Circular 03/24 — Instruction on the Cybersecurity and Information Security Regulation in the Securities Market

Superintendence of the Securities Market of the Dominican Republic CIRCULAR No. 03/2024 To: The Securities Market Participants indicated in the scope of the Draft Regulation on Cybersecurity and Information Security in the Securities Market. Subject: Instruction on the Regulation on Cybersecurity and Information Security in the Securities Market.

HAVING SEEN:
a. Law No. 249-17, on the Securities Market of the Dominican Republic, which repeals and substitutes Law No. 19-00 of May 8, 2000, promulgated on December 19, 2017 (hereinafter, "Law No. 249-17"). b. Law No. 167-21, on Regulatory Improvement and Simplification of Procedures, dated August 12, 2021.
c. Law No. 107-13, on the Rights of Persons in their Relations with the Administration and Administrative Procedure, dated August 6, 2013.
d. Law No. 200-04, General Law on Free Access to Public Information, dated July 28, 2004. e. Regulation on Integrated Risk Management for Securities Intermediaries. f. Second Resolution dated November 1, 2018, of the Monetary Board, which authorizes the Regulation on Cybersecurity and Information Security. g. Regulation on Cybersecurity and Information Security, approved by the National Securities Market Council through Second Resolution R-CNMV-2024-08-MV, dated July 16, 2024.

CONSIDERING:
a. That Article 17, numeral 14), of Law No. 249-17, empowers the Superintendent of the Securities Market to "issue the resolutions, circulars, and instructions required for the development of this law and its regulations". b. That the Superintendence of the Securities Market, in its capacity as the regulatory body of the Securities Market and in accordance with Article 7 of Law No. 249-17, shall have as its objective to promote an orderly, efficient, and transparent securities market, protect investors, ensure compliance with this law, and mitigate systemic risk, through the regulation and supervision of natural and legal persons operating in the securities market.
c. That the Superintendent of the Securities Market is the highest executive authority of the Superintendence of the Securities Market, having under his/her charge the direction, control, and representation thereof.
d. That it is the criterion of the Superintendence of the Securities Market the standardization of formats and content of documents, which has proven to be effective and has contributed enormously to the good development and good organization of the market. e. That Article 60 of the Regulation on Cybersecurity and Information Security in the Securities Market provides that: "The Superintendent, through technical or operational norms, shall issue the content and other applicable requirements for the elaboration, implementation, and management of the Cybersecurity and Information Security Program of the Securities Market Participants". f. That, for its part, Law No. 167-21, on Regulatory Improvement and Simplification of Procedures, has as its objective to define and articulate public policies directed toward regulatory improvement and the simplification of administrative procedures. g. That, pursuant to the aforementioned Law, public consultation is defined as a mechanism of citizen participation used to transparent the process of production and review of regulations, allowing for the receipt of comments from different stakeholder groups and the general public. h. That, in compliance with the current legal framework, the draft instruction of the Regulation on Cybersecurity and Information Security in the Securities Market was submitted to public consultation from July 20, 2023, to September 22, 2023.
i. That from the consultative process, comments were received from the Dominican Association of Investment Fund Management Companies, Inc. (ADOSAFI), CEVALDOM Central Securities Depository, S.A., BHD Financial Center, SCRiesgo, Risk Rating Society, S.R.L., Securities and Markets of the Dominican Republic, S.A. (BVRD), and Cibao Savings and Loans Association (ACAP).
j. That from said process, a matrix was prepared that collects the observations and comments presented, which were duly analyzed and responded to by the technical team of the Superintendence of the Securities Market; subsequently, as part of the administrative procedure and in attention to the principles of transparency and participation, a working group -in virtual mode- with interested sectors was held on July 3, 2024. k. That as a result of the consultative process, the following improvements were contemplated, namely:

• The wording of the Scope is adapted, in consonance with what is provided in the Regulation on Cybersecurity and Information Security in the Securities Market.
• The minimum requirements to be adopted by issuers, external auditors, and risk rating societies from the cybersecurity governance framework are eliminated.
• The wording of the article on Continuous Monitoring of the capacity of systems and Information Technology Infrastructure is modified.
• "personal computing devices" is changed to "end devices".
• The effective date and the adaptation period are modified.

Therefore:
The Superintendent of the Securities Market, in the exercise of the powers conferred by Article 17, numeral 14) of Law No. 249-17, resolves:

1. To approve the Instruction on the Regulation on Cybersecurity and Information Security in the Securities Market, the text of which is transcribed below:

"INSTRUCTION ON THE REGULATION ON CYBERSECURITY AND INFORMATION SECURITY IN THE SECURITIES MARKET"

Chapter I
General Aspects

Article 1. Objective. This Instruction has as its objective to establish the technical procedures and requirements applicable that will complement the elaboration, implementation, and management of the Cybersecurity and Information Security Program of the Securities Market Participants.

Article 2. Scope. The Securities Market Participants subject to compliance with the Regulation on Cybersecurity and Information Security in the Securities Market (hereinafter, the "Regulation") are subject to the formalities provided in this Instruction.

Chapter II
Content of Policies and Procedures of Securities Market Participants

Article 3. Scheme of policies. The Information Security Management policies of the Securities Market Participants shall refer, at least, to the following scheme:
1) Purpose: must establish why these documents were created and the expected benefit thereof.
2) Scope: must indicate the area within the Securities Market Participant to which the processes and activities established in the document apply.
3) Scope of application: must define its applicability.
4) Development: must describe the content of the policies, procedures, and activities for the control and Risk Management to be carried out by the Securities Market Participant in matters of Cybersecurity and Information Security.
5) Responsibility: must define who will be responsible for the appropriate implementation of the guidelines contained therein.
6) Review and update: must establish the processes and activities to carry out the periodic review and update of the procedures. The frequency of execution of these reviews, the responsible person designated to carry them out, and to whom the results will be reported for decision-making must be specified.

Article 4. Content. Securities Market Participants must elaborate policies and procedures for the management of Cybersecurity and Information Security which will be incorporated into the Cybersecurity and Information Security Program, which must be aligned with their strategy, applicable current regulations, and include, by way of example but not limitation, the following:
1) Awareness, education, and training in Cybersecurity and Information Security;
2) Access Control;
3) Physical and environmental security;
4) End-user oriented topics, such as:
a) Acceptable use of assets in Information Asset Management; b) Clean desk and screen; c) Information Transfer; d) Mobile Devices and telework; and, e) Restrictions on facilities and Software use.
5) Information Backups;
6) Protection against Malicious Software;
7) Technical Vulnerability Management;
8) Cryptographic Controls;
9) Communications Security;
10) Privacy and security of personal data;
11) Supplier Management;
12) Asset Management;
13) Secure program development;
14) Change control of applications and equipment;
15) Business Continuity Plan;
16) Risk Management Policy and Procedures;
17) Incident Management; and,
18) Others that the Securities Market Participants consider should be included.

Paragraph I. Securities Market Participants must have declarations signed by employees, contractors, suppliers, and other persons as applicable, in which they commit to comply with the documented security policies and Procedures.

Paragraph II. Information Asset shall be understood as the tangible or intangible good that stores, processes, and/or transmits information.

Article 5. Education and awareness. In accordance with what is established in Article 11 (Education and awareness) of the Regulation, the Securities Market Participant must have different mechanisms to raise security awareness among employees, service providers, and contractors, among which, at a minimum, the following are cited:
1) Provide awareness and training regarding roles and responsibilities on a regular basis so that employees and external parties understand the importance of controls, Integrity, Confidentiality, security, and privacy of the Securities Market Participant's Information in all its forms;
2) Establish continuous awareness programs on the role of employees in Cybersecurity and Information Security, the correct use of Information Systems and Technological Infrastructure, and the management of their Risks through induction programs, informational capsules, bulletins, talks concerning security, and any other valid notification mechanism;
3) Institute continuous technical training programs directed at employees responsible for Cybersecurity and Information Security;
4) Regularly verify that personnel responsible for Cybersecurity and Information Security have the necessary competencies to fulfill their functions based on their education, training, or experience, and verify that these are maintained with training and certification programs as applicable; and,
5) Provide adequate resources to support the effectiveness of continuous Cybersecurity and Information Security awareness programs.

Paragraph. In addition to the preceding numerals, the company's security officer must carry out simulated campaign exercises directed at employees to improve security procedures.

Article 6. Classification and labeling of Information. The policies and Procedures developed by Securities Market Participants, pursuant to Article 15 (Classification and labeling of Information) of the Regulation, must, at a minimum, contemplate the following:
1) Procedures for the management of physical and digital documents that include the stages of creation or acquisition, classification, storage, modification, and destruction of documents; the control mechanisms for the protection and access of Information according to its level of sensitivity, Confidentiality, and their retention periods, the responsibilities of employees and service providers regarding document management;
2) Communicate to their employees the Information classification schemes;
3) Establish the corresponding mechanisms (headers, footers, digital signatures, physical or digital seals, among others) and labels that identify the classification of each of the Information Assets; and,
4) Take the corresponding measures to prevent sensitive and Confidential Information in physical format from leaving the facilities without authorization from the corresponding organs for such purposes.

Article 7. Identity Management and Access Control Mechanisms. The policies and Procedures for identity management and Access Control Mechanisms that apply to Securities Market Participants for employees, contracted personnel, and third parties who have Access to Information Systems and Technological Infrastructure pursuant to the Framework chosen by the Participant, must include:
1) Documented procedures for the administration and authentication of identities at the institutional level:
a) Identity validation procedures prior to the creation of user accounts; and, b) Identification, authentication, login, and user administration procedures.
2) Documented procedure for the assignment of roles and privileges by user type and component of the Technological Infrastructure must consider:
a) The Cybersecurity and Information Security policy of the entity; b) The Information Asset classification scheme; and, c) The requirements established by the owners of the Information Assets and critical business applications.
3) Documented procedure for Access Control for users to the different components of the Technological Infrastructure of the Securities Market Participant based on the principle of least privilege, which must be implemented in:
a) Information Systems and business applications; b) Data networks and network equipment; c) Database; d) End devices for institutional use; and, e) Any other component of the Technological Infrastructure determined by the entity.
4) Establishment of general guidelines for the assignment and use of privileged accounts in Information Systems and business applications that will regulate the assignment and acceptable use of said accounts in cases that strictly require it after obtaining written authorization from the applicable internal organ, in which it is stipulated:
a) A prior review of privileges by responsible personnel, to confirm that they are applied correctly; b) A record of the real identities of each of the users, as well as the access identifiers and the assigned level of privilege; c) Notification to the user regarding the terms and conditions of the use of privileged accounts; d) In the case of users whose assigned roles require performing special functions such as authorizations and other types of financial transactions, two-factor authentication mechanisms must be implemented for the performance of these functions; and, e) Procedures for the periodic review of assigned privileges.
5) Documented procedures for the management of access authorizations for users considering, at a minimum, the following aspects:
a) Assignment of Access privileges for each user individually; b) Application of the principle of least privilege for the assignment of predefined roles to users; c) Nomenclatures and mechanisms that prevent the use or reassignment of previously used usernames; d) Periodic review to ensure that assigned privileges continue to be appropriate for the adequate performance of the user's functions, including, but not limited to, changes in departmental functions or separation from the Securities Market Participant, among others; e) Authorization for users with global privileged Access in cases that are strictly necessary; and, f) Revocation of Access to any employee and external party as a consequence of the separation from employment, termination of contract or agreement, or internal changes of area or functions.

Paragraph. The Access Control Mechanisms must be based on:
a) Results of the Technological Risk Evaluations of the Securities Market Participant; b) Access Control Requirements; c) Evaluation of the functionality of the Access Control Mechanisms; and, d) The identification of other additional factors related to the manufacturers of the equipment and systems that make up the Technological Infrastructure, as well as their levels of interconnection and interoperability with physical security systems.

Article 8. Continuous Monitoring of the capacity of systems and Information Technology Infrastructure. In addition to what is provided in Article 35 (Continuous Monitoring) of the Regulation, the Continuous Monitoring of Securities Market Participants must, at a minimum, contemplate the following aspects:
1) Continuous monitoring of the technological infrastructure in relation to the performance objectives established in previously defined agreements or goals.
2) Elaboration of demand projections, so that the increase in system capacity can be scheduled prior to the materialization of overloads in the projected data flows.

Article 9. Prevention and detection of intruders. In addition to what is established in Article 36 (Prevention and detection of intruders) of the Regulation, Securities Market Participants must implement the prevention and detection of intruders contemplating, at a minimum, the following aspects:
1) Mechanisms for the prevention and detection of intruders in critical systems and Information Networks for the detection of unusual, unacceptable, and unexpected activities and behaviors in Information Systems, business applications, and other components of the Technological Infrastructure;
2) Documented procedures for the detection and prevention of unauthorized Access by intruders contemplating, at a minimum, the following elements:

SC-07-03-05
Superintendence of the Securities Market of the Dominican Republic

a) Identification of unauthorized activities; b) Analysis of suspicious intrusions; c) Response to different types of attacks; and, d) Procedures for collaboration with those responsible for technological operations.

Article 10. Protection against Malicious Software. Securities Market Participants must have policies and procedures for the detection, prevention, and protection against Malicious Software, which include, by way of example but not limitation, the following:

1) Procedure establishing the prohibition of the use of Unauthorized Software;
2) Implementation of controls that prevent or detect the use of malicious websites;
3) Filtering incoming traffic, such as emails and downloads, to protect against Unsolicited Information (for example, spyware and phishing emails);
4) Use and deployment of automated solutions for the minimization of Risks associated with Malicious Software in the organization, encompassing a cycle of detection, identification, mitigation, and recovery;
5) Documented procedures for protection against Malicious Software that contemplate:
a) Installation, configuration, maintenance, and centralized management of Malicious Software protection systems; b) Periodic review of the effectiveness of Malicious Software protection solutions to verify that they are updated, according to the manufacturer's recommendations for these purposes; and, c) Incident Management related to Malicious Software at multiple levels (high, medium, low).
6) Installation and deployment of systems for protection against Malicious Software on all computing devices, such as servers, end-user devices, and office equipment;
7) Performing periodic analysis and scans of infrastructure components, including the following elements:
a) Firmware (including BIOS and memory); b) Master boot record of hard drives; c) Essential operating system files; d) Protected files (compressed files, password-protected); e) Portable storage media; f) Shared network resources, including file repositories; and,

SC-07-03-05 Edition 2 Page 9 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.-4433 http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

Superintendence of the Securities Market of the Dominican Republic

g) Incoming and outgoing network traffic to the corporate network.

8) Continuous procedure for monitoring servers and end-user devices, in order to ensure that the Malicious Software protection system is not disabled on these devices, is correctly configured, and that updates are applied.

Article 11. Network Management. In addition to what is established in Article 38 (Network Management) of the Regulation, the configuration of network devices and the physical network management of the Securities Market Participant must consider the following:

1) Configuration of network devices: the controls to be considered, by way of example but not limitation, are:
a) Network devices configured according to standard and known practices for the administration of security of such devices and the principles of Cybersecurity and Information Architecture; b) Procedure for segmentation between networks with different security levels; c) Restriction of Access to the configuration console of network devices, located in protected data centers or secure storage rooms; and, d) Adequate security configurations of network devices, according to manufacturer recommendations or internal procedures defined for these purposes.

2) Physical network management: network access points must be protected by Access Control mechanisms, such as:
a) Physical controls for the protection of telecommunications cables and network Access points, including labeling of equipment and cabling, concealment of cabling, use of armored conduits, locking of network points to prevent unauthorized hosts from connecting to the LAN, and the provision of alternative power sources. b) Documentation of the network architecture, contemplating the following:
i. Diagrams of the networks showing all nodes and connections of internal networks for each local environment;
ii. Inventory of communication equipment, critical systems and associated applications, links, and external service providers;
iii. Schematics of telephone exchanges, cabling matrix, and deployed equipment;
iv. Procedure for periodic update and review of the network architecture; and,

SC-07-03-05 Edition 2 Page 10 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

SC-07-03-05
Superintendence of the Securities Market of the Dominican Republic

v. Physical inspections, verifying Network Integrity and any improper or suspicious use, as applicable.

Article 12. Electronic Communications. Electronic communications include Voice over Internet Protocol (VoIP) communication services, whose procedures must, at a minimum, contemplate:

1) Request, approval, and revocation of access to the service;
2) Terms and conditions of use of the services;
3) User registration and authentication mechanisms;
4) Security configurations in accordance with the Framework; and,
5) Definition of specific controls for these services, such as the deployment of monitoring tools, installation of resilience and redundancy components, segregation and encryption of voice traffic from the rest of the network traffic using VLAN, Vulnerability Management scheme, application of patches and Software updates, encryption of voice traffic, event logging, as well as the protection of voice mailboxes against Unauthorized Access.

Article 13. External Provider Management. Securities Market Participants that enter into contractual obligations with external providers of technological products or services must ensure the integration of Cybersecurity and Information Security requirements, taking into consideration the following aspects:

1) Outsourcing: This process must contemplate, by way of example but not limitation, the following aspects:
a) Documented procedures for the management of Risks associated with the hiring of external providers of technological products or services, which must include the following:
i. Identification and evaluation of Critical Information to be shared with external providers. This evaluation process must include the classification of Information that may or may not be shared with external providers according to the Securities Market Participant's privacy policies;
ii. Assistance to the acquisitions units in drafting request for proposal documents for the acquisition of goods and services to ensure the inclusion of Cybersecurity and Information Security requirements;
iii. Selection of reliable providers that comply with the security standards established in the chosen framework;
iv. Review of received technical proposals to ensure compliance with Cybersecurity and Information Security requirements of the Securities Market Participant; and,
v. Assistance to acquisitions committees in contract negotiation processes, incorporating Cybersecurity and Information Security requirements into them.

2) Security requirements for external providers: Among the security requirements that Securities Market Participants must implement are the following:
a) Review the Cybersecurity and Information Security aspects of the critical provider's relationships; b) Validate that the provider maintains sufficient service capacity along with feasible plans designed to ensure that agreed service continuity levels are maintained after major failures or disasters; and, c) Request that the critical provider periodically deliver a report on the effectiveness of controls and agreement on the timely correction of relevant issues raised therein.

3) Acquisition or lease of technological equipment and systems: The process of acquisition or lease of technological equipment and systems must be based on reference guides for the selection and approval of equipment, application, and service providers, as well as anticipate the approved technical security requirements by the Cybersecurity and Information Security functional committee or the corresponding body, ensuring that they provide the required functionality and do not compromise the Cybersecurity and Sensitive Information of the Securities Market Participant during its lifecycle; and,

4) Inclusion of Cybersecurity and Information Security aspects in contracts with service providers, specifying the following:
a) Restrictions on the exchange of Information of the Securities Market Participant with third parties; b) Commitment by providers and subcontractors to comply with the Cybersecurity and Information Security requirements established by the Securities Market Participant and regulatory bodies; c) Requirements for ensuring the continuous protection of Business Information before, during, and after the provision of a service; d) Obligations of each contractual party to implement an agreed set of controls including Access Control, performance evaluation, supervision, reporting, and auditing, as applicable; and, e) Rights to verify the processes and controls of critical providers related to the agreement.

SC-07-03-05 Edition 2 Page 12 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

Superintendence of the Securities Market of the Dominican Republic

Article 14. System Development Management. Securities Market Participants that maintain a system development area in their organizational structure must establish policies and Procedures for system development management, which must contemplate, at a minimum, the following provisions:

1) System development methodology: The system development methodology must consider the following aspects:
a) Documentation of analysis and specification of security requirements:
i. Specification of requirements, including those related to Cybersecurity and Information Security;
ii. Design, coding, and testing of applications based on the Secure System, Application, and Digital Service Development Framework;
iii. Compliance with legal and regulatory requirements, including those related to Information privacy, as well as contractual requirements with third parties; and,
iv. Adherence to internal Cybersecurity and Information Security policies.
b) Documentation of system development requirements, including the following:
i. Use of secure development best practices without compromising project component delivery times;
ii. Conduct vulnerability tests on the source code of applications by employees who are not working on the same development team and who possess the skills and knowledge in the programming language used, as well as in Cybersecurity and Information Security aspects;
iii. Development of performance tests in test environments separate from development and production environments;
iv. Segregation of functions in development, testing, and implementation processes; and,
v. Policy for the review and adjustment of the same in accordance with the emergence of new techniques and practices in development, delivery, and application and digital service architecture design, as well as the emergence of new security techniques and standards.
c) The development methodology must require, at the start of each new project, initial activities including:

SC-07-03-05 Edition 2 Page 13 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

Superintendence of the Securities Market of the Dominican Republic

d) i. Notification to the area responsible for Cybersecurity and Information Security regarding the start of a new project;
ii. Evaluations of the needs for the Confidentiality, Integrity, and availability of Information;
iii. Application of the Securities Market Participant's Information classification schemes in the development of business systems, services, and applications.
e) Training for developers on the application of security techniques in the development of systems, services, and digital applications; f) Use by external software development providers of the development methodology approved by the Securities Market Participant; and, g) Continuous Monitoring of adherence to the defined methodology by development teams in each of its phases.

2) System development environments: System development environments must implement mechanisms to ensure the privacy and protection of personal data in pre-production (quality assurance) and production environments, including:
a) Controls for the protection of source code against Unauthorized Access, modification, and disclosure through the Securities Market Participant's system development environments, as well as the removal of Information, such as: authentication details, developer comments in applications, and sensitive information prior to their deployment in production environments; b) Strict application of version control through configuration management, logging of source code access, and maintenance of a properly documented repository of previous versions; c) Mechanisms to prevent the download and execution of malicious code in development environments; d) Policy for backing up source code copies, when developed by third parties, through digital custody mechanisms; e) Version control through configuration management, logging of source code access, and maintenance of a properly documented repository of previous and experimental versions.

3) Quality Assurance: System development must be carried out following quality standards and tests that ensure that the agreed Cybersecurity and Information Security controls and requirements are implemented during the development lifecycle, which includes:

SC-07-03-05 Edition 2 Page 14 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

SC-07-03-05
Superintendence of the Securities Market of the Dominican Republic

a) Documented quality assurance procedures, contemplating security verification activities during the development lifecycle of systems and applications, which must include the following:
i. Verification of application security requirements according to Risk assessment;
ii. Mechanisms to ensure the correct functioning of developed security controls according to requirements; and,
iii. Mechanisms to ensure the use of the Securities Market Participant's system development methodologies by employees involved in development.
b) Identification and documentation of security defects or failures found in systems, as well as the patches applied, prior to their deployment in production environments; and, c) Documentation of defects and Vulnerabilities found in the Securities Market Participant's systems, applications, and digital services, with the purpose that they be corrected in a timely manner and validated by the system development responsible.

Chapter III
Final Provisions

Article 15. Sanctioning Regime. The provisions established in this Circular are mandatory, and in case of non-compliance, the sanctions provided for in Law No. 249-17 and the Regulation on Sanctioning Administrative Procedure will be applied.

Article 16. Validity. The provisions of this Circular enter into force once the Regulation is in force.

Article 17. Adaptation Period. Securities Market Participants must adapt to the provisions of this Circular within the adaptation period established in the Regulation.

2. Inform Securities Market Participants that the Securities Market Superintendence may request audits in the matter of Cybersecurity and Information Security, through inspection reports, based on any finding or if an event occurs that requires it.

3. Inform Securities Market Participants and the public that the terms defined by Law No. 249-17 and its implementing regulations are incorporated into this Instruction.

SC-07-03-05 Edition 2 Page 15 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3

SC-07-03-05
Superintendence of the Securities Market of the Dominican Republic

4. Instruct the Directorate of Regulation and Innovation of the Securities Market Superintendence to publish this Circular on the institution's website.

In Santo Domingo, National District, capital of the Dominican Republic, on the sixth (06) day of the month of August of the two thousand twenty-four (2024).

Er esto Bournigal Read K
Superintendent

SC-07-03-05 Edition 2 Page 16 of 16
AV. César Nicolás Penson No. 66, Gascue, Santo Domingo. Dominican Republic Telephone: 809.221.4433 | http://www.simv.gob.do | info@simv.gob.do | RNC: J-01-4314372-3