Lima, 25 January 2017

CIRCULAR No. G- 191 -2017

-------------------------------------------------------- Ref.: Criteria for the registration of operational risk loss events

---

Mr.
General Manager

Please note that, in exercise of the powers conferred by numeral 7 of article 349 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance - Law No. 26702 and its amendments and by subsection d) of article 57 of the Single Ordered Text of the Law of the Private System of Pension Fund Administration approved by Supreme Decree No. 054-97-EF, this Superintendency issues the following provisions for the purpose of establishing criteria applicable to the loss event database referred to in article 12 of the Regulation for Operational Risk Management, approved by SBS Resolution No. 2116-2009 and amendments, taking as a basis international practices, among which those indicated by the Operational Riskdata Exchange Association (ORX) and European Banking Authority (EBA) stand out, its publication being ordered by virtue of the provisions of Supreme Decree No. 001-2009-JUS:

1. Scope

This Circular shall apply to the companies indicated in literals A, C and D of article 16 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance - Law No. 26702 and its amendments, except for the Small and Micro Enterprise Development Entities (EDPYME); as well as to the Private Pension Fund Administrators (AFP), hereinafter companies.

It shall also apply to the Municipal Savings and Credit Banks, the Municipal Popular Credit Bank, the Bank of the Nation, the Agricultural Bank, the Financial Development Corporation (COFIDE), the MIVIVIENDA S.A. Fund, the Derramas and Cajas de Beneficios under the control of the Superintendency, insofar as they do not conflict with the specific regulations governing the actions of these companies.

2. Definitions

For the purposes of the provisions of this regulation, the following definitions shall apply:

a. Loss event database (BDEP): The operational risk loss event database referred to in article 12 of the Regulation.

b. Event: An occurrence or series of occurrences that may be internal or external to the company, originating from the same cause, that occur during the same period of time.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239

c. Operational risk loss event: The event that leads to one or several losses, whose origin corresponds to operational risk. In this regulation, the terms "operational risk loss event" and "loss event" shall be used interchangeably with the same meaning.

d. Loss: It is a negative impact on the results or on the equity of the company.

e. Claim: In accordance with the definition indicated in the User Service Attention Circular, Circular G-184-2015 and its amending regulations.

f. Regulation: Regulation for operational risk management, approved by SBS Resolution No. 2116-2009 and amendments.

g. Operational risk: The possibility of losses due to inadequate processes, failures of personnel, information technology, or external events. This definition includes legal risk, but excludes strategic and reputational risk.

h. Superintendency: Superintendency of Banking, Insurance and Private Pension Fund Administrators.

i. Value at Risk (VAR): It is an estimate of the potential loss in a financial portfolio as a result of adverse movements in market prices, over a settlement period and with a determined confidence level.

The definitions associated with credit risk, market risk, reputational risk, strategic risk, among other types of risk, shall be in accordance with the provisions of the Comprehensive Risk Management Regulation, approved by SBS Resolution No. 37-2008, and the regulations that amend or replace it.

3. Valuation of loss events

3.1. The gross loss amount associated with an event, which shall be recorded in the BDEP, must include the following aspects, as applicable:

a. Direct impact on the financial statements, including expenses, decrease in the value of assets, among others.

b. Repair or replacement expenses to restore the situation existing before the occurrence of the event, including the payment of deductibles associated with the contracted insurance.

c. Provisions recognized in the financial statements associated with operational risk loss events.

3.2. The following aspects must not be considered in determining the gross loss amount:

a. Recoveries after the occurrence of the loss event.

b. Expenses from general equipment or premises maintenance contracts.

c. Expenses associated with improvements made after the loss event.

d. Insurance premiums.

3.3. Losses associated with damage to fixed assets that render them unusable must be recorded in the BDEP in accordance with the following provisions:

a. If the damaged asset is replaced, the acquisition cost must be recorded as a loss. acquisition. b. If the damaged asset is not replaced, the estimated market price of said asset must be recorded as a loss or, if this is not known, the historical acquisition cost must be recorded. of said asset or, if this is not known, the cost must be recorded historical acquisition cost.
c.
If the asset is replaced subsequently, the amount of loss recorded in the BDEP must be modified following the provisions of literal a. loss recorded in the BDEP following the provisions of literal a.

3.4. In cases where an event simultaneously produces losses and gains for the entity, with a negative net balance, said balance must be considered for the calculation of the loss amount and its recording in the BDEP. For example, when an error in systems causes delays in the closing of planned operations, generating unexpected positive and negative impacts among the assets comprising a stock portfolio, different from those that would have occurred if the loss event had not happened.

3.5. Loss events associated with claims submitted by users must be incorporated into the BDEP, including those cases of operations not recognized by users because they are presumably fraudulent operations, and those in which the company decides to assume the loss without conducting a full investigation.

4. Recoveries

4.1. Any recovery associated with the event must be recorded in the BDEP separately from the gross loss amount but related to the event, in accordance with the guidelines established in the Regulation. A recovery will be considered as such whenever it occurs independently and after the occurrence of the original loss event.

4.2. Below is a non-limiting list of recoveries:

a. Payments received from an insurance company after the execution of contracted policies.

b. Payments received as a favorable result of a judicial or arbitration process.

c. Payments made by a third party providing services to the company, with the aim of mitigating the negative impact of the occurrence of a loss event for which it is responsible that affected both parties.

d. Payments received from clients or employees as a result of the recovery process.

5. Provisions

5.1. The provisions referred to in subsection c of numeral 3.1 must be recorded in the BDEP, including among others, those related to judicial disputes, arbitration processes and administrative proceedings.

5.2. The amount assigned in the BDEP to this provision must be updated as many times as the provision is modified. At the time the final loss amount associated with the event is known with certainty, the amount of the recorded provision must be replaced by the final amount. The company must establish specific procedures for the proper execution of the aforementioned tasks.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239

5.3. The provisions recorded in the BDEP must be clearly identified, so that they can be distinguished from other impacts associated with the event, for which companies must develop and implement appropriate internal procedures.

6. Event with multiple losses

6.1. In the case of an event with multiple losses, companies may record the minimum information required for each loss, and must establish a way to group such information by the event that originated them, that is, the initial event without which none of the related losses would have occurred.

6.2. Below is a non-limiting list of multiple losses:

a. Repeated errors caused by a failure in a business process or in a product.

b. Refunds to several clients arising from a common claim or caused by a single event (for example, the loss of documents during a move or due to a fire).

c. Losses due to fraud carried out through the same action and by the same person or criminal group.

d. An interruption of technology services affecting multiple business lines.

e. An individual or group of officers who receives erroneous instructions that generates multiple losses.

6.3. Multiple errors originated by the same person over a certain period of time must be treated as independent events, and therefore must not be grouped in the BDEP. For example, cash losses due to operational deficiencies of a teller at different times.

6.4. The company must establish procedures that guarantee the recording in the BDEP of those events with multiple losses that together exceed the minimum loss recording amount established by the entity, even though the gross amount of each individual loss originated by the same event is less than the minimum recording amount.

7. Loss events associated with legal risk

7.1. Every loss event attributable to legal risk must be recorded in the BDEP, regardless of the definition and denomination used by the company, such as compliance risk, or others that include legal risk or parts thereof in the form defined in the regulations.

7.2. Below is a non-limiting list of loss events recordable in the BDEP. These events may also be associated with other considerations included in this circular, and their classification follows the structure indicated in the annexes section of the Regulation:

a. Costs and expenses associated with the hiring of external legal advisors for loss events, such as representation in disputes against the company, consultancies, among others, provided they are not part of regular expenses previously contracted.

b. Losses associated with judicial, administrative, arbitration or other disputes, arising from actions initiated against the company such as the payment of costs,

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 5

costs, indemnities or any other concept of a similar nature, as well as those initiated by the company as a result of an operational risk event. c. Losses due to sanctions, fines and corrective measures ordered by the Superintendency or other regulatory bodies or authorities, as a result of any administrative proceeding, the outcome of which is adverse to the company.

d. Losses from the payment of compensations as a result of out-of-court settlements, such as the recognition of amounts in favor of clients, third parties, workers, former workers or others, in which the company decides to assume all or part of the loss of the event, in order to avoid the occurrence of claims, administrative or judicial actions, or that seek to limit their severity, provided that it is associated with failures attributable to the company.

e. Provisions made associated with lawsuits and other legal actions taken against the company, in which case the information recorded may be partial in accordance with the provisions of article 12 of the Regulation.

f. Losses associated with interpretations of legislation or regulation, including those associated with the determination of taxes, that are adverse to the interests of the company.

g. Losses associated with actions of regulators or authorities, even when these do not represent an administrative or sanctioning action, including restitution to clients, unexpected expenses and others that had not been foreseen to be made under the normal course of its operations.

h. Losses arising from contracts or agreements, such as the payment of penalties, execution of guarantees constituted by the supervised company, among others, generated by contracts or agreements that contain ambiguous clauses, contrary to regulation or for not containing clauses that safeguard the interests of the company or limit the due exercise of its rights.

i. Losses related to decisions that led to non-compliance with the external and internal regulations applicable to the company, even when they were taken by authorized officials.

8. Loss events associated with activities that generate credit risk

8.1. Operational risk loss events associated with credit risk must be recorded in the BDEP, additionally identifying this relationship in some field of the database record, in accordance with the provisions of the Regulation.

8.2. A non-limiting list of loss events recordable in the BDEP is provided below. These events may also be associated with other considerations included in this circular, and their classification follows the structure indicated in the annex section of the Regulation:

a. Losses due to deficient management of guarantees or collateral, for example: failures in the contracting of associated insurance, monitoring and compensation of collateral, agreements that do not allow due coverage, among others.

b. Losses due to errors in data entry.

c. Losses due to failures or deficiencies in credit recovery or granting procedures.

d. Losses associated with internal or external fraud.

e. Losses due to errors in the classification of clients.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239

f. Losses arising from improper authorization of credits or credit lines for operations in excess of limits or autonomies, according to the guidelines established by the company.

g. Losses due to errors in scoring models and others used for credit risk management, associated with errors in their design, implementation and execution, as well as in the systems that support them.

h. Losses arising from non-compliance with policies and procedures for granting credits, as well as due to bad practices, such as insufficient study of the client's background or sales in which the client acquires the product or service in the short term and under pressure, without sufficient information.

8.3. Losses associated with the functioning of credit risk models for reasons other than operational ones, for example due to the model's own uncertainty, which were duly studied at the time and accepted as part of a formal decision-making process, are not recorded in the BDEP.

9. Loss events associated with activities that generate market risk

9.1. Operational risk loss events associated with activities that generate market risk must be recorded in the BDEP, although additional identification in the database is not required, in accordance with the provisions of the Regulation.

9.2. A non-limiting list of loss events recordable in the BDEP is provided below. These events may also be associated with other considerations included in this circular, and their classification follows the structure indicated in the annex section of the Regulation:

a. Losses due to failures in internal controls in the operations of the investment process.

b. Losses associated with internal or external fraud.

c. Losses due to errors in the models used for market risk management, associated with errors in their design, implementation and execution, as well as in the systems that support them.

d. Errors during the entry of orders due to human or procedural failures.

e. Errors due to the functioning of the software that supports the investment process.

f. Incorrect specifications in memoranda of understanding or contracts and agreements associated with an offer, in relation to the transaction amount, maturity and other financial characteristics.

g. Losses caused by failures in the adequate interpretation of information, of people or of the functions associated with the investment process.

h. Losses derived from unauthorized practices or operations or above limits.

i. Losses derived from the inability to carry out operations or close positions due to problems from computer failures, or in general lack of availability of services, whether internal or external to the company; or human errors.

j. Losses due to incorrect information in the valuation of the risk of an open position using market prices (mark-to-market), as well as VAR or other models, due to problems in data quality or computer processing.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 7

9.3. The gross amount associated with the total loss incurred must be recorded, except in the case where the company decides, through formalized processes and taking into account criteria other than operational risk control, to maintain open positions after the event has been recognized. In that case, the possible losses or gains associated after that decision form part of market risk and will not be recordable in the BDEP.

9.4. In the case of losses associated with variations in market price generated by operational risk factors (manipulation of rates or parameters, system failures, among others), they will only be recorded in the BDEP if the event has specifically affected the supervised company; if the event has affected more than one company, the associated loss must not be recorded.

9.5. Losses associated with the operation of market risk models for reasons other than operational ones, for example due to the inherent uncertainty of the model, which were duly studied at the time and accepted as part of a formal decision-making process, are not recorded in the BDEP.

10. Loss events associated with strategic risk

10.1. Losses originating from strategic risk are not recorded in the BDEP.

Below is a non-exhaustive list of events not recordable in the BDEP, provided they have been found to be in accordance with legislation and regulation and have not intentionally or inadvertently violated codes of conduct or ethics, internal procedures, contractual requirements, or expected compliance good practices:

a. Losses associated with the final outcome of high-level decisions, such as mergers, acquisitions, spin-offs, significant redefinition of their products or customer segments, restructuring or significant reorganization.

b. Losses originating from decisions not in accordance with the risk appetite defined by the company, approved by the competent body.

c. Losses originating from investment decisions in new lines of business, products, assets, service channels, markets, services, projects, among others.

d. Losses due to the decision to make payments to or exempt certain customers from debts with the aim of retaining them or achieving their loyalty, provided they are not related to operational risk events.

e. Losses originating from hiring, dismissals, or sanctions imposed on workers by the company not associated with operational risk events.

10.2. Losses occurring during the implementation of strategic decisions taken by the company are recorded in the BDEP when they are related to operational risk factors during the life cycle of the management of associated projects or programs, including losses associated with legal risk.

11. Loss events associated with reputational risk

11.1. Loss events due to operational risk associated with the impairment of the company's reputation or image must be recorded in the BDEP, as well as any irregular or unplanned expense associated with the restoration or correction of such effects.

Los Laureles Nº 214 - Lima 27 - Perú Tel.: (511)6309000 Fax: (511) 6309239 8

11.2. Without being limiting, advertising expenses, image consulting or other professional services associated with the repair of the damage, agreements made with customers or customer segments, among others, will be recordable in the BDEP.

12. Loss events associated with insurance products

12.1. Loss events due to operational risk associated with insurance products must be recorded in the BDEP, additionally identifying this relationship in some registration field of the database, in accordance with the provisions of the Regulation.

12.2. Below is a non-exhaustive list of loss events recordable in the BDEP. These events may also be found associated with other considerations included in this circular, and their classification follows the structure indicated in the annexes section of the Regulation:

a. Losses due to poor management in the issuance and underwriting of insurance policies, the inclusion of unauthorized signatures or other requirements that unintentionally expand the company's liability.

b. Losses due to errors in data entry.

c. Losses due to failures or deficiencies in the execution of appraisals and claims investigation.

d. Losses associated with internal or external fraud.

e. Losses due to failures in supporting documentation and contracts.

f. Losses originating from the improper issuance of policies in excess of limits without due authorization or including unauthorized characteristics not supported by the respective technical study.

g. Losses originating from marketing practices that end up being classified as abusive practices, in accordance with the provisions of the Regulation on Transparency of Information and Insurance Contracting approved by SBS Resolution N° 3199-2013 and its amendments.

12.3. Losses associated with the operation of insurance risk models for reasons other than operational ones, for example due to the inherent uncertainty of the models, which were duly studied at the time and accepted as part of a formal decision-making process, are not recorded in the BDEP.

13. Special cases

13.1. Events that lead to opportunity costs or unrealized gains may be recorded in the BDEP provided they are objectively measurable and comparable with operations of a similar nature under normal business conditions, for example interest or commissions not collected due to errors associated with operational risk in the underwriting of the terms and conditions of credit granting contracts.

13.2. There are various events whose recording in the BDEP is not mandatory. Below is a non-exhaustive list of this type of events:

a. Those that did not result in losses, but that under other circumstances could have been actual losses, known as “near misses”. For example, when money is transferred to an incorrect account but after its identification it is reversed on the same day as the transfer, avoiding the negative impact for the entity.

b. Events that resulted in gains, except that there existed simultaneously a event that generates losses and gains, with a negative net result, which shall be recorded in the BDEP as indicated in item 3.4.

c. Events that represent only temporary accounting losses due to failures in the
recording of the company's financial information, and that once corrected do not represent actual financial losses, unless as a result of such failures administrative or other related sanctions are imposed, which must be recorded in the BDEP.

d. Expenses of an internal nature or transfer costs that would have been generated regardless of the occurrence of the event, although overtime expenses are included when compared with usual schedules, provided that these represent effective losses associated with operational risk loss events. these represent effective losses associated with loss events due to risk operational.

13.3. Companies will evaluate the possible associated advantages of having the information indicated in the preceding items. If the company decides to record it, the events will be clearly identified in the database, so that such events can be accurately distinguished from those required by the regulations, for which purpose appropriate internal procedures must be developed and implemented.

14. Supplementary provisions

14.1. Companies will have a periodic process of analysis and reporting to the specialized unit or the internal person in charge of the BDEP, of the movements reflected in the financial statements, in order to ensure that every operational risk loss event is identified and recorded in the BDEP. In said process, movements made to expense and equity accounts, and the provisions made, shall be reviewed in particular.

14.2. The Superintendency may subsequently establish additional criteria for the appropriate allocation of operational risk loss events to the event types and business lines indicated in the Regulation, as well as for other aspects associated with their recording and valuation. Such criteria will be available on the Superintendency's “Portal del Supervisado”.

14.3. Companies shall define and implement policies and procedures to ensure the adequate compliance with the criteria established in this circular, which includes the criteria referred to in item 14.2.

15. Entry into force and adaptation period

15.1. This circular shall enter into force on the day following its publication in the Official Gazette El Peruano.

15.2. Companies shall have a period of adjustment to comply with the provisions of this circular until 01 February 2018.

16. Adjustment Plan

Within a period not exceeding ninety (90) days from the entry into force of this circular, companies shall submit an adjustment plan to the Superintendency. Said plan shall

SUPERINTENDENCY OF BANKING, INSURANCE AND AFP

include a diagnosis of the existing situation in the company regarding compliance with the circular, the actions foreseen for full adjustment within the period indicated in item 15.2 and its implementation schedule, as well as the officials responsible for compliance with said plan.

Sincerely,

SOCORRO HEYSEN ZEGARRA
Superintendent of Banking, Insurance and Private Pension Fund Administrators