Compilation of Securities Market Regulations - Errata - Circular No. 2507 of July 16, 2026

1 Montevideo, August 7, 2026 Ref: COMPILATION OF SECURITIES MARKET REGULATIONS - ERRATA - CIRCULAR NO. 2507 of July 16, 2026. The market is informed that the Superintendent of Financial Services adopted Resolution SSF No. 2026-510 on August 6, 2026.

2025-50-1-02290 Diagonal Fabini 777 - C.P. 11100 - Tel.: (598 2) 1967 - Montevideo, Uruguay - www.bcu.gub.uy JORGE PONCE Intendant of Financial Regulation

CIRCULAR NO. 2508

SUPERINTENDENCY OF FINANCIAL SERVICES – RESOLUTION SUPERINTENDENCY OF FINANCIAL SERVICES

VISTO: Circular No. 2507 of July 16, 2026, which regulated the activity of virtual asset service providers.

RESULTING: I. That in Circular No. 2507 of July 16, 2026, an error occurred in providing for the substitution of Articles 198.2, 198.3, and 204.2 of the Compilation of Securities Market Regulations, as these articles did not form part of said Compilation at the date of issuance of the Circular. II. That, on the other hand, in the aforementioned Article 198.3 regarding the identification of holders or ordering parties in received virtual asset transfers, a grace period was omitted to allow virtual asset service providers to adapt their systems to the provisions thereof.

CONSIDERING: I. That it corresponds to incorporate Articles 198.2, 198.3, and 204.2 into the Compilation of Securities Market Regulations, maintaining the content approved by Circular No. 2507. II. That it is understood to be convenient to incorporate into Article 198.3 a transitional provision to grant virtual asset service providers a period until December 31, 2027, to adapt their systems to the provisions of said article.

ATTENTIVE: To the provisions of Articles 37 and 38 of Law No. 16.696 of March 30, 1995, in the wording given by Articles 693 and 694 of Law No. 20.446 of December 16, 2025, respectively, in MM/2026/00207 of July 20, 2026, and in the proceedings contained in file 2025-50-1-02290.

THE INTENDANT OF FINANCIAL REGULATION IN EXERCISE OF DELEGATED AND COMMITTED ATTRIBUTES AS SUPERINTENDENT OF FINANCIAL SERVICES RESOLVES: RR-SSF-2026-510 Date: 06/08/2026 14:21:39 CIRCULAR NO. 2508

1. INCORPORATE into Chapter II - POLICIES AND PROCEDURES OF DUE DILIGENCE REGARDING CLIENTS of Title I - PREVENTION OF THE USE OF SECURITIES INTERMEDIARIES, INVESTMENT FUND MANAGEMENT COMPANIES, AND VIRTUAL ASSET SERVICE PROVIDERS FOR MONEY LAUNDERING, TERRORISM FINANCING, AND FINANCING OF WEAPONS OF MASS DESTRUCTION of Book III - PROTECTION OF THE FINANCIAL SYSTEM AGAINST ILLEGAL ACTIVITIES of the Compilation of Securities Market Regulations the following articles:

ARTICLE 198.2 (IDENTIFICATION OF THE HOLDER OR ORDERING PARTY IN VIRTUAL ASSET TRANSFERS ISSUED BY VIRTUAL ASSET SERVICE PROVIDERS).

Virtual asset service providers that originate virtual asset transfers - domestic or with the outside - must include, in the message itself instructing the transfer, precise and significant information regarding the holder or ordering party, including - at minimum - information on:

A. Natural Person:

• full name
• home address
• date and place of birth
• identity card or identification number
• account number and type (when this is used to process the transaction) or virtual asset wallet address, as applicable. In the event that there is no account, the reference code that has a function equivalent to the account number.
• date of the transfer
• transaction identifier that allows for its tracing
• type and quantity of each virtual asset transferred
• exchange rates used and their source

B. Legal Entity:

• company name (legal name and trade name if applicable)
• Unique Tax Registry number of the General Tax Directorate and of the Social Security Bank
• real and constituted domicile
• natural person representing it in the transaction, proceeding to verify information on their identity and representation
• account number and type (when this is used to process the transaction) or virtual asset wallet address, as applicable. In the event that there is no account, the reference code that has a function equivalent to the account number.
• date of the transfer
• transaction identifier that allows for its tracing
• type and quantity of each virtual asset transferred
• exchange rates used and their source

The prior consent of the client will be obtained. If the client does not grant the requested authorization, the provider shall not process the operation.

Virtual asset service providers must also adequately identify the beneficiaries of the issued transfers, recording in the message itself identical information to that required for the holder or ordering party.

In the case of domestic transfers for amounts less than or equal to US$ 1,000 (one thousand US dollars) or its equivalent in other currencies, the message may include only the account number of the ordering party and beneficiary, provided that the originating institution can trace the transaction and complete the information upon request of the beneficiary institution or competent authorities within a maximum period of 48 (forty-eight) business hours.

Virtual asset service providers shall not process transfers if they do not have all the data required above.

For the purposes of this article, virtual asset transfers comprise domestic and foreign transfers, received and issued by virtual asset service providers, being the counterparty another virtual asset service provider and regardless of the operational modality used for its execution.

TRANSITIONAL PROVISION: Virtual asset service providers will have until December 31, 2027, to adapt their systems to the provisions of this article.

ARTICLE 198.3 (IDENTIFICATION OF THE HOLDER OR ORDERING PARTY IN VIRTUAL ASSET TRANSFERS RECEIVED BY VIRTUAL ASSET SERVICE PROVIDERS).

Virtual asset service providers that receive virtual asset transfers - domestic or from abroad - must have effective procedures that allow obtaining precise and significant information regarding the holder or ordering party, including - at minimum - information on:

A. Natural Person:

• full name
• home address
• date and place of birth
• identity card or identification number
• account number and type (when this is used to process the transaction) or virtual asset wallet address, as applicable. In the event that there is no account, the reference code that has a function equivalent to the account number.
• date of receipt
• transaction identifier that allows for its tracing
• type and quantity of each virtual asset received
• date of the remittance
• exchange rates used for the remittance and their origin
• if the remittance is in virtual currency: type and quantity of each currency involved in the remittance
• if the remittance is not in virtual currency: type of remittance and its value, if it differs from the amount of virtual currency received
• proof of virtual currency exchange transaction with respect to each virtual currency exchange transaction.

B. Legal Entity:

• company name (legal name and trade name if applicable)
• Unique Tax Registry number of the General Tax Directorate and of the Social Security Bank
• real and constituted domicile
• natural person representing it in the transaction, proceeding to verify information on their identity and representation
• account number and type (when this is used to process the transaction) or virtual asset wallet address, as applicable. In the event that there is no account, the reference code that has a function equivalent to the account number.
• date of receipt
• transaction identifier that allows for its tracing
• type and quantity of each virtual asset received
• date of the remittance
• exchange rates used for the remittance and their origin
• if the remittance is in virtual currency: type and quantity of each currency involved in the remittance
• if the remittance is not in virtual currency: type of remittance and its value, if it differs from the amount of virtual currency received
• proof of virtual currency exchange transaction with respect to each virtual currency exchange transaction.

They must also conduct a detailed examination of said transfers to determine if they constitute an unusual or suspicious transaction that must be reported to the Financial Information and Analysis Unit. The receiving provider must consider the convenience of restricting or terminating their business relationship with those virtual asset service providers that do not comply with standards in matters of identification of transfer ordering parties.

Virtual asset service providers must also adequately identify the beneficiaries of the received transfers, recording in the message itself identical information to that required for the holder or ordering party.

When it comes to domestic transfers for amounts less than or equal to US$ 1,000 (one thousand US dollars) or its equivalent in other currencies, the information may include only the account number of the ordering party and beneficiary, provided that the receiving institution can trace the transaction and complete the information upon request of the beneficiary institution or competent authorities within a maximum period of 48 (forty-eight) business hours.

Virtual asset service providers shall not receive transfers if they do not have all the data required above.

TRANSITIONAL PROVISION: Virtual asset service providers will have until December 31, 2027, to adapt their systems to the provisions of this article.

2. INCORPORATE into Chapter III - VERIFICATION OF LISTS, PREVENTIVE FREEZING, AND REPORTING of Title I - PREVENTION OF THE USE OF SECURITIES INTERMEDIARIES, INVESTMENT FUND MANAGEMENT COMPANIES, AND VIRTUAL ASSET SERVICE PROVIDERS FOR MONEY LAUNDERING, TERRORISM FINANCING, AND FINANCING OF WEAPONS OF MASS DESTRUCTION of Book III - PROTECTION OF THE FINANCIAL SYSTEM AGAINST ILLEGAL ACTIVITIES of the Compilation of Securities Market Regulations the following article:

ARTICLE 204.2 (REPORTING OF FINANCIAL TRANSACTIONS - VIRTUAL ASSET SERVICE PROVIDERS).

Virtual asset service providers must provide the Financial Information and Analysis Unit with information on natural or legal persons who carry out the following transactions:

i. receipt of cash from clients for amounts greater than US$ 10,000 (ten thousand US dollars) or its equivalent in other currencies. ii. cash withdrawals from clients for amounts greater than US$ 10,000 (ten thousand US dollars) or its equivalent in other currencies. iii. receipt of funds (both from clients and from third parties for clients) via drafts and local or foreign transfers, for amounts greater than US$ 1,000 (one thousand US dollars) or its equivalent in other currencies, regardless of the operational modality used for its execution. iv. delivery of funds (either to clients or to third parties on behalf of clients) via drafts and local or foreign transfers, for amounts greater than US$ 1,000 (one thousand US dollars) or its equivalent in other currencies, regardless of the operational modality used for its execution.

In the operations included in items i. and ii., information on transactions for amounts below the defined threshold must also be communicated, when the sum of operations carried out in a specific account exceeds US$ 10,000 (ten thousand US dollars) or its equivalent in other currencies, during a calendar month.

The communication of information on natural or legal persons carrying out the transactions included in the preceding items will be carried out in accordance with the instructions that will be issued.

3. COMMUNICATE the provisions of the preceding items by issuing the corresponding Circular.

RR-SSF-2026-510 Date: 06/08/2026 14:21:39 File 2025-50-1-02290 Publishable: Yes - Signatory: JORGE LUIS PONCE MORENO CIRCULAR NO. 2508