Technical Standards for Operational Risk Management of Financial Entities

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:
I. That in accordance with Article 3, letter c) of the Law on Supervision and Regulation of the Financial System, it is the responsibility of the Superintendence of the Financial System to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.
II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes as part of the members of the financial system: banks constituted in El Salvador, their offices abroad and their subsidiaries; the branches and offices of foreign banks established in the country; insurance companies, their branches abroad and the branches of foreign insurance companies established in the country; cooperative banks, savings and credit societies and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; the Social Housing Fund and the National Popular Housing Fund; the Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., the Development Bank of the Republic of El Salvador; and the other entities, institutions and operations indicated by the laws. (1)
III. That Article 35, letter d) of the Law on Supervision and Regulation of the Financial System, stipulates that directors, managers and other officials holding management or administrative positions of the members of the financial system, must conduct their business, acts and operations complying with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obliged to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management is fulfilled, being obliged, among other actions, to identify, evaluate, mitigate and disclose them in accordance with international best practices.
IV. That Article 99, letter a) of the Law on Supervision and Regulation of the Financial System, stipulates that it will be the responsibility of the Standards Committee to approve technical standards, instructions and provisions that the laws regulating the supervised establish must be issued to facilitate their application, including aspects inherent to risk management by the supervised.
V. That in accordance with international standards, it is necessary to have a solid risk management framework, which allows managing operational risks effectively and efficiently according to the profile, volume of operations, nature of the business, entity resources and best practices, so that

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023 the implementation of prudential measures for the transparent, efficient and orderly functioning of the market is promoted.
THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES, to issue the following:

TECHNICAL STANDARDS FOR THE MANAGEMENT OF OPERATIONAL RISK OF FINANCIAL ENTITIES

CHAPTER I
OBJECTIVE AND OBLIGATED SUBJECTS
Objective
Art. 1.- These Standards aim to provide minimum guidelines for adequate operational risk management and criteria for the adoption of policies and procedures related to the development of risk management methodologies, in accordance with the nature, size, risk profile and volume of their operations. These Standards complement the provisions established in the Technical Standards for the Integral Management of Risks of Financial Entities (NRP-20), the Technical Standards on Corporate Governance (NRP-17) and the Technical Standards for the Integral Management of Risks for Investment Banks that the Central Reserve Bank of El Salvador issues for such purposes through its Standards Committee. (1) Subjects Art. 2.- The subjects obliged to comply with the provisions established in these Standards are:
a) Banks constituted in El Salvador, their offices abroad and their subsidiaries; b) The branches and offices of foreign banks established in the country, insofar as pertinent; c) Insurance companies and their branches abroad; d) The branches of foreign insurance companies established in the country, insofar as pertinent; e) Cooperative banks, savings and credit societies and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; f) The Mortgage Bank of El Salvador, S.A.; g) The Social Housing Fund and the National Popular Housing Fund, insofar as it does not contradict their creation laws nor what is provided by the Court of Accounts;

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023 h) The Agricultural Development Bank, insofar as it does not contradict its creation law, nor what is provided by the Court of Accounts; i) The Development Bank of the Republic of El Salvador, insofar as it does not contradict its creation law, nor what is provided by the Court of Accounts; j) Legal entities that carry out money sending or receiving operations systematically or substantially, by any means, at the national and international level. It will be understood that money sending or receiving operations are carried out systematically or substantially when such activity is carried out habitually or constitutes an important activity within the business operations of the entity; k) Reciprocal Guarantee Societies and their local co-guarantors; l) Foreign Currency Exchange Houses; (1) m) Societies that offer complementary services to the financial services of the members of the financial system, particularly those in which they participate as investors; and (1) n) Investment Banks, their offices abroad and their subsidiaries. (1) Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: The Chief Executive President, Executive Director, General Manager or whoever acts in their place and the executive positions that report to them. For the case of the Development Bank of the Republic of El Salvador, the President; b) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plans; c) Central Bank: Central Reserve Bank of El Salvador; d) Executive Director: is that which exercises the highest administrative authority within the entity, and who may also be part of the Board of Directors; it is frequently referred to as Chief Executive President, General Manager or whoever acts in their place; e) Entity: Subject obliged to comply with the provisions established in these Standards; f) Mass-impact Event: failures or errors in batch processing that results in an impact on clients, whether they are clients of the entity or of other entities to which processing services are provided, such as: incorrect charges applied to a card or account during batch processing. g) Operational risk event: It is an event or series of events, of internal or external origin, which include incidents occurred and potential events that could generate economic losses and may or may not affect the statement of results; h) Operational risk factor: It is the primary cause or origin of an operational event, which can be caused by factors, such as, processes, people, information technology and external events; i) Board of Directors: A collegiate body or equivalent body in charge of the administration of the entity, with supervisory, direction and control functions; for the case of Cooperative Associations, it will be the Board of Directors or as defined in its Creation Law; j) Business Line: It is a specialization of the business that groups processes aimed at generating products and services to serve a target market segment; k) Risk Map: It is a tool that allows presenting a panoramic image of the risks to which the entity is exposed; independent of the form of its presentation, in which the areas/activities/assets (processes) that could be affected during the occurrence of an adverse event are identified and located. It allows seeing the threats and measuring the magnitude of each risk (probability and economic impact). It is a graphical risk management instrument that allows comparing risks by their relative importance, as well as together, allowing the entity to establish acceptable risk levels; l) Risk Profile: Consolidated result of the measurement of the risks to which an entity is exposed; m) Process: It is the set of activities that transform inputs into products or services with value for the user, whether internal or external; n) Batch processing: method of executing tasks in a repetitive and large volume in terms of the quantity of operations or transactions; o) Inherent Risk: Level of risk inherent to the activity, without taking
into account the effect of controls; p) Operational Risk: Possibility of incurring losses due to failures in processes, in people, in information systems and due to external events; it includes legal risk which consists of the possibility of occurrence of losses due to failures in the execution of contracts or agreements, non-compliance with regulations, as well as external factors such as regulatory changes, judicial processes, among others; q) Residual Risk: Level resulting from risk after applying controls. It is the risk that remains, once the relevant controls for its treatment have been implemented. In any case, it requires permanent monitoring to observe its evolution; r) Superintendence: Superintendence of the Financial System; and s) Risk Tolerance: Acceptable levels of risk-taking to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and, generally, is aligned with risk categories, such as strategy, finance, people or reputation.

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023

CHAPTER II
GENERAL PROVISIONS

Provision of services by third parties
Art. 4.- Entities must establish appropriate policies and procedures to evaluate, manage and monitor critical services provided by third parties, that is, those that could interrupt the normal development of operations, defined in the policies of each entity. The provision of services must be formalized through signed contracts, which include the scope of the service and clearly define the responsibilities of the provider and the entity. Likewise, they must include a clause that obliges the provider to document the services provided and guarantees the establishment of contingency and service continuity plans. In addition, there must be clauses that facilitate adequate review of the respective provision of services by the entities themselves or eventually by the Superintendence and other supervisory bodies. Regardless of whether certain services are performed by third parties, the entities subject to these Standards are responsible for ensuring compliance with the provisions applicable to them.

Entities must have a centralized control of all services provided by third parties that must at least contain the name of the provider, the type of service, the contract amount, the counterparty within the entity and its validity. This control must be available to the Superintendence when it requires it.

Legal Risk
Art. 5.- In addition to what is established in these Standards, for the case of legal risk, entities must establish at least specific policies and controls, so that, prior to the celebration of contracts, legal acts or operations they carry out, the legal validity is analyzed and adequate legal verification is sought. Likewise, these policies and procedures must contain aspects related to the orderly, complete, integral and timely conservation of the information and documentation that supports the entity's operations. Business Continuity and Information Security Art. 6.- Entities, except those described in letters j) and l) of Article 2 of these Standards, must implement a business continuity management system and an information security management system that guarantees the availability, integrity and confidentiality of the information they collect, store, for the Management of - -24).

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023

Methodologies for operational risk management
Art. 7.- Entities must define the methodology they will use to manage operational risk, which must be adequately documented and implemented throughout the entity in a consistent manner, for which they must assign sufficient resources for its application -20) and in the Technical Standards for the Integral Management of Risks for Investment Banks, which the Central Bank issues for such purposes through its Standards Committee. (1)

CHAPTER III
OPERATIONAL RISK FACTORS AND EVENTS
Risk Factors
Art. 8.- Entities must manage the different factors generating operational risk, which are the following:
a) Processes: In order to guarantee the optimization of resources and the standardization of activities, entities must have documented, defined and permanently updated processes, which can be grouped into strategic and operational processes. Entities must appropriately manage the risks associated with said processes, with emphasis on the failures or weaknesses they present, since these can have as a consequence the poor development of operations. b) People: Entities must establish policies, processes and procedures that seek adequate planning and administration of human capital, which include the hiring, retention and separation process of personnel. Likewise, they must establish preventive mechanisms that allow identifying and managing failures, insufficiencies, negligence, sabotage, theft, inadequate training, misappropriation of information, among other aspects, associated with personnel, directly or indirectly linked to the entity; in order to minimize the possibility of economic losses occurring. By direct linkage it shall be understood that which emanates from an internal employment contract, according to the respective labor legislation. On the other hand, indirect linkage shall be understood as the legal relationship with the entity that emanates from a contract for the provision of certain services, different from that which originates from an internal employment contract. c) Information Technology: Entities must manage risks associated with information technology, among others, those related to failures in the security and

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023 operational continuity of computer systems, errors in the development and implementation of said systems and their compatibility and integration, as well as the quality of information and adequate investment in technology. d) External Events: Entities must manage risks associated with external events beyond the control of the entity that could alter the normal development of their activities, related to failures in critical services provided by third parties, legal contingencies, the occurrence of natural disasters, attacks and criminal acts, among other factors. Operational Risk Events Art. 9.- Operational risk events are those situations that affect the normal development of the entity's operations, which include incidents occurred and potential events that could generate economic losses and may or may not affect the statement of results, being these the following:
a) Internal fraud; b) External fraud; c) Labor relations and workplace security; d) Clients, products and business practices; e) Damage to material assets; f) Business interruption and system failures; and g) Execution, delivery and process management.

CHAPTER IV
OPERATIONAL RISK MANAGEMENT
Organizational System
Art. 10.- Entities must establish an organizational or functional structure adequate to their business model and appropriately segregated, which clearly delimits functions and responsibilities, as well as the levels of dependence and interrelation that correspond to each of the areas involved in carrying out activities related to operational risk. All these aspects must be contemplated in the respective manual, approved by the Board of Directors of the entity. Board of Directors Art. 11.- The Board of Directors of the entity is the Body directly responsible for the management of operational risk, therefore it must:
a) Approve the entity's strategies, policies and manuals for operational risk management and ensure that Senior Management implements them effectively;

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023 b) Assign and approve the necessary resources to implement and maintain the operational risk management in an effective and efficient manner; c) Ensure that Internal Audit verifies the existence and compliance of the operational risk management scheme; and d) Designate a person responsible for communicating the occurrence of operational risk events, as required in the second paragraph of Article 21 of these Standards, which may be the same delegates for the reporting of events associated with (NRP-24). Risk Committee Art. 12.- The Risk Committee is in charge of ensuring sound management of the entity's operational risk, therefore it must:
a) Evaluate, review and propose for approval by the Board of Directors the strategies, policies and manuals for operational risk management; b) Supervise that operational risk management is effective and that operational risk events are consistently identified, measured, evaluated, mitigated and monitored; c) Propose mechanisms for the implementation of corrective actions required in case there are deviations with respect to the operational risk tolerance level; d) Approve operational risk management methodologies; and e) Support the work of the Risk Management Unit in the implementation of operational risk management. Senior Management Art. 13.- Senior Management is responsible for the implementation of operational risk management, of the strategies, policies and manuals, authorized by the Board of Directors. Risk Unit Art. 14.- The Risk Unit is in charge of implementing the operational risk management methodology, therefore it must:
a) Design and submit for approval by the Board of Directors, through the Risk Committee, the strategies, policies and manuals for operational risk management; b) Design and submit for approval by the Risk Committee the methodology for operational risk management; c) Support and assist other management units in the implementation of the operational risk methodology; d) Elaborate an opinion on the risk of new products or services, prior to their launch; as well as also in the face of important changes in the operational or computer environment; and

NRP-42
IN FINANCIAL ENTITIES
Approval: 26/09/2023
Validity: 11/10/2023 e) Report timely and in a complete and detailed manner the failures in the different factors and operational risk events to the Board of Directors through the Risk Committee.

Internal Audit
Art. 15.- Internal Audit must evaluate, at least annually, the compliance of the procedures used for operational risk management and follow up on the compliance of the Risk Unit's work plan, which involves everything provided in these Standards. Stages of management Art. 16.- For operational risk management, entities must have a continuous and documented process for:
a) Identification: Entities must establish a process of identifying all their operational risk events grouping them according to what is established in Annex No. 1 of these Standards, in such a way that it allows them to establish their operational risk map. Likewise, in the case of banks, cooperative banks and savings and credit societies, additionally, it is necessary that the identification of events be grouped, according to the business lines that the entity maintains, as expanded in Annex No. 2 of these Standards, and for insurance companies, as detailed in Annex No. 3 of these Standards. b) Measurement: Entities must estimate or quantify operational risk considering the probability of occurrence and the economic impact on the entity's results. This quantification is essential for the entity because in function of them, control and mitigation measures are established that seek to minimize losses from this risk. The methodologies and tools to estimate or quantify operational risk must be in accordance with the size, nature of the risk levels assumed by the entity and volume of its operations. c) Control and mitigation: Refers to the coverage and control actions or mechanisms implemented by the entity with the purpose of preventing or reducing negative effects in case adverse operational risk events materialize. An action plan must be established to implement measures that seek to mitigate identified risk events. This plan must detail the actions to be implemented, the estimated execution time and the direct responsible parties for said execution.

NRP-42
IN FINANCIAL ENTITIES
Approval: 09/26/2023
Validity: 10/11/2023

d) Monitoring and communication: Entities must provide systematic and timely follow-up to operational risk events, as well as to the results of actions taken.

Follow-up must ensure periodic review and the generation of sufficient information to support decision-making processes.

Entities must perform permanent monitoring of their risk map and exposure to operational risk losses, complying at minimum with the following aspects:

i. Develop effective and permanent follow-up processes that allow for the rapid detection and correction of deficiencies;
ii. Establish indicators that demonstrate potential operational risks;
iii. Ensure that established internal controls are functioning effectively and efficiently; and
iv. Ensure that residual risks are below the tolerance level established by each entity.

The entity must have managerial information systems and statistical databases that enable the generation of timely, reliable, consistent, and homogeneous information for periodic reports to the Board of Directors, Risk Committee and/or Senior Management, as well as to other stakeholders responsible for decision-making in operational risk management.

Policies

Art. 17.- Entities must have policies to define the operational risk management framework, allowing them to reduce their vulnerability and losses from such risk and to promote at the organizational level a culture of prevention and control of this risk, ensuring compliance with internal and external norms related thereto.

Operational risk management policies must consider, among other aspects, the categorization of loss events, the functions and responsibilities in operational risk management, criteria for identification, measurement, control, mitigation, and information systems for operational risk management.

Operational Risk Management Manual

Art. 18.- Entities must have an operational risk management manual that groups the policies for managing this risk, the functions and responsibilities of the involved areas, the methodology, associated processes, and the frequency with which information must be reported to the Board of Directors and Senior Management regarding exposure to operational risk. This manual must be reviewed and updated every two years.

CHAPTER V
INFORMATION REQUIREMENT

Databases

Art. 19.- Entities must form a centralized database that allows registering, ordering, classifying, and making available information on operational risk events. These must be classified by factors, determining the frequency of the event and the effect produced, and must contain at minimum the fields detailed in Annex No. 4 of these Norms and submit it by electronic means or in the manner determined by the Superintendence.

Annual Report

Art. 20.- Entities must present to the Superintendence, within the first one hundred twenty (120) calendar days following the close of each annual fiscal year, a report regarding actions taken for the control and evaluation of the operational risk faced by the entity, by process and/or business unit and support unit. The report must contain at minimum the following:

a) The definition of the strategy used for operational risk management; b) The detail of the methodology employed for operational risk management; c) Identification, evaluation, and detail of operational risks from critical events that occurred during the year, by process and/or business unit and support unit; and the detail of measures adopted to manage them; d) Detail of executives responsible for risk control activities of critical events that occurred during the year; and e) Activity Plan to be developed by the Risk Unit, related to operational risk management, detailed through a schedule.

Submission of Database

Art. 21.- Entities must send to the Superintendence, annually and no later than [text missing in source, likely "the date established"], as mentioned in these Norms, submitting it by electronic means or in the manner determined by the Superintendence.

In addition to what is provided in the first paragraph of this article, entities must report to the Superintendence, at the time of occurrence, any materialized operational risk event caused by personnel failures or operational errors in processes that massively affect any financial product offered by the entity.

The report on materialized events will be made by each entity by the means available to it, providing a brief description of the event, including general information available regarding the possible cause and impact and actions executed.

Subsequently, the entity, ten calendar days after having reported the referred event, must submit complete the following information and documentation:

a) Date and time of start of occurrence of the event; b) Date and time of end of occurrence, if the event has ended; c) Description of the event; d) Causes of the failures; e) Technical diagnosis; f) Affected channels; g) Impact caused; and h) Corrective actions executed and/or action plan to be implemented by that entity to resolve the causes that originated the event or events, as well as to prevent them in the future.

Submission of Operational Risk Management Manual

Art. 22.- Entities must submit electronically to the Superintendence within ten (10) business days after approval by the Board of Directors, any modifications to the Operational Risk Management Manual referred to in Article 18 of these Norms.

CHAPTER VI
OTHER PROVISIONS AND VALIDITY

Managerial Information Systems

Art. 23.- Entities listed in letters j), k), l), and m) of Article 2 of these Norms must have managerial information and statistical databases that enable the generation of timely, reliable, consistent, and homogeneous information allowing for the preparation of periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other stakeholders responsible for decision-making in risk management.

Entities will continue to send to the Superintendence, annually and [text missing in source, likely "by the established deadline"], by electronic means or in the manner determined by the Superintendence. Likewise, entities must submit operational risk events on the next business day after they occurred; submitting them by electronic means or in the manner determined by the Superintendence.

Sanctions

Art. 24.- Non-compliance with the provisions contained in these Norms will be sanctioned in accordance with what is provided in the Law on Supervision and Regulation of the Financial System.

Repeal

Art. 25.- Norms for the Operational Risk Management of Financial Entities -50), approved in Session of the Board of Directors No. CD-22/2011 on the twenty-ninth of June of the year two thousand eleven by the Board of Directors of the Superintendence of the Financial System, whose Organic Law was repealed by Legislative Decree No. 592 which contains the Law on Supervision and Regulation of the Financial System, published in Official Diary No. 23, Volume No. 390, dated February 2, 2011.

Unforeseen Aspects

Art. 26.- Aspects not provided for in regulatory matters in these Norms will be resolved by the Central Bank through its Standards Committee.

Validity

Art. 27.- These Norms will enter into force starting on the eleventh of October of two thousand twenty-three.

MODIFICATIONS

(1) Modifications in Consideration II and in articles 1, 2, and 7, approved by the Central Bank through its Standards Committee, in Session No. CN-08/2025, on September 30, two thousand twenty-five, with validity starting from October 15, two thousand twenty-five.

NRP-42
IN FINANCIAL ENTITIES
Approval: 09/26/2023
Validity: 10/11/2023

Annex No. 1

TYPES OF EVENTS BY OPERATIONAL RISK

Event Type (Level 1) | Definition | Event Type (Level 2) | Examples --- | --- | --- | --- Internal Fraud | Losses derived from any type of action aimed at defrauding, improperly appropriating assets, or evading regulations, laws, or corporate policies in which at least one member of the entity is involved. | Unauthorized Activities | Unrevealed transactions (intentional), unauthorized transactions (with economic losses), erroneous valuation of positions (intentional).
| | Theft and Fraud | Theft, embezzlement, forgery, bribery, account appropriation, smuggling, tax evasion (intentional).
External Fraud | Losses derived from any type of action aimed at defrauding, improperly appropriating assets, or evading legislation, by a third party. | Theft and Fraud | Theft, forgery.
| | System Security | Damages from cyberattacks, information theft.
Employment Practices and Workplace Safety | Losses derived from actions incompatible with legislation or labor agreements, regarding hygiene or workplace safety, regarding payment of claims for personal damages, or regarding cases related to diversity or discrimination. | Employment Practices | Issues related to remuneration, social benefits, contract termination.

	Workplace Health and Safety	Cases related to workplace health and safety standards; compensation to workers.
	Diversity and Discrimination	Any type of discrimination.
Clients, Products, and Business Practices	Losses derived from the involuntary or negligent non-compliance with a corporate obligation towards specific clients (including fiduciary and suitability requirements), or from the nature or design of a product.	Suitability, Information Disclosure, and Trust
	Improper Business or Market Practices	Restrictive competition practices, improper commercial / market practices, market manipulation, abuse of insider information (in favor of the entity), money laundering.
---	---	---
	Defective Products	Product defects (unauthorized, etc.), model errors.
	Selection, Sponsorship, and Risks	Lack of client investigation according to guidelines, excess of risk limits towards clients.
	Advisory Activities	Litigation regarding results of advisory activities.
Damage to Physical Assets	Losses derived from damage or harm to physical assets as a consequence of natural disasters or other events.	Disasters and Other Events
	Monitoring and Reporting	Non-compliance with reporting obligations, inaccuracy of external reports (generating losses).
---	---	---
	Client Acceptance and Documentation	Non-existence of authorizations / client rejections, non-existent / incomplete legal documents.
	Client Account Management	Unauthorized access to accounts, incorrect client records (generating losses), loss or damage of client assets due to negligence.
	Commercial Counterparties	Failures of counterparties other than clients, other litigations with counterparties other than clients.
	Distributors and Suppliers	Subcontracting, litigations with suppliers.

NRP-42
IN FINANCIAL ENTITIES
Approval: 09/26/2023
Validity: 10/11/2023

Annex No. 2

DETAIL OF BUSINESS LINES

Level 1	Level 2	Activity Groups
Corporate Finance	Corporate Finance	Mergers and acquisitions, underwriting of issuances, privatizations, securitization, research services, debt (public, high yield), equities, syndications, initial public offerings, private placements in secondary markets.
Local / Public Administration	Investment Banking
---	---
Advisory Services	Advisory Services
Trading and Sales	Sales	Fixed income, equities, currencies, commodities, credit, financing, proprietary positions in securities, lending and repurchase agreements, intermediation, debt.
Structuring	Structuring
---	---
Proprietary Trading	Proprietary Trading
Treasury	Treasury
Retail Banking	Retail Banking	Retail client loans and deposits, banking services, trusts.
Private Banking	Loans and deposits for individuals, banking services, trusts, and investment advisory.
---	---
Card Services	Corporate / commercial cards, private label, and retail cards.
Commercial Banking	Commercial Banking	Project financing, real estate, export financing, commercial financing, factoring, financial leasing, loans, guarantees, bills of exchange.
Payment and Settlement	External Clients	Payments and collections, fund transfers, clearing and settlement.
Agency Services	Custody	Deposit certificates, securities lending transactions.
Corporate Agents	Debt issuance and payment agents.
---	---
Corporate Trusts	Trust commissions and other services
Asset Management	Discretionary Fund Management	Retail, institutional, closed-end, open-end, equity participations.
Non-Discretionary Fund Management	Retail, institutional, fixed capital, variable capital.
Retail Intermediation	Retail Intermediation	Execution and full service.

NRP-42
IN FINANCIAL ENTITIES
Approval: 09/26/2023
Validity: 10/11/2023

Annex No. 3

DETAIL OF BUSINESS LINES OF INSURANCE COMPANIES.

Level 1	Level 2	Activity Groups
Life Insurance	Life Insurance	Long-term individual life, short-term individual life, group plans, and other plans
Pension Insurance	Disability and survivor annuities, burial, other annuities and pensions
Accident and Health Insurance	Health and hospitalization, personal accidents, air and school travel accidents Property or General Insurance	Fire and Allied Lines
Motor Vehicles	Private motor vehicles, collective motor vehicles, motorcycles, collective transport,
---	---
General Insurance	Glass breakage, marine transport, air transport, marine hulls, aviation, theft and robbery, fidelity, bank insurance, contractor all-risk, machinery breakage, erection all-risk, electronic all-risk, boilers, livestock agricultural, internal credit, and miscellaneous.
Sureties	Fidelity	Fidelity
Guarantee	Bid and performance, faithful compliance, good quality, good work, civil liability surety, construction surety, other sureties
Motorcyclists	Motorcyclist	Motorcyclist

NRP-42
IN FINANCIAL ENTITIES
Approval: 09/26/2023
Validity: 10/11/2023

Annex No. 4

DATABASE CONTENT TABLE FOR EVENT REGISTRATION

1. Reference: Internal code that identifies the event sequentially.
2. Operational Risk Factor: According to the classification established in Chapter III of these Norms.
3. Loss Event Type: Identifies the type of loss, according to the classification of Annex No. 1.
4. Business Lines: Identification of the business line that originated the event, being the main ones for the case of banks, cooperative banks, and savings and credit societies detailed in Annex No. 2.
   For Insurance Companies, the main business lines are detailed in Annex No. 3.
5. Description of the Event: Detailed description of the event. Service channel or customer attention (when applicable) Geographic zone.
6. Event Start Date: Date when the event begins. Day, month, year.
7. Event End Date: Date when the event ends. Day, month, year.
8. Discovery Date: Date when the event is discovered. Day, month, year.
9. Accounting Date: Date when the economic loss from the event is registered. Day, month, year, hour.
10. Amount: The amount of the loss, economic quantification of the occurrence of the operational risk event and expenses derived from its handling.
11. Currency: Foreign currency in which the event materializes.
12. Affected Accounts: Identifies the accounts from the Chart of Accounts affected.
13. Process: Identifies the affected process.
14. Total Value Recovered: The total value recovered by the direct action of the entity. Includes amounts recovered by insurance.
15. Value Recovered by Insurance: Corresponds to the value recovered through coverage by an insurance policy.
16. Affected Product or Service: Identifies the product or service affected by the operational risk event.
17. Quantification of Damage Severity: Amount of the loss (net of any mitigant or recovery).

For the creation of the operational risk event register, entities may use, in addition to the fields described above, other fields considered relevant.

Entities that consider that operational risk event databases are insufficient to quantify operational risk may opt for the use of external source databases, provided that such databases are normalized and adequate to the entity's internal databases.