Norm on the Regulatory Controller

Page 1 of 9

Resolution No. CD-SIBOIF-1402-1-SEPT5-2023 Dated September 5, 2023

NORM ON THE REGULATORY CONTROLLER

The Board of Directors of the Superintendence of Banks and Other Financial Institutions:

CONSIDERING

I

That Article 59 of Law No. 733, "General Law on Insurance, Reinsurance, and Sureties," published in La Gaceta, Official Diary No. 162, 163, and 164, on August 25, 26, and 27, 2010, respectively (Law No. 733), contained in Law No. 974, "Law of the Nicaraguan Legal Digest on Banking and Finance Matters," published in La Gaceta, Official Diary No. 164, on August 27, 2018, and its updates (Legal Digest), in its relevant parts, establishes that insurance companies must have a Regulatory Controller whose responsibility will be to evaluate compliance with applicable external and internal legal provisions of the company. Likewise, the Board of Directors may issue general application norms regarding the provisions of this article.

II

That through Resolutions No. DS-IS-1781-07-2021/LAME, dated July 1, 2021, and No. DS-IS-0616-03-2022/LAME, dated March 2, 2022, and based on the provisions of the aforementioned Article 59 of Law No. 733, insurance companies were instructed to appoint the person who would serve as Regulatory Controller; however, it is necessary to establish additional requirements pertaining to the compliance function of these entities and the area in charge of this function, for the purpose of uniformity.

III

That according to the considerations stated above and based on the powers provided in Articles 4, 5, items 1) and 2), and 6, item 1) of Law No. 733; and Article 3, item 13) of Law No. 316, "Law of the Superintendence of Banks and Other Financial Institutions," both contained in the Legal Digest.

In exercise of its powers,

HAS ISSUED

The following,

Resolution No. CD-SIBOIF-1402-1-SEPT5-2023 NORM ON THE REGULATORY CONTROLLER

Page 2 of 9

CHAPTER I CONCEPTS, OBJECT, AND SCOPE

Article 1. Concepts.- For the application of this norm, the concepts indicated in this article, whether in uppercase or lowercase, singular or plural, shall have the following meanings:

a) Board of Directors: Board of Directors of the Superintendence of Banks and Other Financial Institutions. b) Regulatory Controller: Official provided for in Article 59 of Law No. 733, "General Law on Insurance, Reinsurance, and Sureties." c) Significant Events: These are facts that may have a material impact on the liquidity, solvency, image, or any other aspect of the insurance company. The materiality of a fact will depend on whether it has the potential to cause an important impact, either quantitative or qualitative, on an important business line of the company or on its operations in general. To this effect, the Regulatory Controller must apply their best professional judgment to determine those facts they consider may potentially impact the company and require reporting due to their significant nature. d) Law No. 316: Law of the Superintendence of Banks and Other Financial Institutions, contained in Law No. 974, "Law of the Nicaraguan Legal Digest on Banking and Finance Matters," and its updates. e) Law No. 561: General Law on Banks, Non-Banking Financial Institutions, and Financial Groups, contained in Law No. 974, "Law of the Nicaraguan Legal Digest on Banking and Finance Matters," and its updates. f) Law No. 733: General Law on Insurance, Reinsurance, and Sureties, contained in Law No. 974, "Law of the Nicaraguan Legal Digest on Banking and Finance Matters," and its updates. g) Insurance companies or companies: Entities authorized by the Superintendence of Banks and Other Financial Institutions, operating in insurance, reinsurance, sureties, and reinsurances, national or foreign, privately owned, state-owned, or mixed, in accordance with the provisions of Law No. 733, General Law on Insurance, Reinsurance, and Sureties. h) Superintendence: Superintendence of Banks and Other Financial Institutions. i) Superintendent: Superintendent of Banks and Other Financial Institutions.

Article 2. Object and Scope.- This norm aims to establish the requirements, minimum functions, and other aspects to be fulfilled by the person serving as Regulatory Controller of insurance companies.

CHAPTER II APPOINTMENT AND REQUIREMENTS OF THE REGULATORY CONTROLLER

Page 3 of 9

Article 3. Appointment.- The Regulatory Controller must be appointed by the General Shareholders' Meeting of the insurance company or, in its absence, by the corresponding deliberative body when dealing with state institutions, who will exercise their functions independently of the administration and will be the person in charge of evaluating compliance with the legal provisions applicable to the company, as established in Article 59 of Law No. 733. The Regulatory Controller will depend organically, functionally, and administratively on the Board of Directors or Board of Directors of the insurance company, before whom they will periodically present the necessary reports, without prejudice to the annual report that must be submitted, in accordance with the provisions of Article 59 referred to above and Article 8 of this norm.

Once the person is appointed to the position, the insurance company will send to the Superintendent the certification of the minutes of the session in which the appointment was made, within a maximum period of ten (10) business days counted from the date of the relevant session, attaching all supporting documentation established in Article 5 of this norm. Based on the information presented, the Superintendent, within a period of thirty (30) calendar days, will ratify or deny, through a reasoned resolution, the aforementioned appointment.

The Board of Directors or Board of Directors of the insurance company must establish the structure under which the Regulatory Controller will develop their functions, which must adhere to the general criteria established in the following paragraph.

For its part, the General Management or Executive Presidency, as appropriate, must guarantee the required budget to ensure that the Regulatory Controller has access to appropriate infrastructure and adequate financial, human, technical, logistical, and training resources commensurate with the magnitude and complexity of the insurance company's operations, as well as the risks it faces or emerging new risks. Likewise, it must guarantee the Regulatory Controller timely access to documents, systems, and/or computer applications, as well as provide all information necessary to fulfill their objectives.

Article 4. Qualification Criteria.- For the purposes of evaluating the honorability and competence of the Regulatory Controller, the following criteria shall be considered respectively:

a) Honorability: Positive reputation of honesty and integrity, to be verified by the information required by this norm; and b) Competence: Experience of at least three (3) years in relevant or substantial positions related to the Insurance Industry; graduated in any of the following fields: law, finance, administration, accounting, or other related to the position; and training in the areas mentioned in Article 10 of this norm.

Article 5. Information and Requirements to be Presented.- For the evaluation of what is indicated in the previous Article 4, the following information must be presented:

a) Curriculum vitae documented with the information required in Annex 1 of this norm, which forms an integral part of it. Photocopies of higher education degrees, post-graduates, master's, or doctorates must be attached to said curriculum, notarized according to the law on the matter, as appropriate.

Page 4 of 9

b) Photocopy of the identity card on both sides for nationals, or of the identity card for residents or of the passport in the case of foreigners, notarized according to the law on the matter. c) Certificate of judicial and police records issued by the corresponding instances, with an age not exceeding two months from the date of the request. d) A minimum of 2 personal references issued by persons of recognized honorability and prestige, related to the profession. e) A minimum of 2 recent bank or commercial references as of the date of the request. f) If they have worked in public institutions, a certificate from the corresponding control body of being solvent with the law is required. g) Declaration before a public notary of not being subject to the impediments of Article 44 of Law No. 733, in accordance with the format established in Annex 2 of this norm, which forms an integral part of it. h) Detailed list of related natural and legal persons, as well as those constituting their unit of interest, based on the criteria established in Article 71 of Law No. 733 and the regulations governing the matter on concentration limits.

The Regulatory Controller must keep the information referred to in this article updated whenever there are changes to it.

Article 6. Revocation.- The General Shareholders' Meeting or, in its absence, the corresponding deliberative body when dealing with state institutions, may revoke the appointment of the Regulatory Controller, having to previously obtain the non-objection of the Superintendent, who will analyze the reasons motivating the revocation. The Superintendent may request a report from the Regulatory Controller, who must present it no later than the date indicated. After the aforementioned term has elapsed, the Superintendent, within ten (10) business days thereafter, through a reasoned resolution, will determine what they consider pertinent.

The position of Regulatory Controller cannot remain vacant for a period exceeding three (3) months.

The person temporarily replacing the Regulatory Controller during this period must comply with the same procedure and requirements established in this norm.

CHAPTER III FUNCTIONS OF THE REGULATORY CONTROLLER, ANNUAL EVALUATION PROGRAM, AND TRAINING

Article 7. General Function.- The Regulatory Controller will be responsible for evaluating compliance with the legal and regulatory provisions applicable to the insurance company, anticipating the risks to which it might be exposed, conflicts of interest, as well as bad market conduct practices in which the company might incur, issuing pertinent recommendations to the entity's board of directors, without prejudice to those corresponding to the Internal Audit Unit in accordance with applicable regulations.

Page 5 of 9

Article 8. Annual Evaluation Program.- The Regulatory Controller must prepare an annual evaluation program whose purpose is to determine the activities and procedures to be developed for the fulfillment of their duties, as well as the areas to be evaluated; furthermore, this program must include the follow-up of recommendations made by the controller to overcome weaknesses detected in their evaluations.

The aforementioned evaluation program must be approved by the Board of Directors or Board of Directors of the insurance company, as appropriate, within the last quarter of the year immediately preceding its execution, and a photocopy must be sent to the Superintendent within a period of ten (10) calendar days after its approval.

The Regulatory Controller must prepare and present to the Board of Directors or Board of Directors of the insurance company, as appropriate, an annual report on the results and observations of their evaluation, including measures adopted to remedy any non-compliance, informing and documenting irregularities that could affect or put at risk the sound development of the entity; this presentation must be made in the first quarter of the year immediately following the execution, and a photocopy must be sent to the Superintendent within a period of ten (10) calendar days after its presentation, in which the decisions adopted by the collegiate body to which the report was presented are established.

Without prejudice to the foregoing, the Regulatory Controller must communicate the occurrence of events that in their judgment are considered significant, immediately, directly, and simultaneously to the Auditor elected by the General Shareholders' Meeting, to the Superintendent, to the Audit Committee, and to the Board of Directors or Board of Directors of the company, as appropriate. Such communication must be made no later than within three (3) days following the knowledge of the events. In case the company requires preparing a normalization plan, the Regulatory Controller will evaluate its compliance.

Article 9. Specific Functions.- The functions of the Regulatory Controller must have the necessary scope to comply with the provisions of this norm, performing, but not limited to, the following activities:

a) Review and analyze the general legal compliance by the insurance company; likewise, advise the Board of Directors or Board of Directors and the administration of the company on their compliance. b) Review and analyze policy models and products in commercial operation, prospectuses, and modifications; as well as other financial services. c) Review and analyze the company's policies, manuals, and procedures, as well as their updates or modifications. d) Review and analyze the reinsurance program, including fronting operations and facultative reinsurance contracts. e) Review and analyze the contracts generally signed by insurance companies.

Page 6 of 9

f) Answer pertinent inquiries made by the main officials of the insurance company, keeping a record of the same regarding what was consulted, the response provided, and observations, as well as providing guidance and training to personnel on compliance with applicable regulations, in order to generate a culture of compliance in the organization. g) Comply with instructions and recommendations made by the Superintendent, without prejudice to the follow-up by the Internal Audit Unit. h) Ensure that the organization has adequate control policies and processes in key areas related to applicable legal obligations.

For the aforementioned aspects, the Regulatory Controller must prepare the relevant Risk Matrix and follow up on it.

Article 10. Training Program.- The Board of Directors or Board of Directors of the insurance company, as appropriate, must approve a training program for the Regulatory Controller and for those officials belonging to their area, for the updating of their knowledge in insurance matters.

CHAPTER IV FINAL PROVISIONS

Article 11. Transitional.- Insurance companies will have a period of 3 months counted from the entry into force of this norm to appoint the officials who will work in the area in charge of the Regulatory Controller. Once this term has ended, insurance companies will have a maximum period of three (3) months to prepare and present the evaluation program referred to in Article 8 of this norm.

Article 12. Validity.- This norm will enter into force upon its notification to insurance companies, without prejudice to its subsequent publication in La Gaceta, Official Diary.

ANNEX 1 CURRICULUM VITAE OF THE REGULATORY CONTROLLER

GENERAL DATA

1.- Full name. 2.- Nationality. 3.- Profession or trade. 4.- Place and date of birth. 5.- Identity card number or residence card (in the case of foreign residents in the country). 6.- Domicile. 7.- Migratory status. Do you have authorization to work in the country? (only for foreigners holding administrative positions). YES ( ) NO ( ) Authorization Number: __________

Page 7 of 9 Authorization Date: _____________ Validity of Authorization: ___________

KNOWLEDGE AND EXPERIENCE

1.- Knowledge and experience in the insurance industry: Entity Position Period from ... to Main Functions A/

2.- Positions held or currently held in other entities: Entity Position Period from ... to Main Functions A/

3.- Studies and training completed: Establishment Title or Course Name Period from ... to Observations A/

A/ It is required to expand in a separate document all information related to the functions and activities carried out in these entities, which allows evaluating their knowledge, skills, and aptitudes to solve problems autonomously and flexibly and substantiate their suitability for the position they hold or are proposed for.

Page 8 of 9

4.- Are you a partner/member of any entity? YES ( ) NO ( ) If affirmative, provide the following information: Entity Name Country No. RUC or its equivalent % Participation Amount in C$

5.- I declare that the data above are true, subjecting myself to the sanctions determined by law for any inaccuracies thereof.

FINAL

1.- Place and date. 2.- Signature

ANNEX 2

To the Superintendent of Banks and Other Financial Institutions Present.

I, [Name], [Age] years old, profession or trade [Profession], nationality [Nationality], domiciled at [Address], with Identity Card No. [Number], in view of having been proposed as Regulatory Controller of the insurance company [Company Name], declare that:

a. I am not in a situation of bankruptcy or insolvency and have never been judicially qualified as responsible for a fraudulent or negligent bankruptcy. b. I am not a delinquent debtor of credits in the financial system. c. For a better analysis of my debtor situation, I detail below the credits I currently have in the financial system: Credit No. Amount Granted Bank (or financial institution) d. In order to verify compliance with item 5 of Article 44 of Law No. 733, General Law on Insurance, Reinsurance, and Sureties, I also declare that I am a shareholder of the entities detailed below (detail entities):

Page 9 of 9

e. I have never been sanctioned for causing patrimonial damage to an entity supervised by the Superintendence or to public faith by altering its financial statements, during the last 15 years. f. I have never participated as a director, manager, deputy manager, or official of equivalent rank of an entity supervised by the Superintendence that has been subjected to intervention processes and declaration of forced liquidation status; or that by judicial or administrative resolution, responsibilities, presumptions, or indications have been established linking me to the aforementioned situations. g. I have never been convicted of intentional crimes that have resulted in a penalty greater than corrective.

(F) Legible Magaly María Sáenz Ulloa (F) Illegible (Luis Ángel Montenegro E) (F) Illegible Fausto Reyes (F) Illegible (Silvio Moisés Casco Marenco) (F) Illegible (Ervin Antonio Vargas Pérez) (F) Illegible (Marvin Saúl Castellón Tórrez) Ad Hoc Secretary.

SAÚL CASTELLÓN TÓRREZ Ad Hoc Secretary Board of Directors SIBOIF