Agreement No. 002-2019 Modifying Agreement No. 010-2015 on Prevention of Misuse of Banking and Fiduciary Services

REPUBLIC OF PANAMA SUPERINTENDENCY OF BANKS AGREEMENT No. 002-2019 (of April 11, 2019) "Modifying Agreement No. 010-2015 on the prevention of the misuse of banking and fiduciary services"

THE BOARD OF DIRECTORS

In exercise of its legal powers, and

CONSIDERING

That as a result of the issuance of Decree-Law No. 2 of February 22, 2008, the Executive Branch prepared a systematic compilation in the form of a Single Text of Decree-Law No. 9 of February 26, 1998, and all its modifications, which was approved through Executive Decree No. 52 of April 30, 2008, hereinafter referred to as the Banking Law;

That Article 36 of Law No. 1 of January 5, 1984, establishes that the Superintendency of Banks will supervise and ensure the proper functioning of the trust business;

That in accordance with paragraphs 1 and 2 of Article 5 of the Banking Law, it is the objective of the Superintendency of Banks to ensure the solidity and efficiency of the banking system, and to strengthen and foster favorable conditions for the development of the Republic of Panama as an International Financial Center;

That Article 112 of the Banking Law establishes that banks and other supervised entities have the obligation to establish policies, procedures, and internal control structures to prevent their services from being used improperly for the crime of money laundering, terrorist financing, and other related or similar crimes;

That in accordance with what is established in Article 114 of the Banking Law, banks and other supervised entities by the Superintendency will adopt policies, practices, and procedures that allow them to know and identify their clients and employees with the greatest certainty possible, with the Superintendency retaining the authority to develop pertinent norms that align with the policies and regulations currently in force in the country;

That Law No. 23 of April 27, 2015, adopts measures to prevent money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction;

That Article 19 of Law No. 23 of 2015 establishes the Superintendency of Banks, among others, as the supervisory body;

That Article 20, paragraph 7 of Law No. 23 of 2015, establishes among the powers of the supervisory bodies, issuing guidance and feedback norms to obligated financial subjects, non-financial obligated subjects, and activities performed by professionals subject to supervision for their application, as well as procedures for the identification of beneficial owners of legal persons and other legal structures;

That through Agreement No. 10-2015 of July 27, 2015, the Superintendency of Banks developed the anti-money laundering norms that banks and trust companies must adopt as minimum parameters to prevent their services from being carried out through or with funds derived from money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction;

Agreement No. 002-2019 Page 2 of 7

That Law No. 70 of January 31, 2019, which reforms the Penal Code and dictates other provisions, criminalizes tax fraud against the National Treasury of the Republic of Panama, which affects the correct determination of a tax obligation to avoid paying the corresponding taxes;

That the Recommendations of the Financial Action Task Force (FATF) constitute a consistent international standard that countries must implement effectively through legal, regulatory, and operational measures in order to have a solid national system that allows combating money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction;

That in accordance with the interpretative note of FATF Recommendation 3, countries must apply the crime of money laundering to all serious crimes, with the aim of including the widest range of predicate offenses, including at least those mentioned within the established categories of crimes, among which tax crimes related to direct or indirect taxes are predicate offenses to money laundering;

That in accordance with FATF Recommendation 37 on mutual legal assistance, countries must provide rapid, constructive, and effective mutual legal assistance to the greatest extent possible regarding investigations, judicial proceedings, and processes related to money laundering, associated predicate offenses, and terrorist financing; and, in particular, they shall not refuse to execute a request for mutual legal assistance solely on the grounds that the offense involved also concerns fiscal matters;

That in working sessions of this Board of Directors, the need and convenience of modifying some articles of Agreement No. 010-2015 on the prevention of the misuse of banking and fiduciary services has been manifested, with the purpose of including some aspects contemplated in the FATF Recommendations related to due diligence.

AGREES:

ARTICLE 1. Article 14 of Agreement No. 10-2015 of July 27, 2015, is hereby amended as follows:

"ARTICLE 14. CLIENT PROFILE FOR NATURAL PERSONS. When dealing with natural persons, banks and trust companies must prepare a client profile which will include a form designed by the entity containing written information, as well as the documents supporting such information. The client profile must contain, at a minimum, the following information and documentation, which must be obtained before initiating the commercial relationship with the client:

1. Identification and verification of the client: full name, age, sex, employment or labor status, marital status, profession or occupation, nationality, residence, and the client's suitable identity document.

For the purposes of the suitable identity document, when it concerns a Panamanian national, it will be the personal identity card (cédula), or the official application form for the identity card while said document is in process. A passport will also be acceptable when it concerns a Panamanian national residing abroad. Likewise, it will require the tax identification number of the country or countries where they are a taxpayer (tax residence) in order to keep information related to their tax identification updated.

When it concerns a foreigner, the suitable identity document will be the passport. Likewise, they must also present:

a. The tax identification number of the country or countries where they are a taxpayer (tax residence) in order to keep information related to their tax identification updated, and

Agreement No. 002-2019 Page 3 of 7

b. Sworn declaration indicating that the inflows and outflows made to the financial entity comply and will comply with tax obligations in their country or countries of tax residence.

In accordance with the Banking Law, banking entities are authorized to collaborate with any investigation carried out by competent authorities.

To satisfy the passport requirement, it will only be necessary to keep a copy of the page(s) where the client's photograph, signature, and general data appear, and the page where the entry stamp of the country is affixed. In the case of clients who have been acquired by the bank or trust company through visits abroad or when the acquisition is carried out by agents of affiliated entities in the group, or when the linkage is performed by banks with an international license, the requirement of a copy of the passport page containing the entry stamp will not apply. These clients may also be identified by the official identification document of their country of origin which contains their photograph, general data, and signature.

Foreigners who have obtained residency in Panama may also be identified by the personal identity card issued by the Electoral Tribunal of Panama.

Persons who are in our country under a migratory status of permanent resident in the condition of refugee or asylee, may be identified by the refugee card issued by the National Migration Service.

In any case, the document must be valid at the time of its presentation for the account opening procedure.

For the purposes of updating the respective files, regarding expired identity cards, the bank may update them by verifying them in the Electoral Tribunal database, without it being necessary to request the client to present the physical document. Regarding expired passports, they must be updated by the client.

PARAGRAPH. The sworn declaration referred to in subsection b of this article may be evidenced in a single and independent document, or as part of the client profile form.

2. Origin and destination of resources or assets: The origin and destination of resources are understood as the jurisdiction from which resources are predominantly received in the case of origin, or towards which they are sent in the case of destination. In all cases, the reference will be in geographical terms.

3. Source of resources or assets and client financial profile: It is understood that the source of resources refers to the written support on the origin of the funds used to carry out a specific transaction.

The financial profile is understood as the result of the analysis of a set of socioeconomic and demographic characteristics and variables presented by a client and verified by the entity at the time of linkage, and which must be enriched with updated and historical information. For these purposes, the client must present at least one of the following documents: employment letter, social security record, sworn tax declaration, payment receipt, or any other legal or contractual documentation that evidences the client's income flow.

Additionally, reasonable measures will be taken to support the source of funds, the frequency of movements, their geographical origin, and whether the client will make cash, quasi-cash, check, or electronic transfers with the purpose of establishing, at the beginning and during the contractual relationship, the usual behavior that the client will maintain with the obligated subject.

4. Client transactional profile: This is understood as the contrast between the expected financial profile and the frequency and capacity of the client's actual transactions over one or several time periods.

The client's financial information must be examined and documented in the physical or digital file, the analysis of the quantity and volume of transactions, to establish the expected monthly or annual transactional profile of the client at the time of linkage.

During the contractual relationship, the bank or trust company must follow up and verify that the financial operations carried out by the client do not reflect material inconsistencies with respect to the expected transactional profile determined at the time of linkage.

When the bank or trust company assigns a risk level to the client, it must consider within the risk classification model the criterion regarding whether the origin and/or destination of resources come from or are sent to jurisdictions considered to have deficient measures against tax evasion or non-cooperative in this matter.

5. Other additional aspects to consider:

a. In cases where the client is acting as an intermediary for another person who is the ultimate beneficiary or usufructuary of the operation, banks and trust companies must conduct due diligence on said beneficial owner.

b. Banks and trust companies must understand and, as appropriate, obtain information about the purpose and nature intended for the commercial or professional relationship.

c. Every new account or contract relationship must comply with an evaluation of the client's financial profile and transactional profile, in order to measure the risk of the products or services offered.

d. Banks and trust companies must leave documented evidence in the respective file of all diligence performed to adequately identify their client and/or beneficial owner.

e. Any service resulting from a relationship between a bank or trust company with a foreign client will be subject to due diligence measures, which must be in accordance with the risk level it represents, with international parameters and standards, and with the internal control policies and procedures established by the entity.

All information required in this article must be consolidated in a single file, whether physical or digital."

ARTICLE 2. Article 15 of Agreement No. 10-2015 of July 27, 2015, is hereby amended as follows:

"ARTICLE 15. CLIENT PROFILE FOR LEGAL PERSONS. When dealing with legal persons, banks and trust companies must prepare a client profile which will include a form designed by the entity containing written information, as well as the documents supporting such information. The client profile must contain, at a minimum, the following information and documentation:

1. Identification and verification of the client: full name of the legal person, registration data, domicile, address, telephone numbers. If it concerns a Panamanian legal person, the unique taxpayer registry number (RUC) when applicable. If it concerns a foreign legal person, the tax identification number of its country or countries where it is a taxpayer, when applicable.

Likewise, a sworn declaration must be requested indicating that the inflows and outflows made to the financial entity comply and will comply with tax obligations in its country or countries of tax residence.

In the case of trust companies, they must know and clearly understand the information regarding the purpose for which the trust is to be constituted.

PARAGRAPH. The sworn declaration referred to in this paragraph may be evidenced in a single and independent document, or as part of the client profile form.

2. Certifications evidencing the incorporation and validity of the legal person: The requirement to obtain certifications evidencing the incorporation and validity of the legal person will be fulfilled as follows:

a. Copy of the social pact for the Panamanian legal person or its equivalent for a foreign legal person.

b. If it concerns a Panamanian legal person, a certificate from the Public Registry, in original or copy, or information extracted by the client or the obligated subject, through the Public Registry database, evidencing the existence and data of the legal person.

c. In the case of a foreign legal person, documents equivalent to those stipulated in paragraph 2 must be presented, evidencing the constitution and validity of the foreign legal person.

3. Identification of dignitaries, directors, attorneys-in-fact, and legal representatives: Banks and trust companies must identify the dignitaries, directors, attorneys-in-fact, and legal representatives of legal persons. For these purposes, only a copy of the personal identity document of the president and/or legal representative, as the case may be, secretary, persons designated as signatories, and legal attorneys-in-fact of the legal person will be required. In the case of trust companies, the protector, advisors, or other persons, if any, who make decisions regarding the trust assets and their distribution must be identified.

4. Identification of the ultimate beneficiary: Banks and trust companies must take reasonable measures to identify the beneficial owner using relevant information obtained from reliable sources. For these purposes, they must understand the nature of the client's business and its shareholding and control structure. In cases where a legal person is the ultimate beneficiary, due diligence will extend to knowing the natural person who is the owner or controller.

For the identification of the ultimate beneficiary, in the case of corporations, obligated subjects must make the pertinent efforts to identify shareholders who own a percentage equal to or greater than ten percent (10%) of the issued shares of the respective society, for which a copy of the identity document will be required. The requirement to identify the ultimate beneficiary is exempted for companies whose shares are listed on the stock exchange, unless it concerns companies organized in countries considered non-cooperative by the Financial Action Task Force (FATF). From all of them, the data of nationality, country of birth, and country of residence must be obtained.

The bank or trust company must document in the file the support certifying that it is a company whose shares are listed on the stock exchange.

In the case of foreigners belonging to jurisdictions with which Panama has signed international agreements allowing for the exchange of information in tax matters, duly ratified by the Republic of Panama and in full force, the bank and the trust company must ensure they have the country information and the tax identification number of the country or countries where they are a taxpayer, in order to keep information related to their tax identification updated.

In the case of public companies (state entities), whose ultimate beneficiary is the Panamanian State or a foreign State, banks and trust companies must identify and take reasonable measures to verify the identity of the relevant natural person occupying the senior administrative position.

In the case of other legal persons, whose ultimate beneficiaries cannot be identified through shareholding, the obligated subject must ensure obtaining a minutes, certification, or sworn declaration duly signed by the representatives or authorized persons, detailing the ultimate beneficiary or beneficiaries.

When the obligated subject has not been able to identify the beneficial owner, they shall abstain from initiating or continuing the business relationship or carrying out the transaction if the doubt regarding the identity of the client or the beneficial owner persists.

5. Treatment of legal persons with external operations. When it concerns Panamanian or foreign legal persons that carry out external operations and maintain accounts in a banking establishment in Panama, the banking entity must request a sworn declaration evidencing that the resources entering said accounts have complied and will comply with the corresponding tax obligations.

6. Origin and destination of resources or assets. The origin and destination of resources are understood as the jurisdiction(s) from which resources are predominantly received in the case of origin, or towards which they are sent in the case of destination, always the reference will be in geographical terms.

7. Source of resources or assets and client financial profile: It is understood that the source of resources refers to the written support on the origin of the funds used to carry out a specific transaction.

The financial profile is understood as the result of the analysis of a set of socioeconomic characteristics and variables presented by a client and verified by the entity at the time of linkage, and which must be enriched with updated and historical information. For these purposes, the legal person must present at least one of the following documents: duly signed financial statements, tax return, and any other legal or contractual documentation that evidences the client's income flow.

Additionally, reasonable measures will be taken to support the source of income and the geographical origin of the funds, the frequency of movements, and whether the client will make cash, quasi-cash, check, or electronic transfers with the purpose of establishing, at the beginning and during the contractual relationship, the usual behavior that the client will maintain with the obligated subject.

8. Client transactional profile: This is understood as the contrast between the expected financial profile and the frequency and capacity of the client's actual transactions over one or several time periods.

When the bank or trust company assigns a risk level to the client, it must consider within the risk classification model the criterion regarding whether the origin and/or destination of resources come from or are sent to jurisdictions considered to have deficient measures against tax evasion or non-cooperative in this matter."

ARTICLE 3. Article 30 of Agreement No. 10-2015 of July 27, 2015, is hereby amended as follows:

"ARTICLE 30. SUSPICIOUS OPERATIONS. Banks and trust companies must directly report to the Financial Analysis Unit any fact, transaction, or operation that has been carried out, including attempts to carry out operations, that are suspected of being related or linked to the crimes of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction, regardless of the amount and that cannot be justified and supported, as well as failures in controls.

The compliance officer will conduct an internal analysis of unusual and/or suspicious operations resulting from the comparison of the client profile and/or their monitoring systems.

When obligated subjects have knowledge, in the course of their activities, of operations that qualify as suspicious and that cannot be justified or supported, they must carry out the following diligence:

1. Create a record with information about the operation. The information will contain the data of the contractual relationship originating the operation, the date(s), the amount(s), and the type(s) of operation; this record must include, in a summary manner, the observations of the official who detects the operation.

2. Notify the suspicious operation to the compliance officer, who will order the review of the operation to verify its suspicious condition and will include, in a summary manner, the respective observations.

3. Notify the suspicious operation to the Financial Analysis Unit within the established timeframe, attaching the record created in step 1 and the observations from step 2.

4. Maintain a copy of the report submitted to the Financial Analysis Unit and all supporting documentation in the client's file.

5. Refrain from carrying out the operation or terminating the business relationship if the obligated subject determines that the operation is suspicious and cannot be justified, in accordance with the internal procedures established for such cases."

ARTICLE 4. The present Agreement enters into force on the date of its publication in the Official Gazette.

Given in the City of Panama, on April 11, 2019.

BOARD OF DIRECTORS SUPERINTENDENCY OF BANKS

[Signatures]