1. Purpose and application

These documents together form Layer 1 of the Standardised DCA Governance Framework. All DCA engagements must operate in accordance with:

• This DCA Governance Policy
• Delegated Authority Schedule (Appendix A)
• Commission & Incentive Standard (Appendix B)
• Hardship Interaction Protocol (Appendix C)
• Credit Reporting Control (Appendix D)

2. Policy statements

#	Statement
2.1	Every DCA must be onboarded using the standard DCA Onboarding Process.
2.2	Delegation of authority to DCAs is defined only in the Delegated Authority Schedule; no verbal or undocumented delegation is permitted.
2.3	Commission and incentives must comply with the Commission & Incentive Standard; no bespoke incentive arrangements without documented exception.
2.4	All hardship identification, referral, and interaction must follow the Hardship Interaction Protocol.
2.5	Credit reporting (default listing, correction, suppression) is controlled per the Credit Reporting Control; DCAs do not report to credit bureaux unless explicitly permitted in writing.
2.6	All DCAs must report using the Standard Monthly Reporting Pack (Layer 3) in the prescribed format.
2.7	Issues must be classified and logged using the Issue Identification Model (Layer 4).
2.8	Governance cadence (Layer 5) and escalation (Layer 6) apply to every DCA without exception.

3. Roles and responsibilities

Role	Responsibility
Head of Collections	Policy owner for DCA operations; ensures SLAs, reporting, and cadence are applied.
Risk (Second Line)	Oversight of DCA risk; attestations; escalation per Layer 6.
Compliance	Regulatory and code compliance; conduct monitoring; exception documentation.
Legal	Contract standard; delegation boundaries; dispute and authority breach handling.
DCA	Comply with policy, schedules, and protocol; report accurately; escalate per contract.

4. Alignment with regulatory framework

This policy operates within the bank’s DCA & Contingent Debt Collections Governance Framework (NZ) and assumes compliance with: CCCFA (including s 132A disclosure), Fair Trading Act 1986, Privacy Act 2020, Credit Reporting Privacy Code, FSF Responsible Debt Collection Code (or equivalent), RBNZ outsourcing expectations where applicable.

5. Review and approval

Review: Annual, or on material change to regulation or operating model. Approval: Risk Committee / CRO. Next review date: To be set.

6. Exception process

Any deviation from this policy or from the standard contract/SLA/reporting requires:

1. Written request from Collections (or business owner) with business justification and risk assessment.
2. Compliance and Risk review and recommendation.
3. Approved exception documented with: scope, duration, approval authority, and review date.
4. Exception register maintained by Compliance / Risk; exceptions reported in governance cadence.

Appendix A - Delegated Authority Schedule

Document ID: POL-DCA-DAS-001. The Delegated Authority Schedule defines what the DCA may do without prior bank approval and what must be referred to the bank. It applies to all DCAs; no DCA may exceed these limits.

A.2 Authority matrix

Activity	DCA authority (within limit)	Refer to bank
Payment arrangements	e.g. arrangements up to $X/month or Y weeks, within policy parameters	Above threshold; structure outside parameters
Settlement (full/partial)	Up to e.g. 70% of current balance; minimum e.g. 50% for closure	Above 70%; below 50%; disputed debt
Waiver of fees/interest	e.g. Up to $Z per account per annum	Above $Z; recurring waivers
Legal referral	None - referral only per process	All legal escalation
Hardship determination	None - identify and refer only	All hardship assessments and arrangement approval
Credit reporting	None - no listing or amendment by DCA	All reporting decisions remain with bank
Account closure / write-off	None - recommend only	All closure and write-off decisions
Dispute acceptance	Acknowledge and refer	All dispute resolution

Insert bank-specific thresholds and any segment-specific variations.

A.3 Evidence and overrides: All exercises of delegated authority must be logged; overrides must be recorded with reason and approver. Breach triggers Layer 6 escalation (suspension of authority until remediated). A.4 Review: Delegated Authority Schedule is reviewed at least annually and as part of Annual Contract & Incentive Review (Layer 5).

Appendix B - Commission & Incentive Standard

Document ID: POL-DCA-CIS-001. To ensure commission and incentive structures are transparent, aligned with conduct and customer outcomes, and do not encourage inappropriate behaviour.

B.2 Principles

#	Principle
B.2.1	Commission/incentive design must not reward conduct breaches, hardship delay, or disclosure failures.
B.2.2	Recovery-based incentives may be used but must be balanced with conduct and quality metrics in scorecards.
B.2.3	No incentive for: legal escalation volume, minimising hardship referrals, or suppressing complaints.
B.2.4	Structure must be documented in contract and disclosed in standard reporting.

B.3 Permitted: Base fee / per-account fee; recovery-based commission (with clawback); quality/conduct gates; caps and floors as defined. B.4 Prohibited or restricted: Incentives that reward reduced hardship referrals or increased legal referrals; unilateral changes by DCA; commission on disputed/reversed amounts without clawback.

Appendix C - Hardship Interaction Protocol

Document ID: POL-DCA-HIP-001. To ensure customers in or at risk of financial hardship are identified promptly, treated fairly, and referred to the bank. No DCA may assess hardship or approve arrangements outside this protocol.

C.3 DCA obligations

#	Obligation
C.3.1	Identify: Train staff to recognise indicators of hardship.
C.3.2	Refer: Refer all potential hardship cases to the bank within e.g. 1 business day; do not continue collection pressure.
C.3.3	Do not assess: DCA must not determine eligibility or approve payment arrangements; only the bank may do so.
C.3.4	Do not delay: No target or incentive may discourage or delay hardship referral.
C.3.5	Record: Log all hardship referrals; report in Monthly Pack (Conduct - Hardship referrals).

Repeated hardship delay triggers Layer 6 escalation (independent review).

Appendix D - Credit Reporting Control

Document ID: POL-DCA-CRC-001. Credit reporting remains under bank control. DCAs do not report to credit bureaux unless explicitly permitted in writing.

#	Statement
D.2.1	Listing of defaults: Only the bank (or its designated system) may list or request listing of defaults for bank-owned debt.
D.2.2	DCA role: DCA must not list, amend, or request suppression unless the bank has granted explicit written authority.
D.2.3	Data for reporting: DCA must not use shared data to report to bureaux.
D.2.4	Corrections and disputes: DCA must refer to the bank; bank owns correction and dispute process with bureaux.

Any breach (e.g. DCA listing without authority) is a Category A issue and triggers immediate escalation per Layer 6.

Layer 1 - DCA Governance Policy · POL-DCA-GOV-001 · Version 1.0 · February 2026 · Confidential