Circular LISOL 1-694, OPRAC 1-846, RUNOR 1-1228: Credit Management, Debtor Classification, Documentation Instrumentation, Conservation and Reproduction, and Financial User Protection

"2016 - Year of the Bicentennial of the Declaration of National Independence" COMMUNICATION "A" 6068 16/09/2016 TO FINANCIAL ENTITIES, TO NON-FINANCIAL COMPANIES ISSUING CREDIT CARDS, TO CREDIT PORTFOLIO ADMINISTRATORS OF PREVIOUS FINANCIAL ENTITIES, TO TRUSTEES OF FINANCIAL TRUSTS INCLUDED IN THE FINANCIAL ENTITIES LAW, TO NON-FINANCIAL COMPANIES ISSUING CHARGE CARDS:
Ref.: Circular
LISOL 1 - 694
OPRAC 1 - 846
RUNOR 1 - 1228
"Credit Management", "Debtor Classification", "Documentation Instrumentation, Conservation and Reproduction" and "Protection of Financial Service Users". Instrumentation of documents on electronic media or of similar characteristics. Adjustments. . ______ We address you to inform you that this Institution has adopted the following resolution:

"1. Replace point 1.1.5. of the norms on "Credit Management" with the following:
"1.1.5. Formal aspects.
The file and annexes may be kept on magnetic, electronic, or other similar technology media. In the latter two cases, the provisions of point 1.1.4. shall not apply, provided that the requirements included in point X. of the norms on "Instrumentation, Conservation and Reproduction of Documents" are observed."

2. Replace point 3.4.5. of the norms on "Debtor Classification" with the following:
   "3.4.5. Formal aspects.
   The file and annexes may be kept on magnetic, electronic, or other similar technology media. In the latter two cases, the requirements included in point X. of the norms on "Instrumentation, Conservation and Reproduction of Documents" must be observed."

3. Replace the title of the norms on "Conservation and Reproduction of Documents" with "Instrumentation, Conservation and Reproduction of Documents".

4. Incorporate as point X. of the norms on "Instrumentation, Conservation and Reproduction of Documents" -text according to point 3. of this communication- the following:

-2-
"X. Instrumentation of Documents.
X.1. Admitted Media.
In addition to media originating in paper, electronic media or media of similar characteristics are admitted to the extent that the documents are unalterable and that expert verifications can be performed on them to prove their authorship and authenticity. Electronic media are not admitted in cases where legislation and/or regulations require a specific form of instrumentation.

X.2. Signature.
Handwritten signatures originally made on electronic documents or other similar technologies are admitted to the extent that expert verifications can be performed on them to prove their authorship and authenticity.

X.3. Delivery of Copies.
Financial entities must send to the email address provided by the client the files that include all the documentation signed or incorporate the corresponding digitized images into the client's "home banking".
Without prejudice to this, the client may personally request copies of the aforementioned documentation at the corresponding branch where the account and/or file is registered.

X.4. Information Security Requirements.
When it comes to the instrumentation of documents on electronic media or of similar characteristics -as provided in point X.1.-, financial entities must observe the following:

X.4.1. "Documents Signed on Electronic Media" (DFE) are defined as data files in electronic format that have an associated, indivisible digitized handwritten signature that is verifiable, such that it allows for expert verifications to prove its authorship and authenticity and that is equivalent to the paper document signed in its original version, constituting an original, legitimate, unique, and unalterable signed document during its use and validity, and irrecoverable after its discard or expiration.

X.4.2. The following general requirements must be met for the protection of DFEs at each stage of their lifecycle:

X.4.2.1. Creation. This refers to the generation of new DFEs or the update of existing content:

-3- i) The digitization of the handwritten signature must comply with the biometric requirements indicated by ISO IEC 19794-7. ii) The DFE must have a unique relationship with the handwritten signature. iii) Any update to a DFE is equivalent to the creation of a new relationship between document and signature, generating a new DFE that replaces and invalidates the previous one.

X.4.2.2. Storage. This is the action of placing DFEs in some type of storage repository and may be performed simultaneously with their creation. i) Created DFEs must be safeguarded, protecting the confidentiality of the biometric datagram of the handwritten signature through encryption, in accordance with the risk assessment, in line with what is required by the norms on "Minimum requirements for management, implementation and control of risks related to information technology, information systems and associated resources for financial entities". ii) It must be guaranteed that the document cannot be deleted, modified, or replaced once created.

X.4.2.3. Use. This is the access to DFEs for reading, processing, or other types of activity, provided it does not include modification. i) Access to DFEs must be guaranteed to authorized users in accordance with the concept of "need to use/know". ii) The handwritten signature datagrams must be used to authenticate the signing individual. iii) All use activity of DFEs must be traceable; that is, there must be a record of who accessed the document, when, how, and what was done during that access. iv) Encryption keys to access the datagrams must be safeguarded and managed securely.

X.4.2.4. Distribution. The DFE is made accessible to others, such as other users, clients, and/or collaborators. i) The DFE must have an identified owner who can access the document and is responsible for authorizing how and with whom it is shared, and who will also define its archiving or destruction. All activity related to its distribution must be traceable.

-4- ii) The DFE must have a classification (criteria of criticality) in accordance with the organization's security policy, in line with what is required by the norms on "Minimum requirements for management, implementation and control of risks related to information technology, information systems and associated resources for financial entities".

X.4.2.5. Historical Archive. DFEs will no longer be available online and will be hosted in long-term electronic storage. The storage of a DFE must be performed on media that guarantee its confidentiality, integrity, and availability for the time determined legally according to its nature.

X.4.2.6. Destruction. DFEs will be permanently destroyed. i) The action of destroying the DFE must be duly registered and formalized. ii) It must be guaranteed that partial or total recovery of the data is not possible through secure erasure techniques.

X.4.3. All documents related to contracts/agreements with the banking client, the client's personal and financial data held by the financial entity, and those protected by Law 25.326 on the Protection of Personal Data must possess the highest criticality allowed by the entity's risk management methodology and be treated accordingly during the DFE lifecycle.

X.4.4. Complementarily, financial entities must take as a reference what is provided by the norms on "Minimum requirements for management, implementation and control of risks related to information technology, information systems and associated resources for financial entities" regarding the treatment of information of the entities and their clients."

5. Replace the second paragraph of point 1. and the first paragraph of point 2.1. of the norms on "Instrumentation, Conservation and Reproduction of Documents" -text according to point 3. of this communication- with the following:

"All original paper documentation whose reproduction is admitted or has been admitted, which has effectively been carried out as established in this regime, prior to its physical destruction must be made available to the interested parties, through reliable notification or with one of the modalities provided in the norms on "Information to clients by electronic means for environmental care" -in the latter case, subject to the observance of the conditions established in those norms-, for a period of 6 months counting from said notification."

"Financial entities may conserve, in substitution of the paper originals -to the extent that legal provisions do not oppose this-, photographs, microfilming, or digitized reproductions of the vouchers linked to their operations."

-5-
6. Replace the third paragraph of point 2.3.1.1. of the norms on "Protection of Financial Service Users" with the following:

"When it comes to requests for products or services that will be subject to subsequent approval by the obligated subject, a copy of all forms signed by the user at that time, intervened by the obligated subject as proof of receipt, must be delivered to the financial service user, in accordance with what is provided in the norms on "Instrumentation, Conservation and Reproduction of Documents", if applicable. At that time, the obligated subject must also notify them -keeping a record of this- that once the request is approved, they will be provided -within ten business days counted from the date of its approval or the effective availability of the product or service, whichever occurs last- with the contract bearing the authorized signature of the obligated subject."

Likewise, we inform you that we will subsequently send you the sheets that, in replacement of those previously provided, must be incorporated into the norms on "Credit Management", "Debtor Classification", "Protection of Financial Service Users" and "Instrumentation, Conservation and Reproduction of Documents" -text according to point 3. of this communication-.

We greet you attentively.
CENTRAL BANK OF THE ARGENTINE REPUBLIC
Darío C. Stefanelli Agustín Torcassi
Chief Manager of Issuance and
General Manager
Normative Applications of Norms