Resolution SBS No. 11699-2008: Internal Audit Regulation

Lima, November 28, 2008

S.B.S. Resolution
No. 11699 -2008

The Superintendent of Banks, Insurance, and Private Pension Fund Administrators:

CONSIDERING:

That, in accordance with Article 180 of the General Law of the Financial System and of the Insurance System and the Organic Law of the Superintendence of Banks and Insurance, Law No. 26702 and its amendments, hereinafter General Law, it is the responsibility of this Superintendence to establish the requirements and standards for internal audit for companies in the financial and insurance systems, with the aim of providing adequate protection to savers and insured persons;

That, by SBS Resolution No. 1041-99 dated November 26, 1999, and its amendments, the Internal Audit Regulation was approved;

That, pursuant to subsection e) of Article 57 of the Single Text of the Law of the Private Administration of Pension Funds System, approved by Supreme Decree No. 054-97-EF, it is the attribution and obligation of the Superintendence to supervise AFPs in compliance with the legal provisions and administrative directives governing them, which is why it is convenient to include them within the scope of application of the Internal Audit Regulation;

That, the work carried out by the internal audit of supervised companies constitutes a fundamental mechanism of support for the supervision and control carried out by this Superintendence, so it is necessary to update the minimum criteria required for its exercise in accordance with international standards and best practices;

That, an effective and efficient internal audit constitutes a vital element for prudent administration in companies in the financial, insurance, and private pension fund administrator systems;

That, pursuant to the Law Creating the Financial Intelligence Unit of Peru (UIF-Peru), approved by Law No. 27693 and its amendments, this Superintendence, in exercising its supervision function of the system for the prevention of money laundering and terrorist financing, will rely, among other agents, on internal audit areas, which will formulate an annual special report on the evaluation of the system for the prevention of money laundering and terrorist financing;

That, on July 25, 2006, the

2
Regulation of Law No. 27693, approved by Supreme Decree No. 018-2006-JUS, was published, which regulates various aspects related to the work of the internal audit area of subjects obliged to report to UIF-Peru supervised by this Superintendence;

That, by SBS Resolution No. 37-2008 of January 10, 2008, the Regulation of Integrated Risk Management was approved, stating in Article 22 of said Regulation that internal audit plays an independent role in Integrated Risk Management;

That, consequently, it is necessary to issue a new Internal Audit Regulation;

Having heard the opinions of the Adjunct Superintendencies of Banking and Microfinance, Risk, Insurance, Private Pension Fund Administrators, Legal Advice, the Financial Intelligence Unit of Peru -UIF, as well as the Economic Studies Management; and,

In exercise of the powers conferred by numeral 7 of Article 349 and numeral 7 of Article 367 of the General Law;

RESOLVES:

First Article.- Approve the Internal Audit Regulation, which forms an integral part of this Resolution.

Second Article.- Grant a deadline until December 31, 2008, for companies to adapt to the provisions of the Regulation approved in the First Article.

Third Article.- Upon expiration of the adaptation period indicated in the preceding article, the Internal Audit Regulation approved by SBS Resolution No. 1041-99 of November 26, 1999, the last paragraph of Article 79 of Resolution No. 053-98-EF/SAFP, as well as all those provisions that oppose it in whole or in part, shall become ineffective.

Fourth Article.- The preparation, presentation, and implementation of the Annual Work Plan and its respective reports, corresponding to the 2009 fiscal year, shall be subject to the provisions of the Regulation approved by the First Article.

Fifth Article.- Incorporate Procedures Nos. 116 and 117 "Special Authorizations for Significant Outsourcing of Internal Audit Functions" and "Authorization to Submit the Risk-Based Audit Work Plan," respectively, into the Single Text of Administrative Procedures - TUPA of the Superintendence of Banks, Insurance, and AFP approved by SBS Resolution No. 131-2002, according to the text attached to this Resolution and published as provided in Supreme Decree No. 004-2008-PCM, Regulation of Law No. 29091. (Institutional portal: www.sbs.gob.pe).

3
Register, communicate, and publish,

FELIPE TAM FOX
Superintendent of Banks, Insurance, and Private Pension Fund Administrators

4
INTERNAL AUDIT REGULATION

CHAPTER I
GENERAL PROVISIONS

Article 1º.- Scope
This Regulation shall apply to the companies indicated in Articles 16 and 17 of the General Law, as well as to Private Pension Fund Administrators (AFP), hereinafter companies.

In the case of Municipal Savings and Credit Caisses (CMAC), the Popular Credit Municipal Caixa of Lima, the Guarantee Fund for Small Industry Loans (FOGAPI), the National Bank, the Agricultural Bank, the Development Financial Corporation (COFIDE), MIVIVIENDA S.A. Fund, Derramas, Benefit Caisses under the control of the Superintendence, and the Municipal Savings and Credit Caixa Fund (FOCMAC), this Regulation shall apply insofar as it does not conflict with specific regulations governing the operations of these companies. 1

Article 2°.- Definitions
For the application of this Regulation, the following definitions shall be considered:

a) Scheduled activities.- Those included in the Annual Audit Work Plan, some of which are mandatory due to regulatory requirements.

b) Head Office.- Refers to the main company or the one exercising control in a financial or mixed conglomerate.

c) Audit Committee.- Any reference to the Audit Committee, in case companies are not obliged to constitute said Committee under Article 11 of the Integrated Risk Management Regulation, shall be understood to refer to the Board of Directors.

d) Days.- Calendar days.

e) Board of Directors.- Any reference to the board, or any equivalent body.

f) Integrated risk management.- A process, carried out by the Board of Directors, Management, and personnel, applied throughout the company and in the definition of its strategy, designed to identify potential events that may affect it, manage them according to their risk appetite, and provide reasonable assurance in achieving their objectives.

g) Significant events.- Those events that may have a significant impact on the financial situation of the company, or on the achievement of its objectives.

h) Head of Internal Audit.- The Manager or managerial-level official, regardless of title, responsible for the internal audit unit or service.

i) Policy and procedure manuals.- Documents containing functions, responsibilities, policies, methodologies, and procedures established by the company for the performance of the activities of each of the units it has, including those corresponding to risk management.

j) Plan.- Refers to the Annual Audit Work Plan.

k) Assurance services.- Objective examinations of evidence for the purpose of providing an independent assessment of an organization's risk management, control, and governance processes. These services include financial, performance, compliance, system security evaluations, among others.

l) Consulting services.- Advisory, counseling, and related services provided to users, whose nature and scope are agreed upon with them and are directed to add value and improve the organization's governance, risk management, and control processes, 1

5 without the internal auditor assuming management responsibilities. Some examples of these activities are counseling, advisory, facilitation, and training.

m) Superintendence.- Superintendence of Banks, Insurance, and Private Pension Fund Administrators.

Article 3°.- Responsibility of the Board of Directors and the Audit Committee
The Board of Directors is responsible for taking the necessary actions so that the internal audit unit can perform its functions in accordance with the provisions of this Regulation and the nature and complexity of the company's operations.

The Audit Committee's main purpose is to oversee that accounting and financial reporting processes are appropriate, as well as to evaluate the activities carried out by internal and external auditors.

Reports prepared by the internal auditor submitted to the Audit Committee and required by this Regulation shall be understood as submitted to the Board of Directors. The responsibilities indicated in this Regulation for the Audit Committee shall be understood as assigned to the Board of Directors when the Audit Committee has not been constituted.

The Audit Committee Regulation, which must be approved by the Board of Directors, will establish the relationships and reporting form between the Audit Committee, the Board of Directors, and the Internal Audit Unit, insofar as it does not conflict with this Regulation.

CHAPTER II
ON INTERNAL AUDIT

Article 4º.- Internal Audit
Internal Audit is an independent and objective assurance and consulting activity, conceived to add value and improve company operations, by helping them achieve their objectives by providing a systematic and disciplined approach to the evaluation and improvement of risk management effectiveness and corporate governance.

Article 5º.- Independence of the Internal Audit Unit
Companies must have an internal audit unit, hereinafter IAU, which will report to the Audit Committee, when it exists, and to whom it will submit the reports it prepares, unless in the auditor's opinion they should also be reported to the Board of Directors.

The IAU must have sufficient independence to perform its functions effectively, efficiently, and timely, having all the powers and mechanisms to achieve its objectives.

The IAU must have access to the information it requires to fulfill its functions and develop its examinations, without limitation that could affect its conclusions, including that derived from board minutes and its Committees, and any other management, executive, or administrative body. In the case of CMAC and FOCMAC, the IAU must have internal regulations establishing the difference in the functions corresponding to it regarding those applicable to the Institutional Control Body (OCI), which are subject to the norms of the National Control System. 2

2 Paragraph modified by SBS Resolution No. 1325-2018 published on 06.04.2018.

6

Article 6º.- Functions of the Internal Audit Unit
The functions that the IAU must perform include, among others, the following:

a) Evaluate the design, scope, and functioning of internal control.

b) Design the Plan and submit it to the Board of Directors for approval, as well as comply with scheduled activities and prepare the reports derived from them;

c) Evaluate compliance with the legal provisions governing the companies, during their examinations, particularly the General Law and the provisions issued by the Superintendence;

d) Continuously evaluate the quality and adequacy of information systems and the mechanisms established by the company to ensure information security;

e) Continuously evaluate compliance with policy and procedure manuals and other internal company norms, as well as propose modifications to them;

f) Evaluate the timely and adequate implementation of recommendations and measures to overcome observations made by the Superintendence, external auditors, as well as those made by the IAU itself. 3

g) Verify compliance with the system for the prevention of money laundering and terrorist financing.

h) Evaluate compliance with those aspects determined by this Superintendence; and,

i) Other assurance or consulting activities indicated by the company itself.

Article 7º.- Competence of Internal Audit and Significant Outsourcing
The IAU, when considered as a whole, must possess or obtain the knowledge, technical skills, and other competencies required to fulfill its responsibilities, according to the complexity and size of the company.

Internal Audit Competence
The IAU and the internal auditors comprising it must possess the knowledge, technical skills, experience, and other competencies required to fulfill their responsibilities.

Any IAU must have an information systems audit service, which collaborates in achieving its functions and objectives. This service must have competent personnel and specific experience in systems audit, appropriate in competencies to the complexity and size of the operations performed by the company, which may also be outsourced.

The experience and specialization required for the professional practice of internal audit may be accredited, among others, by valid professional certifications of international prestige such as the Certified Internal Auditor (CIA), issued by The Institute of Internal Auditors (IIA) and the Certified Information Systems Auditor (CISA), issued by ISACA.

4

Significant Outsourcing
Significant outsourcing is defined as that outsourcing which aims to replace most of the functions assigned to the IAU, in a non-occasional manner and with the purpose of accessing advantages of a technical, resource, methodology, among other nature. This type of outsourcing requires prior authorization from the Superintendence, as indicated in the Final First Provision.

3 Subsection modified by SBS Resolution No. 1325-2018 published on 06.04.2018.

4 Paragraph modified by SBS Resolution No. 1132-2025 published on 26.03.2025.

7

Regardless of the level of outsourcing, the Head of Audit remains responsible for ensuring that internal audit functions adequately and effectively, and in accordance with current regulations and the service level agreement or equivalent.

The contracting of specific services from professional service providers for the better development of the IAU's functions, which does not imply significant outsourcing, does not require prior authorization by this Superintendence, but must be reported to this supervisory body.

The Head of Internal Audit is responsible for supervising compliance with the service contract, ensuring the overall quality of activities, reporting to the Audit Committee, as well as following up on the results of the contracted work.

Article 8º.- Infrastructure and Other Resources
The IAU must have appropriate infrastructure and human, technical, and logistical resources, adequate to the magnitude and complexity of the company's operations, as well as to the risks it faces.

The Board of Directors is responsible for ensuring appropriate conditions for the development of the internal audit function.

The Head of Internal Audit and other internal auditors must receive permanent training in matters related to their functions, for which it corresponds to the Head of Internal Audit to present the training needs regarding IAU members, indicating the main training areas and the number of hours required annually.

Article 9°.- Standards and Standards for the Practice of Internal Audit 5

Insofar as it does not conflict with the provisions of the Superintendence's regulations, the standards issued by The Institute of Internal Auditors (IIA) shall apply. In the case of systems auditors, the audit guidelines provided by ISACA shall be taken into consideration.

Article 10°.- Risk-Based Audit (RBA)
Risk-Based Audit consists of a set of processes through which audit provides independent assurance to the Board of Directors regarding:

• Whether the risk management processes and measures implemented are functioning as expected;
• Whether risk management processes are appropriate and well-designed; and,
• Whether the risk control measures implemented by Management are adequate and effective, and reduce the risk to the level of tolerance accepted by the Board of Directors.

RBA depends on the level of development the company itself has achieved in risk management in the area(s) under examination, and the extent to which appropriate objectives have been defined by Management against which associated risks can be measured.

When the company has an adequate risk management system in the area(s) under examination, without prejudice to the need for additional verifications proper to due professional care, RBA may rely to a greater extent on the risk assessment performed by the company itself, and develop a Risk-Based Plan (RBP) that complements the actions performed by the company and increases the value of Internal Audit activities. When the company has a less developed risk management system, RBA requires relying more on the risk assessment performed by Internal Audit itself.

CHAPTER III
ON THE HEAD OF INTERNAL AUDIT

Article 11º.- Appointment
The IAU shall be headed by the Head of Internal Audit, who shall be a managerial-level official on a full-time and exclusive dedication basis, who cannot have management functions, whose appointment is the responsibility and attribution of the Audit Committee.

Article 12º.- Requirements and Impediments of the Internal Auditor
The Head of Internal Audit must have moral solvency, knowledge, and appropriate experience for the function performed by said unit, and must meet the following minimum requirements:

a) Have a professional degree or Master's degree, as well as specialization in matters related to the functions of the IAU;

b) Have at least three (3) years of experience in audit activities, as appropriate, in companies in the financial, insurance, pension fund, complementary or related services, derramas, pension Caixa systems, and/or have held similar positions for such companies, for a period of at least five (5) years, as appropriate;

c) Have no criminal records;

d) For obligated companies, not be subject to any of the impediments indicated in Article 81 of the General Law, with the exception of numeral 5 of said Article;

e) Not have been sanctioned by this Superintendence for committing infractions considered serious or very serious;

f) Not have been sanctioned by any public body for committing infractions considered serious or very serious by the sanctioning entity;

g) Have no ownership or management ties with the company or with the legal entities forming the conglomerate to which it belongs. Likewise, have no kinship relationship with its shareholders or partners, directors, managers, legal representatives, or main officials, according to the regulations issued by this Superintendence;

h) Not be subject to situations that limit the necessary independence for the exercise of their functions;

With the exception of subsections a) and b) indicated in this Article, the other members of the IAU must meet the requirements indicated in the preceding paragraph. Likewise, these members must not have management functions.

The minimum requirements indicated must be duly verified by the human resources area or equivalent, and such verification must be recorded in personnel files.

Article 13º.- Responsibility of the Head of Internal Audit
The Head of Internal Audit is responsible for fulfilling the obligations assigned to him in this Regulation, as well as for immediately informing this Superintendence, within a period of two (2) business days, about any event that significantly affects the functioning of the IAU and/or its independence.

9
The Head of Internal Audit is also responsible for immediately and directly informing the Superintendency and the Audit Committee, simultaneously, of the occurrence of significant events. Such communication must be made within two (2) business days of the completion of the corresponding evaluations and the issuance of the report. Depending on the circumstances and their importance, the Head of Internal Audit may provide preliminary information on the significant events under examination and send preliminary reports if deemed appropriate; and likewise, the Superintendency may request them, while the final report is being prepared. It is the responsibility of internal auditors to apply the general standards defined in Article 9° in the exercise of their functions.
Article 14º.- Removal of the Head of Internal Audit
The removal of the Head of Internal Audit may only be carried out for duly justified cause, which must be agreed upon by the Board of Directors. In the case of companies that are part of the National Control System, the specific applicable regulations must be taken into account. The adoption of such agreement must be communicated to this Superintendency, indicating the reasons for taking this decision. This Superintendency may summon the Head of Internal Audit and take the measures it deems necessary. The vacancy situation due to removal or resignation may not last more than thirty (30) days, except for force majeure reasons, which must be reported to the Board of Directors and to this Superintendency.
Article 15º.- Interim Head of Internal Audit
With prior authorization from this Superintendency, the Internal Audit Unit (UAI) may be headed by an Interim Head of Internal Audit for a period of up to six (6) months, who must meet the requirements referred to in Article 12° of these Regulations, with the exception of what is provided in letter b) of said article. As an alternative to what is indicated in the cited letter, the experience shall be of at least two (2) years in audit activities of the companies indicated or in the performance of similar managerial positions in said companies. The registration process will be followed through the information system of the Registry of Directors, Managers and Principal Officers (REDIR), in the manner provided for the Head of Internal Audit.
CHAPTER IV
ON THE WORK PLAN
Article 16º.- Minimum Content of the Plan
The annual internal audit work plan must include all tasks to be carried out. This Plan must be approved by the Board of Directors, and a copy must be sent to this Superintendency no later than December 31 of the previous year. This Plan must consider, at least, the following aspects:
a) Objectives and scope of the plan; b) Activities, examinations, and reports and their schedule; c) Human resources available for the fulfillment of the Plan, indicating, if necessary, the need to hire specialized services; and, d) Follow-up on observations made by this Superintendency. The activities mentioned in letter b) must include, at a minimum, what is indicated in the annex attached to these Regulations, unless authorization is obtained from the Superintendency, as indicated in the Third Final Provision. Furthermore, the Superintendency may request additional activities and require complementary information regarding the content of the Plan. Likewise, the Superintendency may define the minimum structure that the Plan must contain, as well as its presentation by electronic means, through a Multiple Office Notice. In the case of CMACs, the annual internal audit work plan must be formulated so that there is no duplication with respect to the functions assigned to the OCI, which is subject to the norms of the National Control System. 6
Article 17º.- Modifications to the Plan
Significant modifications made to the Plan must be approved by the Audit Committee and reported to the Superintendency as part of the progress report on the plan referred to in the following article.
CHAPTER V
ON REPORTS PRESENTED TO THE SUPERINTENDENCY
Article 18º.- Report on the Progress of the Plan
The UAI will present to this Superintendency a quarterly report on the progress of the Plan, indicating the degree of fulfillment of objectives and activities carried out and other aspects considered relevant, among others, within twenty (20) days following the close of each quarter. The last quarterly report will account for the activities planned and carried out during the year. A list of the reports prepared by the UAI during the respective period, a brief summary of the content and the observations found and their importance, will be included in said report. Likewise, said report will contain an evaluation of the status of the observations and recommendations made by this Superintendency, indicating those resolved, pending, in process, and their age. The report must be brought to the attention of the Board of Directors or the Audit Committee, if the latter has been constituted, in a timely manner, for the taking of pertinent actions. Regarding the report on the progress of the Plan, ETFs must present the reports on a semi-annual basis, within twenty (20) days following the close of each semester. This Superintendency may define the minimum structure that the report must contain, as well as its presentation by electronic means, through a Multiple Office Notice.
Article 19º.- Special Reports
In addition to what is stated in the previous article, the UAI must present to this Superintendency annual special reports, which may be included as part of the report corresponding to the last quarter, on the following:

1. For the companies indicated in paragraphs I, II, III, IV, and VI of the attached annex, the evaluation of the system for the prevention of money laundering and terrorist financing, emphasizing:
   6 Paragraph incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018.

11 a) Establishment of policies that ensure adequate customer knowledge, market knowledge, and knowledge of correspondent banking, when applicable. b) Existence of the Manual for the Prevention of Money Laundering and Terrorist Financing, permanently updated and in accordance with current legislation. c) Level of compliance with the Manual for the Prevention of Money Laundering and Terrorist Financing. d) Existence of periodic training programs that cover all levels of the company. e) Compliance with regulations on the prevention of money laundering and terrorist financing. f) Evaluation of the criteria applied by the Compliance Officer to not consider certain operations suspicious. In case there is a Committee for the Prevention of Money Laundering and Terrorist Financing, the attendance provided by said Committee must also be evaluated. g) Timeliness of the communication of suspicious operations to UIF-Peru based on the Register of Suspicious Operations. This review does not imply access to information protected by the duty of confidentiality, provided for in Article 12° of Law No. 27693. h) Implementation of the Register of Operations in accordance with the guidelines established by current regulations. The conclusions of said evaluation must be presented to the Superintendency through an annual special report. Said report will be presented within the deadline established for the Annual Report of the Compliance Officer corresponding to the second semester.
2) For the companies indicated in paragraphs I and IV of the attached annex, except Investment Banks, the evaluation of the functioning of the system for handling requests and complaints, as well as compliance with the provisions on the management of market conduct of the financial system, emphasizing:
a) Implementation of policies and procedures defined by the company, in accordance with the Market Conduct Principles on their business practices, information transparency, and management of their complaints. b) Criteria established by the company to ensure full transparency in the dissemination of interest rates, commissions, expenses, and other fees for the active and passive operations it carries out, as well as their modifications. c) Timely compliance in the communication of modifications to interest rates, commissions, expenses, and other fees. d) Compliance with all aspects referenced in the provisions on the management of market conduct of the financial system, regarding the information attached to contracts whose object is the realization of active and passive operations. The conclusions of said evaluation must be presented to the Superintendency through an annual special report. Said report will be presented within the deadline established for the Annual Report of the Market Conduct Officer. 7 7 Number modified by SBS Resolution No. 3966-2018 of 11/10/2018, effective from the audit corresponding to the 2019 fiscal year.

12
CHAPTER VI
ON REPORTS PRESENTED TO THE BOARD OF DIRECTORS
Article 20°.- Presentation to the Board
The UAI must present to the Audit Committee or Board of Directors all reports it prepares in compliance with its functions. This body will evaluate the respective reports no later than in the immediate next session after their presentation. The timeliness with which this body becomes aware of the reports, the decisions adopted regarding them, and the follow-up on corrective measures, must be recorded in the respective Minutes Book.
Article 21°.- Files
The UAI must maintain a file containing the reports prepared, working papers, and communications informing the results of its examinations to the different units of the company, as well as the supporting documentation thereof. This information must be available to the Superintendency, external auditors, and, if applicable, risk rating agencies, when so required.
Article 22º.- Minimum Content of Reports
The UAI reports must contain, at least, the following information:
a) Objective and scope of the evaluation; b) Evaluation of the situation of the activity or operation as of the date of the report, identifying the risks detected and their impact on the company; c) Observations and recommendations made, regardless of whether they have been remediated or not at the close of the report, indicating the status in which they are; d) Name of the official responsible for the evaluation; and, e) Start and end date of the evaluation. FINAL PROVISIONS First.- Special authorizations for significant subcontracting of internal audit functions Except for the Fisherman's Benefit and Social Security Fund, the Military-Police Pension Fund, and the Derramas, the functions of the UAI may be subject to significant subcontracting with the parent company, the company exercising direct or indirect control, or the one having direct responsibility for the operation, or with specialized audit firms, provided that such subcontracting meets or exceeds the criteria provided in these Regulations and represents a significant advantage in scope, specialization, and professional competence. The companies, prior to subcontracting, must request authorization from the Superintendency, with the approval of the Board of Directors, for which they must present the following information:

1. Request submitted by the Audit Committee,
2. Organization of the audit service of the parent company, the company exercising direct or indirect control, or the one having direct responsibility for the operation, insofar as it is pertinent to the authorization requested.
3. Justification of the reason for subcontracting.
4. Methodology to be applied.
5. Description of available resources.
6. Detailed explanation of how the provisions established in these regulations will be applied, insofar as it is pertinent.

13
7) Report describing how compliance with the International Standards for the Professional Practice of Internal Auditing, as published by The Institute of Internal Auditors, is given, insofar as it does not oppose these regulations.
8) Draft Agreement of the level of service or equivalent, indicating the measures the company will take to ensure its adequate compliance.
9) When a specialized firm is hired, additional information regarding the planned audit teams, responsible partner, seniority, and experience of the firm in Peru in relevant audit activities will be presented.
10) Others at the request of the Superintendency.
Additionally, the following must be considered:
a) In case the activities of the conglomerate to which the company belongs are developed mainly outside the country, the functions of the Internal Audit Unit may be assumed by its parent company, the company exercising direct or indirect control, or the one having direct responsibility for the operation. This subcontracting modality, when provided from outside the country, is mainly directed to cover the audit needs of companies whose volume of operation does not require the presence of teams permanently stationed in Peru. The company must designate a local responsible person for the oversight of the adequate functioning of the services received, through the service level agreement or equivalent, who will be responsible for compliance with these Regulations before the Superintendency, as well as for the norms related to the internal auditor. b) The specialized firms with which the internal audit function is subcontracted cannot provide the same company with consulting services, external audit, or others that limit their independence in the exercise of the internal audit function. Likewise, the specialized firm cannot have carried out the evaluation of the money laundering and terrorist financing prevention system, nor the examination of the financial statements during the two (2) consecutive previous years, a restriction that is also applicable to the members of the teams. Likewise, the same partner rotation requirements, exigible to external auditors, according to the External Audit Regulations, must be observed. Specialized firms must operate and be legally authorized for this purpose in Peru. Given the specialized nature of their services, these firms must have external methodological support and periodic quality reviews, as well as relevant experience in the country. Second.- Cancellation of authorizations This Superintendency may cancel at any time the special authorizations referred to in this norm, when in the exercise of its supervisory function it observes that, among other reasons, the volume of operation, the company's activities, or the parent company's services change significantly and do not adequately cover the associated risks, that the company has failed to comply with the obligations provided, or that the authorization granted has not contributed to an improvement in the audit work. Third.- Risk-based audit plan (PBR) and scheduled activities Companies must include in their plan the aspects contemplated in the special reports corresponding to the evaluation of the money laundering and terrorist financing prevention system and the evaluation of the functioning of the user attention system, as well as the activities related to compliance with the provisions on the norms of information transparency and contracting with users of the financial system, indicated in Article 19° of these Regulations, which are required by legal mandate. Likewise, those companies that have solid internal audit practices and adequate compliance with the
criteria provided in this regulation, may request authorization from the Superintendency so that in the formulation of their annual plan, only the activities provided in the annex "scheduled activities" that are relevant according to the company's own risk-based audit methodology implemented are considered, having to include for each "scheduled activity" that had not been considered in its plan, except for activities 17A 8 , 23 and 24 of paragraph I that cannot be excluded from the plan, the reasons that support not having considered them in the audit plan of that year. 9 Requests for authorization to the Superintendency must be presented at least sixty (60) calendar days before the presentation of their annual plan, for which they must present the following documentation:
a) Request made by the Internal Auditor or Audit Committee, b) Description of the risk-based audit approach and associated methodology. c) List of existing human and technical resources, as well as related hiring policies, such as specialized audit services for systems, among others. d) Self-assessment performed by the Internal Auditor on the degree of compliance with the "International Standards for the Professional Practice of Internal Auditing" according to the Institute of Internal Auditors (IIA), and the measures it will take regarding cases where there is a significant deviation. The Superintendency will determine the duration of the authorization, indefinitely or only for a specific fiscal year, as well as with the exceptions it deems necessary, based on the evaluation of the information sent by the requesting company. Likewise, if as a result of its supervisory work it deems it necessary to carry out certain examinations excluded by the company, it may require them to be included as non-scheduled activities. The Superintendency's authorization does not exempt the company from complying with examinations required by current laws, understanding that this is limited only to those activities required by regulation issued by the Superintendency. Fourth.- Agreements Supervised companies may establish agreements of collaboration and mutual support, technological transfer, or others, for the adequate application of these Regulations. Fifth.- Complementary and Related Service Companies For the purposes of what is stated in Article 11° of this norm, regarding Complementary and Related Service Companies, said companies will be subject to the provisions of the cited article, according to the magnitude of the operations they carry out. Fund Transfer Companies (ETFs) whose monthly average of funds transferred in the last twelve (12) months is equal to or exceeds four thousand (4,000) Tax Units (UITs), must have a full-time Internal Auditor. The Internal Auditor of ETFs whose cited monthly average is lower than the aforementioned 4,000 UITs, may be hired part-time and under any modality, must comply with the requirements and functions indicated in these Regulations. TRANSITIONAL PROVISION FIRST:
10
Exceptionally, regarding the annual internal audit work plan corresponding to the year 2009, the request for authorization referred to in the Third Final Provision must be presented at least thirty (30) calendar days before the presentation of the Plan. SECOND: 11 The requirements contemplated in the Regulations will be applicable to the Peruvian Federation of Municipal Savings and Credit Caisses (FEPCMAC) as long as it is under the supervision of the Superintendency, in accordance with what is established in Article 21 of Supreme Decree No. 157-90-EF and its modifying norms. THIRD:
12 Regarding the annual internal audit work plan referred to in the Third Final Provision, companies that have authorization must incorporate in their plan, activities 23 and 24 of numeral I of the Annex "Scheduled Activities".
10 Numbering modified by SBS Resolution No. 1325-2018 published on 06.04.2018.
11 Provision incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018.
12 Provision incorporated by SBS Resolution No. 467-2023 published on 13.02.2023, effective from the audit plan corresponding to the 2024 fiscal year.

16
ANNEX
SCHEDULED ACTIVITIES
As part of the annual plan, companies must consider at least the execution of reviews directed at evaluating and verifying the adequate functioning of the following topics:

I. COMPANIES INDICATED IN LETTERS A, B AND C OF ARTICLE 16 OF THE GENERAL LAW (EXCEPT GUARANTOR AND GUARANTEE COMPANIES), BANCO DE LA NACIÓN, BANCO AGROPECUARIO, FONDO MIVIVIENDA AND CORPORACIÓN FINANCIERA DE DESARROLLO (COFIDE) 13:

1. Evaluation of the compliance with the operational limits of the companies, both individual and global;
2. Evaluation of the criteria for allocation and compliance with capital requirements for each risk, the calculation of leverage and total effective equity;
3. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity 14;
4. Evaluation of market risk management, which must include the review of compliance with management and operational requirements for operations that generate market risk. Likewise, in the evaluation of market risk management it must include:
   a) Review of compliance with policies and procedures. b) Review of compliance with regulatory and internal limits. c) Review of the assumptions and results of market risk measurement models, as well as models for stress tests and back-testing, if applicable. d) Review of the quality of the information in the regulatory annexes that are applicable, verifying compliance with the respective methodological notes, as well as the reasonableness of the assumptions, and the timely submission of information to the Superintendency. 15 4A) Evaluation of liquidity risk management; 16
5. Evaluation of credit risk management; the same which must include the review of the classification of a representative sample of debtors from the non-retail credit portfolio, at least every six months, being able to vary the composition of the sample in each review. The methodology for determining the representative sample and its modifications must be duly documented and remain at all times available to the Superintendency. This control body may require modifications in said methodology.
   13 Title modified by Resolution SBS No. 8934-2012 published on 01.12.2012. Subsequently modified by Resolution SBS No. 3544-2015 published on 26.06.2015.
   14 Item replaced by Resolution SBS No. 504-2021 published on 23.02.2021, effective starting from the audit corresponding to the 2022 fiscal year.
   15 Item replaced by Resolution SBS No. 4906-2017 published on 26.12.2017.
   16 Item incorporated by Resolution SBS No. 9075-2012 published on 07.12.2012.

17
The methodology for determining the representative sample must consider among other criteria: the largest individual exposures, debtors who have been subject to alerts, debtors who have had occasional delays repeatedly and debtors who have improved their classification during the last year. It must also include debtors from refinanced and restructured credits, credits granted to persons linked to the financial system company itself, and debtors reclassified by the company or by the Superintendency. For the review of the classification of retail credit debtors, permanent automated controls must be implemented. Likewise, companies must use data integrity analysis and perform analyses of representative samples, as review procedures, at least once a year. In the case of economic groups or the presumption of single risk referred to in Article 203 of the General Law, the review will be carried out considering them as a single client. 5A) 'Evaluation of the process of management, classification and registration of commitments, including that the areas responsible for defining the amount of commitments are competent according to the internal policies of the company; 17
6) Evaluation of credit exchange rate risk management;
6A) Evaluation of country risk management; 18
7) Evaluation of compliance with the provisions indicated in special norms on linkage and economic group;
8) Analysis of the mechanisms for integral risk management of the financial group, taking into account the risk exposure from operations carried out with natural persons, legal persons or legal entities linked and conglomerate companies. Evaluation of significant accounting policies used in the consolidation of the financial statements of the financial group and consolidable groups, as well as the evaluation of compliance with equity requirements, global and concentration limits, and the other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates; 19
9) Evaluation of compliance with the norm on Requirements regarding Ethical Conduct and Professional Capacity of Persons participating in the Investment Process of Banking, Insurance Companies and Portfolios Managed by AFPs;
10) Evaluation of the nature and frequency of claims presented to the companies as well as the treatment given to them;
11) Evaluation of compliance with recommendations formulated by the FATF, external auditors and by the Superintendency;
12) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons carrying out said function.
20
17 Item incorporated by Resolution SBS No. 4345-2023 published on 04.01.2024, effective starting from the information of July 2025.
18 Item incorporated by Resolution SBS No. 7932-2015 published on 04.01.2016.
19 Item modified, starting from 01-01-2011, by Resolution SBS No. 11823-2010 of 29-09-2010 and by Resolution SBS No. 779-2021 starting from 01.04.2021 20 Item modified by Resolution SBS No. 8754-2011 published on 05.08.2011.

18
13) Evaluation of credit portfolio transfer and acquisition operations.
21
14) Evaluation of trust operations. 22
15) Evaluation of compliance with the provisions indicated in the Regulation for Social and Environmental Risk Management, in case the cited regulation is applicable. 23
16) Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies related to variable remuneration, which includes bonuses for strategic plan compliance, annual productivity bonuses, among others 24
  .

17. Evaluation of compliance with the Regulation for Classification and Valuation of Investments of Financial System Companies, the Norms for Investment in Instruments Traded through Non-Centralized Trading Mechanisms and the Regulation for Negotiation and Accounting of Derivative Financial Products in Financial System Companies.
    25
    17A) Annual evaluation of the procedures that the company has established and uses in the calculation of amounts of deposits subject to coverage and the premium paid to the Deposit Insurance Fund. The auditor must evaluate at least two of the quarters comprised in the last twelve months, counted from the date when the review begins. 26
18. For the case of CMAC, verification of compliance with Supreme Decree No. 157-90-EF and its modifying norms and the norm issued by the Superintendency, which includes at minimum what is provided in articles: 8 (do not consider 8-A and 8-B), 11 and 12 of the aforementioned Supreme Decree No. 157-90-EF, as well as the first final complementary provision of Law No. 30607.
    27
19. For Municipal Savings and Credit Boxes: 28
    a) The evaluation of compliance with the standards indicated in the Special Norms for the implementation of Law No. 30607 referred to the capitalization of profits. b) The evaluation of compliance with what is provided in the Regulation of Participation of Municipal Savings and Credit Boxes in the Law that promotes regional and local public investment with private sector participation, if applicable.
20. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting and constitution of provisions for controversies. 29
21. For companies included in letters A and B of article 16 of the General Law, to the Banco de la Nación and to the Banco Agropecuario; according to what is stated in article 1 of
    21 Item modified by Resolution SBS No. 1308-2013 published on 20.02.2013.
    22 Item incorporated by Resolution SBS No. 1882-2014 published on 29.03.2014.
    23 Item incorporated by Resolution SBS No. 1928-2015 published on 28.03.2015.
    24 Item incorporated by Resolution SBS No. 272-2017 published on 23.01.2017.
    25 Item incorporated by Resolution SBS No. 4906-2017 published on 26.12.2017. Subsequently renumbered by Resolution SBS No. 681-2018 published on 24.02.2018.
    26 Item incorporated by Resolution SBS No. 2448-2020 published on 09.10.2020.
    27 Item incorporated by Resolution SBS No. 1325-2018 published on 06.04.2018.
    28 Item incorporated by Resolution SBS No. 1706-2018 published on 04.05.2018.
    29 Item incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective starting from the audit corresponding to the 2022 fiscal year.

19 the Provisions for the application of maximum interest rates, approved by Resolution SBS No. 02192-2022 30:
Evaluation of the procedures established by the company for the adequate application of maximum interest rates in its consumer credit operations, and for small and micro-enterprises, which must include, at least, the following:
a) Establishment and implementation of procedures consistent with the provisions associated with the application of maximum interest rates. b) Designation of a person responsible for monitoring and reporting tasks on the application of maximum interest rates, as well as the level of compliance with its functions. c) Timeliness and quality of information sent to the Superintendency.
22) Evaluation of compliance with the provisions indicated in the Regulation of Model Risk Management, in case the cited regulation is applicable. 31
23) Evaluation of balances and movements of pending operations, as well as their age. It must be verified that balances do not exceed the maximum periods allowed by accounting provisions, as well as analyze cases that have exceeded such periods and the reasons for it, likewise evaluate accounting dynamics in such cases. In addition, a significant sample of registered items must be identified, which includes at minimum the most significant movements of pending operation items, those that are not performed regularly, those carried out with related parties, with the purpose of identifying the nature of said movements, regardless of closing balances. 32
24) Evaluation of balances and movements of operations between the main office, branches and agencies. It must be verified that the active and passive accounts corresponding to the main office, branches and agencies of the company are used in accordance with accounting provisions and that their balances are duly compensated, as well as analyze cases where this is not met. In addition, a significant sample of registered items must be identified, which includes at minimum the most significant movements and those that are not performed regularly, those corresponding to operations with other companies, such as their linked ones, with the purpose of identifying the nature of said movements and the reclassifications that must be made. 33
25) For companies included in letters A and B of article 16 of the General Law, as well as for the Banco de la Nación and the Banco Agropecuario, evaluation of compliance with the requirements for the use of transactional information for the estimation of sales, income and expenses of the family-business unit of debtors with small business or microenterprise credits, if applicable.
34
The other evaluations and reports that companies must carry out periodically according to the current provisions of this Superintendency.”
35
30 Item incorporated by Resolution SBS No. 2192-2022 published on 14.07.2022.
31 Item incorporated by Resolution SBS No. 00053-2023 published on 11.01.2023.
32 Item incorporated by Resolution SBS No. 467-2023 published on 13.02.2023, effective starting from the audit plan corresponding to the 2024 fiscal year.
33 Item incorporated by Resolution SBS No. 467-2023 published on 13.02.2023, effective starting from the audit plan corresponding to the 2024 fiscal year.
34 Item incorporated by Resolution SBS No. 2368-2023 published on 19.07.2023, effective starting from the audit plan corresponding to the 2025 fiscal year to be sent to the SBS no later than 31.12.2024.
35 Paragraph incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011.

20
II. INSURANCE AND/OR REINSURANCE COMPANIES:

1. Evaluation of the management of risks other than technical insurance risks, which include operational risk, market risk, credit risk, liquidity risk, among others; as well as, evaluation of compliance with procedures carried out for the identification, measurement, control and reporting of said risks;
   36
2. Evaluation of the management of policy underwriting and premium collection;
3. Evaluation of compliance with procedures carried out by the person(s) in charge of the actuarial function and the technical risk management function;
   37
4. Evaluation of co-insurance and reinsurance management, as well as the determination of the quality of reinsurers;
   38
5. 39
6. Evaluation of compliance with procedures carried out to guarantee the quality of data used in rating, in the calculation of technical reserves and solvency margin;
   40
7. Evaluation of investment management and its valuation. As part of this evaluation, it must include: 41
   a) Verify that a record of personal investments of those who make decisions in the investment process is kept, including personnel from risk and investment committees and the board of directors. b) Verify that there is independent control so that personnel who have access to information regarding analysis, strategies, positions, among other reserved information regarding the company's investments, sign sworn declarations of compliance with the Policies on appropriate use of reserved information; and that these are available to the Superintendency. c) Regarding assets that are subject to notification and authorization processes, within the framework of what is stated in articles 26°, 27 and 28° of the Investment Regulation of Insurance Companies, reasonable compliance with the minimum requirements established for investment and risk units indicated in articles 13° and 15° of said Regulation must be verified, which contribute to ensuring the adequate investment process linked to the instrument under analysis. 42
8. Evaluation of management in policy marketing and transparency of information to potential insured parties;
9. Evaluation of compliance with Superintendency provisions regarding substantiation of claim rejections;
10. Evaluation of the nature and frequency of claims presented to the companies, as well as the treatment given to them;
    36 Item modified by Resolution SBS No. 2507-2010 published on 19.03.2010. Subsequently, modified by Resolution SBS No. 00053-2023 published on 11.01.2023. Subsequently, modified by Resolution SBS No. 397-2024 published on 05.02.2024, effective starting from 01.04.2024. Subsequently, modified by Resolution SBS No. 1660-2025 published on 09.05.2025, effective starting from 01.01.2026. 37 Item modified by Resolution SBS No. 3863-2016 published on 16.07.2016. 38 Item modified by Resolution SBS No. 4706-2017 published on 13.12.2017. 39 Item eliminated by Resolution SBS No. 3863-2016 published on 16.07.2016. 40 Item modified by Resolution SBS No. 3863-2016 published on 16.07.2016. 41 Item replaced by Resolution SBS No. 1041-2016 published on 27.02.2016. 42 Literal incorporated by Resolution SBS No. 556-2025 published on 18.02.2025.

21
11) Evaluation of compliance with the provisions indicated in special norms on linkage and economic group;
12) Analysis of the mechanisms for integral risk management of the financial group, taking into account the risk exposure from operations carried out with natural persons, legal persons or legal entities linked and conglomerate companies. Evaluation of significant accounting policies used in the consolidation of the financial statements of the financial group and consolidable groups, as well as the evaluation of compliance with equity requirements, global and concentration limits, and the other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates 43
13) Evaluation of compliance with the norm on Requirements regarding Ethical Conduct and Professional Capacity of Persons participating in the Investment Process of Banking, Insurance Companies and Portfolios Managed by AFPs;
14) Evaluation of compliance with recommendations formulated by the FATF, external auditors and by this Superintendency;
15) Evaluation of the custody and intermediation of the company's investments and, if applicable, the implementation and exercise of investment mandates, according to what is established by the Regulation for Classification and Valuation of Investments of Insurance Companies;
44
16) Evaluation of compliance with regulatory limits established by the Superintendency.
45
17) Evaluation of the quality of information presented to the Superintendency on financial statements and accounting information (forms, annexes, reports and reports) that require norms issued by the Superintendency.
46
18) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons carrying out said function.
47
19) Evaluation of trust operations. 48
20) Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies related to variable remuneration, which includes bonuses for strategic plan compliance, annual productivity bonuses, among others 49
  .

21. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting and constitution of provisions for
    43 Item modified by Resolution SBS No. 11823-2010 of 29-09-2010 published on 01.10.2010 effective starting from 01.01.2011. Subsequently modified by Resolution SBS No. 779-2021 published on 19.03.2021 effective starting from 01.04.2021 44 Item modified by Resolution SBS No. 5027-2017 published on 30.12.2017 effective starting from the audit corresponding to the 2018 fiscal year. 45 Item modified by Resolution SBS No. 2507-2010 published on 19.03.2010. 46 Item incorporated by Resolution SBS No. 2507-2010 published on 19.03.2010. 47 Item modified by Resolution SBS No. 8754-2011 published on 05.08.2011. 48 Item incorporated by Resolution SBS No. 1882-2014 published on 29.03.2014. 49 Item incorporated by Resolution SBS No. 272-2017 published on 23.01.2017.

22. Review of the consistency of the information contained in the database of secured assets for calculating Loss at Risk (LaR) in the catastrophic reserve calculation, which is submitted to the Superintendency through Annex No. SG-4, as well as the information contained in Annex No. SG2, Annex No. SG-3, Annex No. SG-4A, and Annex No. SG-7.

23. Evaluation of asset and liability management. As part of this evaluation, the following must be included:
    a) Review of compliance with policies and procedures. b) Review of compliance with regulatory and internal limits. c) Evaluation of the procedures carried out to ensure the quality of the information submitted to the Superintendency regarding Homogeneous Groups of Regulatory Obligations, the Asset Sufficiency Analysis, interest rate risk indicators, liquidity indicators, stress tests, and liquidity contingency plan.

24. Evaluation of the following aspects of parametric insurance regulations:
    a) Compliance with the characteristics established by the Superintendency regarding products registered as parametric insurance. b) Compliance with the procedures carried out for the commercialization, monitoring, and verification of the parameter, as well as for the determination of parametric insurance claims. c) Evaluation of the technical capacity of the calculation agent and compliance with the functions assigned to them. Other examinations and reports that companies must periodically perform in accordance with the current provisions of this Superintendency.
    III. COMPLEMENTARY AND RELATED SERVICE COMPANIES:

25. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity;

26. Evaluation of the nature and frequency of claims submitted to companies, as well as the treatment given to them;

27. Evaluation of compliance with the operating limits established by the Superintendency:

28. Evaluation of compliance with the recommendations made by the internal audit unit, external auditors, and this Superintendency;

29. In the case of general warehouses:
    a) Evaluation of the client portfolio for warehousing services, and b) Evaluation of control, valuation, and custody responsibility policies for stored goods, in the case of general warehouses.

30. Additionally, Fund Transfer Companies (ETF) must include the following activities in their Work Plan:
    a) Evaluation of commissions charged to foreign companies for the delivery of funds to beneficiaries in Peru, as well as their accounting registration, with a semi-annual execution frequency. b) Evaluation of the adequate identification and control of own and third-party available funds, subject to the service, with a semi-annual execution frequency. c) Evaluation of compliance with deadlines for the delivery of funds to third parties in accordance with the policies and internal rules established by the company, commitments assumed with users, as well as adequate publicity and information to clients, with a semi-annual execution frequency. d) Evaluation of compliance with the company's operating limit regarding available funds, with a quarterly execution frequency. e) Evaluation of compliance with Board Agreements, with a semi-annual execution frequency. f) Evaluation of adequate supervision and centralization of Agent operations, if applicable, with a semi-annual execution frequency.

31. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.

32. Additionally, Electronic Money Issuing Companies (EEDE) must include the following activities in their Work Plan:

• Evaluation of compliance with the limits and operating conditions established by the Law regulating the basic characteristics of electronic money as a financial inclusion instrument, Law No. 29985; the Regulation of Law No. 29985 regulating the basic characteristics of electronic money as a financial inclusion instrument, approved by Supreme Decree No. 090-2013-EF; and the Regulation of Electronic Money Operations, approved by SBS Resolution No. 6283-2013.
• Evaluation of commissions charged for operations, as well as their accounting registration.
• Evaluation of compliance with commitments assumed with clients, as well as adequate information and publicity provided to them.
• Evaluation of compliance with Board Agreements.
• Evaluation of compliance with provisions regarding guarantees: constitution, operation, balances, and effective coverage, etc.
• Evaluation of adequate supervision and centralization of correspondent cashier operations, if applicable.

9. Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan achievement, annual productivity bonuses, among others.

10. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.
    Other examinations and reports that companies must periodically perform in accordance with the current provisions of this Superintendency.
    IV. GUARANTEE AND SURETY COMPANIES:
11. Evaluation of granted guarantees;
12. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on information security and Cybersecurity.
13. Evaluation of the nature and frequency of claims submitted to companies, as well as the treatment given to them;
14. Evaluation of compliance with the operating limits established by the Superintendency:
15. Evaluation of compliance with the recommendations made by the UAI, external auditors, and this Superintendency;
16. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.
17. Evaluation of the criteria for allocation and compliance with capital requirements for each risk, the calculation of leverage, and total effective equity.
18. Evaluation of credit portfolio transfer and acquisition operations.
19. Evaluation of trust operations.
20. Evaluation of compliance with the provisions indicated in the Regulation for the Management of Social and Environmental Risk, if said regulation is applicable.
21. Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan achievement, annual productivity bonuses, among others.

12. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.
13. Evaluation of compliance with the requirements for the use of transactional information for the estimation of sales, income, and expenses of the family-business unit of debtors with small or micro-enterprise loans, if applicable.
    Other examinations and reports that companies must periodically perform in accordance with the current provisions of this Superintendency.
    V. MUTUAL AID FUNDS AND PENSION FUNDS:
14. Evaluation of accountable advances and their regularization;
15. Evaluation of the company's investment management, its valuation, the constitution of provisions, and adequate backing of obligations with its associates;
16. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and Cybersecurity;
17. Evaluation of the constitution of technical reserves and liabilities for obligations with its associates.
18. Evaluation of the nature and frequency of claims submitted to companies, as well as the treatment given to them;
19. Evaluation of compliance with policies and procedures implemented for the granting and classification of debtors in their credit portfolio; as well as on the adequate constitution of provisions.
20. Evaluation of compliance with the recommendations made by the UAI, external auditors, and this Superintendency; and,
21. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.
22. Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan achievement, annual productivity bonuses, among others.

10. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.
11. Additionally, for Mutual Aid Funds, the evaluation of information by type of activity and business unit.
    Other examinations and reports that companies must periodically perform in accordance with the current provisions of this Superintendency.
    VI. PRIVATE PENSION FUND ADMINISTRATORS (AFP):
12. Evaluation of operational risk management and the provisions of current regulations on business continuity management and information security;
13. Evaluate the investment risk management system, which must include, at a minimum, the following:
    a) The development of investment risk management in accordance with the provisions indicated in Chapter XI of Title VI and in the manual of policies and procedures established by the AFP. b) The organization of the investment risk unit, which includes the assignment of responsibilities within the investment risk unit; and its independence from other functional areas. c) The sufficiency, integrity, consistency, and degree of integration of information processing systems and for investment risk analysis. d) The consistency, accuracy, integrity, timeliness, and validity of the information sources used in the measurement models. e) Modifications to risk measurement models and their corresponding approval by the investment risk committee. f) The approval process for risk measurement models used by personnel from various areas and for operations control.
14. Evaluation of the nature and frequency of claims submitted to companies, as well as the treatment given to them;
15. Evaluation of compliance with the standard on Requirements for Ethical Conduct and Professional Capacity of Persons Participating in the Investment Process of Banking Companies, Insurance Companies, and Portfolios Administered by AFPs;
16. Evaluation of the measures taken to implement the recommendations made by the UAI, external auditors, and this Superintendency;
    and,
17. Evaluate at least annually compliance with Title VI of the Compendium of Superintendency Regulatory Standards of the Private Pension Fund Administration System referred to Investments, and report to the AFP's board of directors and the Superintendency once said evaluation is completed, including the preventive and corrective measures adopted.
18. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.
19. Evaluate at least semi-annually the process linked to the direct investment of Pension Funds in local and foreign derivative instruments, including compliance with applicable regulations of the investment, investment risk, and back office units.
20. Evaluate compliance with the requirements associated with the general authorization process established through Circular No. AFP-140-2014.
    The conclusions of the evaluation must contain any change and/or modification that may have been made and may affect compliance with any of the requirements indicated in Circular No. AFP-140-2014.
21. Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan achievement, annual productivity bonuses, among others.

11. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.
    Other examinations and reports that companies must periodically perform in accordance with the current provisions of this Superintendency.