Technical Standards for the Provision of Correspondent Banking Services

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 9 CNBCR-09/2025 NRP-95 TECHNICAL STANDARDS FOR THE PROVISION OF CORRESPONDENT BANKING SERVICES Approval: 10/11/2025 Validity: 25/11/2025

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING: I. That in accordance with Article 3, literal c) of the Law for the Supervision and Regulation of the Financial System, it is the responsibility of the Superintendence of the Financial System to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity. II. That Article 35, in its first clause and literal c) of the Law for the Supervision and Regulation of the Financial System establishes that, without prejudice to other obligations that may correspond to them, the directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work for, the adoption and updating of policies on ethical standards of conduct, management of conflicts of interest, use of insider information, prevention of behaviors that may imply manipulation or abuse of the market, as well as the compliance with principles, rules, or standards in the management of business that establish to achieve corporate objectives. III. That Article 63 of the Banks Law and Article 44 of the Investment Banks Law, in their first and second clauses, establish that banks must elaborate and implement policies and control systems that allow them to adequately manage their financial and operational risks; considering, among others, provisions related to management, destination, and diversification of credit and investments, liquidity management, interest rates, and foreign currency operations, as well as those carried out abroad. Likewise, banks must establish policies, practices, and procedures that allow them to know their clients in a reliable manner. IV. That Article 41 of the Cooperative Banks and Savings and Credit Societies Law establishes that, cooperatives must elaborate and implement policies and control systems that allow them to adequately manage their financial and operational risks, considering among others, provisions related to the management, destination, and diversification of credit and investments, management of their liquidity, interest rates, and foreign currency operations. Likewise, they must establish policies, practices, and procedures that allow them to know their clients in a reliable manner. V. That Article 155 of the Cooperative Banks and Savings and Credit Societies Law

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 9 CNBCR-09/2025 NRP-95 TECHNICAL STANDARDS FOR THE PROVISION OF CORRESPONDENT BANKING SERVICES Approval: 10/11/2025 Validity: 25/11/2025 establishes that, savings and credit societies shall be subject to the provisions of the Banks Law. VI. That Article 71 of the Investment Banks Law establishes that, the provisions contained in Articles 23 and 24 of the Banks Law shall apply to Investment Banks, insofar as they do not contravene the Investment Banks Law, nor the nature or purpose of Investment Banks. VII. That according to international standards, it is necessary to have guidelines that allow the effective and efficient management of risks related to the correspondent banking service, so as to promote the implementation of prudential measures for the transparent, efficient, and orderly functioning of the business.

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law for the Supervision and Regulation of the Financial System, AGREES to issue the following:

TECHNICAL STANDARDS FOR THE PROVISION OF CORRESPONDENT BANKING SERVICES

CHAPTER I OBJECT AND OBLIGATED ENTITIES Object Art. 1.- These Standards aim to establish minimum guidelines for financial entities acting as local correspondents of foreign banks to manage the risk of money laundering and asset laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction, in the operations originating from this type of service. These Standards complement the provisions established in the "Technical Standards for the Integral Risk Management of Financial Entities" (NRP-20), "Technical Standards for the Management of Money Laundering and Asset Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction" (NRP-36) and the "Technical Standards of Corporate Governance" (NRP-17), as applicable.

Subjects Art. 2.- The obligated subjects for compliance with the provisions established in these Standards are: a) Banks constituted in El Salvador, their offices abroad, and their subsidiaries; b) Cooperative banks; c) Investment banks, their offices abroad, and their subsidiaries; and d) Savings and credit societies. The entities listed above, to provide the correspondent banking service, must previously have the authorization of the Central Reserve Bank of El Salvador in accordance with what is provided in the Banks Law, the Cooperative Banks and Savings and Credit Societies Law, and the Investment Banks Law.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Creditor or beneficiary: Natural or legal person in whose favor a payment originating from a client correspondent bank and ordered by another person located in a foreign country or locality is made; b) Central Bank: Central Reserve Bank of El Salvador; c) Client correspondent bank: The entity domiciled abroad that uses local correspondent banking services to carry out its clients' transactions; d) Local correspondent bank: The local entity that receives and/or makes payments and provides other services on behalf of the client correspondent bank; this concept applies to banks, investment banks, cooperative banks, and savings and credit societies; e) Shell bank: A bank constituted in a country or jurisdiction where it has no physical presence and is not a subsidiary of a regulated financial group. Additionally, a shell bank is one that: i. Does not employ one or more employees on a full-time basis; ii. Does not maintain transaction records at its domicile; and iii. Is not subject to inspection by the authority that granted its operating license. f) Payable Through Accounts: Are accounts of the client correspondent bank opened at the local correspondent bank, which are used directly by third parties to carry out commercial or any other type of transactions on their own behalf; g) Entity/entities: Obligated subjects for compliance with these Standards; h) Regulated subsidiary: A bank whose owner, directly or indirectly, is authorized in a country or jurisdiction that has an adequate legal framework to prevent the crime of money laundering and asset laundering, and terrorist financing;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 9 CNBCR-09/2025 NRP-95 TECHNICAL STANDARDS FOR THE PROVISION OF CORRESPONDENT BANKING SERVICES Approval: 10/11/2025 Validity: 25/11/2025 i) FATF: Financial Action Task Force. An intergovernmental institution that establishes international standards whose objective is to prevent money laundering and asset laundering, terrorist financing, and counter the financing of the proliferation of weapons of mass destruction; j) Financial Investigation Unit Instruction: Instruction for the Prevention, Detection, and Control of Money Laundering and Asset Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of the Financial Investigation Unit of the Attorney General's Office of El Salvador; k) Board of Directors: A collegiate body or equivalent body in charge of the administration of the entity, with supervision, direction, and control functions; for the case of Cooperative Associations, it will be the Board of Administration or as defined in its creation Law; l) ML/TF/PFMD: Money Laundering and Asset Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction; m) Politically Exposed Persons (PEPs): Comprises the persons established in Article 9-B of the Law against Money Laundering and Asset Laundering and those described in Article 16 of the Financial Investigation Unit Instruction of the Attorney General's Office of El Salvador.; n) Correspondent banking service: The provision of banking services by a local financial entity to another financial entity located outside its territory, referred to in these Standards as Client correspondent bank; o) Superintendence: Superintendence of the Financial System; p) FIU: Financial Investigation Unit of the Attorney General's Office of El Salvador; and q) User or originator: Natural or legal person who requests, through a client correspondent bank, the payment of a transaction to third parties using a local correspondent bank.

CHAPTER II ON CORRESPONDENT BANKING

Due Diligence Art. 4.- Local correspondent banks must have knowledge that client correspondent banks apply due diligence measures in the detection and prevention of money laundering and asset laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction, which establish international practices and recommendations regarding correspondent banking operations.

Local correspondent banking policies Art. 5.- The Board of Directors or equivalent body of the local correspondent bank is responsible for ensuring the adequate management of ML/TF/PFMD risk, therefore, the policies, procedures, and internal controls issued in accordance with the Salvadoran legal and regulatory framework must consider the identification of clients, users, and counterparties, measurement, control, monitoring, and communication of the referred risk in the correspondent banking services provided. In these policies, it must be explicitly stipulated that the entity will not establish any type of commercial, business, or service relationship with shell banks.

Principles on correspondent banking Art. 6.- Local correspondent banks in their relationships with client correspondent banks must maintain transparent, clear, documented relationships that do not put the entity, clients, their shareholders, and consequently the financial stability of the country at risk, with the objective of preventing ML/TF/PFMD risk. Entities must pay special attention to commercial relationships and transactions with natural or legal persons and other financial institutions that carry out operations in countries that do not apply FATF recommendations or do so insufficiently. For these purposes, entities must, at a minimum, verify the following: a) Updated lists of natural or legal persons involved in crimes related to ML/TF/PFMD originating from publications of countries or local and international bodies binding for the Republic of El Salvador. b) Lists related to countries considered as null or low taxation jurisdictions or qualified as tax havens, natural or legal persons linked to criminal acts prior to establishing or initiating any business with potential clients and during the continuation of the commercial relationship. c) Lists related to natural persons who hold or have held prominent public functions in the country or country of origin (Politically Exposed Persons), prior to establishing or initiating any business with potential clients and during the continuation of the commercial relationship; Art. 7.- In the event that entities detect unusual or inconsistent transactions with the type of economic activity of the client, they must examine, to the greatest extent possible, the background and objective of said transactions. If after the analysis it is concluded that it is a suspicious operation, they must send the corresponding report in accordance with what is established in the FIU Instruction.

Art. 8.- The Superintendence, on its own or at the request of the FIU, when it determines that a country does not apply FATF Recommendations or does so insufficiently, taking as a basis the updated list of these countries published on the website of said body, will require entities to develop the following measures: a) Strict requirements to identify clients, and improvement of alerts, including specific financial ones for certain jurisdictions, with the objective that entities identify beneficial owners before commercial relationships are established with natural or legal persons from those countries; b) Improvement of reporting mechanisms or instruct the systematic reporting of all financial transactions, based on the premise that financial transactions with these countries are more likely to be suspicious; c) Warn non-financial sector businesses that transactions with natural or legal persons within a specific country could run the risk of ML/TF/PFMD; and d) Limit commercial relationships or financial transactions with countries or persons that represent a latent risk of ML/TF/PFMD.

Art. 9.- The Superintendence will not authorize the establishment of subsidiaries, branches, or representative offices of financial institutions originating from a country that does not have the necessary systems to guarantee the adequate prevention of ML/TF/PFMD risk.

Controls Art. 10.- Local correspondent banks must consider and evaluate the nature of their controls against ML/TF/PFMD, the manner in which they are applied, periodically in accordance with what is established in the "Technical Standards for the Management of Money Laundering and Asset Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction" (NRP-36).

Information Obtention Art. 11.- Prior to signing the correspondent banking service contract with a client correspondent bank, the entity must perform due diligence that allows it to verify its reputation, as well as its compliance with norms and controls of the origin supervisor on prevention, detection, control, and reporting of ML/TF/PFMD and if it has been subject to investigations for this illicit, therefore, it must form a file in which at least the following is documented: a) The determination of the country or jurisdiction where the head office of the client correspondent bank is domiciled, the place where it operates and maintains its usual business; likewise, verify that they have a supervisory body that applies international standards for the prevention of ML/TF/PFMD; b) The entity must verify that the client correspondent bank is not included, at least, in the lists of the Office of Foreign Assets Control of the United States Department of the Treasury (OFAC) and the United Nations Security Council and lists binding for the Republic of El Salvador; they must also review the pronouncements of regulatory or supervisory agencies and/or international bodies such as FATF and evaluate the risk presented by the country or jurisdiction where the client correspondent bank or its head office are located or domiciled, especially when it comes to tax havens or countries considered as non-cooperative by FATF; c) Inquiry, among other aspects, of the legal nature of constitution of the client correspondent bank, the domicile of its owners, experience in the management of its business, ownership structure, and the participation of politically exposed persons in the ownership, management, senior management, or administration of the client correspondent bank, all of this with the objective of evaluating the risk to face in case the local entity decides to be a correspondent of the client correspondent bank; d) Investigation of the types of business, markets, and segments where the client correspondent bank predominantly operates; e) Sworn declaration of the legal representative of the client correspondent bank, in which it is mentioned that its representative, in the last five years, has not been subject to legal action with adverse results in administrative or penal matters regarding ML/TF/PFMD; f) If the client correspondent bank is listed on a stock exchange, inquire if its shares are transferred in jurisdictions with adequate regulation and supervision in matters of ML/TF/PFMD; likewise, identify any significant control participation; and g) Certification of the agreement approving the hiring of the local correspondent banking service, issued by the Board of Directors or by the official it designates.

Updating the file of users of the client correspondent bank Art. 12.- The local correspondent entity must require client correspondent banks to review and update the information of their users' files regularly, at least once a year, or when there are material changes in the risk profile. The aforementioned information together with all the necessary or required data in Article 14 of these Standards must appear in the contract signed for this purpose.

Payable Through Accounts Art. 13.- When the correspondent banking service includes payable through accounts, the local correspondent bank, in concordance with what is provided in Article 4 of these Standards and for the purposes of complying with the due diligence measures established in the FIU Instruction and not incurring transactions presumably with a shell bank as such, must require a certification from the client correspondent bank that endorses that it has verified the identity and has carried out the respective procedures of the user who has access to the accounts of the client correspondent bank, and that is in conditions to supply the identification data of the same.

Databases Art. 14.- With the aim of having an integral risk profile of client correspondent banks, the local correspondent bank must create a database with the documentation and electronic justifications of the operations or transactions that those carry out with it. The statistical base must contain data, not only of monetary figures, but mention which of the total transactions have been considered irregular or suspicious, the frequency of the same, and why they have been considered as such. The statistical base of local entities in their role as correspondent must contain, at a minimum, the following information: a) Name of the user or originator of the operation; b) Name of the beneficiary; c) If the user or the beneficiary is a politically exposed person; d) If the user is a frequent client of the client correspondent bank and the degree of frequency with which it requires its services or products (daily, weekly, monthly, etc.); e) Type of product, service, or operation; and f) Amount of the transaction or operation. The database and the risk profile of client correspondent banks, duly documented, must be available at any moment to the Superintendence and the FIU.

CHAPTER III OTHER PROVISIONS AND VALIDITY

Central Banks and Supranational Bodies Art. 15.- These Standards will not apply to contractual relationships with Central Banks and monetary authorities of FATF member countries or supranational bodies, nor to operations carried out through the Payment Interconnection System (SIPA), in which the Central Bank has the quality of direct participant.

Sanctions Art. 16.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law for the Supervision and Regulation of the Financial System.

Derogation Art. 17.- These Standards repeal the "Standards for the Provision of Correspondent Banking Service" (NPB 4-51), approved by the Board of Directors of the Superintendence of the Financial System in Session No. CD-25/2011 of July 20, 2011, whose Organic Law was repealed by Legislative Decree No. 592 which contains the Law for the Supervision and Regulation of the Financial System, published in Official Diary No. 23, Volume No. 390, of date February 2, 2011.

Unforeseen Aspects Art. 18.- The unforeseen aspects in matters of regulation in these Standards will be resolved by the Central Bank through its Co