Norm Reforming the General Standard on the Imposition of Fines

Page 1 of 10 RESOLUTION No. CD-SIBOIF-1147-1-DIC17-2019 Dated December 17, 2019 NORM REFORMING THE GENERAL STANDARD ON THE IMPOSITION OF FINES

The Board of Directors of the Superintendence of Banks and Other Financial Institutions,

CONSIDERING

I

That by Resolution No. CD-SIBOIF-410-1-MAR14-2006, dated March 14, 2006, the "General Standard on the Imposition of Fines" was approved, published in La Gaceta, Official Journal No. 80 of April 25, 2006.

II

That in accordance with the powers established in Article 171 of Law No. 561, "General Law of Banks, Non-Bank Financial Institutions and Financial Groups," published in La Gaceta, Official Journal No. 232, of November 30, 2005; and Articles 30, letter a), 36, and 47 of Law No. 977, "Law Against Money Laundering, Terrorist Financing, and Financing of Proliferation of Weapons of Mass Destruction," published in La Gaceta, Official Journal No. 138, of July 20, 2018, hereinafter Law 977 or Law Against ML/TF/PF; legal frameworks contained in Law No. 974, "Law of the Nicaraguan Legal Digest of the Banking and Finance Sector," published in La Gaceta, Official Journal No. 164, of August 27, 2018, and its updates (Legal Digest Law); it proceeds to modify Article 10 of the "General Standard on the Imposition of Fines" in order to update the infractions and sanctions applicable to financial institutions for non-compliance with their obligations in the matter of prevention of money laundering or asset laundering risks, terrorist financing, and financing of proliferation of weapons of mass destruction (ML/TF/PF) contained in the laws and regulations on the matter, as well as in the recommendations of the Financial Action Task Force (FATF).

Likewise, based on Articles 168 and 171 of the aforementioned Law No. 561, it also proceeds to modify Article 12, letter b, numeral 3 of the aforementioned standard.

III

That according to the considerations previously stated and based on the power established in Articles 3, numerals 2), 12) and 13), and 10, numerals 1) and 2) of Law No. 316, "Law of the Superintendence of Banks and Other Financial Institutions," published in La Gaceta, Official Journal No. 196, of October 14, 1999 and its reforms (Law No. 316); contained in the Legal Digest Law.

In exercise of its powers,

HAS ISSUED

Page 2 of 10 The following, Resolution No. CD-SIBOIF-1147-1-DIC17-2019 NORM REFORMING THE GENERAL STANDARD ON THE IMPOSITION OF FINES

FIRST: Article 10 of the "General Standard on the Imposition of Fines," contained in Resolution No. CD-SIBOIF-410-1-MAR14-2006, of March 14, 2006, published in La Gaceta, Official Journal No. 80, of April 25, 2006, and its reforms, is hereby amended, which shall read as follows:

"Art. 10.- Imposition of fines for infractions of the provisions and/or guidelines for the Prevention of Money or Asset Laundering, Terrorist Financing, and Financing of Proliferation of Weapons of Mass Destruction.- In accordance with what is indicated in Article 164 of the General Banking Law, with respect to the prevention of money or asset laundering, terrorist financing, and financing of proliferation of weapons of mass destruction, supervised financial institutions shall be sanctioned by the Superintendent in accordance with the following:

a. Range: 5,000 to 60,000 fine units.

b. Infractions and applicable amount.

1. When the institution does not have a Program for the Prevention of Money or Asset Laundering, Terrorist Financing, and Financing of Proliferation of Weapons of Mass Destruction (hereinafter, it may be referred to as the ML/TF/PF Program) in accordance with the laws and regulations on the matter. Amount: 60,000 fine units.

2. When the institution's ML/TF/PF Program does not contemplate conducting the individual risk assessment of ML/TF/PF for clients, countries or geographic areas, products, services, operations or transactions, distribution and delivery channels, use of new technologies for service provision, both new and existing, and other risk factors, in accordance with applicable legal and/or regulatory requirements. Amount: 60,000 fine units.

3. When the institution has not carried out and/or updated its individual ML/TF/PF risk assessment in accordance with applicable legal and regulatory provisions; and/or has not established in its policies the methodology and/or frequency to carry out and/or update the aforementioned assessment; and/or its methodology is incomplete or deficient, increasing the institution's risk profile; and/or the measures established to identify the highest and lowest ML/TF/PF risks are not supported by the results of its own risk assessments. Amount: 15,000 to 30,000 fine units.

4. When the ML/TF/PF Program presents material or significant deficiencies, both in its content and in its execution, the respective sanction will be applied as these deficiencies are determined, among which are mentioned:

i. When it does not adjust to the nature and/or complexity of its products and/or services and/or to the size of its activity and/or to the provisions in accordance with the laws and/or regulations on the matter. Amount: 5,000 to 30,000 fine units.

ii. When it has not carried out the differentiation of the intensity of policies, procedures, internal controls, tasks, and measures in accordance with the ML/TF/PF risk levels classified as high, medium, or low in all areas of its business and activities, to its clients, and to the size of the institution. Amount: 10,000 to 30,000 fine units.

iii. When its implementation or execution is deficient, increasing the institution's risk profile. Amount: 5,000 to 30,000 fine units.

iv. When there is no Policy and Procedures Manual for the Prevention of ML/TF/PF risks or ML/TF/PF Manual. Amount: 5,000 to 30,000 fine units.

v. When it has not carried out and/or updated in its ML/TF/PF Manual the policies, procedures, internal controls, weights, criteria, and variables for the determination of ML/TF risk levels and its classification matrix for each of these risks and/or the results of its application are not properly documented. Amount: 5,000 to 30,000 fine units.

vi. When the ML/TF/PF Manual is not properly updated in accordance with the standard and law on the matter, properly approved by the institution's Board of Directors. Amount: 5,000 to 30,000 fine units.

Page 3 of 10

vii. When the ML/TF/PF Manual exists, but it is inadequate or incongruent with respect to the complexity of its financial products and services, service and business technology, or the institution's or market's risk profile. Amount: 5,000 to 30,000 fine units.

viii. When the ML/TF/PF Manual exists, but it does not contain specific policies and procedures for:

A) The administration, backing, safeguarding, custody, conservation, maintenance, and access controls of records, files, archives, and other data, whether physical and/or electronic, which in accordance with the law and regulations for the prevention of ML/TF/PF are subject to retention for the legal period, or, if these procedures exist, they are inadequate or deficient, or are being applied deficiently. Amount: 5,000 to 30,000 fine units.

B) The prevention and monitoring of ML/TF/PF risks through transactions via electronic fund transfers and/or through the purchase or sale of foreign currency and/or instruments of consignment and/or remittances and/or deposits and/or withdrawals of funds and/or credit operations and/or other transactions and/or products and services for which the institution is authorized by law, or, if these procedures exist, they are inadequate or deficient, or are being applied deficiently. Amount: 5,000 to 30,000 fine units.

C) The early detection, investigation, analysis or scrutiny, escalation, documentation, and decision to report or not report suspicious ML and/or TF and/or PF activities to the competent authority, or if these procedures exist, they are inadequate or are being applied deficiently and/or the tools used for monitoring accounts and/or products and/or services and/or transactions are not in correspondence with the complexity and volume of the entity's operations and/or are ineffective for the early detection of suspicious activities. Amount: 5,000 to 30,000 fine units.

D) Reassess existing ML/TF/PF risks in the redesign, modification, or innovations of operations, products, services, channels, and/or payment methods and/or existing business lines, through the use and application of new technologies and/or the appropriate measures to manage and mitigate identified risks and/or does not include them in its ML/TF/PF Manual. Amount: 5,000 to 30,000 fine units.

Page 4 of 10

E) The classification of the ML/TF/PF risk level in new or sophisticated financial products or services and/or those that facilitate anonymity and/or those used for their monitoring and early detection of unusual and/or suspicious ML/TF/PF operations and/or the systems and/or tools for their monitoring are not in correspondence with the technology being used by the institution in the provision of the same. Amount: 5,000 to 30,000 fine units.

ix. When the documentation in the files is not in accordance with the ML/TF/PF risk level regarding identification, verification measures, and knowledge of the client and/or its ultimate beneficiary and/or occasional non-recurring users and/or regarding the ordering parties and/or the beneficiaries of fund transfers and/or remittances is incomplete and/or inappropriate in accordance with the minimum requirements of the law and/or regulations on the matter and/or regarding the institution's own "Know Your Customer" policies, which denote an inadequate or deficient application of Due Diligence or Enhanced Due Diligence. Amount: 5,000 to 40,000 fine units.

x. When the obligation to report to the competent authority, according to the law on the matter, reports of cash transactions is not fulfilled, in accordance with the information required by the law and applicable regulations for said report. Amount: 10,000 to 40,000 fine units.

xi. When cash transaction reports do not include all transactions that in accordance with the Law and standard must be submitted or the content of these does not agree with the information required by the standard and/or provisions issued by the competent authority for said reports. Amount: 5,000 to 40,000 fine units.

xii. When the institution does not have a ML/TF Administrator or Compliance Officer duly appointed by its Board of Directors, before whom it must report administratively, organizationally, and functionally, dedicated exclusively to the implementation, training, and follow-up of the ML/TF/PF Program: Amount: 10,000 to 30,000 fine units.

xiii. When the Superintendent determines that the ML/TF Administrator or Compliance Officer does not meet one, several, or all of the following conditions:

A) Is not formally invested and in practice with the due authority and autonomy, organizational, administrative, and functional;

Page 5 of 10

B) Does not have the professional capacity, training, and experience in the matter and industry in which the institution operates;

C) Does not have the adequate personnel and/or the training and education that this function requires;

D) Does not fulfill or fulfills deficiently the functions corresponding to it in accordance with the law and regulations on the matter.

E) The institution does not provide evidence or cannot evidence that the ML/TF Administrator or Compliance Officer or their substitute, when substituting the holder, have an administrative treatment comparable in all aspects to that granted to other first-level managerial positions in the administrative structure of the same. Amount: 5,000 to 30,000 fine units.

xiv. When the financial, human, technological, and material resources assigned by the institution's Board of Directors to carry out the execution of the ML/TF/PF Program are not in accordance with the volume, complexity of its financial products and services, service and business technology, or the institution's or market's risk profile. Amount: 5,000 to 30,000 fine units.

xv. When the institution does not have or does not evidence having an Annual Operational Plan for ML/TF/PF authorized by its Board of Directors; which must comply and adjust, insofar as applicable, to the legal framework and/or if it exists, is deficient in its programming and/or execution. Amount: 5,000 to 20,000 fine units.

xvi. When it does not have or does not evidence having an annual and institutional Training Program on ML/TF/PF with its due budget allocation for its execution, authorized by its Board of Directors. Amount: 20,000 fine units.

xvii. When the ML/TF/PF training program is deficient, inadequate, or incongruent in relation to the complexity, size, or risk profile of the institution; or said program is executed deficiently: Amount: 5,000 to 20,000 fine units.

Page 6 of 10

xviii. Lack of a Code of Conduct that meets the policies adopted by the institution's Board of Directors for the ML/TF/PF Program, or when it exists, it is inadequate or insufficient. Amount: 5,000 to 20,000 fine units.

xix. When the internal audit function is insufficient or deficient in the permanent review of the ML/TF/PF Program in accordance with the law and/or regulations on the matter or regarding the institution's own audit program. Amount: 15,000 to 40,000 fine units.

xx. For the non-performance or late performance of the external audit for the verification of the efficacy and quality of the ML/TF/PF Program, in accordance with the regulations on the matter or that having been performed, the results of this are deficient and inadequate in relation to the findings determined in the inspections carried out by the Superintendence. Amount: 5,000 to 40,000 fine units.

xxi. For other circumstances, in which due to the deficient implementation of the ML/TF/PF Program and/or non-compliance with other legal and/or regulatory provisions on the matter, the institution's risk profile is negatively affected. Amount: 5,000 to 40,000 fine units.

5. When the institution does not fulfill the obligation to report to the competent authority, according to the law and regulations on the matter, unusual operations or transactions that are suspicious of ML and/or TF and/or PF. Amount: 40,000 to 60,000 fine units.

6. The person holding any of the following categories: manager, official, ML/TF Administrator or Compliance Officer or any other employee of the institution who discloses or informs the client that their transaction is being analyzed or considered for a possible Suspicious Transaction Report of ML and/or TF and/or PF or informs them that such a report was filed. Amount: between four and eight monthly salaries of the person involved in the infraction according to the categories cited above.

7. When it concerns the person occupying the position of director who discloses or informs the client that their transaction is being analyzed or considered for a possible Suspicious Transaction Report or informs them that such a report was filed.

Page 7 of 10

Amount: 10,000 to 50,000 fine units.

8. When it does not deliver the information requirements that the Superintendent makes to the institution, either for the performance of its on-site or off-site supervision activities or the particular ones requested of them, such as statistical information, or does not deliver it in the form and/or deadlines and/or means requested and/or does not provide delegated supervisors with the minimum necessary conditions for the development of their inspection tasks. Amount: 10,000 to 50,000 fine units."

SECOND: Article 12, letter b, numeral 3 of the "General Standard on the Imposition of Fines," contained in Resolution No. CD-SIBOIF-410-1-MAR14-2006, of March 14, 2006, published in La Gaceta, Official Journal No. 80, of April 25, 2006, and its reforms, is hereby amended, which shall read as follows:

"b...

3. Serious Infractions: Serious infractions are those that affect the financial situation of the entity and significantly impact its liquidity and solvency or the public's deposits and investments; as well as those in which provisions prohibiting or limiting operations, transactions, records are not observed, or without observing the conditions established in the laws or standards, considering as such those indicated below, which are not expressly sanctioned by the previous articles:

i) Performing acts or operations without the authorization of the Superintendence, when so established by law or standards, or without observing the conditions established in these.

ii) Revaluing real estate without complying with the established procedure.

iii) Valuing assets, contingencies, and other risk exposures without adjusting to the legal and regulatory provisions established.

iv) Performing or exercising activities foreign to its legally established corporate purpose.

v) Canceling contributions to the Bank Superintendence outside the established deadlines.

vi) Performing acts or operations prohibited by law, standards, and other laws applicable to it.

vii) Lacking the legally required accounting, keeping it without complying with the accounting standards issued, recognized, or authorized by the Superintendence or with irregularities that prevent knowing the patrimonial, reserve, economic, and financial situation of the institution.

Page 8 of 10

viii) Performing operations to evade reserve requirements.

ix) Refusing to present to the Bank Superintendence accounting books, as well as any other information required of it in accordance with the law.

x) Failing to fulfill the obligation to submit its annual financial statements to the examination of an external auditor in accordance with the law.

xi) Not publishing audited financial statements in accordance with the law and regulations.

xii) Not publishing the cost table required for credit card operations in accordance with the law and regulations on the matter, as well as modifying it without the prior authorization of the Superintendent.

xiii) Not publishing the credit card operations contract model in accordance with the law and regulations on the matter, or making modifications to it without the prior authorization of the Superintendent.

xiv) Presenting or publishing financial information that differs from the actual situation of the entity.

xv) Transacting with related parties under preferential conditions or without complying with the legal and regulatory provisions established for active operations.

xvi) Lack of minimum information that in accordance with the law and corresponding standards must be demanded from financing applicants and debtors, when such information has an impact on determining their payment capacity and/or credit recoverability.

xvii) The refusal or resistance to the action of the Bank Superintendence in its surveillance and inspection tasks, with written request.

xviii) Not Registering or Incorrectly Registering (or at the appropriate time) provisions for assets and other risk exposures, as well as adjustments resolved by the Superintendent of Banks and by internal and external auditors.

xix) Not Registering or Incorrectly Registering (or at the appropriate time) reserves required by law or standard.

xx) Non-compliance with resolutions that prohibit operations or order actions aimed at correcting patrimonial or liquidity deficiencies and other provisions derived from them.

xxi) Registering shareholders without the authorization of the Superintendent.

Page 9 of 10

xxii) Interrupting or not providing public service on working days, in contravention of what is established in the standard on the regulation of working days.

xxiii) Any other infractions of equal or similar gravity committed against legal, regulatory, and other applicable provisions, as well as instructions of the Superintendent.

For this type of infractions, the Superintendent will apply a sanction of 10,001 to 50,000 fine units. The infractions established in this numeral may be applied individually for each observed fault and/or for each branch where the fault occurs and/or for each day that the same persists."

THIRD: This standard will enter into force upon its notification, without prejudice to its subsequent publication in La Gaceta, Official Journal. (F) S. Rosales (F) Illegible (Luis Ángel Montenegro E.) (F) Fausto Reyes B. (F) Illegible (Silvio Moisés Casco Marenco) (F) Illegible Secretary. SAÚL CASTELLÓN TÓRREZ Ad Hoc Secretary of the SIBOIF Board of Directors