Circular CONAU 1-1659: Minimum Standards on Internal Controls for Financial Entities. Modifications.

"AÑO DE LA DEFENSA DE LA VIDA, LA LIBERTAD Y LA PROPIEDAD" COMUNICACIÓN “A” 8168 20/12/2024 TO FINANCIAL ENTITIES:
Ref.: Circular
CONAU 1-1659:
Minimum Standards on Internal Controls for
Financial Entities. Modifications.
___________________________________________________________________________ We address you to deliver to you the new consolidated text of the standards referenced.
In this regard, it is clarified that adjustments were made to Annexes I to VI.
The aforementioned modifications must be taken into account for the presentation of the annual internal audit planning corresponding to the year 2025.
We greet you attentively.
CENTRAL BANK OF THE ARGENTINE REPUBLIC
Mariana A. Diaz Estela M. del Pino Suárez
Manager of Information Regime
Deputy General Manager of Information Regime and Protection of Users of Financial Services

ANNEX

-Index-

Annex I: General Provisions
Annex II: Methodology for the evaluation of internal control
Annex III: Substantive tests and other procedures
Annex IV: Documentation and Internal Audit Reports
Annex V: Anti-Money Laundering and Counter-Terrorist Financing Cycle
Annex VI: Information Technology and Information Security Cycle

B.C.R.A. CONSOLIDATED TEXT OF THE MINIMUM STANDARDS ON INTERNAL CONTROLS FOR FINANCIAL ENTITIES Version: 4th. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 1

GENERAL PROVISIONS
I.- BASIC CONCEPTS
The definition of internal control –with its fundamental underlying concepts of a process carried out by people, providing reasonable assurance– along with the characterization of the objectives, components, criteria for effectiveness, and associated discussions constitute the basis of these internal control standards. The provisions contained in this regime must also be observed in branches and subsidiaries that consolidate financial statements with the financial entity under the terms provided in the Consolidated Supervision Consolidated Text.

Internal Control:
Internal control is a process carried out by the Board of Directors or equivalent authority, management, and the rest of the members of a financial entity, designed to provide reasonable assurance regarding the achievement of the organization's objectives. It is a continuous process that must be carried out by all levels of the organization in accordance with the size and complexity of the financial entity's activity. The objectives of an entity can be classified into the following categories:

strategic objectives
effectiveness and efficiency of operations.
reliability of information
compliance with applicable laws and regulations.
Strategic objectives are high-level objectives that are aligned with the entity's mission. The mission establishes what the entity aspires to achieve and from this, management sets strategic objectives, formulates plans to achieve them, and establishes the corresponding operational, information, and compliance objectives for the organization. Although the mission and strategic objectives are generally stable, the plans to achieve them and many related objectives are more dynamic and adapt better to changing internal and external conditions. The effectiveness and efficiency of operations are concepts related to the administrative capacity to achieve proposed plans by producing the maximum result with the minimum amount of resources and time. The reliability of information is a concept related to the preparation of trustworthy information, both financial and non-financial, which is needed at all levels of the organization to identify, evaluate, and respond to risks and, on the other hand, to direct the entity and achieve its objectives. Compliance with applicable laws and regulations refers to the compliance with laws and regulations in which entities and, where applicable, the companies of the economic group subject to the Consolidated Supervision Consolidated Text are included.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 1

Internal control is composed of five components that are interrelated and integrated into the management process. Although the components are relevant to all entities, small and medium-sized ones may implement them in a manner appropriate to their size, always with the objective of obtaining effective internal control. The components of internal control are:
a) Internal Environment:
The internal environment constitutes the basis of all other components, providing discipline and structure. The factors of the internal environment include: the entity's risk management philosophy and, where applicable, of the companies of the economic group subject to the Consolidated Supervision Consolidated Text, its risk appetite, the monitoring exercised by Management, the integrity, ethical values, and competence of its personnel, as well as the manner in which management assigns authority and responsibility and organizes and develops its employees. Integrity and commitment to ethical values fostered or instilled from top management, which establishes the organizational culture, affects the behavior of the rest of the organization's personnel. An adequate organizational culture at the highest level contributes to the members of the entity and, where applicable, the companies of the economic group subject to the Consolidated Supervision Consolidated Text doing the right thing, both from a legal and moral point of view. It is important to clearly communicate to each employee what the acceptable and expected behavior is in the organization, in order to foster an environment that reduces the risk of fraud.

b) Risk Assessment:
Every entity faces a variety of risks from external and internal sources that must be evaluated. A prerequisite for risk assessment is the determination of objectives, linked to the different categories mentioned above and linked to each other and to the entity's mission/vision.
Risk assessment must be carried out from a corporate perspective that requires considering risks from an integral perspective and not from an individual unit. Corporate risk management also focuses on risk from its dual perspective of inherent and residual, as well as from its probability of occurrence and its impact. Inherent risk is that inherent to the activity to which an entity is exposed, without taking into account the actions that management might adopt to modify its probability or impact. Residual risk is that which remains after management develops its responses to inherent risks. Risk assessment is applied first to inherent risks and once the response to these risks has been incorporated, management considers the residual risk. The steps for risk assessment involve: establishing objectives, identifying potential internal and external events that could have an impact on achieving them, assessing the risks themselves (using both quantitative and qualitative techniques), and identifying responses to risks, which include: avoiding, accepting, sharing, or reducing risks.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 2

Management, when considering the risk response, must evaluate its effect on the probability and impact of the risk, as well as the costs and benefits, in order to select that which places the residual risk within the desired risk tolerances.
In addition to the high-level risk assessment carried out by management, the person responsible for each process must evaluate the risks of the process under their charge, identify responses to said risks, and report to general management and/or top management about residual risks that could not be mitigated, as well as the probability of occurrence of related events. As part of the risk assessment process and the control activities developed by the entity, internal audit must carry out procedures aimed at identifying and evaluating the internal controls established to prevent and detect signs of fraud, including the risk of transnational bribery.

c) Control Activities
Control activities are the policies and procedures that help ensure that management directives are carried out. This implies that necessary actions are taken to address risks towards achieving the entity's objectives and, where applicable, of the companies of the economic group subject to the Consolidated Supervision Consolidated Text. Control activities are carried out throughout the organization, at all levels and in all functions. They include a diverse range of activities such as approvals, authorizations, verifications, reconciliations, operational performance reviews, asset security, and segregation of duties.

d) Information and Communication
Information systems use data generated internally and from external information sources for risk management and decision-making. Relevant information must be identified, captured, and communicated in a manner and at a time that allows people to fulfill their responsibilities.
Communication is not only inherent to information systems, but must also take place in a broader sense, addressing expectations, the responsibilities of individuals and groups, taking into account the classification and confidentiality of information. In this sense, management generates specific and oriented internal communications that address expectations regarding the behavior and responsibilities of personnel. This includes a clear exposition of the entity's risk management philosophy and approach with a corporate vision and a clear delegation of authority. Communication about processes and procedures must align with the desired culture and reinforce it. There is also a need for communication to the outside world, with open external communication channels. These include communication with stakeholders, regulators, financial analysts, and other third parties that provide the entity with relevant information for its needs. This communication should be meaningful, relevant, and timely and comply with legal and regulatory provisions. Management is responsible for generating the necessary channels for communication to be effective.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 3

e) Monitoring
The internal control system must be monitored. Monitoring is achieved by reviewing the existence and functioning of the internal control components over time, which is carried out through permanent monitoring activities carried out by the persons responsible for each process and independent evaluations by the entity's internal audit. During the normal course of management activities, permanent monitoring takes place, which must cover corporate risks. The scope and frequency of independent evaluations will depend fundamentally on the risk assessment and the effectiveness of the permanent monitoring procedures executed in the financial entity, as well as in the rest of the companies that consolidate information.

Roles and responsibilities of financial entity personnel.
All members of an organization participate in internal control tasks. The Board of Directors or equivalent authority is a critical factor of the internal environment and influences its elements significantly. The integrity of management and its commitment to ethical values influence the style of administration. Their independence, the experience and reputation of their members, their degree of involvement and monitoring of activities, and the adequacy of their actions play a very important role. The organizational structure of an entity and, where applicable, of the companies of the economic group subject to the Consolidated Supervision Consolidated Text provides the framework to plan, execute, control, and monitor its activities. The organizational structure must include the definition of key areas of authority and responsibility and the establishment of adequate reporting lines. In the case of financial entities subject to consolidated supervision standards, it is recommended that they develop activities that allow them to achieve adequate supervision and evaluation of their controlled companies, in order to strengthen internal control and strengthen the risk management scheme of the economic group. Such activities to be developed must be approved by the Board of Directors or Board of Administration of the financial entity that presents consolidated information.

Board of Directors or equivalent authority.
The Board of Directors or equivalent authority is the highest responsible party. It provides and approves internal control procedure standards.
It is the Board of Directors or equivalent authority that must approve and monitor the strategic objectives and corporate values of the financial entity, which must be communicated to the entire organization and is who must create a culture of honesty and integrity in the prevention, deterrence, and detection of fraud by implementing programs and controls to prevent it. Management is responsible for defining individual and corporate risks to be assumed by the entity and their relationship and alignment with previously defined objectives. It is also the Board of Directors or equivalent authority that determines how to respond to risks once they have been evaluated. In considering its response, management evaluates its effect on the probability and impact of the risk, as well as the costs and benefits and selects that which places the residual risk within the desired risk tolerances.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 4

It is also who must establish and enforce clear lines of responsibility and authority throughout the organization.
The assignment of responsibility and authority implies the extent to which individuals and teams are authorized and encouraged to use their initiative to deal with issues and solve problems, as well as the limits of such authority. The Board of Directors or equivalent authority is responsible for ensuring that all personnel understand the objectives of the entity. These concepts go in line with the structure of the organization, which provides the framework to plan, execute, control, and monitor its activities.

General Management or equivalent authority.
General Management or equivalent authority is responsible for implementing the policies, procedures, processes, and controls necessary to manage operations and risks prudently to comply with the strategic objectives set by the governing body and to ensure that it receives relevant, complete, and timely information that allows it to evaluate management and analyze whether the functions delegated to the management line are being effectively fulfilled. Likewise, it is responsible for informing internal audit about new developments, initiatives, projects, products, and operational changes. General Management or equivalent authority must monitor the persons responsible for the different areas in a manner consistent with the policies and procedures established by the governing body. One of the key roles of General Management or equivalent authority is to establish, under the guidance of the governing body, an effective internal control system, becoming the highest operational responsible party and therefore responsible for the implementation, administration, and monitoring of the minimum internal control standards. In addition to implementing an effective internal control system, General Management, or equivalent authority, must issue an annual opinion on its functioning. Such opinion must be issued on the date of closing of the financial statements, and prior to their publication.
Audit Committee.
The Audit Committee will be responsible for assisting, within the framework of its specific functions, the Board of Directors or equivalent authority in the monitoring of: (1) internal controls, individual and corporate risk management, and compliance with standards established by the entity, by the Central Bank of the Argentine Republic, and by current laws, (2) the process of issuing financial statements, (3) the suitability and independence of the External Auditor, (4) the performance of Internal and External Audit, (5) the resolution of observations formulated by Internal and External Audit, the Central Bank of the Argentine Republic, and by other control bodies, through the evaluation and monitoring of deadlines and measures adopted for their regularization. Additionally, it will be responsible for coordinating the internal and external audit functions that interact in the financial entity and, where applicable, the audit functions of the companies of the economic group subject to the Consolidated Supervision Consolidated Text. Likewise, the Board of Directors or Board of Administration of the financial entity that presents consolidated information may define the inclusion of its Highest Internal Audit Responsible, as an integral member of the Audit Committees in other financial entities that make up the Economic Group subject to the Consolidated Supervision Consolidated Text, in order to guarantee that risk and control evaluation is executed under equal quality standards, as well as to provide reasonable assurance regarding the reliability of financial information and the preparation of financial statements in accordance with current professional and legal accounting standards.
Internal Audit.
It will be responsible for the evaluation and monitoring of internal control, including the evaluation of risk management and corporate governance.
The internal audit function must carry out independent examinations of the financial entity's risk management and its internal controls, taking into consideration the Guidelines for Corporate Governance and Risk Management in Financial Entities established by the Central Bank of the Argentine Republic. It must also determine the effectiveness of internal controls since controls must not only be well defined in procedures, but also applied correctly. It is necessary that internal auditors have the necessary training and experience for the evaluation of topics related to the regulatory aspects that financial entities must comply with. In particular, internal audit must have the capacity to evaluate key aspects of comprehensive risk management and of each risk in particular, evaluating, among other topics, the effectiveness, efficiency, and reliability of risk management systems and risk measurement methodologies and economic capital estimation models, liquidity control and regulatory capital sufficiency, and regulatory compliance functions, stress tests, implemented contingency plans, risk measurement methodologies, and any other relevant model used. In the event that a financial entity that presents consolidated information has opted to include its internal auditor as a member of the Audit Committee in other companies that make up the economic group, the aforementioned internal auditor will assume the responsibility of keeping the Audit Committee of the financial entity informed about the results of the evaluation and monitoring that is executed in the company/companies that consolidate economic-financial information.
Other members of the organization.
Internal control concerns all those who are part of the organization and, therefore, must be an explicit part of the job description of everyone. All employees produce information used in the internal control system or take other necessary actions to carry out control. Furthermore, all personnel must be responsible for upwardly communicating problems in operations, non-compliance with the code of conduct (if any), the commission of illegal actions, or other violations of policies set by the entity. The persons responsible for each process established in the entity must be clearly defined. The aforementioned persons must ensure the adequate design of internal controls, will have the effective compliance of said controls under their charge, and will be those who must respond to the results of the evaluation of the effectiveness and efficiency that third parties carry out on said controls.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMUNICACIÓN “A” 8168 Validity:
01/01/2025 Page 6

II.- AUDIT COMMITTEE – COMPOSITION AND FUNCTIONS

Composition

Financial entities must establish an "Audit Committee" composed of at least two members of the Board of Directors or equivalent authority, as applicable, and the head of the entity's Internal Audit department. In the case of financial entities that have chosen to delegate internal audit tasks to independent professionals, the role of head of audit may be exercised by one of the two members of the Board of Directors or equivalent authority who comprise said Committee.

In the case of financial entities within an economic group subject to the Consolidated Supervision Regime, the head of internal audit of the financial entity presenting the consolidated information may be included in the Committee.

In the case of branches of foreign financial entities, two first-level officials designated by the Head Office shall be incorporated into said Committee, in place of the members of the Board of Directors or equivalent authority.

The aforementioned executives shall remain in these functions for a minimum period of two (2) years (provided their term does not expire earlier) and a maximum of six (6) years. Furthermore, the duration of their tenure in said function must not coincide, such that the Committee is always composed of an executive with experience in the matter.

Directors, councilors, or officials designated by the Head Office of foreign financial entities who are members of the Audit Committee assume, with respect to their other peers on the governing body or, where applicable, the highest authority in the country, primary responsibility for any non-compliance with internal control standards that result in sanctions under Article 41 of the Financial Entities Law.

The Audit Committee must implement training programs for its members that enable them to acquire the necessary knowledge to adequately fulfill their functions.

For financial entities falling under Group "A" according to the classification provided in the Consolidated Text on Financial Entity Authorities, and in order to strengthen the independence of the Audit Committees, the composition of these must include, as a minimum, one (1) director or councilor who holds the status of independence with respect to the financial entity, in which case they may remain on the Committee indefinitely. In the case of branches of foreign entities, the Head Office must designate a first-level official as a member of the Committee, without executive functions under their charge, in which case they may remain on the Committee indefinitely.

For the remaining financial entities not included in the aforementioned Group "A", the inclusion of one (1) director or councilor who holds the status of independence with respect to the financial entity is recommended, or, in the case of branches of foreign entities, one (1) first-level official who does not perform executive functions, in which case they may remain on the Committee indefinitely.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 7

Furthermore, it is recommended that the majority of the directors comprising the Audit Committee hold the status of independence with respect to the entity.

Entities must inform the Audit Control Department of the Superintendence of Financial and Foreign Exchange Entities of the Central Bank of the Argentine Republic which or which are the Directors comprising their Audit Committee who hold the status of independence, or, in the case of branches of foreign entities, who are the first-level officials comprising the Committee who do not have executive functions under their charge.

It is recommended that all directors or equivalent authorities comprising the Audit Committee have experience in basic financial and accounting practices, and that one of them holds the status of accounting and/or financial expert. Additionally, the list of Directors comprising the Committee who have experience in basic financial and accounting practices, and the member or members who hold the status of accounting-financial expert, must be reported to the Audit Control Department of the Superintendence of Financial and Foreign Exchange Entities of the Central Bank of the Argentine Republic, including a description of the background for each case.

To consider that a member holds the quality of accounting expert, it is required that they demonstrate possessing:
a) An understanding of:

Current Professional Accounting Standards,
Standards of the Central Bank of the Argentine Republic,
Risks and controls,
Process of generating financial statements, and
Functions of the Audit Committee.
b) Experience in:
The preparation or audit of financial statements
The application of current Professional Accounting Standards and the standards of the Central Bank of the Argentine Republic.

Functions

The Audit Committee must have a bylaws regulating its operation, and must fulfill at least the following functions:

Monitor the proper functioning of the internal control systems defined in the entity through periodic evaluation, and inform themselves about the entity's strategic objectives and main risks, monitoring the application of policies designed by management for risk administration, thereby contributing to the improvement of the effectiveness of internal controls,
Review and approve the annual work program of the entity's internal audit department ("Internal Audit Planning Memorandum" or "Annual Planning"), to be carried out in accordance with this regulation, as well as its degree of compliance,
Review and approve the reports issued by internal audit in accordance with the provisions of these standards,

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 8

Ensure that internal audit has sufficient and adequate resources to perform its obligations and other functions within the entity,
Recommend to the Board of Directors or equivalent authority the candidates to serve as the entity's external auditor, as well as the contracting conditions.

The Audit Committee's opinion regarding the proposal for the designation or removal of external auditors must contain at least:
a) an evaluation of the considered background, and b) the reasons supporting the designation of a public accountant in the position, or those supporting the change to another.

Periodically verify that external auditors carry out their work in accordance with contracted conditions, analyzing their performance and confirming that this satisfies the requirements of the Board of Directors or equivalent authority and the Central Bank of the Argentine Republic,
Analyze and opine, prior to contracting, regarding the different services provided in the entity by external auditors and their relationship with their independence, in accordance with the audit standards established by the FACPCE and any other regulation issued by the authorities responsible for controlling the professional registry. The aforementioned opinion must be formally communicated to the Board of Directors or equivalent authority.
Analyze the reasonableness of fees billed by external auditors, considering that the nature, scope, and timing of planned tasks are appropriate to the entity's risks, separately exposing those corresponding to external audit and other related services intended to provide confidence to third parties, and those corresponding to special services different from those mentioned above,
Take note of the planning of external audit. In the event of comments regarding the nature, scope, and timing of the audit procedures to be performed, the Committee must express them on that occasion,
Monitor the process of preparation and publication of the entity's financial statements, for which it must:
a) Take note of the annual, quarterly financial statements, and the external auditor's reports issued on them, as well as special reports. b) Interact with the external auditor on the following topics:

The treatment to be given to accounting information in accordance with current professional accounting standards and the standards of the Central Bank of the Argentine Republic, evaluated with the General Management.
Any relevant written communication between the external auditor and General Management, such as the management letter or the detail of audit differences not adjusted by the entity.
Any difficulty that arose during the course of the audit, any restriction in the scope of their tasks or access to required information, and any significant disagreement that arose with General Management.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 9

c) Evaluate jointly with General Management and the external auditor:

The financial statements, in order to determine if they reasonably present the economic-financial reality of the entity.
Significant issues revealed and criteria followed regarding the preparation of the entity's financial statements, including any significant change the entity has made regarding the selection or application of accounting principles, any relevant matter regarding the adequacy of the entity's internal controls, as well as any decision adopted regarding significant control deficiencies.
Those legal and regulatory matters that could significantly impact the entity's financial statements.

Provide mechanisms so that reports to be presented by the external and internal auditors of financial entities do not contain limitations in the scope of their tasks and are presented in a timely manner.
Hold meetings with General Management in order to inform themselves about the entity's exposure to identified relevant risks and the actions management has taken to monitor and control such exposure, including the risk management policies adopted by the entity.
Require the external auditor to keep the Audit Committee permanently informed of any relevant facts identified during the course of work that may originate a significant impact on the entity's equity, results, or reputation, or represent a relevant weakness in its internal control structure,
Evaluate observations on internal control weaknesses found during the tasks performed by external and internal auditors, by the Central Bank of the Argentine Republic, and by other control agencies, as well as monitor the corrective actions implemented by General Management, aimed at regularizing or minimizing those weaknesses. The frequency of monitoring corrective actions must be related to the degree of risk of the internal control weaknesses. To this end, it must:
a) evaluate the measures proposed by the responsible areas to address the detected observations, analyzing the reasonableness of the same and the proposed deadline for regularization, avoiding successive rescheduling of committed solution dates. b) keep a record of the entity's internal control weaknesses that contemplates at minimum the date of origin of the observations, the area responsible for solving them, the committed deadline for their solution, and the different stages/states of the solution process for the weaknesses. This record must allow tracking the measures adopted for the regularization of the observations and evaluating the effectiveness of the monitoring process.
Issue an opinion on the effectiveness of the internal control system implemented in the entity and submit to the Board of Directors or equivalent authority, upon the publication of the year-end closing financial statements, a report on the status of said internal control system. For the purpose of obtaining the required opinion, the following must be taken into account:

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 10

a) internal control deficiencies that require improvement, considering in this regard the reports of internal and external auditors and control agencies, b) the implementation of preventive and corrective measures derived from the observations made by internal and external audits and by control agencies c) the opinion on the internal control system issued by General Management through a report requested by the Committee in which it expresses its conclusions regarding the prevailing internal control environment in the entity.

In the case of the Audit Committee of a financial entity that presents information for compliance with the Consolidated Supervision Regime, said Committee must arrange means to have the necessary information to comply with what is requested in the entities and companies that consolidate information.

Take note of the results obtained by the Statutory Audit, Supervisory Council, or Auditing Commission of the entity in the performance of their tasks, as arising from their respective reports, and of the results obtained by the various committees established by the Central Bank of the Argentine Republic and by the entity itself.
Maintain constant communication with the officials of the Superintendence of Financial and Foreign Exchange Entities responsible for controlling the entity in order to know their concerns, the problems detected in inspections conducted in the entity, as well as the monitoring of actions taken for their solution.
Review operations in which there is a conflict of interest with members of the governing bodies or controlling shareholders.

In the case of a financial entity that presents consolidated information, the Audit Committee must arrange means to obtain, from the internal auditors of the other companies forming the economic group, the necessary information that allows it to remain informed of the results of the evaluation and monitoring executed in the company/companies that consolidate economic-financial information.

Proposal for Solution of Observations from the Work of Those Responsible for Verifying Compliance with the Minimum Standards on Internal Controls

In those cases where, as a result of reviews conducted by the Audit Control Department of the Superintendence of Financial and Foreign Exchange Entities of the Central Bank of the Argentine Republic, situations arise that due to their importance require solution in a short period, the aforementioned department may require the Audit Committee to present a "Proposal for Solution of Observations".

The aforementioned proposal must be submitted to the Audit Control Department within 20 calendar days of receipt and must contain a detailed description of all procedures that entities will implement to regularize these observations.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 11

The maximum deadline for carrying out the procedures provided in the "Proposal for Solution of Observations" is 120 calendar days. This deadline is counted from the receipt in the entity of the formal acceptance of the aforementioned proposal by the Audit Control Department.

Upon expiration of the regulatory deadline of 120 days for the solution of observations, the Audit Committee must send to the Audit Control Department a communication with the character of a sworn declaration, stating that it has complied with the solution of the same. Such communication must detail the grounds for compliance with the aforementioned Proposal for Solution of Observations.

Periodicity and Documentation of Meetings

The Audit Committee must meet periodically in order to carry out assigned tasks. In these meetings, in addition to the members of the Committee, officials deemed necessary to address a particular topic will participate. The External Auditor, the Statutory Auditor, or members of the Supervisory Council or Auditing Commission may also intervene, as applicable.

The minimum periodicity of these meetings shall be monthly. The Audit Committee will prepare minutes detailing the topics discussed in each meeting, as well as the points requiring subsequent follow-up. Such minutes will be transcribed in a special internal control book enabled for this purpose and sent to the Board of Directors or equivalent authority, for their knowledge at the first meeting of said body after its submission.

Additionally, in the said special internal control book, the internal control reports of external audits, the internal audit planning memorandum, as well as reports on the internal control surveys and reviews conducted by professionals assigned to this task, must be transcribed. In the case of the latter, an executive summary may be transcribed, which must contain at minimum, a description of the scope of verification procedures performed and a conclusion of the results obtained, including the observations resulting from the verification performed.

Reports issued by internal audit must be kept in the entity for a minimum period of six (6) years, remaining available to its Board of Directors or equivalent authority, and to the Superintendence of Financial and Foreign Exchange Entities of the Central Bank of the Argentine Republic.

The special internal control book may be documented in electronic format, provided that measures have been implemented to guarantee its integrity and unalterability.

III.- INTERNAL AUDIT

Functional Independence

The internal audit activity must be independent, and internal auditors must be objective in the performance of their work.

The purpose and responsibility of internal audit must be formalized in a manual, which must also include a description of the methodologies used to plan, evaluate, monitor, and qualify the entity's internal control.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 12

The Board of Directors or equivalent authority of the entities will appoint the persons responsible for internal audit, with the objective of evaluating internal control through compliance with these minimum standards. The head of this group will integrate the Entity's Audit Committee and will functionally depend on the Board of Directors or equivalent authority. Internal audit must have an approved Code of Ethics by the Board of Directors or equivalent authority, which establishes the conduct parameters of the area members. This Code of Ethics must provide for the obligation of confidentiality. It will be established that members of the internal audit team must keep secret, even after ceasing functions, all information acquired in the performance of their specific activity.

When it does not involve directors or equivalent authorities, in order to promote adequate independence of judgment, this function must be exercised by personnel employed by the entity and independent from the other areas constituting the entity's organizational structure. The entity may delegate internal audit tasks to independent professionals other than the external auditor and the oversight function exercised by the statutory audit or auditing commission, and who are not linked to these nor to their university professional association, but not the responsibility for compliance with these standards, which will be primarily that of the entity's Audit Committee.

When these tasks have been delegated to an independent professional, this person (or the team head when it involves several professionals) must integrate the entity's Audit Committee.

Entities must send – within ten (10) business days following their appointments – to the Superintendence of Financial and Foreign Exchange Entities, the personal data of the members of the Audit Committee and the work background of the head of internal audit, detailing name and surname, document (type and No.), CUIT/CUIL, date and place of birth, professional address, professional email address, position, marital status, period of appointment as a member of the Board of Directors (with start and end dates of the term). Additionally, the Board of Directors' minutes approving their appointment must be attached. Furthermore, they must communicate to said Institution any dismissals or resignations that occur within ten (10) business days of occurrence, indicating the causes that gave rise to such situations.

Any information related to the registration or modification of data must be sent to the Audit Control Department, through the Entry Desk of the Central Bank of the Argentine Republic (Mesa de entrada@bcra.gob.ar), digitized in pdf format.

Non-compliance with the Minimum Standards on Internal Controls makes members of the Audit Committee subject to the sanctions provided by Article 41 of the Financial Entities Law, without prejudice to the responsibility belonging to the Board of Directors or Administration Council or equivalent authorities.

The Superintendence of Financial and Foreign Exchange Entities will periodically verify compliance with the internal control provisions. To this end, it may request the working papers supporting the reports transcribed in the special internal control book, which must be preserved by the entity for a minimum of six (6) years.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
ANNEX I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 13

IV.- DESIGN AND DOCUMENTATION OF CONTROLS

Responsibilities in the design and implementation of controls
Financial entities must develop and document administrative and accounting procedures for the processing and control of the transactions they carry out.
Spanish shall be used in them.
It is especially required that the aforementioned documentation clearly specify the techniques established by the entities to ensure adequate internal control over the transactions carried out and their accounting recording, which must comply with the regulatory provisions of the Central Bank of the Argentine Republic. Likewise, such documentation must contain an organizational chart of the entity, indicating the degrees of responsibility at the official level, regarding the authorization of operations and the corresponding signature records of said officials.
Responsibility of the Board of Directors or equivalent authorities.
The responsibility for ensuring the design, documentation, and implementation of the aforementioned procedures lies with the Board of Directors or equivalent authority, who, taking into account the size of the entity, based on the number of branches it has, the volume, and the complexity of the operations it carries out, will appoint the persons in charge of said task.
Documentation and updating.
The manner in which the documentation will be configured is left to the judgment of the entities, which may be done through narrative manuals, by using flowcharts or process charts, or in any other way that allows the process followed to be clearly appreciated, with special emphasis on the existing controls (monitoring, application, and information technology controls), and the administrative sectors, positions, and roles responsible for each step in the flow and control of transactions. The aforementioned documentation must be kept up to date and may be requested at any time by the Superintendence of Financial and Foreign Exchange Entities.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex I
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 14

METHODOLOGY FOR THE EVALUATION OF INTERNAL CONTROL The evaluation of the internal control processes of financial entities constitutes the most important function of internal audit. For this purpose and as a way to ensure its proper functioning, internal audit must document the planning, surveying, and evaluation tasks of the controls of each of the relevant cycles.

Cycles.
The most relevant cycles in financial entities and that require adequate functioning of internal controls are, in general and by way of example, the following:

Fiduciary activities;
Branch administration;
Various fixed assets and intangibles;
Foreign trade and exchange;
Purchases;
General Accounting;
Personnel costs;
Deposits / Fund Management;
Integral risk management (includes the evaluation of the sufficiency of economic capital);
Corporate Governance;
Investments;
Presentation of accounting and financial information;
Loans (includes evaluation of portfolio provisioning);
Prevention of money laundering and terrorist financing (the procedures listed in Annex V must be complied with);
Subsidiaries;
Information technology and Information Security (the procedures listed in Annex VI must be complied with);
Treasury;
Protection of users of financial services.

Planning Policy
For the development of its task, the entity's internal audit must present to the Audit Committee for approval, before the thirty days following the close of each fiscal year, the annual planning of its activities for the following fiscal year. Said Committee will send the internal audit plan -once approved- to the Board of Directors or equivalent authority, who will take note and resolve on its approval before the start of the audited fiscal year, leaving a record in the Minutes Book of the Board of Directors or equivalent authority. Audit planning must contain references to:

identification of the entity's risks,
risk assessment,
nature, scope, and timing of the procedures to be applied to the cycles and branches,
coordination of tasks with the external auditor,

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 1

the necessary and available resources to fulfill the plan.

2.1 Risk Assessment
As part of planning, internal audit must document, using the methodology it deems most appropriate, the risk assessment to be carried out for each existing cycle in the entity, as described in point I.1.b) of Annex I.
The evaluation methodology must be approved by the Audit Committee prior to its use.

2.2 Definition of relevant cycles and branches
Based on the assessment in the previous point, a preliminary conclusion must be reached regarding the risk level of the entity's cycles and branches, determining their relevance and, based on this, the procedures to be applied and the frequency of review of said cycles.
Taking into account the annual nature of task planning, internal audit must evaluate the increase in the frequency of review of the cycles based on the risk level assigned to them.

2.3 Nature and scope of procedures to be applied
Once the relevance and frequency of review of the entity's cycles and branches have been determined, the procedures to be applied must be indicated:

Survey or update of the previous survey
Control tests (design and operating effectiveness)
Continuous audit procedures
Substantive tests and other procedures (as established in Annex III)
Continuous audit procedures aim to permanently examine the entity's risks and controls through dynamic indicators, allowing for the early detection of alerts regarding potential errors and irregularities. This systematic process, carried out through technological means, must be documented and considered in the rating of the corresponding cycles. Likewise, it is necessary to leave evidence of the impact of the results obtained through continuous audit on the frequency and scope of the evaluations to be carried out for the cycles and branches. The aforementioned technological means may include the use of advanced big data analysis techniques, automation of repetitive tasks (bots), and the use of predictive analysis, among others.

2.4 Coordination of tasks with the external auditor
For the coordination of tasks with the external auditor, the risks involved and the nature of the procedures to be applied must be taken into consideration.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 2

2.5 Necessary and available resources to fulfill the plan
Planning must include an analysis of the necessary and available resources to comply with the annual plan.

Evaluation of internal control
The evaluation of the internal control of the entity's cycles must be documented with the frequency resulting from the risk assessment carried out, whether from its initial survey or from successive updates.
Both the survey and the identification, evaluation, and testing of controls can be documented through narratives, flowcharts, process charts, matrices, questionnaires, or any other form that allows the process followed and the existing controls to be clearly appreciated.
Such documentation must be prepared with sufficient detail to allow understanding of the purpose followed, origin, and conclusions obtained. It must contain, for each activity of each cycle of the entity, a conclusion on the compliance with the defined control objectives and, if applicable, its effect on the control structure. These conclusions will be reported in a cycle-by-cycle report submitted to the Audit Committee.

3.1 Control objectives
There are six control objectives that provide a structure upon which control policies and procedures can be built and provide reasonable assurance of achieving the objectives of effectiveness and efficiency of operations, reliability of information, and compliance with applicable laws and regulations. They are:

Authorization.
Means that transactions have been approved and are carried out with the concurrence of a third party.
Accuracy and timeliness of entry.
Means the correct and timely entry of the transaction into the system, i.e., that it represents the amounts paid or received, the client with whom the operation was conducted, the type of transaction, and the correct amount.
Integrity of entry.
Ensuring that all transactions are entered into the system only once. This means that there are no transactions unentered or entered more than once. Together with the first two objectives (authorization and accuracy), they cover the initiation of the transaction.
Integrity and accuracy of updates.
This objective follows the initiation of the transaction. It addresses the requirement that each entered transaction is recorded completely and accurately in a file that is part of the entity's accounting records, such as the general ledger or the journal or sub-journal.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 3

Integrity and accuracy of accumulated data.
This objective follows the update of information. It ensures that the updated information remains in the file until it is correctly removed from it.
Restricted access.
To assets and to the records that represent those assets. This addresses both the confidentiality of information files, their unauthorized changes, and the physical safeguarding of assets.
These objectives apply both with respect to the transaction (authorization, accuracy, and integrity) and with respect to the cycle itself (integrity and accuracy of updates, of accumulated data, and restricted access).

3.2 Survey of the cycles.
The surveys must clearly contain the transaction flow and the system environment in which the transactions operate, identifying the existing risks for each of the six control objectives mentioned above and the controls implemented by the entity.
For adequate analysis and documentation of the internal control structure of entities, the following stages and aspects of survey and evaluation must be met, at a minimum, with respect to each cycle:

3.2.1 Accounting system.
The accounting system constitutes an important part of the internal control structure. It comprises the procedures established to identify, accumulate, classify, analyze, and record transactions and the reports issued by the system.
As part of the control structure analysis, it is necessary to survey and understand the accounting system. The objectives of this survey are:

to know the accounting records, significant transactions, and the flow of information through the system;
to help understand the entity's business,
to help identify inherent characteristic risks, know the control procedures, and consider their implications in the control structure;
to develop effective tests on the accounting system;
to verify compliance with information obligations, including reports required by regulatory bodies;
to identify major deficiencies in the accounting system or its controls that must be reported to Management or the Board of Directors or equivalent authority.
The survey of the accounting system must be adequately documented. The degree of detail and the methodology used will depend on the needs of each entity.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 4

3.2.2 Monitoring controls.
They constitute a part of the internal control structure and correspond to the use made by management of the information generated by the system. Monitoring controls performed by the managerial level of entities only aim to detect a significant problem or error and not its cause. They may indicate that one or more control objectives have not been met, but they cannot determine which one and therefore cannot determine the origin of the problem. From these controls arises the need to investigate errors, which is the most important aspect of this type of control. These controls include not only the financial function of the entities but also the information technology function. Monitoring controls must be documented, at a minimum, for all significant applications and their corresponding computer control structure. Internal audit must consider the consequences that observed deficiencies or lack of monitoring controls have on the objectives of the internal control system as a whole.

3.2.3 Application controls.
They constitute a part of the internal control structure and correspond to controls on the initiation of transactions and on the cycle itself, i.e., to the controls that ensure management authorization, accuracy, and integrity in the entry of transactions of each cycle, the integrity and accuracy in the update of files and records, and in the maintenance of accumulated data and restricted access to information, to information files, and to physical assets. The inadequate fulfillment of a control objective in the cycle allows determining the origin of problems or potential problems. Therefore, the adequate documentation of this type of control is fundamental for each of the relevant cycles of the entities. To document application controls, a uniform elaboration process must be used consisting of:

focusing on the control objective and its related businesses,
obtaining knowledge of how the objective is achieved, identifying manual and automatic controls:
identifying any unfulfilled objective;
determining the consequences that unfulfilled objectives have on the internal control structure.
determining the consequences that unfulfilled objectives have on the internal control structure
Once the first aspect is documented, special attention must be paid to the fulfillment of the second, as it corresponds to the description of the control activities or procedures (manual and automatic) carried out by the entity to fulfill the defined objective.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 5

Once the control activities have been identified and documented -second aspect- internal audit must complete tests to determine if the controls are appropriately designed and operating.
For each control activity identified within each cycle, internal audit must document whether the established objective is met or not, either because the control procedures have not been adequately designed or are not effective (see control tests). For those unfulfilled objectives, internal audit must consider the effect thereof on the internal control structure of the cycle and of the entity. If there are no unfulfilled objectives, this must be explicitly stated.

3.2.4 Information technology controls.
They comprise the environment in which the entity's applications are processed and their consequences on the internal control structure. Likewise, they include the need to ensure that application systems operate constantly according to what was designed by Management or that their changes have been authorized, that information is processed systematically (i.e., in a predetermined order and manner, which must be documented) and that information is restricted to persons who genuinely need to access it.

3.3 Control testing.
The identification of existing control activities for each cycle is not sufficient for an adequate evaluation of the entity's internal control system. For this purpose, it is necessary to evaluate whether these activities have been adequately designed to fulfill their purposes and if they function adequately, according to their design. This evaluation must be carried out based on the following types of tests:

3.3.1 Design tests.
Design effectiveness tests of a control activity correspond to the evaluation of whether the activity is adequately designed to fulfill the defined controls and, if its adequate functioning allows avoiding or detecting errors in accounting and financial information. The test procedures will vary depending on the specific control activity, the documentation of the control activity, and the complexity of the entity's operations.

3.3.2 Operating tests.
Operating effectiveness tests refer to the manner in which the control activity is applied, the consistency with which it is applied, and who applies it throughout the entire period.
Test procedures include conducting inquiries, inspecting documentation, and observing activities and operations.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex II
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 6

SUBSTANTIVE TESTS AND OTHER PROCEDURES

Substantive tests
Internal audit of financial entities must apply sufficient substantive procedures to ensure (a) the existence, ownership, and integrity of accounting records, (b) their adequate valuation according to accounting standards established by the Central Bank of the Argentine Republic, and (c) the adequate compliance with the technical, monetary, exchange, and legal regulations established by the Central Bank of the Argentine Republic. The nature and scope of substantive procedures will be determined by the internal auditor according to their judgment, risk assessment, and the parameters determined in the planning stage. Among the substantive procedures that may be applied, the following may be mentioned:

Cash and/or securities counts that support the balances of operations (cash on hand, securities to be deposited or of third parties, loan documents, holdings of public and/or private securities, received guarantees, agreed requests, etc.).
Compilation of debtor inventories for loan operations or other credits, creditors for deposits and other obligations, other financings, contingent obligations, and third-party securities in custody. Comparison of said lists with accounting records and verification of a sample of operations with the respective supporting documentation.
Requests for confirmation of balances of debtors for loans and other credits and creditors for deposits and/or other obligations and of other operations that justify it, specifying the number of clients, amounts involved, and responses received -concordant, with differences, and unanswered, with indication, in these last two cases, of the alternative procedures applied.
Verification of balances corresponding to "Collections and other operations on behalf of third parties" and "Uncollected amounts", by visualizing their supporting documentation and their cancellations within reasonable timeframes.
Verification of reconciliations with local and foreign correspondent banks, analyzing, if applicable, pending items with supporting documentation and their subsequent regularization within reasonable timeframes.
Verification of balances of items pending allocation, analyzing the original supporting documentation, their cancellation within reasonable timeframes, and their correct accounting registration destination.
Participation in the realization of physical inventories of fixed assets and various items.
Review of the documentation presented to the Central Bank of the Argentine Republic for the compliance with technical relations and monetary regulations, as well as the established information regime, including notes to the financial statements.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex III
Version: 3rd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 1

This review will include, among others, the following regulations: minimum capital, minimum cash, fixed assets and other items, fragmentation of credit risk, financing to related clients and credit grading.

Review of the most significant income statement accounts, by applying global tests, reprocessing and/or visualization of the documentation supporting the operations that originated them.
Verification that the balance sheet balances of the sector or branch, subsidiary and/or subsidiary subject to review coincide with that considered in the consolidated balance sheet of the entity.

Other procedures

Regardless of the risk analysis carried out by the internal auditor, the following procedures must be completed:

Review of the controls applied by the entity regarding the disqualifications provided for in art. 10 of the Financial Entities Law, with respect to each designated official.
Verification of the reasonableness of the information contained in the Information Regime on Bounced Checks.
Verification of the reasonableness of the information contained in the Monthly Accounting Information Regime – Debtors of the Financial System Partial Rectifications, based on the analysis of the documentation supporting the modifications and/or suppressions entered into the records of the debtors duly reported to the Central Bank of the Argentine Republic.
Verification of the control and monitoring carried out by the entity on the decentralization of administrative or non-operational activities carried out in third-party premises, with respect to compliance by the entity with the same normative and regulatory conditions required for centralized activities, as well as the verification of the existence of an outsourcing contract that includes the acceptance and compliance with said conditions by all parties involved.
Review of the internal control procedures implemented for the estimation of Expected Credit Losses (ECL). To this end, a general evaluation of the ECL estimation model defined by the entity must be carried out, verifying that it is the one effectively implemented, validating any subsequent adjustment made to it, verifying the integrity and reasonableness of the parameters and historical and prospective information used.
Verification of compliance with the minimum security measures in Financial Entities established by the B.C.R.A., which must, among other procedures, verify that the persons responsible for physical security take note of the results of the inspections reported through the application "Security Measures Upload" available at the site https://www4.bcra.gob.ar/Acua.Extranet, as well as the treatment provided by the entity and the resolution of the same.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex III
Version: 4th. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 2

Any verification procedure that may be specifically required by the Central Bank of the Argentine Republic, on a one-off basis or with the frequency that it determines.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex III
Version: 1st. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 3

AUDIT DOCUMENTATION AND REPORTS

Audit Documentation.
A record of the audit procedures applied must be maintained, which includes all the information that supports the evidence of the work performed. This information may be kept in physical or digitized files and must be kept protected against risks of destruction or unwanted access, using a system that guarantees the verification of its integrity and immutability. The documentation of the internal audit procedures must provide a clear understanding of their purpose, source and conclusions reached and constitute the evidence supporting the audit reports, in such a way as to allow supervision by the Superintendence of Financial and Exchange Entities.
Availability of audit documentation.
All audit documentation, minutes prepared as a result of the Audit Committee meetings and reports issued by internal audit must be made available to the Superintendence of Financial and Exchange Entities when requested. Audit procedures whose documentation is not made available in a timely manner will be considered as not performed.

Within the framework of the function of evaluating the work of internal audits, it is at the discretion of the Superintendence of Financial and Exchange Entities to establish the mode of review (in-person, remote or a combination of both).

Internal audit must seek the necessary mechanisms to generate and deliver the required documentation in an electronic format that allows, among other things, the option of downloading all the files that make up the audit evidence, in the manner that the Superintendence of Financial and Exchange Entities establishes in each case to ensure confidentiality, availability, integrity and immutability of the information in the evaluation process.

Internal audit reports.
As a result of the work carried out to evaluate internal control, internal audit will prepare reports according to the modalities deemed appropriate and which, therefore, may reflect partial aspects of the control task.

The reports must contain a description of the scope of the tasks performed, the deficiencies observed, their effects on the entity's control structure or accounting information, if applicable, as well as recommendations to remedy them.

These reports must include the rating assigned by internal audit to the internal control evaluation carried out, which must be determined according to the methodology described in the manual referred to in Annex I point III.

A final report must be issued for each relevant cycle evaluated, which considers the results of the reports issued as a consequence of the control tasks linked to it.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex IV
Version: 4th. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 1

A final report must be issued for each relevant cycle evaluated, which considers the results of the reports issued as a consequence of the control tasks linked to it.

The same may be kept in the internal audit area in the manner that each entity decides, either on magnetic or physical media, as long as they are immediately available when requested and have some filing system that guarantees the verification of their integrity and immutability.

The person responsible for the entity's internal audit must send the reports issued to the Audit Committee so that said body takes note of them. The aforementioned taking of knowledge must take place at the first meeting of the Audit Committee, after the issuance of the report.

At that time, the Audit Committee must approve what was discussed and submit to the Board of Directors, Board of Administration or equivalent authority the minutes formalizing its meeting, along with recommendations aimed at solving the internal control deficiencies that may have been observed.

The Board of Directors, Board of Administration or equivalent authority must take formal note of said minutes of the Audit Committee meeting and record in its minutes at its first meeting after the submission and resolve on each of the recommendations cited in the previous paragraph.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex IV
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 2

ANTI-MONEY LAUNDERING AND TERRORISM FINANCING PREVENTION CYCLE

The internal audit of financial entities must evaluate the anti-money laundering and terrorism financing prevention system implemented by the entity, which must contain all the policies, procedures and controls established for the management of money laundering and terrorism financing risks to which it is exposed, also considering the aspects that concern its subsidiaries and affiliates that consolidate financial statements with the financial entity in the terms provided for in the TO on Consolidated Supervision, within the framework of the risk assessment carried out for such purposes.

To this end, it must carry out, at a minimum, surveys and design tests of the aforementioned controls implemented by the entity, and tests of compliance with such controls, which must be directed to the verification and evaluation of their conformity with what is provided by the regulations in force at each moment established by the Financial Information Unit (UIF), the Central Bank of the Argentine Republic and other regulatory bodies in matters of:

a) Anti-money laundering, terrorism financing and other illicit activities prevention system, including all policies, procedures and controls established for the management of money laundering and terrorism financing risks to which financial entities are exposed;

b) Due diligence. Customer identification and knowledge policy;

c) Transaction monitoring, analysis and reporting, and;

d) Information regimes.

The tasks must contemplate, within the framework of the risk assessment mentioned in the first paragraph, the verification of the aspects mentioned in point 5.2.3. of the TO on Consolidated Supervision, in relation to internal control procedures on "Anti-Money Laundering and Other Illicit Activities Prevention" and "Terrorism Financing Prevention", which financial entities must follow regarding the subsidiaries and affiliates included.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex V
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 1

TECHNOLOGY AND INFORMATION SECURITY CYCLE

To evaluate the Technology and Information Security cycle, internal audit must survey the entity's technological infrastructure in order to understand and identify the processing technological platform, the telecommunications infrastructure, the information systems and applications that support the business, the level of exposure to risk of these and the consequences on the internal control structure. It must maintain adequate documentation on the tasks carried out in order to evaluate the aforementioned infrastructure.

The level of risk exposure determined by internal audit must be in line with the results of the Technology and Information Security Risk Management that the entity has determined.

To this effect, the evaluation of the technological infrastructure with all its components and the functioning of the internal controls linked to technology and information security must comprise and observe the application of the aspects included in the Minimum Requirements for the Management and Control of Technology and Information Security Risks, as well as those associated with digital financial services, as established by the regulations of the Central Bank of the Argentine Republic in force at each moment.

Without prejudice to the fact that the internal audit work must be carried out in accordance with the regulations in force in the matter at the time of the respective audit, the following aspects to be considered in the aforementioned evaluation, included in the currently valid regulations, are highlighted, by way of example:

Technology and information security governance.
Technology and information security risk management.
Information technology management.
Information security management.
Business continuity management.
Technological infrastructure and processing.
Cyber incident management.
Development, acquisition and maintenance of "software".
Third-party relationship management.
Digital financial services:
Risk management of services provided by digital means.
Protection of services provided by digital means.
Detection and monitoring.
Information systems and applications.

The procedures carried out by internal audit to verify the design and/or functioning of the controls related to the control areas mentioned above will maintain the following scheme, considering the maturity level of such controls:

application of minimum audit procedures to be carried out at the time of the cycle review for each exercise. The design of the control will be evaluated (first review or when it has changes) and its functioning, when applicable.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 1

application of a risk-based approach that considers the criticality and relevance of the normative requirements not included in the previous item. The result of the technology and information security risk assessment and the effectiveness of the related internal controls must be considered.

Minimum audit procedures to be applied at the time of the cycle review for each exercise:

Technology and information security governance Evaluate the technology and information security governance framework established by the entity. Verify that it considers the objectives provided for in the normative requirement.
Verify the formal assignment of roles and responsibilities for the Board of Directors, Senior Management, Technology and Information Security Areas, and the Technology and Information Security Governance Committee.
Evaluate controls related to Segregation of Duties.

Technology and information security risk management Verify the existence of an area or function of risk management related to technology and information security, which presents an adequate functional dependency, forming part of the unit responsible for operational risk management and being independent of the areas that originate the risks, the business lines and internal audit. Evaluate the technology and information security risk management framework considering that the responsibilities and considerations defined in the normative requirement are established, and issue an opinion on the alignment between this management framework and the policies and practices established for comprehensive risk management. Evaluate the results of risk management related to technology and information security.

Information technology management
Evaluate the information technology strategy and issue an opinion on the alignment between it and the results of information technology management and the business and security requirements, considering the results of risk management and the objectives of the security strategy.
Verify that the entity has established an enterprise architecture model, which responds to the characteristics of this in terms of its operations, processes and structure and that allows it to coordinate the data strategy, technology and application architecture with business processes.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 2

Evaluate the project management framework. When evaluating the functioning of these controls, strategic and most relevant projects for the entity must be considered. Follow-up of these projects must be carried out, leaving formal evidence of the procedures applied.
Evaluate the process defined for data management and issue an opinion on the alignment between it and the business strategy, enterprise architecture and information security management framework.
Evaluate the normative framework defined by the entity for the classification of data and information.
Evaluate the processes established for the management of information assets and for the classification of information assets in accordance with data classification.
Evaluate the control process on the management of information technology areas and the considerations related to management reports.

Information security management
Evaluate the information security management framework with the current normative considerations. Verify that the information security strategy is aligned with the business strategy and is consistent with the entity's operations, processes and structure. Evaluate norms and procedures that make up the normative framework to manage, control and document the activities of the processes for information security management. Evaluate the control process on the management of information security areas and the considerations related to management reports.

Regarding access control and privilege management, evaluate the management process that allows requesting, approving, assigning, modifying, monitoring and revoking access rights to information assets. Evaluate the implementation of measures that allow maintaining control over privileged and service accounts, as well as to maintain control over assigned rights. Also verify the implementation of mechanisms to ensure that the activities of all accounts are identified and registered uniquely, and provide sufficient information for audit and investigation purposes.

Likewise, the following requirements must be evaluated:

Access control measures. Verify that security directives define the methods used for authentication. Validate the effectiveness of the procedures generated to support user access models, which contemplate authentication factors, behavior in the use of services and different sources of information that allow validating their identity.
Authentication methods. Verify that the results of risk analyses and compliance with access control policies and procedures are considered. Verify that authentication factors, validation and the channel used are considered.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 3

General requirements for authentication factors. Verify that the minimum controls established are applied.
General requirements for multifactor authentication. Evaluate its use for access to information assets considering that it responds to their classification, and to threat and vulnerability management.
Information controls. Verify the implementation of measures that allow detecting and preventing unauthorized access, modification, copying or transmission of information. Likewise, evaluate the adequate implementation of controls that identify unauthorized transfer or processing of information classified as confidential or critical.

Regarding the detection, monitoring and analysis of events, evaluate the process established for the registration and analysis of information related to security events of systems, networks and technological infrastructure.

Regarding threat and vulnerability management, evaluate the process established to collect, process, analyze and interpret information referring to threats through proactive and reactive methods, which provides information for decision-making linked to cyber incident management. Likewise, evaluate the vulnerability management process established for all systems and applications, own or third-party, corroborate that it is consistent with risk management and linked to incident management.

Business continuity management
Evaluate the business continuity management framework. Verify the designation of an area, sector or person responsible for coordinating activities linked to business continuity management, as well as the roles and responsibilities linked.

Regarding cyber resilience in business continuity, verify that proactive measures are established in the design of operations and processes in order to mitigate the risk of disruptive events and maintain confidentiality, integrity and availability.
Evaluate the process to prepare the business impact analysis (BIA) involving all areas of the entity and allowing to define recovery needs and priorities.

Regarding risk and scenario assessment, verify that periodic assessments of disruptive scenario risks are carried out.
Evaluate business continuity strategies and corroborate that they address identified threat scenarios and business processes.
Verify that business continuity plans respond to the defined strategies and allow operations to continue during the service restoration period of the affected service.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 4

Regarding crisis management and communication strategies, evaluate the designation of responsible parties, the development of crisis management plans, and the procedures defined for this purpose.

Evaluate the plan for exercises and tests of the business continuity plans defined by the entity. Verify that at least one of the highest criticality scenarios is contemplated. Evaluate the results of the tests. Verify that a detailed record of the results of each exercise, the observations and problems detected, and the action plans defined for their correction is maintained.

Technological Infrastructure and Processing

Regarding the Management of technological infrastructure, evaluate the structures, processes, and procedures defined by the entity to carry out management activities for updates and configurations, the implementation of changes, the monitoring of infrastructure, the operation of systems, and the management of communications. Furthermore, the process established for the management of the registration and response to technology service demands must be verified.

Evaluate the Change Management process. Verify that it allows for the registration, evaluation, planning, review, approval, and communication of changes to information assets before implementation in production environments.

Regarding the Update of technological infrastructure, evaluate the process for managing technological infrastructure updates, in accordance with the defined enterprise architecture. Evaluate the process for managing configurations. Evaluate the process for managing security updates.

Evaluate the process for managing communications.

Regarding Data Processing, evaluate the management, execution, monitoring, and control processes for technology operations.

Cyber Incident Management

Evaluate the cyber incident management framework and verify that it is aligned with the ordered texts on "Guidelines for Response and Recovery to Cyber Incidents" and "Protection of Users of Financial Services." Evaluate the policies for cyber incident management.

Regarding the preparation for response to cyber incidents, evaluate the norms and procedures established to manage, control, and document cyber incident management activities; contain the impact and restore capabilities and services, and prevent new incidents and investigate causes.

Evaluate the cyber incident registry and repository. Verify that the entity has established and maintains a complete registry of its cyber incidents that allows for the identification, traceability, and evidence of actions taken until closure. Evaluate the implementation of a registry tracking activities.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 5

Evaluate the test plan for the activities foreseen for the response to cyber incidents.

Evaluate the control and reporting process on cyber incident management, considering procedures, tools, and metrics.

Development, Acquisition, and Maintenance of “Software”

Evaluate the Requirements for systems and applications, considering the verification of the following aspects:

Automated controls defined in current regulations.
Controls for the unique identification of the client and the registration of mandatory data. Furthermore, evaluate that periodic control and cleansing processes are carried out.
Authorization schemes in accordance with the access control policy for the entry, modification, and deletion of operations and parameters.
Functionality for user and profile management, and the assignment of permissions on system functions.
Functions that allow exercising control over the assignment of profiles in accordance with the roles and functions established by the entity.
Audit logs that ensure the traceability of each action performed.
Updated functional, technical, and user documentation of information systems.

Evaluate the requirements for generating information regimes. Verify the automated systems or processes for generating the information regimes required by the BCRA.

Management of Third-Party Relationships

Evaluate the general conditions for the delegation of processes, services, and/or activities linked to technology and information security processes, and verify the establishment of a sector or function responsible for managing third-party relationships, based on the entity's operations, processes, and structure.

Evaluate the policy and framework for managing processes, services, and/or activities delegated to third parties.

Regarding the formalization of the relationship, evaluate that the entity formalizes relationships with third parties providing delegated processes, services, and/or activities in accordance with established procedures. For this purpose, the functioning of this control applied to those services, processes, and/or activities delegated that internal audit determines to be of high criticality or relevant to the business will be evaluated, based on the results of technology and information security risk management applied to this type of asset.

Regarding the control and monitoring aspects of these activities, evaluate the control process that allows for the follow-up and evaluation of technology and information security processes, services, and activities delegated to third parties.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 2nd. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 6

Evaluate the procedures for executing controls on third parties, the evaluation of compliance with regulatory requirements and agreed service levels, and the follow-up of compliance requests, in case of non-compliance. Verify compliance with regulatory requirements linked to reports from independent third parties, as well as internal and external audit reports.

Information Systems and Applications.

To evaluate information systems and applications, procedures must be applied that validate the functioning of the controls indicated in “Requirements for Systems and Applications – Software Development, Acquisition, and Maintenance” for cases where internal audit identifies them as high criticality or relevant to business cycles. In particular, controls regarding interfaces, access profiles, audit logs, and technical and user documentation must be evaluated.

The design of the aforementioned controls must be evaluated as established in the “Software Development, Acquisition, and Maintenance” section of the current communication.

Digital Financial Services:

Risk Management of services provided via digital means.

Verify risk analyses linked to the provision of services via digital means and that they are in accordance with what is established in the TO on Minimum Requirements for the Management and Control of Technology and Information Security Risks.

Protection of services provided via digital means.

Regarding the guidelines to consider in digital financial transactions, verify that digital services are duly identified and documented, as well as their functionality. Furthermore, verify that controls for transactions have been designed and implemented in accordance with the results of risk management and threat and vulnerability management. Verify that this control framework considers at least the following criteria:

The client must be identified and authenticated to perform any type of transaction.
Implement multi-factor authentication techniques in accordance with risk levels, the result of transactional monitoring, and/or when exceeding thresholds established by the organization.

Furthermore, the application of controls on the confirmation of critical and non-critical actions, and on services based on telephone attention or messaging platforms, must be evaluated.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 1st. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 7

Regarding controls on devices and applications provided by the organization, evaluate the implementation of controls related to the following aspects:

Applications provided by the organization.
Devices provided by the organization.
Protection of audit logs.
Physical controls on provided devices.
Controls in the maintenance, configuration, opening, loading, and balancing of provided devices.
Transaction receipt.

Regarding aspects linked to the digital identification of clients, evaluate the processes that allow corroborating the unique correspondence of the required data or elements with the data of the human person to be identified, in cases where digital and non-face-to-face identification is admitted. Consider controls for the process of uncompleted registration.

Regarding access control, evaluate the requirements established for authentication factors. Verify the implementation of controls related to the following aspects:

Memorized secret.
Out-of-band authentication.
One-time passwords (OTP).
Payment cards (debit, credit, or prepaid) and physical authentication elements.
Replacement of provided authentication factors.
Authentication factors retained or not delivered to the client.
Authentication factors based on cards with integrated circuits (chip).
Authentication factors based on cards with magnetic stripe.

Evaluate the regulatory requirements indicated for the elaboration of specific training and awareness plans for digital financial services, in accordance with what is established in “Training and Awareness Programs” of the TO on Minimum Requirements for the Management and Control of Technology and Information Security Risks.”

Evaluate the requirements indicated to provide communication channels to clients.

Detection and Monitoring.

Regarding aspects related to the detection and analysis of events, evaluate the process for registering and analyzing information linked to security events of systems, networks, and the technological infrastructure supporting digital financial services, in accordance with what is established in the point “Security Operations” of the TO on Minimum Requirements for the Management and Control of Technology and Information Security Risks. Verify that the systems and applications supporting digital financial services generate audit logs that ensure the traceability of each action performed, in accordance with what is established in the point “Requirements for Systems and Applications” of the TO on Minimum Requirements for the Management and Control of Technology and Information Security Risks.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 1st. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 8

Regarding the monitoring of customer activity and transactions, evaluate the monitoring strategy that allows detecting unusual activities or suspicious transactions from customers in digital financial services, in accordance with what is established in “Guidelines to Consider in Digital Financial Transactions.”

Additionally, in those entities that carry out activities related to Information Technology and/or Information Systems in a decentralized and/or outsourced manner, the effective compliance with current regulatory provisions on the expansion of Financial Entities regarding the decentralization and outsourcing of activities must be evaluated.

B.C.R.A.
MINIMUM STANDARDS ON INTERNAL CONTROLS
FOR FINANCIAL ENTITIES
Annex VI
Version: 1st. COMMUNICATION “A” 8168 Validity:
01/01/2025 Page 9

Circular CONAU 1-1659: Minimum Standards on Internal Controls for Financial Entities. Modifications.

Similar documents from other regulators