Compilation of Payment System Rules - Modifications in Books I, II, III and VI

Compilation of Payment System Rules - Modifications in Books I, II, III and VI Montevideo, December 11, 2023 CIRCULAR NO. 2441 Ref: It is brought to your attention that this Central Bank adopted, on December 6, 2023, Resolution No. D/385/2023, which is attached.

DE HEROS MENDEZ, ANA CLAUDIA PAYMENT SYSTEM MANAGEMENT

1 Diagonal Fabini 777 - C.P. 11100 - Tel.: (598 2) 1967 - Montevideo, Uruguay - www.bcu.gub.uy

DIRECTORATE - RESOLUTION Montevideo, December 6, 2023.

DIRECTORATE

HAVING VIEWED: the "Rapid Payment System" project created within the framework of the Payment System Roadmap with lines of action for the years 2023 to 2025.

RESULTING: I) that among the objectives set by the Central Bank of Uruguay and incorporated in the Payment System Roadmap for the 2023-2025 period, the implementation of a rapid payment system in line with international best practices stands out; II) that by resolution D/13/2023 of January 18, 2023, a multidisciplinary and cross-functional working group was created to implement the aforementioned project; III) that by resolution D/17/2023 dated January 18, 2023, a new reporting line to the Directorate named Payment System Management was created.

CONSIDERING: I) that the current regulation must be updated to reflect the particularities of the operational framework and technological infrastructure of the rapid payment system, as well as the specific risks of an operation characterized by immediacy; II) that it is also necessary to create specific accounts for the settlement of operations arising from the rapid payment clearing house, in order to increase the scope of the intraday liquidity provision tool, with the objective of facilitating the settlement process of the rapid payment clearing house, as well as incorporating provisions for automated clearing houses regarding corporate governance, risk management, operational manuals, obligations of administrators and participants; III) that a proposal for modification of the Compilation of Payment System Rules has been prepared, which covers all aspects for rapid payment system operations, as well as changes in the structure of the Payment System Management and other adjustments to prudential rules; IV) that the regulatory project was submitted to public consultation, having considered some of the observations made by the Payment System Management and incorporated into the proposal.

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 156 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

ATTENTIVE: to the above, to the provisions of Article 3 letter B) and Article 7 letter G) of Law No. 16.696 of March 30, 1995 and amendments, to Articles 19 to 21 of Law No. 18.573 of September 30, 2009, to the Compilation of Payment System Rules, to resolutions D/13/2023 and D/17/2023 of January 18, 2023, to the legal opinion No. 2023/0309 of August 3, 2023, to what was reported by the Payment System Management on December 4, 2023 and other background information appearing in file No. 2023-50-1-0919,

IT IS RESOLVED:

1. Substitute Article 2 of Part One of Book I of the Compilation of Payment System Rules, with the following: Article 2 (CLASSIFICATION OF CURRENT ACCOUNTS). Current accounts will be classified as common, restricted, special, and rapid based on the type of institution and the operations that the Central Bank of Uruguay authorizes them to perform in its settlement system.

2. Substitute Article 2.4 of Part One of Book I of the Compilation of Payment System Rules, with the following: Article 2.4 (RAPID ACCOUNTS). Rapid current accounts are for exclusive use in the settlement of operations arising from the rapid payment clearing house. The administration of these accounts will be the responsibility of said clearing house under the conditions established by the Payment System Management.

3. Incorporate Article 2.5 into Part One of Book I of the Compilation of Payment System Rules, with the following content: Article 2.5 (EXCEPTIONS). The Central Bank of Uruguay may establish restrictions on the use of common current accounts as well as allow institutions holding restricted current accounts to carry out specific operations other than those determined in accordance with Article 2.2.

4. Substitute Article 3 of Part One of Book I of the Compilation of Payment System Rules, with the following: Article 3 (OPENING OF COMMON CURRENT ACCOUNT). The Central Bank of Uruguay may authorize the opening of common current accounts to the following types of institutions, provided they meet the requirements referred to in Article 5: financial intermediation companies, pension savings fund administrators, insurance companies and mutuals, financial services companies, electronic money issuing institutions, electronic payment method acquirers, exchange houses, credit administration companies, public and para-public bodies, Ministry of Economy and Finance, central counterparty entities, issuers of public offer securities, stock exchanges, securities intermediaries, investment fund administration companies, and state participation companies.

The Directorate of the Central Bank of Uruguay may authorize the opening of common current accounts to other entities not mentioned in the previous paragraph.

5. Incorporate Article 3.4 into Part One of Book I of the Compilation of Payment System Rules, with the following content: Article 3.4 (OPENING OF RAPID CURRENT ACCOUNT). Direct participants authorized by the administrator of the rapid payment clearing house will request the opening of a rapid current account, in addition to the opening of the common current account provided for in Article 3.

6. Substitute Articles 4 to 10 of Book I of the Compilation of Payment System Rules, with the following: Article 4 (CURRENCY). The Central Bank of Uruguay may authorize the opening of common, restricted, or rapid current accounts in national currency or foreign currency. Foreign currency current accounts will only be opened in currencies in which the Central Bank of Uruguay maintains a correspondent relationship.

Article 5 (REQUIREMENTS). In addition to the presentation of the information or documentation requested by the Central Bank of Uruguay, in order to authorize the opening of common and rapid current accounts, the institution must have the approval of the Compliance Officer of the Central Bank of Uruguay, and must present and complete all information requested by said officer.

Article 6 (ACCOUNT BALANCES). Account-holding institutions must maintain daily credit balances in their national currency current accounts and in each of their foreign currency current accounts to cover all operations processed through said accounts and to cover debits arising from their relationship with the Central Bank of Uruguay.

The Payment System Management may require institutions to maintain a minimum credit balance, depending on the uses they make of their current accounts.

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 157 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

Article 7 (PROVISION OF FUNDS IN NATIONAL CURRENCY). Account-holding institutions will provide funds to their current accounts through credits effected by: a. deposits of banknotes and coins under the conditions established by the Central Bank of Uruguay; b. transfers issued by other account-holding institutions on their accounts and carried out through the settlement system administered by the Central Bank of Uruguay; c. clearing of payment instruments in authorized Clearing Houses; d. compliance with written instructions given by other account-holding institutions and received by the Settlement System Department, under the conditions communicated by the Central Bank of Uruguay; e. operations carried out with the Central Bank of Uruguay; f. operations arising from the settlement of market operations.

Article 8 (WITHDRAWAL OF FUNDS IN NATIONAL CURRENCY). Account-holding institutions will withdraw funds from their current accounts through debits effected by: a. transfers entered by the account-holding institution from the settlement systems administered by this Central Bank for other account-holding institutions; b. clearing of payment instruments in authorized Clearing Houses; c. the Settlement System Department of the Central Bank of Uruguay in compliance with written instructions given by said institutions, under the conditions communicated by the Central Bank of Uruguay; d. operations carried out with the Central Bank of Uruguay; e. operations arising from the settlement of market operations.

Article 9 (PROVISION OF FUNDS IN FOREIGN CURRENCY). Account-holding institutions must provide funds in their foreign currency current accounts through credits effected by:

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 158 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

a. Transfers to accounts of the Central Bank of Uruguay at foreign correspondents, provided that the funds come from the account-holding institution's own accounts at correspondents and that said institutions abroad are not on sanctions lists or do not come from countries that are not cooperative with competent bodies in the prevention and control of money laundering and terrorist financing; b. Transfers received in the settlement system, originating from other account-holding institutions on their accounts registered at the Central Bank of Uruguay; c. compliance with written instructions given by other account-holding institutions and received by the Settlement System Department, under the conditions communicated by the Central Bank of Uruguay; d. operations with the Central Bank of Uruguay; e. operations arising from the settlement of market transactions.

Article 10 (WITHDRAWAL OF FUNDS IN FOREIGN CURRENCY). Account-holding institutions will withdraw funds from their foreign currency current accounts through debits effected by: a. transfers made through the settlement systems for other account-holding institutions; b. drafts or transfers abroad to own accounts at correspondents that are not on sanctions lists or do not come from countries that are not cooperative with competent bodies in the prevention and control of money laundering and terrorist financing, provided they do not have a prohibition on transferring abroad; c. the Settlement System Department of the Central Bank of Uruguay, in compliance with written instructions given by said institutions, under the conditions communicated by the Central Bank of Uruguay; d. operations directly related to the Central Bank of Uruguay; e. operations arising from the settlement of market transactions.

7. Substitute Article 17 of Book II of the Compilation of Payment System Rules, with the following:

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 159 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

Article 17 (CURRENCY). Operations for intraday liquidity facilities will be exclusively in national currency. The Directorate of the Central Bank of Uruguay may authorize, for well-founded reasons of opportunity and convenience, the offering of intraday liquidity facility operations in other currencies, provided that the affected instruments are expressed in that same currency. In the latter case, the Payment System Management will establish the guarantee mechanism and the conditions under which the authorized operation will be governed.

8. Substitute Articles 20 and 21 of Book II of the Compilation of Payment System Rules, with the following:

Article 20 (CONSTITUTION OF THE OPERATION). In order to cover the debit balance of the day's operations in national currency, institutions may submit the request for intraday liquidity facility throughout the operating hours of the Central Settlement System. In order to give fluidity to the system, the Central Bank of Uruguay may enter such operation on behalf of the institution. Institutions may delegate the request for the constitution of the operation to third parties expressly authorized, for the settlement of specific operations, under the conditions established by the Payment System Management.

Article 21 (CANCELLATION OF THE OPERATION). Intraday liquidity facility operations must be cancelled during the day by the institution or by the Central Bank of Uruguay, through the provision of funds. Those operations that have not been cancelled before closing time will be cancelled by the administrator of the settlement system, provided there are sufficient funds in the current account.

In the event of insufficient funds, the Central Bank of Uruguay's Central Settlement System will cancel pending balances by converting them into a repurchase agreement operation for one day at the maximum penalty rate. In this case, the values affected by the operation will be those assigned by the institution to the securities portfolio for money market operations, and therefore the instruments will be specifically affected. In the event of not having sufficient securities in that portfolio, the Central Bank of Uruguay may assign the available values in the intraday liquidity facility portfolio to the securities portfolio destined for market operations. If insufficiency persists, the BCU may assign eligible values from its own account and freely available, based on the nearest maturity or other criteria established by the Payment System Management.

9. Substitute Articles 37 and 38 of Chapter IV of Part One of Title II of Book III of the Compilation of Payment System Rules, with the following:

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 160 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

Article 37 (INTRADAY LIQUIDITY). In order to facilitate the functioning of the Payment System, providing fluidity to the settlement of electronic clearing in national currency, the Central Bank of Uruguay makes available to supervised or monitored institutions the intraday liquidity provision mechanism, purchase of public securities with commitment to sell on the same day, provided for in Articles 15 and following.

Article 38 (INSTRUMENTS ADMITTED FOR INTRADAY LIQUIDITY). The Central Bank of Uruguay will accept for the constitution of these operations, portfolios of public securities, deposits and current account balances, at the Central Bank of Uruguay, in national currency, indexed units and pension units. The instruments must be owned by the institution, freely available, and registered for these purposes at the Central Bank of Uruguay.

10. Substitute Article 60 of Part One of Book VI of the Compilation of Payment System Rules, with the following:

Article 60 (DEFINITIONS) For the purposes of this Book, the following shall be understood:

Automated Clearing Houses: (hereinafter ACC) electronic clearing systems in which payment orders are exchanged between participants and are administered by at least one data processing center. This definition includes clearing houses that process payments that will be credited in a deferred manner and clearing houses that process rapid payments, which will be credited immediately in the beneficiary's account.

Administrator: is the entity authorized to operate the system.

Beneficiary: is the final recipient of the funds sent through the ACC.

Direct Participant: entity authorized to send or receive payment orders and electronic transfer instructions within the system. This category includes financial institutions, public bodies, electronic money issuing institutions, electronic payment method acquirers, and any other entity authorized for these purposes by the ACC and whose participation has the favorable opinion of the BCU.

Indirect Participant: entity or natural person that settles its transactions in the books of direct participants and not in its own accounts at the clearing institution.

Operational Risk: is the risk that deficiencies in information systems or internal processes, human or management errors, or disturbances caused by external events, result in reduction, deterioration, or interruption of services.

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 161 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

Electronic Transfer: is a payment order or a sequence of payment orders made with the aim of making funds available to the beneficiary, and in whose clearing and settlement process one or more direct participants or systems authorized to operate in the country intervene.

Credit Electronic Transfer: is an electronic transfer in which both payment instructions and funds move from the entity where the payer has funds deposited to the entity where the beneficiary holds their account or instrument.

Debit Electronic Transfer: collection order or sequence of collection orders directed from the beneficiary's entity to the payer's entity and which, once authorized by the payer's entity, result in a charge (debit) to the payer's account or instrument and a credit to the beneficiary's account or instrument. In the clearing and settlement process, several direct participants or systems authorized to operate in the country may intervene.

Bank Draft: payment order or sequence of payment orders made with the aim of making funds available to the beneficiary, and where the instruction specifies that the funds are delivered in cash to the beneficiary or where the drawer pays or deposits in cash for subsequent sending to the recipient's account at another Institution. This operation allows sending money or paying services by persons or agents without using accounts in the financial system.

Data Processing: Data processing is understood as the execution of any action on data that achieves a transformation in them, including the change of medium in which they are supported.

Integrated Risk Management: Integrated risk management system is understood as the set of policies, procedures, and control mechanisms implemented by the ACC to promote adequate identification, measurement, control, and monitoring of the risks to which it is exposed.

11. Substitute Articles 62 to 64 of Book VI of the Compilation of Payment System Rules, with the following:

Article 62 (SCOPE OF APPLICATION). This Book shall apply to: a. electronic payment transaction clearing operations that derive from payment obligations arising from credit card, debit, common or rapid credit or debit electronic transfers, ATM operations, Internet transactions, cell phone, and other mechanisms used to order electronic payments, which must be cleared mandatorily through an ACC, when the participation of more than one direct participant is required; b. the clearing and settlement processes of transactions; c. the role of the ACC administrator and its participants; d. the systems used to perform electronic clearing;

The electronic clearing of checks and bills of exchange shall be governed by this regulation in all those aspects not contemplated in its specific regulation. Without prejudice to the transactions defined in letter a), the Central Bank of Uruguay may authorize new electronic payment instruments that will be processed through the ACCs.

Article 63 (REQUEST FOR AUTHORIZATION TO START ACTIVITIES). The operation of ACCs requires prior authorization from the Central Bank of Uruguay, which will be granted by Resolution of its Directorate with the prior report of the Payment System Management.

For the purpose of requesting authorization, the following is required:

1. Constitute a commercial company whose corporate purpose includes the administration and operation of an electronic payment clearing system. In the event that the company develops more than one activity, the same/s must be related to the one regulated. The bylaws or social contract must establish that to proceed with the transfer of social quotas or shares, prior authorization from the Central Bank of Uruguay must be obtained, which may deny it for reasons of legality, opportunity, or convenience. In the event of constituting a joint-stock company, it will be required that its shares be nominal or book-entry. It will be admitted to carry out operations that in the judgment of the BCU result as complementary or related to the main activity, provided that prior authorization from the BCU is obtained.
2. Submit the corresponding request to the Payment System Management, attaching the following documentation: a. Approved or pending approval Bylaws or Social Contract. b. List of Directors, partners or shareholders, and legal representatives of the company, with their identification data. c. List of Senior Management members, accompanied by Curriculum Vitae, professional and labor references related to the reference business or to the financial activity in general.

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 162 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 163 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION

R.No.: D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio no. 164 CIRCULAR NO. 2441

DIRECTORATE - RESOLUTION d. Organizational structure and planned staffing for the execution of the operations. e. Business Plan for the first four years of activity. f. Technological specifications to be used for the provision of the service. g. Internal operating standards containing the requirements established in this regulation. h. Model contract to be signed with the participants of the CCA. The Payments System Management will determine the manner of compliance with each of these points. The BCU may request any additional information it deems necessary for the purposes of authorizing the administrator, which may include a demonstration of its functioning. Article 64 (REQUEST FOR OTHER AUTHORIZATIONS). Prior authorization from the Payments System Management will also be necessary for activities intended to be incorporated after the granting of the authorization and which are related to: a. Modification of internal operating standards b. Incorporation of services or payment instruments. c. Outsourcing of operations or processes linked to its main activity, taking into account the restriction established in the fourth paragraph of Article 64.1. d. Use of the brand, logo, or identification of the product and/or services offered by the CCA. e. Hiring of External Audit services. To authorize modifications, incorporate services or instruments, or outsource functions, it will be necessary to submit an explanatory note with the corresponding data, background, and documentation. The Payments System Management will determine the manner of compliance. 12) Incorporate Articles 64.1 and 64.2 into Part Two of Book VI of the Compilation of Payment System Regulations, with the following content: R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 165 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION Article 64.1 (OUTSOURCING OF SERVICES). CCAs must request prior authorization from the Payments System Management for the hiring of third parties to provide on their behalf those services inherent to their business that, when performed by the entities administering the CCAs themselves, are subject to regulation and control by the BCU. The companies providing the outsourced services will be subject, with respect to those activities, to the same standards that govern when they are performed by the controlled entities, with the exception of those of a sanctioning nature. The Central Bank of Uruguay will have full access to the data, systems, and technical documentation related to the outsourced service held by the provider, as well as may conduct periodic audits at the provider's facilities, for the purpose of evaluating risks and verifying compliance with all aspects contemplated in the regulations. Outsourcing does not in any case exempt or limit the responsibility that the law or regulations impose on the CCAs for non-compliance with their obligations. It will not be possible to outsource the provision of the administration and/or operation of the electronic payment clearing system. CCAs must have established written policies and procedures that allow for the effective identification, measurement, control, and monitoring of risks - both present and future - associated with outsourcing agreements made. In particular, they must evaluate the emerging risks of outsourcing multiple activities to the same provider. The BCU may establish that certain services will not require authorization for their hiring. In cases it deems convenient, the Payments System Management may request the presentation of a provider exit plan for services that have been outsourced. Article 64.2 (ADDITIONAL REQUIREMENTS FOR DATA PROCESSING IN OR FROM OUTSIDE THE COUNTRY). When data processing is provided by a third party located abroad or in the country, but the service is provided wholly or partially in or from abroad, the CCAs must evaluate the legal and regulatory requirements and the socioeconomic conditions existing in the host jurisdiction, which could conspire against the provider's ability to satisfactorily fulfill agreed obligations. These aspects must be verified both at the time of the initial selection of the provider and at the time of any contract renewals. The third party must have an operational mode and equipment such that they allow online access to all information from the terminals installed in the CCA at all times. With respect to the business continuity plan referred to in Article 71.1, this must be tested with successful results prior to the start of processing activity and subsequently, at least once a year. The Payments System Management may order that these tests be carried out under its supervision. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 166 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION 13) Replace Articles 66 and 67 of the Compilation of Payment System Regulations, with the following: Article 66 (CANCELLATION OR SUSPENSION). The Payments System Management may recommend to the Directorate the suspension or cancellation of the authorization to operate in case of detecting non-compliance or infractions that in its opinion are considered serious. Article 67 (OPERATING STANDARDS FOR CCAs). CCAs must comply with the following procedures:

1. Clearing Procedure: Multilateral clearing will be used for obligations between participating entities, and bilateral clearing may also be admitted.
2. Settlement Procedure: The final settlement of daily transactions will be made in the accounts that participants hold in the settlement system and must adhere to the schedules established by the settlement agent for the execution of these operations. Automated clearing houses that, in the opinion of the BCU, have systemic relevance, will settle obligatorily in the gross settlement system administered by the BCU.
3. Sending of Results: They must make available to participating entities the preliminary results obtained from the net of the day's transactions, prior to the hour established by the BCU for settlement, so that each institution knows its position and ensures the provision of necessary funds for final settlement.
4. Irrevocability of Transactions: They must establish that at the moment the payment order issued to the Chamber conforms to the controls established regarding bilateral and multilateral debit limits, it will be considered accepted and received by the Chamber and cannot be revoked by the participant. The payment obligation will be cancelled when offset against the rest of the payments exchanged, proceeding to its settlement according to the established procedures.
5. Identification of transactions from other payment systems and of the different instruments that clear: They must have operational capabilities in the information systems that allow identifying settlement transactions coming from other systems or from the different payment means that are cleared in the system. Transactions must identify the issuing client and the receiving client.
6. Statistical Information: For statistical and informational purposes, the clearing matrix will be open, by type of payment instrument processed by the system. This information must be provided to the Payments System Management of the BCU according to what the regulation establishes. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 167 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION 14) Replace Article 68 of Part Four of Book VI of the Compilation of Payment System Regulations, with the following: Article 68 (CORPORATE GOVERNANCE). CCA administrators must establish well-documented good governance policies that provide direct and clear lines of responsibility and accountability. The adopted corporate governance structures must allow for effective, verifiable, and clear decision-making. Adequate corporate governance must include: a. A clear definition of roles and responsibilities within the organization, especially of the Board of Directors and Senior Management. b. An organizational structure that allows setting objectives and means to achieve them. Objectives must assign high priority to security and efficiency. c. A business strategy, a control environment, and a risk management system, adequate information security management, and IT governance appropriate to the entity's objectives, volume, and complexity of operations. d. Effective control systems (including Internal and External Audit). e. Transparency policies in information. f. Policies, processes, and procedures that ensure the availability, resilience, and continuity of the CCA's business, including IT disaster recovery. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 168 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION The Payments System Management will regulate the minimum characteristics to be presented regarding each of these points. 15) Incorporate Article 68.1 into Part Four of Book VI of the Compilation of Payment System Regulations, with the following content: Article 68.1 (DESIGNATION OF PERSONS OCCUPYING POSITIONS OF DIRECTORS AND GENERAL MANAGER). CCAs must communicate to the BCU the designation of new directors and general manager or person exercising the highest executive authority within the organization, regardless of the title adopted for the position. The designated persons cannot take office until the Payments System Management communicates that it has no objection to the designation, or after 30 business days have elapsed. For the purpose of granting non-objection, the personal and professional background of the candidates will be evaluated. The Payments System Management will determine the minimum information necessary to carry out such evaluation. If any fact affecting the suitability of a person to continue performing the positions listed in the first paragraph of this article is found, the BCU – complying with due process guarantees – will instruct the CCA in which such person performs functions to adopt the necessary measures to correct the detected situation. 16) Replace Article 69 of Part Four of Book VI of the Compilation of Payment System Regulations, with the following: Article 69 (COMPREHENSIVE RISK MANAGEMENT). CCAs must have a comprehensive risk management system, in accordance with the nature, size, and complexity of their operations and their risk profile. As a minimum, this system must contemplate operational, legal, compliance, strategic, reputational, and money laundering, terrorism financing, and proliferation of weapons of mass destruction financing risks. The Payments System Management will establish the conditions that the comprehensive risk management system must meet. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 169 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION 17) Incorporate Articles 69.1, 69.2, and 69.3 into Part Four of Book VI of the Compilation of Payment System Regulations, with the following contents: Article 69.1 (COMPREHENSIVE RISK MANAGEMENT. DOCUMENTATION). The policies and procedures for the identification, measurement, control, and monitoring of all risks to which the CCA is exposed must be clearly defined in writing in policy and procedure manuals. Their content must be periodically reviewed based on changes in current or future circumstances, to ensure they remain aligned and prudent. Article 69.2 (COMPREHENSIVE RISK MANAGEMENT. BOARD RESPONSIBILITIES). The Board of Directors is the ultimate responsible party for the proper functioning of the comprehensive risk management system, as it competes, among other duties:

• to understand the risks faced by the CCA and the level of exposure to each type of risk, as well as to monitor changes in them.
• to approve and review - at least annually - the relevant strategies and policies regarding the management of the risks assumed by the CCA, in which the levels of risk exposure tolerance must appear.
• to ensure that Senior Management takes the necessary measures to manage each risk consistently with the referred strategies and policies, and that it has the resources required for these purposes.
• to request information that allows it to supervise the performance of Senior Management in this matter.
• to assign sufficient resources to the Internal Audit body. Likewise, seek through said bodies and External Audit, periodic validations as to whether processes, policies, procedures, and controls are being monitored and whether appropriate actions are taken against significant weaknesses or failures.
• to ensure an adequate control environment in the CCA, in accordance with the volume and nature of its operations and its risk profile, stimulating and promoting control awareness and commitment among all its personnel, integrity, and ethical values, elements that must be recorded in a Code of Ethics.
• to approve the Code of Ethics and ensure that Senior Management takes the necessary measures for its adequate implementation throughout the institution. Article 69.3 (COMPREHENSIVE RISK MANAGEMENT. SENIOR MANAGEMENT RESPONSIBILITIES). Senior Management is responsible, among others, for:
• implementing the strategy designed and duly approved by the Board of Directors or the equivalent hierarchical authority in matters of risk management;
• developing the necessary procedures and controls to manage operations and risks prudently; R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 170 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION

• maintaining an organizational structure that explicitly assigns responsibilities, authority, and reporting lines within the organization;
• ensuring that the Board of Directors or the equivalent hierarchical authority receives relevant, accurate, complete, and timely information. Likewise, with respect to the Code of Ethics, it is responsible for: a. Implementing the Code of Ethics, developing the necessary training policies so that personnel know the ethical principles and good practices contained in the Code, as well as the situations that may arise in the CCA's operations. b. Establishing effective mechanisms to receive doubts and controversies that arise regarding ethical behaviors in the performance of tasks, as well as resolving them with speed. c. Establishing procedures to guarantee the formulation of reports on unethical behaviors in a confidential manner and independent of the hierarchical chain, and providing adequate protection to employees who report illegal, unethical, or questionable practices, from any negative consequence, direct or indirect, resulting from their upright conduct. d. Verifying compliance with the Code of Ethics, correcting, and sanctioning deviations that are detected. e. Informing the Board of Directors or equivalent hierarchical authority about the implementation of the Code of Ethics and the measures adopted to strengthen the ethical culture in the organization.

18. Replace Article 70 of Part Four of Book VI of the Compilation of Payment System Regulations, with the following: Article 70 (OPERATIONAL RISK MANAGEMENT). All possible sources of operational risk, internal and external, derived from technological, human, natural, and interdependence events, must be identified, measured, controlled, and managed. For the purpose of managing operational risk:

1. The Board of Directors must approve the general principles for the management of operational risk, the risk appetite, and the institution's policies on an individual and consolidated basis and review them periodically. Likewise, it must regularly review exposure to operational risk and ensure that risk levels are within the established framework. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 171 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION 2. Senior Management must implement the policies approved by the Board of Directors and develop appropriate procedures for the identification, measurement, monitoring, and control of operational risk. These policies and procedures must consider operational risk in all CCA activities. 3. Senior Management must implement policies and develop appropriate procedures for the identification, measurement, monitoring, and control of compliance risk and report to the Board of Directors on the management of this risk. 4. The CCA must have a contingency and business continuity plan that allows operation in the occurrence of severe events. 5. The information supplied to the BCU must be reliable and timely, and there must be a responsible person in the organization for its preparation and presentation. 6. The CCA must establish mechanisms for independent and periodic review of the operational risk management process. The results of the reviews must be reported directly to the Board of Directors and Senior Management. 7. CCA administrators must keep a record of Operational Risk events, according to instructions issued by the Payments System Management. 19) Incorporate Articles 70.1 and 70.2 into Part Four of Book VI of the Compilation of Payment System Regulations, with the following contents: Article 70.1 (INFORMATION SECURITY MANAGEMENT SYSTEM). The CCA must have an information security management system aligned with international standards. The Payments System Management will establish the minimum characteristics of this System. Article 70.2 (INFORMATION RELATED TO INFORMATION SECURITY INCIDENTS). The CCA must inform the Payments System Management, under the conditions established, of information security incidents suffered, both within its technological infrastructure and in that of any outsourced service provider and that have impacted it, any participant, the regulator, or users of the financial and payment system. 20) Replace Article 71 of Part Four of Book VI of the Compilation of Payment System Regulations, with the following: Article 71 (FRAMEWORK FOR IT GOVERNANCE AND MANAGEMENT). CCA administrators must have a framework for IT governance and management that contemplates current international best practices and standards regarding control, planning, and implementation of service management and its modifications, service provision, relationship and interdependence processes, and incident resolution and control processes. The Payments System Management will establish the minimum conditions required for these frameworks. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 172 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION 21) Incorporate Articles 71.1, 71.2, and 71.3 into Part Four of Book VI of the Compilation of Payment System Regulations, with the following contents: Article 71.1 (AVAILABILITY AND BUSINESS CONTINUITY). The CCA must guarantee minimum levels of availability and resilience as required by the BCU. The CCA must have a documented plan approved by the Board of Directors, which ensures business and operational continuity in case of any event affecting facilities, equipment, data, or software, or the provision of outsourced services, preventing normal operations. Business continuity management must align with current international best practices and standards in the matter. The Payments System Management will establish the minimum characteristics that the business continuity plan and its tests must contain. Article 71.2 (INFORMATION BACKUP). CCAs must implement data and software backup and recovery procedures that guarantee that the technological infrastructure and systems used for communication, storage, and processing of data align with the CCA's information security and business continuity policies and strategies. In turn, it must be possible to reconstruct the information issued to the BCU, and any other information centralized by the operator that is considered relevant for the reconstruction of operations for regulatory purposes. In case of information backup abroad, a physical copy must be located in Uruguay and be available to the BCU if requested. The Payments System Management will establish the minimum characteristics of the backup system and process and its tests, and the cases and conditions under which exceptions to the location of a physical copy of backups in national territory will be admitted. R.N°:D-385-2023 File No.: 2023-50-1-00919 D-385-2023.pdf Folio No. 173 CIRCULAR No. 2441

DIRECTORATE - RESOLUTION Article 71.3 (RESPONSIBLE FOR DATA, SOFTWARE, AND DOCUMENTATION CUSTODY). The CCA must appoint a responsible person for data, software, and documentation backup and recovery procedures. In particular, this person shall be responsible for the custody of keys for data access and decryption, as well as ensuring that the institution has a procedure for such access and decryption that does not involve requiring authorizations or actions from personnel outside the institution's dependency. This responsible person must belong to the Senior Management of the CCA. 22) Replace Article 72 of Part Five of Book VI of the Compilation of Payment System Rules, with the following: Article 72 (CCA OPERATIONAL MANUAL). The internal operational rules referred to in Part Three of this regulation, as well as any subsequent modifications, must be authorized by the BCU prior to the issuance of the operating authorization. Its operational manual must contain the following provisions regarding:

1. Rights and obligations of participants and CCA administrators: which must contemplate the norms provided for in this regulation.
2. Corporate Governance. The manual must establish the composition of Corporate Governance, its different bodies, as well as the functions and responsibilities of each.
3. Participation requirements: they must provide clear access criteria, which contemplate the equality of participants and include technical, solvency, and conduct requirements that allow preserving the required levels of security and efficiency for operation. Likewise, compliance with the norms established by the Central Bank of Uruguay regarding the prevention of illicit operations that may be processed through the system must be required.
4. Tariff establishment: Operational rules must establish mechanisms for a clear assignment of tariffs for all parties involved in the process.
5. Provisions on sanctions, suspensions, and withdrawal of participants: Applicable sanctions for participant non-compliance, as well as procedures for suspensions or withdrawals of participants by judicial or administrative decision, must be clearly established.
6. Procedure for resolving incidents and conflicts: Mechanisms and procedures for resolving conflicts that may arise between participants will be defined.
7. Compensation and settlement operational procedures: It must establish the procedures for the daily operation of compensation and settlement in accordance with the guidelines provided in Part Three of this regulation, internationally accepted principles, and the provisions issued by the Central Bank of Uruguay.
8. Process schedules: In the case of the chamber with deferred credit in the beneficiary's account, the operating schedule must be established in such a way that the validation and processing of the transaction can be completed by the receiving participant in t+0, and the transaction must be effective in t+0. It will be admitted to establish more than one daily compensation and settlement schedule. The internal manual must contain the detailed schedule/s in which the different stages of the process will be carried out. Operations subject to schedules must include at least transactions of: a. Sending of instructions by the sender. b. Reception and forwarding to the receiver by the CCA administrator. c. Validation by the receiver and submission of rejections to the CCA administrator. d. Bilateral and multilateral compensation and consolidation of partial and final results by the CCA administrator. e. Submission of partial and final results to the BCU. f. Settlement of results in the participants' accounts at the BCU and effective annotation in the receiver's account. The internal operational rules will establish the chronological order and the schedules in which these stages must be carried out, taking into account compliance with the schedules established by the BCU to carry out the reservation of funds, the availability of the guarantees established in Part Six, and the final settlement in the participants' accounts at the BCU. In the case of the fast payment chamber, the system must be available 24 hours a day, every day of the year. The validation and credit of the transaction in the beneficiary's account must be completed immediately. More than one compensation and settlement cycle will be admitted in the clearing agent.
9. Risk management mechanisms: Operational rules must specify the internal controls that both participants and the chamber administrator must carry out to comprehensively manage the risks to which they are exposed. Regarding credit and liquidity risk management, in addition to what is established in the previous paragraph, the chamber administrator must establish maximum operation limits per participant (bilateral and multilateral limits) and require them to maintain individual and collective guarantees. Likewise, they must agree on the mechanisms for the return of guarantees when they are used. In particular for the case of the fast payment chamber, liquidity management must be carried out considering the moment when the transaction is processed: – Settlement system in enabled hours (ONLINE): The fast payment chamber may send a compensation to be settled each time a participant reaches 80% of the maximum tolerated exposure while the central settlement system is within the hours enabled to receive transactions. The participant or, in their absence, the fast payment chamber must reconstitute the balances of the fast accounts up to the minimum amount fixed by the chamber prior to the next compensation. – Settlement system not enabled (OFFLINE): The chamber must verify the sufficiency of balance for the settlement of operations. Once the balance in the fast account has reached 50% of the maximum tolerated exposure, the chamber must notify the participant. When the balance reaches 80%, the enabled liquidity provision mechanisms must be activated, based on the criteria ordered by the participant in amounts and items.
10. Compliance with AML/CFT rules: Internal operational rules must provide that participants comply with all applicable anti-money laundering and counter-terrorist financing rules based on the activities they carry out.
11. Requirements to use the temporary liquidity provision mechanism provided for in Book II of the Compilation of Payment System Rules: Automated Clearing Houses that settle in the Central Settlement System of the Central Bank of Uruguay must require their participants to comply with all necessary requirements to use the temporary liquidity provision mechanism provided for in Book II of the Compilation of Payment System Rules.

23. Replace Article 74 of Part Six of Book VI of the Compilation of Payment System Rules, with the following: Article 74 (CONSTITUTION OF GUARANTEES). Participating institutions of the CCA must have individual guarantees which will consist of demand deposits constituted at the BCU, for each of the currencies in which the participant operates in the chamber. Individual guarantees will be constituted in the BCU's Central Settlement System (LBTR), as a sub-position of the participant's current account and therefore forming part of its balance but being available only for the purposes of settling operations arising from the CCA. The provisions in the preceding paragraphs do not apply to the fast payment chamber. Collective guarantees will be constituted with contributions from participants in money or in a portfolio of local public issuance securities and will be managed by the chamber administrator. The execution of guarantees (individual and collective) will be ordered by the CCA administrator. The minimum amounts of both guarantees will be determined by the CCA administrator. Without prejudice to this, the Payment System Management may demand, at any time, their modification in value or in kind. Transitional Provision: The Payment System Management will establish when these guarantees will enter into force.
24. Replace Articles 77 and 78 of Part Eight of Book VI of the Compilation of Payment System Rules, with the following: Article 77 (PARTICIPANT REQUIREMENTS). Entities under the supervision or surveillance of the BCU that demonstrate compliance with the requirements required for the development of their activity may participate in automated clearing houses. The BCU may specifically authorize the participation of other types of entities. Article 78 (PARTICIPANT OBLIGATIONS). Direct participants are obliged to:

1. Release funds in t+0 when the result of the compensation of transactions processed through the CCA implies a net debit balance for them.
2. Comply with the admission requirements established by the CCA administrator to access its services.
3. Sign a participation contract with the CCA system administrator in which they commit to participate in the compensation processes and comply with the provisions contained in this regulation and in the internal regulations regulating CCA operations issued by the administrator.
4. Provide the guarantees required in this regulation and in the CCA's internal regulations, which may be constituted in public securities or in funds deposited in a reserve account, as established by the BCU.
5. Have the technological means established by the CCA administrator and the BCU to access the services for the transmission of electronic instructions, compensation, and settlement of transactions, which must comply with the same information security standards of the system authorized by the BCU.
6. When the participant does not have the necessary funds at the time of settlement to cover the net debit balance arising from compensation, they are obliged to take the corresponding precautions to provide funds to their accounts to comply with the settlement processes described in this book, as well as with the provisions of the operating regulations. If the settlement corresponds to fast payment operations, the participant must ensure the availability of funds through the mechanisms established in Book II of this Compilation of Rules.
7. Provide the Payment System Management with the information they request.
8. Comply with all applicable anti-money laundering and counter-terrorist financing rules based on the activities carried out by each participant.
9. Make the corresponding credits to the beneficiary's accounts within t+0 when participating in the chamber with deferred settlement or immediately in the case of transactions derived from the fast payment chamber.
10. Establish a framework for fraud control that includes due identification, authentication, authorization, and audit in every operation sent to the CCA, as well as for the natural and legal persons involved in each operation, and their respective participant accounts of the same. Likewise, they must collaborate with the CCA in fraud control activities agreed upon between the parties.
11. In the case of fast payments, comply with the duty to inform users, so that they are the ones who choose, freely and informed, to use the fast payment mechanism over other instruments.

25. Entrust the communication of what is provided herein, by Circular, to the Payment System Management. (Today's Session – Minutes No. 3684) (File No. 2023-50-1-0919) Jorge Christy General Secretary Am/ds Publishable Resolution Signer: Jorge Eduardo Christy Davies Date: 06/12/2023 17:48:50