Agreement No. 3 (2025) Modifying Agreement No. 4-2010 on External Bank Audits

Republic of Panama Banking Superintendence of Panama AGREEMENT No. 3-2025 (April 8, 2025)

THE BOARD OF DIRECTORS In the exercise of its legal powers, and CONSIDERING: That following the issuance of Decree-Law No. 2 of February 22, 2008, the Executive Branch prepared a systematic ordering in the form of a Single Text of Decree-Law No. 9 of 1998 and all its modifications, which was approved by Executive Decree No. 52 of April 30, 2008, hereinafter the Banking Law; technical in nature

Agreement No. 3-2025 Page 2 of 6 AGREES: ARTICLE 1. Article 3 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: [Text of Article 3 not provided in source]

ARTICLE 2. Article 5 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: [Text of Article 5 not provided in source]

ARTICLE 3. Article 6 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: [Text of Article 6 not provided in source]

Agreement No. 3-2025 Page 3 of 6 ARTICLE 4. Article 7 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: PARAGRAPH 1. Once the general audit plan is submitted and as a consequence of the working meetings referred to in the previous item 12, this Superintendence may determine that the scope of the audit must be expanded. For these purposes, the regulated entity will carry out, at its own cost, the adjustments in the corresponding contracting, including those required when the external audit must expand beyond what is required by the International Standards on Auditing (ISA), including the issuance of special reports. If after the review process of the audited financial statements, the audit report, the special reports requested by this Superintendence, or the working papers supporting the work and reports issued, they, in the judgment of this Superintendence, do not comply with the International Standards on Auditing or with the regulations issued by this regulatory body, the situation and any other related to the ethics and independence standards applicable to external audit firms in the Republic of Panama will be brought to the attention of the Technical Board of Accounting.

Agreement No. 3-2025 Page 4 of 6 ARTICLE 5. Article 8 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: [Text of Article 8 not provided in source]

ARTICLE 6. Article 9 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows: [Text of Article 9 not provided in source]

ARTICLE 9. SPECIAL REPORTS. The board of directors of the regulated entities, through its audit committee, shall request their external auditors, within the term established for the delivery of their audited financial statements, to send in separate document(s) and with a copy to the Banking Superintendence, reports prepared by said auditors, when during the course of the external audit they detect the existence of facts related to the following aspects:

1. Findings of presumed significant activities that put the operations of the regulated entity at risk.
2. Questionable transactions with affiliated companies, related parties, or the same banking group to which the regulated entity belongs.
3. Evidence of misuse of insider information.
4. Recommendations made in the past by the external auditors of the regulated entity that have not been adopted.
5. Situations of fraud or suspicions of fraud or material accounting or financial errors observed during the audit according to ISA 240 on Auditor Responsibilities Regarding Fraud in an Audit of Financial Statements.
6. Situations of non-compliance with laws and regulations, as provided in ISA 250 on Consideration of Laws and Regulations in an Audit of Financial Statements.
7. Any other acts or irregular situations of fraud or suspicion of fraud detected during the course of the external audit, including irregular acts or situations of management, directors, or shareholders.
8. Reports to address those additional aspects required by this Superintendence, in accordance with Article 7, paragraph 1. Additionally, regulated entities shall keep available and send to the Banking Superintendence, when so requested, copies of the following documents: a. Audit engagement letter between the regulated entity and the audit firm, b. External audit plan,

Agreement No. 3-2025 Page 5 of 6 c. Evidence of communications of the external auditor with the board of directors or the audit committee of the regulated entity, d. Minutes of audit committee meetings, e. Divergences of the external auditor with management regarding the application of IFRSs, f. Letters to management, through which the auditor sends its observations and recommendations to the management of the regulated entity regarding internal control and other deficiencies and irregularities, g. Representation letter issued by the regulated entity to the external auditor, h. Adjusted and unadjusted audit difference sheets, i. Any other special report issued by an external auditor on a particular topic, j. Others that this Superintendence deems appropriate to indicate. The board of directors together with the audit committee of the regulated entity must take notice of all reports sent by the external auditors and adopt the necessary corrective measures, which must be recorded through the board of directors minutes.

ARTICLE 7. Article 10 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows:

ARTICLE 10. MINIMUM REQUIREMENTS OF REGULATED ENTITIES TOWARDS THEIR EXTERNAL AUDITOR. Regulated entities must require the external auditor to fulfill the following minimum responsibilities:

1. To issue an independent opinion on whether the financial statements reasonably present the financial situation of the regulated entity, financial performance, and its cash flows in accordance with IFRSs, as issued by the International Accounting Standards Board.
2. To apply the auditing standards referred to in Agreement No. 6-2012.
3. To observe the Professional Ethics Code applicable to external audit firms in the Republic of Panama, the Code of Ethics for Professional Accountants issued by the International Federation of Accountants (IFAC), and Law 280 of 2021 regulating the profession of the authorized public accountant.
4. To communicate in writing to the audit committee and to this Superintendence the occurrence of any acts or presumed material or significant irregularities that have been detected in the regulated entity, which must be recorded in the minutes issued by the audit committee.
5. To prepare the special reports referred to in the previous Article 9.

ARTICLE 8. Article 11 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows:

ARTICLE 11. WORKING PAPERS. The external audit contract shall establish that the external audit firm must keep in its possession, in full and in good condition, the working papers, either physically or digitized, as evidence of the work performed, for a minimum period of 5 years, from the date of issuance of the last report linked to each audit. Regulated entities shall ensure that the external audit contract includes an authorization for the auditors to make available to the Banking Superintendence, upon its request, the working papers, the audit program, and any other documentary support that is relevant for banking supervision purposes.

ARTICLE 9. Article 13 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows:

ARTICLE 13. INDEPENDENCE OF AUTHORIZED PUBLIC ACCOUNTANT FIRMS. Regulated entities may not hire, as external auditor, any authorized public accountant or firm of authorized public accountants in which the firm itself, or any of its partners or persons forming the audit team assigned to the regulated entity, incur in the incompatibilities established below, without prejudice to others that the Banking Superintendence might establish subsequently:

1. Having held or currently holding positions in the audited bank, its affiliates, subsidiaries, or in entities that are part of its banking group during the last two audited fiscal periods.

Agreement No. 3-2025 Page 6 of 6 2. Possessing directly or through third parties, interests or economic links with the businesses of the audited bank or with the banking group to which said bank belongs, with shareholders holding participations equal to or greater than 5% of the share capital, or with the members of the board of directors of the audited bank or its banking group. 3. Acting as a securities broker for the regulated entity. 4. Being a debtor of the audited bank or of the entities that make up its banking group, if the credits were granted under more favorable conditions than the rest of its clients or the loan is classified in a subnormal or higher risk category as established in Agreement No. 4-2013. 5. Providing other professional advisory services to the regulated entity, which involve active participation in managerial decision-making or compromise the independence of the external auditor to issue its objective and professional opinion. 6. Receiving services from the audited regulated entity under more favorable conditions than those usual for the rest of its clients. Additionally, the external auditor hired by the regulated entities must comply with the independence requirements established in the International Standards on Auditing (ISA), the Code of Ethics for Professional Accountants issued by the International Federation of Accountants (IFAC), and the Professional Ethics Code applicable to accountants and audit firms in the Republic of Panama.

ARTICLE 10. Article 14 of Agreement No. 4-2010 of August 10, 2010, is hereby amended as follows:

ARTICLE 14. ROTATION OF THE EXTERNAL AUDIT TEAM. Regulated entities must require their external auditors to rotate the engagement audit team at least every five (5) years, including managers, directors, and partners. The rotation also includes specialized personnel used in audits (tax auditors, technology, and others). The professional from the external audit firm who dedicates 10 or more hours of work to the regulated entity will be considered part of the external audit team and subject to rotation rules. This rotation does not necessarily imply a change of the external audit firm hired by the regulated entity. It will only be permitted that, at the time of carrying out the rotation, a member of the audit team that was attending to the regulated entity, remains for an additional period of one year. The person who remains for the additional time cannot be the partner that was attending to the regulated entity. From the date the rotation has been carried out, the people from the audit team who have been rotated can be reincorporated to the team once (a) three (3) years have passed for the case of managers, directors, and partners, and (b) two (2) years for the rest of the team that makes up the audit personnel. During the period mentioned in the previous paragraph, external auditors must ensure that the rotated audit team does not participate in the audit of the regulated entity, nor perform quality control of the work, nor receive consultations from the engagement audit team or the regulated entity regarding technical or specific issues of the regulated entity, transactions, or facts, and that they do not directly influence the result of the engagement.

ARTICLE 11. The provisions of this Agreement will begin to govern from its promulgation. Given in the city of Panama, on the eighth (8) day of the month of April of two thousand twenty-five (2025). NOTIFY, PUBLISH, AND COMPLY. THE PRESIDENT, THE SECRETARY, Rafael Guardia Adriana Raquel Carles