related bodies corporate, excluding Rural Bank Limited. Personal information within the meaning of the Privacy Act. Authorised Deposit-Taking Institution, RSE Licensee, Australian Financial Services Licence Holder or Australian Credit Licence Holder (excluding Rural Bank Limited) Responsible Person In the case of Bendigo, a responsible person as defined in CPS 520. (1) A director of the regulated institution. (2) A senior manager of the regulated institution, ie a person (other than a director of that regulated institution) who: (a) Makes, or participates in making, decisions that affect the whole, or a substantial part, of the business of the regulated institution. (b) Has the capacity to affect significantly the regulated institution s financial standing. (c) May materially affect the whole, or a substantial part, of the business of the regulated institution or its financial standing through their responsibility for: (i) enforcing policies and implementing strategies approved by the Board of the regulated institution; or (ii) the development and implementation of systems that identify, assess, manage or monitor risks in relation to the business of the regulated institution; or (iii) monitoring the appropriateness, adequacy and effectiveness of risk management systems. (3) An auditor. (4) A person who performs activities for a subsidiary of the regulated institution where those activities may materially affect the whole, or a substantial part, of the business of the regulated institution or its financial standing, either directly or indirectly. In the case of Sandhurst, a responsible person is defined in SPS 520 as: (1) A director of the RSE licensee. (2) A secretary of the RSE licensee (3) A senior manager of the RSE licensee, i.e. a person (other than a director of that regulated institution) who: (a) Makes, or participates in making, decisions that affect the whole, or a substantial part, of the RSE licensee s business operations. (b) Has the capacity to affect significantly the RSE licensee s business operations or its financial standing. (c) May materially affect the whole, or a substantial part, of the RSE licensees business operations or its financial standing through their responsibility for: (i) enforcing policies and implementing strategies approved by the Board; (ii) the development and implementation of systems used identify, assess, manage or monitor risks in relation to the RSE licensee s business operations; or 7

Expression Meaning (iii) monitoring the appropriateness, adequacy and effectiveness of risk management frameworks; or (d) is otherwise an executive officer of the RSE licensee. (5) An RSE auditor. (6) A person who performs activities for a connected entity of the RSE licensee where those activities could materially affect the whole, or a substantial part, of the RSE licensee s business operation, or its financial standing, either directly or indirectly. Responsible Manager In relation to an AFSL holder (ASIC Regulatory Guide 105): A licensee must nominate responsible managers who are directly responsible for the significant day-to-day decisions about the ongoing provision of the financial services. RSE Licensee In relation to an ACL holder (ASIC Regulatory Guide 206): Each director and secretary, or senior manager who performs duties in relation to credit activities to be authorised by the licence (more specifically, the people with primary responsibility, or most directly involved in, managing the credit activities and who will be responsible for the quality of the credit activities of the business). Registrable Superannuation Entity Licence holder. Sandhurst is currently the RSE licensee of one Registrable Superannuation Entity ( RSE ), registered as The Bendigo Superannuation Plan. 8