2019 – YEAR OF EXPORT

COMMUNICATION “A” 6832 15/11/2019

TO FINANCIAL ENTITIES, TO EXCHANGE HOUSES, TO EXCHANGE AGENCIES:

Reference: Circular

REMON 1 – 986
LISOL 1 – 853
RUNOR 1 – 1505
CONAU 1 – 1367

Standards on “Minimum Capitals of financial entities”, “Minimum Cash”, “Minimum security measures in financial entities”, “Minimum management, implementation and control requirements for risks related to information technology, information systems and associated resources for financial entities”, and “Minimum internal‑control standards for exchange houses and agencies”. Update.

We address you to forward, attached, the sheets that, in replacement of those previously provided, must be incorporated into the referenced regulations, in accordance with the provisions of the resolution disseminated by Communication “A” 6207.

We also note that the denomination of the ordered text on “Minimum internal‑control standards for exchange houses and agencies” has been changed to “Minimum internal‑control standards for exchange houses”, which incorporates the provisions disseminated through Communication “A” 6184 and includes formal adjustments.

Finally, we remind you that on this Institution’s website www.bcra.gob.ar, accessing “Financial System – LEGAL FRAMEWORK AND REGULATIONS – Ordering and summaries – Ordered texts of general regulations”, you will find the modifications made with texts highlighted in special characters (strikethrough and bold).

-2-

We greet you attentively.

CENTRAL BANK OF THE ARGENTINE REPUBLIC

Mariano E. Leguiza – Senior Analyst

Darío C. Stefanelli – Senior Manager of Issuance and Regulatory Applications

ANNEX

6.10.2.3. Complex Products

For complex products, for example, securitizations and credit derivatives of successive default, entities shall explicitly assess the need to adjust valuation to reflect two forms of model risk: the use of an incorrect valuation methodology and the use of calibration parameters that are unobservable and potentially incorrect.

6.10.2.4. Adjustments to Current Value

Adjustments to the current value of the less‑liquid positions of point 6.10.2.2 shall be deducted from Tier 1 ordinary capital, even if they exceed the adjustments of point 6.10.1.3 and those arising from accounting standards.

6.11. Responsibilities

Financial entities that operate by buying and/or selling, regardless of amount, option contracts and those that, on any day of a month, record assets (the sum of bought and sold positions of the included assets) that together exceed 25 % of the RPC recorded on the last day of the second preceding month shall define responsibilities in the handling of the risk‑management policy assumed for positions subject to the minimum‑capital‑requirement for market risk.

This will entail designating the persons who will be in charge of the correct application of the established calculation methodology and the primary responsibility for adopting the necessary safeguards to keep the positions covered with the required capital, especially actions leading to regularising daily‑integration defects that exceed 3 % of the requirement. They will also be responsible for providing information in a timely manner to the SEFyC in accordance with the informational regime that will be established on the matter.

Changes to the roster of designated responsible persons, the General Manager, and the member of the Board of Directors, Administrative Council or equivalent authority to whom the function reports, must be communicated to the Superintendence by submitting the Institutional Information Regime for Financial and Exchange Entities.

6.12. Internal Audit

Internal audit shall carry out an exhaustive review of the scheme adopted by the entity for measuring the market‑risk requirement, especially regarding the provisions in point 6.10, recording the work programs and reports prepared on the matter. Periodically, it shall also monitor the correct application and any changes introduced in the measurement of that requirement.

MINIMUM CAPITALS OF FINANCIAL ENTITIES

Section 6. Minimum Capital for Market Risk

Version: 2a. COMMUNICATION “A” 6832

MINIMUM CAPITALS OF FINANCIAL ENTITIES

TEXT ORDERED	ORIGIN REGULATION	OBSERVATIONS	Section
6.	6.6.	“A” 5867	1. According to Comm. “A” 6663 and 6690.
6.	6.7.	“A” 2461 unique III	According to Comm. “A” 3161, 4172, 5272, 5867 and 6690.
6.	6.8.	a
6.	6.10.	“A” 5867	1. According to Comm. “A” 6690.
6.	6.11.	“A” 2461 unique VI	According to Comm. “A” 4172, 6690 and 6832.
6.	6.12.	“A” 5867	1. According to Comm. “A” 6690.
7.	7.1.	“A” 5272	2. According to Comm. “A” 6327.
7.	7.2.	“A” 5737	2. According to Comm. “A” 5746, 6260, 6475 (point 4.) and 6633.
7.	7.3.	“A” 5272	2. According to Comm. “A” 5369, 5580, 5737 and 5867.
8.	8.1.	“A” 414 LISOL‑1 VI 3.1. 1st	According to Comm. “A” 2279, 2453, 2793, 2914, 3039, 4172 and 5369 (Annex I).
8.2.1.	“A” 414 LISOL‑1 VI 3.1.1.	According to Comm. “A” 2223, 2227, 4296 (point 2.), 4576 (point 1.), 4665, 5369 (Annex I), 6327, 6396 and 6428.
8.2.2.	“A” 5369 I
8.2.3.	“A” 414 LISOL‑1 VI 3.1.2.	According to Comm. “A” 2223, 2768, 2948, 4172, 4576 (point 3.), 4665, 4702, 5369 (Annex I) and “B” 9074.
8.3.	“A” 5369 I
8.3.1.	“A” 5369 I
8.3.2.	“A” 4576	2. According to Comm. “A” 4591 (points 2. to 5.), 4665, 4782 and 5369 (Annex I).
8.3.2.2.	“A” 4576	2. According to Comm. “A” 4665, 5369 (Annex I) and 5831.
8.3.2.7.	“A” 4576	2. According to Comm. “A” 4591 (point 2.), 4665, 5369 (Annex I) and 5831.
8.3.3.	“A” 414 LISOL‑1 VI 3.1.2.2.	According to Comm. “A” 2264, 4172, 4576 (points 4., 5., 6. and 8.), 4665, 4782 and 5369 (Annex I).
8.3.4.	“A” 5369 I
8.3.4.1.	“A” 5369 I	According to Comm. “A” 5831.
8.3.4.4.	“A” 5369 I	According to Comm. “A” 5831.
8.3.5.	“A” 5369 I
8.4.1.	“A” 5369 I
8.4.1.1.	“A” 4296	2. According to Comm. “A” 4576, 4665, 5369 (Annex I) and 6327.
8.4.1.2.	“A” 2287	3.
8.4.1.3.	1st “A” 2497	1. According to Comm. “A” 3621, 4172, 5183, 5831 and 6628.
8.4.1.4.	last “A” 2263	2. According to Comm. “A” 4172 and 6327.

RESPONSIBLES FOR LIQUIDITY POLICY

5.1. The financial entity shall inform the Superintendence of Financial and Exchange Entities of the names of the persons responsible for handling the liquidity policy – which includes adopting safeguards for compliance with the integration of minimum cash and, where applicable, monitoring the liquidity‑coverage ratio – (officials and/or area manager), the General Manager and the director or counselor or highest authority in the country in the case of foreign entities, to whom the function must be reported.

When changes occur in that roster, the information requirement shall be considered fulfilled by submitting the Institutional Information Regime for Financial and Exchange Entities.

5.2. Responsibilities
Designated officials shall be responsible in case of improper calculations that cause reductions in the minimum‑cash requirement or, where applicable, in the liquidity‑coverage ratio referred to in the standards on “Liquidity‑Coverage Ratio”.

Mechanisms or modalities that, in the view of the Superintendence of Financial and Exchange Entities, give rise to a presumption of such miscalculations shall determine the obligation of the financial entity to provide explanations on the matter within 5 business days from receipt of the request.

The Superintendence shall issue its decision within 30 business days following receipt of the defenses.

5.3. Sanctions
Verification of infractions shall determine the application of the provisions in the regulations on “Disciplinary Regime under the Central Bank of the Argentine Republic, Laws 21.526 and 25.065 and their amendments”.

MINIMUM CASH

Section 5. Responsible Persons and Sanctions

Version: 8a. COMMUNICATION “A” 6832

MINIMUM CASH

TEXT ORDERED	ORIGIN REGULATION	OBSERVATIONS	Section	Point	Paragraph
2.	2.1.1.	“A” 3274 II	2.	2.1.2.	According to Comm. “A” 3304, 3498, 4016 and 4147.
2.1.2.	“A” 3498 unique	2.	2.1.3.	According to Comm. “A” 4147.
2.1.3.	“A” 3274 II	2.	2.1.3.	According to Comm. “A” 3498, 4147, 4276 and 5194.
2.1.4.	“A” 3274 II	2.	2.1.4.
2.1.5.	“A” 4016	1.
2.1.6.	“A” 4716	2. According to Comm. “A” 6628 and “B” 9186.
2.2.	“A” 3274 II	2. According to Comm. “A” 3498, 4449, 4716, 5299, 6349, 6719 and 6774.
2.3.	“A” 3365	2. According to Comm. “A” 3387, 3470, 3498, 3549, 3597, 3732, 3824, 4016, 4449, 4716, 5152, 5299, 5373, 6288, 6349, 6575, 6616, 6719 and “B” 9186.
2.4.	“A” 4147	3. According to Comm. “A” 4276, 4449, 4509, 5152, 5299, 6349 and 6719.
2.5.	“A” 4147	3. According to Comm. “A” 4393, 4509, 4716 and 5299.
3.	3.1.	“A” 3274 II	3.	3.1.
3.1.1.	“A” 3274 II	3. According to Comm. “A” 3326, 3365, 3498, 3549, 3905, 4276, 4449, 4473, 4707, 4716, 4862, 5356, 6349, 6638, 6719 and “B” 9186.
3.1.2.	“A” 3274 II	3.
3.1.3.	“A” 3274 II	3. According to Comm. “A” 3326.
3.1.4.	“A” 3274 II	3.
3.2.	“A” 3274 II	3. According to Comm. “A” 6719.
3.2.1.	“A” 3274 II	3.2.2.1. According to Comm. “A” 4449, 6349 and 6719.
3.2.2.	“A” 3274 II	3.2.2.2. According to Comm. “A” 4449 and 6719.
3.3.	“A” 3274 II	3. According to Comm. “A” 3498.
3.3.1.	“A” 3274 II	3.1. According to Comm. “A” 4771 and 6275.
3.3.2.	“A” 3274 II	3.
4.	4.1.	“A” 3274 II	4.	4.1.
5.	5.1.	“A” 3274 II	5.	According to Comm. “A” 3498, 5693 and 6832.
5.2.	“A” 3905	5. According to Comm. “A” 5356 and 5693.
5.3.	“A” 3905	5. According to Comm. “A” 4449 and 6167.

When a replacement or exemption of certain measures has been authorized, the entity must have the pertinent conformity issued by the BCRA.

These elements must be presented to the verifying officer each time they are requested and, regarding the matter, the following shall be taken into account:

6.3.1. Documentation at Branches

Financial entities must file in each of their branches a copy, in physical or digitally accessible form, of the certificates and attestations that demonstrate the suitability of the minimum security measures implemented and the authorisations of replacement, approvals or exemptions granted by the BCRA, required by current legislation and regulations. These copies must bear a legend stating: “This is a true copy of the original, archived at the Head Office”, and must be signed by the entity’s security officer.

6.3.2. Submission to Jurisdictional Security Body

A set of copies of these certificates and other attestations shall be supplied, against receipt, to the jurisdictional security body for filing in each department’s file.

6.4. Security Officer of the Financial Entity

While all members of the financial entity must be accountable for security in their area of labor competence, each entity shall designate a direct security officer who will have primary responsibility for complying with all applicable legal and regulatory requirements in the matter and will be the point of contact, for all purposes, with the BCRA, without prejudice to obligations that may fall on the authorities of the financial entity.

This designation shall be made to a person who holds a qualifying degree in the specialty or, failing that, a person who can demonstrate at least 5 years of experience in functions related to banking security.

To cover temporary leaves or absences of that officer, the entity shall nominate a person who will act as replacement during those periods, meeting similar suitability or experience requirements and notifying the BCRA.

The evidence proving compliance with the previously set requirements shall be sent directly to the Security Management to obtain its conformity, prior to sending the corresponding data of the designated security officer through the Institutional Information Regime for Financial and Exchange Entities.

6.5. Security Plan

Financial entities must prepare in writing and implement an annual security plan, which shall be treated as confidential and must be approved by the entity’s highest authorities. It shall contain, at a minimum:

6.5.1. Mission and Functions of the Security Officer and the Highest Authority to Which He/She Reports

MINIMUM SECURITY MEASURES IN FINANCIAL ENTITIES

Section 6. Complementary Provisions

Version: 8a. COMMUNICATION “A” 6832

MINIMUM SECURITY MEASURES IN FINANCIAL ENTITIES

TEXT ORDERED	ORIGIN REGULATION	OBSERVATIONS	Section
6.	6.3.	“A” 2687	According to Comm. “A” 2985, 3390, 5308, 6272 and 6438.
6.4.	“A” 2687	According to Comm. “A” 2985, 3390, 5120, 6272 and 6832.
6.5.	“A” 2985	According to Comm. “A” 3390, 5412, 6272 and 6438.
6.6.	“A” 5814	According to Comm. “A” 6014, 6029, 6272, 6438 and “C” 69485.
6.7.	“A” 2687	According to Comm. “A” 2985, 3390, 5308, 6209, 6272 and 6438.
6.8.	“A” 2687	According to Comm. “A” 2985, 3390, 5308, 5412 and 6272.

Policies are high‑level documents that represent the entity’s philosophy and strategic thinking. To be effective they must be clearly written and concise.

Procedures are written documents that describe sequentially how to execute an activity to achieve a specific objective within a defined scope.

In these documents, operational processes are set out, responsibilities are defined, the documents (forms, reports, records) to be issued and controlled are identified, and the necessary controls are detailed, defining where and when they must be performed.

Both policies and procedures must be clearly written, formally communicated, kept up‑to‑date, assign responsibilities, and serve as the basis for coordination and execution of tasks, as well as the instrument that enables training on activities related to data administration and/or processing, systems or technologies related to the entity.

2.3. Risk Analysis

The Board of Directors, or equivalent authority, shall be responsible for the existence of control mechanisms over the degree of exposure to potential risks inherent to information systems, information technology and associated resources. They shall also be the primary observers of its continuous execution.

The existence of formally performed and documented risk analyses on information systems, information technology and associated resources must be evidenced. These shall remain available for review by the External Systems Audit Management of the Superintendence of Financial and Exchange Entities.

The results of the analyses and their periodic updates must be formally reported to the Board of Directors, or equivalent authority, who shall be primarily responsible for ensuring that weaknesses exposing the entity to high or unacceptable risk levels are corrected to acceptable levels.

2.4. Dependency of the Information Technology and Systems Area

The Information Technology and Systems area – or the denomination the entity chooses for the function of data, systems or related technology administration and/or processing – shall depend organizationally within the financial entity’s structure on a level that does not create functional dependence on user areas of its management.

The entity must report the designation of the area’s responsible person by submitting the Institutional Information Regime for Financial and Exchange Entities.

MINIMUM MANAGEMENT, IMPLEMENTATION AND CONTROL REQUIREMENTS FOR RISKS RELATED TO INFORMATION TECHNOLOGY, INFORMATION SYSTEMS AND ASSOCIATED RESOURCES FOR FINANCIAL ENTITIES

Section 2. Functional Organization and Management of Information Technology and Systems

Version: 2a. COMMUNICATION “A” 6832

TEXT ORDERED	ORIGIN REGULATION	OBSERVATIONS	Section	Point
1.	1° to 3° “A” 4609 unique	1° to 3°	4° “A” 3198	1°
1.1.	“A” 4609 unique	1.1.
1.2.	“A” 3198	1.2.
1.3.	“A” 3198	1.3.
1.4.	“A” 3198	1.4.
1.5.	“A” 4609 unique	1.5.
1.6.	“A” 3198	1.6.
1.7.	“A” 3198	1.7.
2.	2.1. “A” 3198	2.5. According to Comm. “A” 4609.
2.2.	“A” 3198	3.1. to 3.3. According to Comm. “A” 4609.
2.3.	“A” 4609 unique	2.3.
2.4.	“A” 3198	2.1. and 2.5. According to Comm. “A” 4609 and 6832.
2.5.1.	“A” 3198	2.3. According to Comm. “A” 4609.
2.5.2.	“A” 3198	2.4.
2.5.3.	“A” 3198	2.2. According to Comm. “A” 4609.
2.5.4.	“A” 4609 unique	2.5.4.
2.5.5.	“A” 4609 unique	2.5.5.
3.	3.1. “A” 4609 unique	3.1.
3.1.1.	“A” 3198	6.1. According to Comm. “A” 4609.
3.1.2.	“A” 4609 unique	3.1.2.
3.1.3.	“A” 4609 unique	3.1.3.
3.1.4.	“A” 3198	6.3. to 6.5. According to Comm. “A” 4609 and 4690 (pt. 1.).
3.1.5.	“A” 4609 unique	3.1.5.
3.2.	“A” 4609 unique	3.2.
3.2.1.	“A” 4609 unique	3.2.1.
3.2.2.	“A” 3198	7.3. According to Comm. “A” 4609.
3.2.3.	“A” 3198	7.3. According to Comm. “A” 4609.
3.2.4.	“A” 4609 unique	3.2.4.
4.	4.1. “A” 4609 unique	4.1.
4.2.	“A” 4609 unique	4.2.
4.3.	“A” 3198	7.2. According to Comm. “A” 4609.
4.4.	“A” 3198	7.2. According to Comm. “A” 4609.
4.5.	“A” 3198	7.2. According to Comm. “A” 4609.
4.6.	“A” 3198	7.2. According to Comm. “A” 4609.
5.	5.1. “A” 3198	4.2.3. According to Comm. “A” 4609.
5.2.	“A” 4609 unique	5.2.
5.3.	“A” 3198	4.1. According to Comm. “A” 4609.

ORIGIN OF THE PROVISIONS CONTAINED IN THE STANDARDS ON “MINIMUM MANAGEMENT, IMPLEMENTATION AND CONTROL REQUIREMENTS FOR RISKS RELATED TO INFORMATION TECHNOLOGY, INFORMATION SYSTEMS AND ASSOCIATED RESOURCES FOR FINANCIAL ENTITIES”

Index
- Section 1. General Aspects
  - 1.1. Basic Concepts
  - 1.2. General Provisions
- Section 2. Methodology for Internal‑Control Evaluation
  - 2.1. Cycles
  - 2.2. Control Objectives
  - 2.3. Cycle Mapping
  - 2.4. Control Testing
  - 2.5. Documentation
- Section 3. Substantive Tests
- Section 4. Internal Audit Reports
- Correlation Table

ORDERED TEXT OF THE “MINIMUM INTERNAL‑CONTROL STANDARDS FOR EXCHANGE HOUSES”

Version: 2a. COMMUNICATION “A” 6832

1.1. Basic Concepts

1.1.1. Internal Control

Internal control is broadly defined as a process carried out by the board of directors, management and other members of an exchange house, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

Effectiveness and efficiency of operations
Reliability of accounting information
Compliance with applicable laws and regulations

The first category addresses the basic business objectives of an exchange house, including performance, profitability and asset protection. The second relates to the reliable preparation of financial statements and supplementary information for the Central Bank of the Argentine Republic (BCRA) and other users. The third refers to compliance with the laws and regulations to which the entities are subject.

Internal control consists of five interrelated components, which are integrated with the management process. While the components are relevant to all exchange houses, small and medium‑sized ones may implement them differently from larger ones. Their controls may be less formal and less structured, but even so those exchange houses must obtain effective internal control.

The components are:

Control Environment – establishes the operating mode of an organization, influencing the control consciousness of its people. It is the foundation for all other internal‑control components, providing discipline and structure. Factors include integrity, ethical values and competence of the exchange house’s personnel; management style and operating methods; how management assigns authority and responsibility, organizes and develops its people, and the attention and direction provided by the board.
Risk Assessment – every exchange house faces a variety of external and internal risk sources that must be evaluated. A prerequisite to risk assessment is the determination of objectives, linked to different levels and internally compatible. Risk assessment is the identification and analysis of significant risks to achieving objectives, forming a basis for determining how risks should be managed. Because economic, financial, regulatory and operational conditions will continue to change, mechanisms are needed to identify and address special risks associated with change.

End of Document

1.1.1.3. Control Activities

Control activities are the policies and procedures that help ensure that management directives are carried out. This implies that the necessary actions are taken to address risks toward achieving the objectives of the exchange house. Control activities are performed throughout the organization, at all levels and in all functions. They include a diverse range of activities such as approvals, authorizations, verifications, reconciliations, operational performance reviews, asset security and segregation of duties.

1.1.1.4. Information and Communication

Relevant information must be identified, captured and communicated in a form and in a time that allow agents to fulfill their responsibilities. Information systems generate reports that contain operational, financial and accounting information, making it possible to direct and control the business. It is not only about information generated internally but also about information concerning external matters, activities and conditions necessary for decision‑making and external reporting. Effective communication must also, in a broader sense, flow throughout the organization. All personnel must receive the clear message from Management that control responsibilities must be taken seriously.

1.1.1.5. Monitoring

The internal control system must be monitored. Monitoring is a process that evaluates the quality of the system’s performance over time. This is achieved through ongoing monitoring activities, separate evaluations, or a combination of both.

The definition of internal control – with its underlying fundamental concepts of a process performed by people providing reasonable assurance – together with the characterization of objectives, components, criteria for effectiveness, and associated discussions, constitute the basis of these internal control standards.

1.1.2. Roles and Responsibilities of Exchange House Personnel

All members of an organization participate in internal control tasks.

1.1.2.1. Board or Equivalent Authority

The Board or equivalent authority in the country of the exchange houses is the ultimate responsible party. It provides and approves internal control standards and procedures.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES

Section 1. General Aspects.

Version: 2a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 2

1.1.2.2. Internal Control Officer

Exchange houses must designate an Internal Control Officer and must communicate the appointment through the submission of the Institutional Information Regime of Financial and Exchange Entities. The mentioned function must be covered by a member of the Board or equivalent authority. Entities must send, within ten business days after the designation, a note addressed to the Control Management Auditors of the Superintendency of Financial and Exchange Entities (SEFyC), with the personal data and work background of the Internal Control Officer.

If the Internal Control Officer decides to delegate review tasks, in order to promote appropriate independence of judgment, the tasks must be carried out by personnel independent of the other areas of the exchange house with the corresponding supervision of the Officer. Such tasks may not be delegated to the external auditor nor to other professionals linked to the auditor or to his/her professional university association.

1.1.2.3. Other Members

Internal control concerns everyone who is part of the organization and therefore should be an explicit or implicit part of every employee’s job description. Virtually all employees produce information used in the internal control system or take other necessary actions to perform control. In addition, all personnel must be responsible for upward communication of operational problems, violations of the code of conduct – if any – the commission of illicit acts or other breaches of policies set by the exchange house.

1.2. General Provisions

1.2.1. Internal Control Officer – Functions

The Internal Control Officer must, among other things:

Monitor the proper functioning of the exchange house’s internal control system through periodic evaluation.
Submit its annual work plan to the Board or equivalent authority for approval before the close of the third quarter of the previous fiscal year; the plan must contain references to internal control evaluation tasks and substantive tests to be performed.
Issue, at least every two months, a report containing a review of the evaluated cycles, control tests and substantive tests performed during the period, which must be forwarded to the Board or equivalent authority.
Take knowledge of the external audit planning, reports issued by it, as well as all relevant accounting information.
Consider observations detected as a result of its task and those arising from any other control evaluation (external audit, SEFyC, etc.), as well as corrective actions implemented to remediate the identified weaknesses.

Non‑compliance with these standards will make the Internal Control Officer subject to the sanctions provided for in article 41 of the Financial Entities Law, without prejudice to the responsibility of the Board or equivalent authority.

SEFyC will periodically verify compliance with the internal control provisions. For this purpose, it may request the working papers that support the report recorded in the special internal control book, which must be retained by the exchange house for at least six (6) years.

1.2.2. Planning Policy

The Internal Control Officer must present, before the close of the third quarter of each fiscal year, the annual planning of its activities for the following year to the Board or equivalent authority of the exchange house, which will acknowledge it and decide on its approval before the start of the fiscal year, leaving a record in the Board Minutes Book.

The audit planning must contain references to internal control evaluation tasks and substantive tests to be applied.

The internal auditor may base the scope of any of its procedures on coordination with the tasks to be performed by the external auditor.

1.2.3. Design and Documentation of Controls

1.2.3.1. Responsibilities in Design and Implementation of Controls

Exchange houses must develop and document appropriate administrative and accounting procedures for processing and controlling the transactions they carry out. These must be in Spanish. It is especially required that the mentioned documentation clearly specify the techniques established by the exchange houses to ensure adequate internal control over the transactions performed and their accounting registration, which must conform to BCRA regulatory provisions.

The documentation must also contain an organizational chart of the exchange house, indicating the levels of responsibility of officials regarding operation authorizations and the corresponding signature registers.

1.2.3.2. Responsibility of the Board

The responsibility for the design, documentation and implementation of control procedures corresponds to the Board or equivalent authority, which, taking into account the size of the exchange house, the volume and complexity of operations, will designate the persons in charge of those tasks.

1.2.3.3. Documentation and Updating

The form of the documentation is left to the discretion of the exchange houses; it may be done through narrative manuals or instructions, using flowcharts or other means that clearly show the process followed, with special emphasis on existing controls (monitoring, application and IT controls), and the administrative sectors, positions and responsibilities of each step in the transaction flow and control.

The mentioned documentation must be kept up‑to‑date and may be requested at any time by SEFyC.

1.2.4. Proposal for Solving Observations of the Internal Control Verification

When, as a consequence of reviews carried out by the SEFyC Control Management Auditors of BCRA, situations arise that, due to their importance, require a short‑term solution, the exchange houses may be required to submit a “Proposal for Solving Observations”.

The proposal must be presented by the exchange houses to the Control Management Auditors within 20 calendar days of receiving the “Detail of Observations to be Regularized in a Short Period” and must contain all procedures that the exchange houses will implement to regularize those observations.

The maximum period for carrying out the procedures foreseen in the “Proposal for Solving Observations” is 120 calendar days. This period starts from the receipt by the exchange house of the approval – by the Control Management Auditors – of the cited proposal.

Failure to present the proposal on time or to comply with the approved “Proposal for Solving Observations” may lead to the application of the sanction regime provided in article 41 of the Financial Entities Law.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES

Section 1. General Aspects.

Version: 2a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 5

The evaluation of the internal control structure of exchange houses constitutes the most important function of internal audit. To ensure its proper functioning, exchange houses must document and report on the data‑gathering and evaluation tasks of the controls for each relevant cycle.

2.1. Cycles

The most relevant cycles in exchange houses that require proper internal control functioning, without being an exhaustive list, are:

Treasury (including, among others, processes related to Cash, Correspondents and Exchange Assets),
Presentation of accounting and financial information and general accounting,
Investments,
Fixed and miscellaneous assets,
Information technology,
Purchases (covers activities not related to Exchange Assets),
Tourist services.

Additionally, those responsible for internal control evaluation or persons to whom review tasks have been delegated must include in their planning the evaluation of the anti‑money‑laundering and terrorist financing prevention program implemented by the entity and the related controls.

As a result, they must issue a report on the existence and functioning of the internal control procedures the entity applies to comply with BCRA standards on anti‑money‑laundering and terrorist financing, at least once a year or more frequently as the internal auditor deems necessary based on risk. The report must also cover the remaining requirements set out in Section 4 for all of them.

To issue the report, at a minimum, data‑gathering and design testing of the controls mentioned above, implemented by the entity, and compliance testing of those controls must be performed.

The mentioned data‑gathering and testing must be directed at verifying, at a minimum, the following aspects:

2.1.1. Organization of the AML/FT Prevention Program, Staff Training and Internal Control

It must be assessed whether the entity’s culture promotes a strong commitment to AML/FT prevention.

2.1.2. AML/FT Risk Assessment

It must be assessed the entity’s exposure risk to money‑laundering and terrorist financing through an analysis of the entity’s overall control environment and the characteristics of its products, services and clients.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES

Section 2. Methodology for Internal Control Evaluation.

Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 1

2.1.3. “Know Your Customer” Policy, Particularly in Defining Regular and Occasional Clients

It must be assessed whether the entity obtains up‑to‑date and sufficient information on clients to reasonably establish their profile and expected behavior.

In particular, it must be assessed that entities verify, at account opening, maintenance and operation, that clients are not listed in terrorist or terrorist‑supporting organization lists contained in United Nations Security Council Resolutions, without prejudice to verification against other lists indicated in the specific regulations.

2.1.4. Monitoring Activities for AML/FT Prevention and Detection

It must be assessed whether the entity has a system that allows reviewing and controlling client transactions to identify unusual or suspicious operations, according to a predefined profile, and subsequent reporting.

2.1.5. Reporting Procedures

It must be assessed whether the entity’s systems have the capacity to capture the information necessary to meet regulatory reporting requirements to various bodies, ensuring its integrity.

2.1.6. Linking Staff Knowledge of AML/FT Regulations with Individual Performance Evaluation

It must be assessed whether employees possess the skills, competence, knowledge, integrity, information, incentives or resources to implement the necessary procedures and policies.

2.2. Control Objectives

These are defined as “categories” in point 1.1.1. There are six control objectives that provide a structure on which control policies and procedures can be built to ensure, through their proper functioning, the production of reliable accounting and complementary information.

They are:

2.2.1. Authorization

Means that transactions have been approved and are carried out with a third party that has been confirmed. Authorization also includes the establishment of purchase or sale limits for foreign currency and securities, as well as technical limits or relationships imposed by BCRA.

2.2.2. Accuracy and Timeliness of Entry

Means the correct and timely entry of the transaction into the system, i.e., that it reflects the amounts paid or received, the client involved, the type of transaction and the correct amount.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES

Section 2. Methodology for Internal Control Evaluation.

Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 2

2.2.3. Integrity of Entry

Ensures that all transactions are entered into the system only once. This means there are no missing entries nor duplicate entries. Together with the first two objectives (authorization and accuracy) they cover the start of the transaction.

2.2.4. Integrity and Accuracy of Updates

This objective follows the start of the transaction. It deals with the requirement that each entered transaction be fully and accurately posted in a file that forms part of the exchange house’s accounting records, such as the general ledger, journal or sub‑journal.

2.2.5. Integrity and Accuracy of Accumulated Data

This objective follows the information update. It ensures that the updated information remains in the file until its cancellation.

2.2.6. Restricted Access

Applies to assets and the records representing those assets. It addresses both the confidentiality of information files, unauthorized changes, and the physical safeguarding of assets.

These objectives apply both to the transaction itself (authorization, accuracy and integrity) and to the cycle as a whole (integrity and accuracy of updates, of accumulated data and restricted access).

2.3. Data‑Gathering of the Cycles

The internal audit of exchange houses must adequately document, and – using the method it decides – analyze the relevant cycles of the exchange house with the aim of identifying existing risks for each and how the controls designed by Management function and are sufficient to mitigate those risks. Data‑gathering must clearly contain the transaction flow, the system environment in which transactions operate and the existing controls. This gathering must be completed for each cycle and updated at least once a year. The risk‑assessment documentation for each cycle must anticipate compliance with each of the six control objectives mentioned earlier. Additionally, for each unmet objective, the auditor must analyze and document its effect on the internal control structure of the exchange house, as well as indicate the risks generated by its non‑compliance.

For an adequate analysis and documentation of the internal control structure of exchange houses, it is recommended to comply, for each cycle, at a minimum with the following stages and aspects of data‑gathering and evaluation:

Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 3

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES

Section 2. Methodology for Internal Control Evaluation.

2.3.1. Accounting System

The accounting system constitutes an important part of the internal control structure. It includes the procedures established to identify, accumulate, classify, analyze and record transactions and documents produced by the system. Some of these procedures may be performed manually or by computer.

As part of the control‑structure analysis, it is necessary to gather and understand the accounting system. The objectives of this data‑gathering are:

Know the accounting records, significant transactions and information flow through the system;
Help understand the exchange house’s business;
Help identify characteristic inherent risks, know control procedures and consider their implications for the control structure;
Develop effective tests on the accounting system;
Verify compliance with information obligations, including reports required by regulatory bodies;
Identify major deficiencies in the accounting system or its controls that must be reported to Management or the Board.

The accounting‑system data‑gathering must be properly documented. The level of detail and methodology used will depend on each exchange house’s needs. However, it must be ensured that the following are documented and understood:

How the main transactions are initiated and their relationship with others;
The main significant accounting records, supporting documents and reports required by the exchange house.

2.3.2. Monitoring Controls

These constitute part of the internal control structure and correspond to the use made by Management of the information generated by the system. Monitoring controls performed by the managerial or supervisory level of exchange houses only aim at detecting a significant problem or error and not its cause. They may indicate that one or more control objectives have not been achieved but cannot determine which ones, and therefore cannot determine the origin of the problem. From these controls arises the need to investigate errors, which is the most important aspect of this type of control.

Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 4

2.3.3. Application Controls

They constitute part of the internal control structure and correspond to controls over the initiation of transactions and over the cycle itself, i.e., the controls that assure management of the authorization, accuracy and completeness in the entry of transactions for each cycle, the integrity and accuracy in the updating of files and records and in the maintenance of accumulated data and restricted access to information, to information files and to physical assets.

The lack of an adequate control objective in the cycle allows the determination of the origin of problems or potential problems. Therefore, proper documentation of this type of controls for each relevant cycle of exchange houses is essential.

To document application controls, a uniform preparation process must be used, consisting of:

focusing the control objective and its related risks,
obtaining knowledge of how the objective is achieved,
identifying any unmet objective, and
determining the consequences that unmet objectives have for the internal control structure.

Once the first aspect is documented, special attention must be paid to the fulfillment of the second, as it corresponds to the description of the activities or control procedures that the exchange house carries out to meet the defined objective.

After the control activities – the second aspect – have been identified and documented, the internal auditor must perform tests to determine whether the controls are appropriately designed and operating.

For each control activity identified within each cycle, the auditor must document whether the established objective is achieved or not, either because the control procedures have not been properly designed or are ineffective (see control test evidence). For unmet objectives, the auditor must consider the effect on the internal control structure of the cycle and of the exchange house. If there are no unmet objectives, this must be expressly indicated.

2.3.4. Information Technology Controls

These include the need to ensure that application systems continuously operate as designed by Management or that any changes have been authorized, that information is processed systematically (i.e., in a predetermined order and manner, which must be documented) and that information is restricted to persons who truly need to access it.

First, the auditor must understand the computing environment in which the exchange house's key applications are processed and its consequences for the internal control structure. To this end, the auditor must document and update information about each computing environment in which one or more key applications are processed.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES Section 2. Methodology for Internal Control Evaluation Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 5

To that effect, the evaluation of the computing environment must cover the following aspects:

2.3.4.1. Organization and Internal Control of the Information Systems Area

Adequacy of the organization of the Systems area
Conduct a detailed survey of the structure and control procedures of the systems area to assess the organization (adequate segregation of duties with conflict‑of‑interest opposition, clear definition of responsibilities) and appropriate managerial supervision (systems plan and control of activities performed in the area).
Adequacy of the regulations and procedures for systems, programming and technical support
Identify the existence of written norms, documentation, standards and procedures that establish guidelines for the development of the area’s activities and functions, their proper application and compliance. Also identify written control procedures that provide the entity with continuous capability and certainty to produce reliable and integral information.
Control of computerized operations or processes
Identify the existence of control procedures and verify them concerning the Operations sector activities – control of process execution and correct termination, re‑processing, data backup copies, audit logs, etc.
Dependence on external providers
Determine the degree of functional dependence of the exchange house on external software and/or processing services and the overall internal control environment of the company that performs data processing. Also determine whether the contracts governing the relationship between the exchange house and the provider contain a clause establishing that the provider ensures there are no limitations for the SEFyC regarding access to data and all related technical documentation (file design, type of organization, etc.).
Control of integrity and validity of processed information
Identify procedures aimed at ensuring that data entered and processed in the system are integral and correct, through the existence of controls and/or procedures that determine appropriate entry (data validations, batch controls, control totals, etc.) and processing, including printed outputs and their distribution.

2.3.4.2. Adequacy of Implemented Logical Security

Identify and analyze the correct implementation of the logical security system, determining to what level it has been implemented and its scope; analyze its particularities, for example: the person responsible for administration, dependence, control, procedures, password characteristics, security of operations performed through electronic means, etc.

2.3.4.3. Continuity of Data Processing

Identify the existence of adequate measures that ensure the continuity of electronic data processing. This includes physical security (person entry controls, detectors, fire or smoke alarms and extinguishers, etc.), alternative processing equipment (backup), data backup copies, contingency‑emergency plan including drills, insurance, etc.

2.3.4.4. Adequacy of Tele‑processing

Identify the controls and precautionary measures established in the tele‑processing system, as an important source of inherent risk in data transfer, both in traditional and electronic systems. Analyze security, information integrity, encryption, maintenance, responsibility, segregation of duties, etc.

2.3.4.5. Application Systems

For each application system, at a minimum, the following aspects must be indicated:

background of the application (objective, technical documentation, user manuals, modifications, approximate transaction volume, etc.),
programming language,
security levels,
ownership of source code,
known problems or limitations,
description of hardware and software used in the application,
overview of network links,
use of the application in relation to resources for end users (description of end‑user software used in the application, possibility of updating production data files, customizing parameters, formulas or report formats, etc.).

Additionally, the evaluation must consider the following applications and specific aspects:

a) Management Information System for Decision‑making Determine the existence of a management information system to be used by senior management for decision‑making that is obtained and integrated in a fully computerized manner and verify its reasonableness regarding the information it provides.

b) Accounting System
Verify compliance with the authorization controls that must exist over the posting of “value‑date” entries as well as the backward‑time limits parameterized in the accounting system, according to the following guidelines: the acceptable period for such entries shall be a maximum of five (5) days for personnel entering accounting movements, and if this period is exceeded within the open month (approximately forty (40) days), transactions should only be entered with authorization from the exchange house’s highest accounting authority.

c) Information Generation for the BCRA
Determine the existence of a system that generates information for the BCRA that is obtained and integrated in a fully computerized manner and verify its validity.

2.3.4.6. Funds Transfer Systems, SWIFT and Others

Evaluate the sufficiency of control procedures and verify the controls implemented to ensure correct fund transfers. Analyze segregation of duties and conflict‑of‑interest opposition, operation registration, signature registration, transmission confirmation, information confidentiality, encryption and the implemented security system.

For any unmet information‑technology control objectives, their effect on the internal control structure must be documented (see control test evidence). Additionally, cases where objectives cannot be met due to inherent software or hardware limitations must be indicated.

2.4. Control Testing

Identifying existing control activities for each cycle is not sufficient for an adequate evaluation of the internal control system of exchange houses. It is necessary to assess whether those activities have been appropriately designed to achieve their purposes and whether they operate adequately, in accordance with their design.

This evaluation must be carried out using the following types of tests:

2.4.1. Design Tests

Design effectiveness tests of a control activity correspond to evaluating whether the activity is properly designed to meet the defined controls, and whether its proper functioning allows errors in accounting and financial information to be avoided or detected. Test procedures will vary depending on the specific control activity, the documentation of the control activity, and the complexity of the exchange house’s audited operations.

2.4.2. Operating Tests

Operating effectiveness tests refer to how the control activity is applied, the consistency with which it is applied, and who applies it throughout the entire period. Test procedures include making inquiries, inspecting documentation and observing activities and operations.

2.5. Documentation

The documentation of the internal control evaluation of each of its components must be performed annually, either from the initial survey or from successive updates.

Both the surveying of cycles and the identification, evaluation and testing of controls may be documented through narratives, flowcharts, cursograms, matrices, questionnaires or any other form that clearly shows the process followed and the existing controls.

Such documentation must contain, for each activity of each exchange‑house cycle, a conclusion on the compliance with the defined control objectives and, where applicable, its effect on the control structure. These conclusions shall be reflected, to the extent of their significance, in a report per cycle that will be sent to the Internal Control Officer and the Board of Directors.

Reports for each relevant cycle must have a minimum periodicity of at least one year (as provided in Section 4).

The internal audit of exchange houses must apply sufficient substantive procedures that ensure (a) the existence, ownership and integrity of accounting records, (b) their proper valuation in accordance with the accounting standards issued by the BCRA, and (c) compliance with the regulations issued by the BCRA.

To this end, the internal audit of exchange houses must apply its substantive procedures with the minimum frequency indicated below, unless a risk assessment performed in accordance with these standards indicates the need to increase the review frequency:

Central House: substantive procedures must be applied, considering that all sectors of the exchange house must be reviewed at least once a year. This frequency must be quarterly for those sectors that, due to their importance, complexity, involved risks or other circumstances, warrant it.
Branches: each branch must be reviewed individually at least once a year. The frequency must increase for those that, due to their importance, complexity, involved risks or other circumstances, warrant it.

The nature and scope of the substantive procedures will be determined by the Internal Control Officer according to his/her judgment and the parameters set during the planning stage. The scope and nature of such procedures may be modified during the execution of the tasks, insofar as the Officer deems it appropriate and it does not affect the audit objectives.

Substantive procedures to be applied in these reviews must include the following:

Cash and/or securities counts.
Verification of reconciliations with local and foreign correspondent banks, analyzing, where applicable, pending items with supporting documentation and their subsequent regularization within reasonable timeframes.
Participation in the execution of physical inventories of fixed assets and other assets.
Review of the most significant profit‑and‑loss accounts, using global tests, re‑processing and/or inspection of documentation supporting the originating transactions.
Review of the proper calculation of the General Exchange Position, as well as compliance with the established limit for it.
Verification of compliance with the per‑person dollar‑sale limits.
Verification of compliance with the rules on the requirement and integration of minimum capital.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES Section 3. Substantive Tests Version: 3a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 1

As a consequence of the work performed to evaluate internal control, the Internal Control Officer shall prepare reports according to the modalities deemed appropriate, which may therefore reflect partial aspects of the control task.

These reports must contain a description of the scope of the work performed, observed deficiencies, their effects on the control structure or accounting information, as well as recommendations to remedy them. Such reports must be issued for each evaluated relevant cycle, at least once a year, and may be issued more frequently to the extent the auditor deems necessary. They will be recorded in a special Internal Control book prepared for this purpose and sent to the Board of Directors or equivalent authority for acknowledgment at the first meeting following its issuance.

In addition, the Internal Control Officer must send to the Board of Directors or equivalent authority, at least bimonthly, a report containing a summary of the evaluated cycles, control tests and substantive tests performed during the period, in line with the planned work, the scope achieved and the opinion on the results.

B.C.R.A. MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES Section 4. Internal Audit Reports Version: 2a. COMMUNICATION “A” 6832 Effective date: 16/11/2019 Page 1

Ordered Text	Source Norm	Observations	Sec.	Point	Paragraph	Communication	Annex	Point	Paragraph
“A” 4133	According to Comm. “A” 6184 and 6832.
“A” 4133	According to Comm. “A” 4608, 6184 and 6832.
“A” 4133	According to Comm. “A” 4608, 6184 and 6832.
“A” 4133	According to Comm. “A” 6184 and 6832.

B.C.R.A. SOURCE OF THE PROVISIONS CONTAINED IN THE “MINIMUM STANDARDS ON INTERNAL CONTROLS FOR EXCHANGE HOUSES”