Resolution Amending Articles 16, 18, 19, 22, 24, 25, 26, 27, 29, 31 and Annex 3 of the Regulation on Private Credit Bureaus

Page 1 of 7 Resolution No. CD-SIBOIF-1129-3-SEP10-2019 Dated September 10, 2019 REGULATION AMENDING ARTICLES 16, 18, 19, 22, 24, 25, 26, 27, 29, 31 AND ANNEX 3 OF THE REGULATION ON PRIVATE CREDIT BUREAUS

The Board of Directors of the Superintendence of Banks and Other Financial Institutions,

CONSIDERING

I

That on March 18, 2009, the Regulation on Private Credit Bureaus was approved, contained in Resolution No. CD-SIBOIF-577-1-MAR18-2009, published in La Gaceta, Official Journal No. 79 of April 30, 2009, which aims to regulate the mechanisms for the approval of the constitution and operation of Private Credit Bureaus (CRP) in accordance with Article 115 of the General Banking Law.

II

That it is necessary to modify Articles 16, 18, 19, 22, 24, 25, 26, 27, 29, 31 and Annex 3 of the aforementioned regulation, in order to adapt the aspects of external auditing applicable to private credit bureaus, contained in said articles, in accordance with the International Financial Reporting Standards (IFRS), as well as updates to the International Standards on Auditing (ISA), among other aspects.

III

That in accordance with the foregoing and based on the powers established in Article 10, item 10) of Law 316, Law of the Superintendence of Banks and Other Financial Institutions, and its reforms; contained in Law No. 974, Law of the Nicaraguan Legal Digest of the Banking and Finance Matter, published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its reforms.

In exercise of its powers,

HAS ISSUED

The following,

Resolution No. CD-SIBOIF-1129-3-SEP10-2019 REGULATION AMENDING ARTICLES 16, 18, 19, 22, 24, 25, 26, 27, 29, 31 AND ANNEX 3 OF THE REGULATION ON PRIVATE CREDIT BUREAUS

FIRST: Articles 16, 18, 19, 22, 24, 25, 26, 27, 29 and 31 of the Regulation on Private Credit Bureaus, contained in Resolution No. CD-SIBOIF-577-1-MAR18-2009, of March 18, 2009, published in La Gaceta, Official Journal No. 79 of April 30, 2009, are amended, which shall read as follows:

Page 2 of 7

“Article 16. Hiring of Firms.- Private Credit Bureaus (CRP) must hire annually, no later than within the third quarter of the year to be audited, the services of Firms registered in the Registry. Likewise, the CRP must communicate to the Superintendent the name of the selected Firm within a maximum period of five (5) days, counted from the signing of the contract, attaching a copy of the certification of the board of directors meeting minutes where the hired Firm is approved and indicating names and positions of the audit team. The documentation supporting compliance with the hiring requirements referred to in the next article must be available to the Superintendent. The Superintendent may order the non-hiring of a selected Firm when there are technical, legal, or other reasons, duly justified, that warrant such action.

Article 18. Minimum conditions of contracts.- The following minimum conditions must be incorporated into external audit service contracts: a) The start of the audit engagement must take place no later than thirty (30) days before December 31 of each year. b) The scope of the audit engagement and the content of the reports issued by the Firms must comply with the International Standards on Auditing (ISA). c) The obligation of the Board of Directors, the partners of the Firm, and each member of the team that will audit the CRP, to present a notarized declaration according to Annex 2 of the current Regulation, which is an integral part of it. d) The deadline for delivering the reports must include a penalty clause indicating the monetary fines that will be deducted from the Firm for non-compliance with the quality and time delivery of the corresponding reports, unless such non-compliance is caused by reasons attributable to the CRP. e) The obligation of the Firm to inform in writing to the Superintendent and the Board of Directors of the CRP, any significant event that puts at risk the access, handling and safeguarding of information of its Holders, as well as the financial stability of the CRP or regarding the existence of illegal operations that it determines during or at the end of the audit it is conducting. This report must be made no later than within three (3) business days following the knowledge of the significant event. f) The obligation of the Firm to make available to the Superintendent the working papers, the audit programs applied and other documentary and electronic information, supporting the reports they issue and, if applicable, substantiate the respective report, upon simple request of the Superintendent. g) The obligation of the Firm to send to the Superintendent, simultaneously with its presentation to the Board of Directors of the audited CRP, a copy of the reports issued in compliance with this Regulation. h) The commitment of the Firm not to replace the partner, manager, supervisor or auditor in charge of the audit, without the authorization of the Board of Directors of the CRP.

Page 3 of 7

Those cases are exempted when they cease to work for the Firm, have completed the rotation period established in Article 22 of this Regulation or due to force majeure cases duly justified, for which the Superintendent must be informed indicating the name, position and experience of the person replacing them. i) The participation of the Superintendence, when it deems it necessary, in meetings of work that the Firm holds with the Board of Directors of the CRP, its management staff and internal auditor and/or audit committee, if they exist.

Article 19. Responsibilities of the CRP in external audit engagements.- The Board of Directors, the General Management and the internal audit, if it exists, are directly responsible for providing the hired Firm with the information and facilities necessary for it to carry out its audit engagement adequately, independently and timely. Likewise, it is the responsibility of said bodies to ensure compliance with the provisions established in this Regulation and to form a file containing the background and responses to information requests made by the Firm.

The CRPs will keep available to the Superintendent a copy of the management letter or internal control report prepared by the Firm in connection with the preparation of the audited financial statements, supplementary reports and the correspondence that the CRPs have sent to the Firm in response to their communications.

Article 22. Requirement for rotation of the audit team.- The Firm has the obligation to rotate the partner, manager, supervisor and auditor in charge, after three (3) years of having executed audits or related recurrent services to the same CRP. Once the aforementioned period has concluded, a period of at least two (2) years must elapse before any of these individuals can return to participate in performing audits or services related to the CRP. The rotation may not be simultaneous for all team members.

For the purposes mentioned in the previous paragraph, the work performed by these individuals in the CRP is cumulative, even if they were part of another Firm.

The CRPs must inform the Superintendent about the reasons that may eventually motivate a change of Firm before they sign the respective contract with the new Firm, attaching a certification of the minute point where the change was agreed. In any case, both the hiring of the Firm and the termination of contracts must be communicated to the Superintendent within a period of ten (10) days, counted from the date on which the respective agreement was taken.

In the event that the Superintendent detects situations that may constitute omissions or existence of commitments or links between the directors or officials of the CRP and the external auditors of the same, which affect the independence of opinion of the latter, or for any other reason based on inspection results, the Superintendent may require the hiring of another Firm, without prejudice to the sanctions it may impose on the previously hired Firm or the CRP.

Article 24. Execution of external audit work.- Firms must execute their work based on the International Standards on Auditing (ISA).

Page 4 of 7

The working papers or other audit evidence filing methodology applied by the Firm must comply with what is provided in the International Standards on Auditing (ISA), and among others, but not limited to these, must present evidence regarding: a) Audit conclusions. b) Criteria for sample selection, procedures and scope applied to the accounts and areas reviewed therein. c) Unaudited aspects and their justification d) Evidence of review by the partner-manager in charge of the audit e) Detailed summary of adjustments and/or reclassifications resulting from the review practiced on the financial statements and related statements.

If the Firm has indications or certainty that it will have limitations in the scope of its audit engagement or that it will issue a modified opinion of the type: “Qualified Opinion”, “Adverse Opinion” or “Disclaimer of Opinion”, it must communicate this to the Superintendent in writing, no later than within twenty-four (24) business hours following.

Article 25. Applicable audit engagements.- Firms must evaluate and issue a report, no less than at the close of each accounting period, opining on the reasonableness of the financial statements of the CRP, considering the overall functioning of the internal control system and the evaluation of compliance with the laws and regulations applicable to these entities, primarily those issued by the Superintendence.

The following information must be attached to the Firm’s report on the financial statements:

1. Statement of Financial Position.
2. Audited Statement of Results.
3. Other Comprehensive Income.
4. Audited Statement of Changes in Equity.
5. Audited Statement of Cash Flows.
6. Notes to the Audited Financial Statements required by this Regulation.
7. Detailed report on adjustments and reclassifications proposed recorded by the entity, specifying the effects of debits and credits in each of the accounts of the financial statements.
8. Any other information of importance that the External Auditors deem fit to add.

Article 26. Opinion on financial statements.- The auditor must issue its opinion as an independent auditor regarding the reasonableness of said financial statements taken as a whole, in accordance with the comprehensive accounting basis established for these entities. If there are qualifications to the opinion, these must be clearly identified and, when applicable, quantified within the same.

Page 5 of 7

Article 27. Notes to financial statements.- Firms must verify that the CRPs comply with disclosing in the Notes to the Financial Statements information whose disclosure is required by the International Financial Reporting Standards (IFRS).

Article 29. Findings.- Each finding revealed in the aforementioned reports must contain the following attributes: a) Condition: It is the revelation of what the auditor found, which must be drafted briefly with sufficient information, with examples of errors or irregularities found; as well as the qualification regarding the relevance and impact of the respective finding (low, medium, high). b) Criterion: It is the revelation of what should exist or be complied with regarding laws, internal control standards, manuals of functions and procedures, policies and any other written disposition. The identification of the criterion is very important to highlight the importance of the finding or deficiency found. c) Cause: It is the revelation of the reasons why the deficiency or finding occurred; among which stand out the lack of: i. An adequate organizational structure; ii. The establishment of procedure manuals that include the application of previously established standards and instructions; iii. An adequate delegation of authority; iv. An adequate segregation of functions; v. Establishment of training policies for personnel; vi. Establishment of adequate communication between different areas; vii. Hiring of adequate human resources; viii. Assignment of sufficient material resources for the development of functions; ix. Code of ethics, business conduct and honesty among officials; x. Establishment of incentive or motivation policies for operational personnel; xi. Adequate supervision by control areas; and xii. others that may arise in the review conducted. d) Effect: It is the consequence or potential risks that may affect the integrity and financial situation of the institution, if the condition determined by the auditor persists. e) Recommendation: It constitutes the auditor's suggestion to overcome or correct the findings or deficiencies determined. f) Management Comments: These are the mandatory manifestations of the management of the audited entity, regarding the deficiency pointed out by the auditor and the corrective measures it will implement. It must clearly identify the procedures and mechanisms necessary that will be implemented to avoid or prevent the recurrence of such deficiencies and the time period required for their implementation.

In the case that the Firms identify problems that do not allow the performance of the audit engagements adequately, they must communicate this immediately to the Superintendent, and indicate in the respective reports the reasons that prevented such evaluation.

Page 6 of 7

Article 31. Information on significant events.- Firms have the obligation to communicate in writing to the Superintendent and the Board of Directors of the CRP within three (3) business days of having taken knowledge, of the significant events they detect in the audit process of the CRPs, without prejudice to including them in the corresponding reports.”

SECOND: Annex 3, first paragraph and item I, letters d), f) and g), of the Regulation on Private Credit Bureaus referred to in the first section of this resolution, are amended, which shall read as follows:

“ANNEX 3 REQUIREMENTS OF INDEPENDENCE AND SUITABILITY

The Firms, their partners, directors, administrators, managers, supervisors, auditor responsible for the audit work and other members of the audit team, who sign reports and any other official who could influence the results of the audit, must be suitable and independent persons of the audited CRP at the date of celebration of the service provision contract and during the development of the audit. It is considered that there is no independence and suitability when any of the aforementioned persons, as the case may be, falls under any of the following scenarios:

I. INDEPENDENCE: … d) When the partners, directors, managers, supervisors, administrators, auditor responsible for the audit work and other members of the audit team, who sign reports and any other official who could influence the results of the audit, as well as the spouse and relatives of these, up to the second degree of consanguinity and second degree of affinity, have directly or through a legal entity, investments in shares, debt instruments or derivative instruments on shares of the CRP or of the legal entities forming part of the group of economic interest to which the CRP belongs. … f) When the Firm or any of its partners, directors, managers, supervisors, administrators, auditor responsible for the audit work and other members of the audit team, who sign reports and any other official who could influence the results of the audit, provide in turn to the CRP or to the legal entities forming part of the group of economic interest, in addition to the audit, services of accounting; operation of information systems; administration of their local network; operation, supervision, design or implementation of computer systems (hardware and software); valuations, appraisals or estimates; administration; internal audit; representation and resolution of legal and tax conflicts; recruitment of personnel; training; consulting, among others. g) When the income that the Firm receives or will receive for auditing the financial statements of the CRPs depends on the result of the audit itself or on the success of any operation carried out by them, which has as its basis the opinion of said financial statements. …”

Page 7 of 7

THIRD: This regulation will enter into force upon its notification, without prejudice to its subsequent publication in La Gaceta, Official Journal.

(S) S. Rosales C. (S) Illegible (Luis Ángel Montenegro E.) (S) Fausto Reyes R. (S) Illegible (Silvio Moisés Casco Marenco) (S) Illegible (Rafael Ángel Avellán Rivas).

RAFAEL ÁNGEL AVELLÁN RIVAS Secretary of the Board of Directors SIBOIF