Administrative, Accounting or Data Processing Service Providers - Removal from the Regulatory Scope of the Central Bank of Uruguay

Montevideo, September 4, 2026 Ref: ADMINISTRATIVE, ACCOUNTING OR DATA PROCESSING SERVICE PROVIDERS - Removal from the Regulatory Scope of the Central Bank of Uruguay

The market is informed that the Financial Services Superintendence adopted Resolution SSF No. 2026-557 on August 31, 2026.

2026-50-1-01345 Diagonal Fabini 777 - P.C. 11100 - Tel.: (598 2) 1967 - Montevideo, Uruguay - www.bcu.gub.uy JUAN PEDRO CANTERA Superintendent of Financial Services

CIRCULAR No. 2511

FINANCIAL SERVICES SUPERINTENDENCE – RESOLUTION FINANCIAL SERVICES SUPERINTENDENCE

VIEWING: Article 693 of Law No. 20,446 of December 16, 2025, which replaced Article 37 of Law No. 16,696 of March 30, 1995, as amended by Article 1 of Law No. 20,345 of September 19, 2024.

RESULTING: I) That through the aforementioned legal change, the regulatory scope of the Central Bank of Uruguay is removed for natural or legal persons included in Article 25 of Law No. 19,574 of December 20, 2017. II) That the aforementioned Article 25 refers to providers of administrative, accounting, or data processing services, defined as natural or legal persons acting from our country who provide administrative, accounting, or data processing services directly related to the management of businesses of natural or legal persons who, professionally and habitually, develop financial activities abroad.

CONSIDERING: I) That it is appropriate to align the current regulation regarding providers of administrative, accounting, or data processing services with the legal change introduced by the article referred to in the Viewing section. II) That, therefore, references to the aforementioned service providers must be eliminated from the Compilation of Regulations and Control Norms of the Financial System.

ATTENTIVE: To the provisions of Article 37 of Law No. 16,696 of March 30, 1995, as amended by Article 693 of Law No. 20,446 of December 16, 2025, the powers established in literal A) of Article 38 of Law No. 16,696 of March 30, 1995, as amended by Article 694 of Law No. 20,446 of December 16, 2025, and the reports in file No. 2026-50-1-01345.

THE SUPERINTENDENT OF FINANCIAL SERVICES RESOLVES:

1. REPEAL Title VII – Providers of administrative, accounting, or data processing services of Book I – Authorizations and Registrations of the Compilation of Regulations and Control Norms of the Financial System, Chapters I – Definition, II – Registration and cancellation of registration, and Articles 123, 124, 125, and 125.1 contained therein.

2. SUBSTITUTE Title III – Prevention of the use of micro-credit administrator companies, credit-granting entities, and providers of administrative, accounting, or data processing services for money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction of Book III – Protection of the financial system against illicit activities of the Compilation of Regulations and Control Norms of the Financial System with Title III – Prevention of the use of micro-credit administrator companies and credit-granting entities for money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction.

3. SUBSTITUTE Articles 316.19, 316.20, 316.21, 316.22, and 316.23 of Title III – Prevention of the use of micro-credit administrator companies and credit-granting entities for money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction of Book III – Protection of the financial system against illicit activities of the Compilation of Regulations and Control Norms of the Financial System with the following:

ARTICLE 316.19 (PREVENTION OF MONEY LAUNDERING, TERRORIST FINANCING, AND FINANCING OF THE PROLIFERATION OF WEAPONS OF MASS DESTRUCTION). Micro-credit administrator companies and credit-granting entities shall: a) Establish policies and procedures that allow them to prevent, detect, and report operations that may be related to money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction. To this end, they must consider establishing rules to adequately know their clients, including, in the case of micro-credit administrator companies, the businesses adhered to the system, as well as identify the persons with whom they operate and maintain records of transactions carried out with them. Likewise, third parties who provide financing under the terms of Articles 81 and 86.3, when they are not institutions supervised by the Financial Services Superintendence, shall be included. b) Establish policies and procedures regarding personnel that ensure: • A high level of integrity on their part. Micro-credit administrator companies and credit-granting entities must consider aspects such as personal, professional, and asset background checks, which enable the evaluation of the justification for significant changes in their asset situation or consumption habits. • Permanent training that allows them to know the regulations in this matter, recognize operations that may be related to money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction, and the manner of proceeding in each situation. c) Designate a compliance officer who will be responsible for the implementation, monitoring, and control of the adequate functioning of the preventive system, promoting the permanent updating of the policies and procedures applied by the institution. Additionally, this official will serve as the liaison with competent bodies. The Compliance Officer shall be an employee included in the senior management category, and the function may be performed by one of the owners. They must be based in the country and have the training, hierarchy within the organization, and necessary human and material resources to perform their task autonomously and efficiently.

ARTICLE 316.20 (PRESERVATION OF INFORMATION). Micro-credit administrator companies and credit-granting entities must preserve records of all operations carried out with or for their clients, as well as all information obtained in the due diligence process, for a minimum period of 5 (five) years after the end of the commercial relationship, in accordance with the provisions of Article 21 of Law No. 19,574 of December 20, 2017.

ARTICLE 316.21 (CONFIDENTIALITY). Micro-credit administrator companies and credit-granting entities shall not disclose to the persons involved or to third parties the actions or reports they carry out or produce in compliance with their duty to report or in response to a request for information made by the Financial Information and Analysis Unit.

ARTICLE 316.22 (DUTY TO REPORT SUSPICIOUS OR UNUSUAL OPERATIONS). Micro-credit administrator companies and credit-granting entities are obligated to report to the Financial Information and Analysis Unit transactions, whether carried out or not, that, in the usages and customs of the respective activity, appear unusual, are presented without obvious economic or legal justification, or are posed with unusual or unjustified complexity, as well as financial transactions involving assets whose origin is suspected to be illicit, for the purpose of preventing the crime of money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction. In the latter case, the obligation to report extends even to those operations that – even involving assets of lawful origin – are suspected to be linked to natural or legal persons included in said crime or destined to finance any terrorist activity. The information must be communicated immediately once qualified as such, even if the operations have not been effectively completed by the institution, either because the client withdrew from carrying them out or because the institution decided not to proceed with them. The communication will be carried out in accordance with the instructions issued by the Financial Information and Analysis Unit for this purpose.

ARTICLE 316.23 (DUTY TO VERIFY LISTS, PREVENTIVE FREEZING, AND REPORTING). Micro-credit administrator companies and credit-granting entities must permanently control and verify: A. Lists of individuals or entities associated with terrorist organizations, compiled by the United Nations Organization pursuant to Resolutions of the Security Council of said Organization. B. Lists of individuals or entities linked to the financing of the proliferation of weapons of mass destruction, compiled pursuant to Resolutions of the Security Council of the United Nations Organization. C. Designations of natural or legal persons or entities, pursuant to Resolution of the Security Council of the United Nations Organization S/RES/1373. D. The roster of persons declared terrorists by final national or foreign judicial resolution. If there is a match of natural or legal persons or entities with the names or identification data arising from the aforementioned lists or designations, they must proceed to the immediate and without delay preventive freezing of the funds and other financial assets or economic resources of said persons or entities, and also prevent the entry of funds at their disposal. Likewise, they must immediately report to the Financial Information and Analysis Unit of the Central Bank of Uruguay that they have carried out a preventive freeze, in accordance with instructions to be issued.

4. REPEAL Part VI – Providers of administrative, accounting, or data processing services of Book VI – Information and Documentation of the Compilation of Regulations and Control Norms of the Financial System and Articles 660, 661, and 661.1 contained therein.

5. SUBSTITUTE Articles 673 and 674 of Title II – Sanctions for delay or error in the presentation of information of Part I – Sanctions for financial intermediation institutions of Book VII – Sanctioning and Procedural Regime of the Compilation of Regulations and Control Norms of the Financial System with the following:

ARTICLE 673 (FINE FOR DELAY IN THE PRESENTATION OF INFORMATION). The late presentation of information required by the Central Bank of Uruguay will be sanctioned with a daily fine determined as follows: I) Periodic Information. a) For information that the Financial Services Superintendence considers relevant to present on time and in due form and that is required from institutions – except administrators of advance savings groups – the daily fine will be equivalent to 0.00003 of the basic asset liability for banks. b) For information that the Financial Services Superintendence considers relevant to present on time and in due form and that is required from exchange houses, administrators of advance savings groups, large-asset credit administrator companies, representatives of financial institutions constituted abroad, fund transfer companies, and financial services companies, the daily fine will be equivalent to 0.000015 of the basic asset liability for banks. c) For information that the Financial Services Superintendence considers relevant to present on time and in due form and that is required from credit administrator companies whose total assets plus contingencies at the close of the economic year do not exceed the equivalent of 100,000 Adjusted Units and from companies administering peer-to-peer lending platforms, the daily fine will be equivalent to 0.000005 of the basic asset liability for banks. d) For other information required from the institutions mentioned in literal a), the daily fine will be equivalent to 0.00001 of the basic asset liability for banks. e) For other information required from the companies mentioned in literal b), the daily fine will be equivalent to 0.000005 of the basic asset liability for banks. f) For other information required from the companies mentioned in literal c), the daily fine will be equivalent to 0.0000025 of the basic asset liability for banks. When the delay in the presentation of information exceeds five days, the fine will be doubled. After ten days of delay, the provisions of Article 667 will also apply until the information is presented and the fine paid. In these cases, the provisions of Articles 670 and 672 will not apply. For these purposes, only business days of delay will be considered. II) Aperiodic Information. Information that is not of periodic presentation will be sanctioned with the same criteria as those provided in numeral I), with a maximum of thirty days of daily fine. Without prejudice to this, when the delay period in the presentation of the information exceeds thirty days, the sanction may be increased based on the valuation of the following factors:

• Magnitude of the infringement. The relevance of the information in question and the extent of the period in which the non-compliance was verified will be evaluated.
• Potential harm to third parties. Third parties are understood to be natural or legal persons who had a relationship with the infringing institution.
• Benefit generated for the infringer. In consideration of the provisions of Article 665, third paragraph, the benefits obtained due to the non-presentation of the information, both by the institution and by the natural or legal persons linked to it in the manner provided in Article 210, will be determined.
• Reiteration. The history of delays in the presentation of the same information, as well as other aperiodic information, during the last twelve months will be evaluated.
• Detection of non-compliance. It will be taken into consideration whether the non-compliance was detected by the Financial Services Superintendence or was reported by the institution itself. To apply a greater sanction, under the terms referred to above, the procedural regime referred to in Article 721 will be followed.

ARTICLE 674 (FINE FOR ERRORS IN THE INFORMATION PRESENTED). Institutions – except administrators of advance savings groups – that present information with errors will be sanctioned with a fine equivalent to 0.00018 of the basic asset liability for banks. This fine will be increased for each business day of delay in the presentation of the new information in accordance with the provisions of Article 673. Exchange houses, administrators of advance savings groups, credit administrator companies, fund transfer companies, financial services companies, and companies administering peer-to-peer lending platforms that present information with errors will be sanctioned with a fine equivalent to one-third of that referred to in the previous paragraph. This fine will be increased for each business day of delay in the presentation of the new information in accordance with the provisions of Article 673. After ten days of delay, the provisions of Article 667 may also apply until the information is presented and the fine paid. In all cases, the delay will be calculated from the next business day after the date of notification of the error committed. In this system, Articles 670 and 672 will not apply. Information containing errors detected at the time of delivery and resulting in its rejection will be considered as not presented, and this article will not apply to such errors.

6. SUBSTITUTE Part VI – Sanctions for providers of administrative, accounting, or data processing services and companies administering peer-to-peer lending platforms of Book VII – Sanctioning and Procedural Regime of the Compilation of Regulations and Control Norms of the Financial System with Part VI – Sanctions for companies administering peer-to-peer lending platforms.

7. SUBSTITUTE Article 720 of Part VI – Sanctions for companies administering peer-to-peer lending platforms of Book VII – Sanctioning and Procedural Regime of the Compilation of Regulations and Control Norms of the Financial System with the following:

ARTICLE 720 (FINES FOR DELAY AND ERROR IN THE PRESENTATION OF INFORMATION). Companies administering peer-to-peer lending platforms that present information with delay or with errors required by the Central Bank of Uruguay will be sanctioned with fines determined based on what is established in Articles 673 and 674, respectively.

8. COMMUNICATE the resolution via Circular.

JUAN PEDRO CANTERA Superintendent of Financial Services

RR-SSF-2026-557 Date: 31/08/2026 12:19:02 Exp. 2026-50-1-01345 Publishable: Yes - Signatory: JUAN PEDRO CANTERA SENCIÓN CIRCULAR No. 2511