
Information Classification					Internal Access
☐ Informal	☑ Public non-informal	☐ Reserved	☐ Confidential		☑ All employees	☐ Restricted

CENTRAL BANK OF RESERVE

Instruction for the Administration and Operation of Mass Payments

Code:
INS-MP02-GOF-004

Version:
7.0

Validity:
September 15, 2026

Payments and Values Department
Financial Operations Management

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 2 of 60

INDEX

Generalities ................................................................................................................................... 3
Objective ............................................................................................................................................ 5
Definitions ...................................................................................................................................... 6
General Rules ........................................................................................................................... 14
Specific Rules ......................................................................................................................... 17
Special Provisions ................................................................................................................. 39
Validity, Distribution and Disclosure ............................................................................................... 45
Formats and Records Used .................................................................................................... 46
Version Control ....................................................................................................................... 46

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 3 of 60

1. Generalities

1.1. Background

The Mass Payments System, currently identified as Transfer365, is a payment platform administered by the Central Bank of Reserve of El Salvador. Its operation began on June 5, 2021, as a result of the transformation of the previous Mass Payments System, which had been functioning since 2013 primarily for the payment of suppliers and government payrolls of the Government of El Salvador, through the Ministry of Finance, under a scheme limited to business days and hours.

Transfer365 operates as an automated clearinghouse that facilitates the population's ability to make interbank fund transfers and payments instantly, from anywhere, at any time and every day of the year. To do this, it interconnects banks, cooperative banks, savings and credit societies, federations of cooperative banks, the Ministry of Finance, and other authorized Participants who require the use of the service.

The Board of Directors of the Central Bank of Reserve of El Salvador approved the Instruction for the Administration and Operation of Mass Payments via Session No. CD-5/2021, on February 11, 2021, with validity starting from March 5, 2021, repealing the instruction authorized in Session No. CD-39/2018, on October 8, 2018.

Subsequently, via Session No. CD-07/2022, on March 14, 2022, a new version of the Instruction was approved, valid from March 31, 2022, in which adjustments related to the recognition of the Mass Payments System as the Transfer365 System were incorporated, as well as the expansion of the scope of its services through the electronic channels of the authorized Participating Entities.

Likewise, in Session No. CD-08/2022, on March 28, 2022, Participating Entities were authorized to make the Transfer365 Mobile service available to their customers, which allows making interbank transfers using the cell phone number associated with a bank account.

Additionally, in Session No. CD-16/2022, on July 28, 2022, modifications were approved aimed at reducing the processing times of Participants

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 4 of 60

for the crediting and/or return of funds, with the purpose of improving the Transfer365 Service experience for the benefit of the population.

In Session No. CD-11/2024, on April 22, 2024, modifications were made to operationalize the recurring payments service.

In Session No. CD-E31/2025, on November 13, 2025, the Board of Directors authorized participating institutions to make the necessary adjustments in their systems and internal processes to enable the processing of operations in the time frame between 10:00 p.m. and 11:59 p.m., in order to consolidate the operation of Transfer365 under a continuous availability scheme, twenty-four (24) hours a day, seven days a week. Consequently, it is necessary to incorporate into this Instruction the modifications related to operating hours and applicable processes.

In Session No. CD-12/2026 on June 16, 2026, the settlement cycle schedules were modified to consolidate a 24/7 service, the schedule for sending account verification files was updated until 23:00 hours, and a migration to a new format was carried out in compliance with the update of the Instruction for the Management of Administrative Instruments V6.0 and its Guidelines.

1.2. Legal Basis

The Mass Payments System and the Payment Instructions derived from it are based on the following legal and regulatory provisions:

1.2.1. Treaty on Payment Systems and Securities Settlement in Central America and the Dominican Republic.
1.2.2. Organic Law of the Central Bank of Reserve of El Salvador, Art.3, second paragraph, letters e), g), h) and l) and Art. 65, 66, 67, 94 and 95.
1.2.3. Bank Law, Article 60.
1.2.4. Cooperative Bank and Savings and Credit Society Law, Art. 34 letters h) and s).

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 5 of 60

1.2.5. Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction.
1.2.6. Special Law Against Acts of Terrorism.
1.2.7. Law on the Issuance of Digital Assets.
1.2.8. Law to Facilitate Financial Inclusion.
1.2.9. Instruction for the Prevention, Detection and Control of Money Laundering and Assets, Terrorism Financing and the Financing of the Proliferation of Weapons of Mass Destruction.
1.2.10. Instruction for the Recognition of Payment Systems of Systemic Importance.
1.2.11. Regulation of the Real-Time Gross Settlement System (RTGS).
1.2.12. Regulation for Operating Electronic Payment Systems of the ACH type.
1.2.13. Rules for the Entry and Participation in Payment Systems Administered by the Central Bank of Reserve of El Salvador by Financial Services Payment Administrators.
1.2.14. Rules for the Participation of Digital Asset Service Providers in Payment Systems

1.3. Scope of Application

This Instruction is strictly mandatory for Entities in Process, Participants of the Mass Payments System (Transfer365 System) and for the Central Bank of Reserve of El Salvador, in its capacity as Administrator.

2. Objective

This Instruction establishes the operating rules of the Transfer365 System, which are strictly mandatory for Entities in Process, their Participants and for the Central Bank of Reserve of El Salvador, in its capacity as Administrator of the System.

Likewise, it contains provisions applicable to the Central Bank of Reserve as a direct user of the Transfer365 System for its own operations.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 6 of 60

3. Definitions

For the purposes of this Instruction, the following shall be understood:

3.1. Files:
Refers to electronic files constituted by a batch, and this in turn by one or a set of individual credit transfers or confirmation or verification messages, which can be:

3.1.1. Credit Transfer Cancellation File:
Electronic file constituted by a batch and this in turn by one or a set of individual fund transfers that could not be transferred to the destination Participant, which is sent to the Participants who originated the payment.

3.1.2. Credit Transfer Confirmation File:
Electronic file constituted by a batch and this in turn by one or a set of individual items, which is sent to the Participants who originated the payment with the details of all fund transfers credited to the final beneficiary.

3.1.3. Credit Transfer Return File:
Electronic file constituted by a batch and this in turn by one or a set of individual fund transfers returned for any of the return reasons defined in Annex No. 4 "Reasons for Return of Credit Transfers" of this Instruction, which is sent to the Participants who originated the payment.

3.1.4. Credit Transfer File:
Electronic file constituted by a batch and this in turn by one or a set of individual fund transfers, sent to one or several Destination Participants.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 7 of 60

3.1.5. Account Verification File:
Electronic file constituted by a batch, and this in turn by a set of individual account data to be validated, belonging to a single Origin Participant.

3.2. BCR:
Central Bank of Reserve of El Salvador.

3.3. Settlement Cycle:
Process consisting of the following stages:

3.3.1. Fund Reservation:
Collateral mechanism, which is executed at the beginning of each settlement cycle, to guarantee the rights and obligations of Participants, derived from fund transfer orders or payments sent to the system.

3.3.2. Sending of Credit Transfer Files:
Electronic transmission of credit transfer files during the time period defined in this Instruction.

3.3.3. Sending of Credit Transfer Return Files:
Electronic transmission of credit transfer return files, for one of the return reasons defined in Annex No. 4 "Reasons for Return of Credit Transfers", during the time period defined in this Instruction.

3.3.4. Sending of Credit Transfer Confirmation Files:
Electronic transmission of credit transfer confirmation files, during the time period defined in this Instruction.

3.3.5. Settlement:
Act by means of which, a payment obligation between two Participants of the Mass Payments System is extinguished, which is materialized through the registration

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 8 of 60

in the accounts of both in the Real-Time Gross Settlement System (RTGS). This act is executed at the end of each settlement cycle defined in this Instruction.

3.4. Client:
Natural or legal person account holder of a Participating Entity or who has a banking product enabled with a Participating Entity, who originates or receives Transfer365 services through it, which can be of two types:

3.4.1. Originator or Orderer:
Natural or legal person who originates payments charged to their account through the Origin Participant.

3.4.2. Beneficiary or Final Beneficiary:
Natural or legal person to whom the destination Participant must credit the funds in the reference of the banking product

3.5. Deposit Account:
Account that Participants maintain at the BCR for the settlement of their operations as demand obligations, in accordance with what is established in the Contract or Agreement signed between the parties, for this purpose.

3.6. Standardized Account:
Consists of a unique number that identifies an account constituted in Banks, Cooperative Banks or Savings and Credit Societies or another Entity authorized as a Participant of the Transfer365 System duly authorized, for this purpose this number is composed of a series of alphanumeric characters based on the International Bank Account Number (IBAN). For the case of El Salvador it consists of 28 characters and the Entities will determine and assign them to their clients' accounts, so that they can electronically transfer funds between them, through the Mass Payments System.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 9 of 60

3.7. DPV:
Payments and Values Department of the BCR.

3.8. Entity in Process:
Institution authorized by the Superintendency of the Financial System as a financial institution that has a pending application to be a Participant of the Payment Systems administered by the BCR, or has been authorized by the Central Bank of Reserve of El Salvador to start the process to be a Participant of the Mass Payments System (Transfer365).

3.9. Finality:
Refers to the fact that fund transfer orders issued by Participants in a recognized payment system and validly accepted therein; will be final, enforceable and opposable to third parties, which means that they cannot be challenged or annulled for any reason, even by the initiation of a reorganization or liquidation procedure against a Participant.

The attribute of finality will not be applicable in the case of operational errors attributable to the Participants of the Transfer365 System and the BCR.

3.10. Gateway or API (Application Programming Interface): Components that serve as an interface for the traffic of files or messages that travel between the Central Bank of Reserve of El Salvador system and the Participants' systems.

3.11. Manager:
Refers to the person holding the position of Manager of Financial Operations of the Central Bank of Reserve of El Salvador.

3.12. Irrevocable:
Refers to the fact that fund transfer orders issued by Participants to a recognized payment system cannot be withdrawn by their orderer or by third parties from the moment determined by the system's operating rules.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 10 of 60

The attribute of irrevocability will not be applicable in the case of operational errors attributable to the Participants of the Transfer365 System and the BCR.

3.13. ISO 20022:
Standard for the electronic exchange of data between Participating Entities.

3.14. Item or Record:
Data of a fund transfer or account to be validated.

3.15. OVSP:
Payment Systems Surveillance Office.

3.16. Recurring Payments:
Transfer365 service through which, clients can automatically program their fund transfers or payments through their electronic channels, taking into consideration the amount, term and frequency, for transfer products to bank account numbers and/or linked to a cell phone number, credit card payments, loan payments, among others. Likewise, providing the ease of cancellation of the service.

3.17. Participant:
Financial entity authorized by the Central Bank of Reserve as part of the Transfer365 System, in accordance with the requirements established in this Instruction, a quality that is acquired with the signing of the participation contract in said system.

3.17.1. Destination Participant:
Financial entity that receives credit transfer and/or account verification files for validation and/or application in the accounts of final beneficiaries.

3.17.2. Origin Participant:
Entity that remits fund transfers and account files for verification, at its own request or that of its clients.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 11 of 60

3.18. PKI:
Public Key Infrastructure (PKI) is a combination of hardware, software, policies and security procedures, which allow the execution with guarantees of cryptographic operations, such as encryption, digital signature and non-repudiation of electronic transactions.

3.19. Continuous Settlement Process:
Automated process by means of which, Credit Transfer Files and Credit Transfer Returns validly accepted by Transfer365, are settled one by one and continuously in the RTGS System.

3.20. Net Settlement Process:
Process that allows the immediate settlement of fund transfers and payments of Transfer365 Participants' clients and in a deferred manner in the deposit accounts that Participants maintain at the Central Bank of Reserve of El Salvador based on the constitution of a fund reserve.

3.21. Banking Product Reference:
Identification code related to a bank account, credit cards, loans, cell phone number, among others, to which a transaction will be applied.

3.22. Payment Systems:
Set of rules, agreements, procedures and systems, whose main objective is the execution of fund transfer instructions between its Participants.

3.23. RTGS System:
Real-Time Gross Settlement System. It is the main national payment system of systemic importance owned by the BCR, through which, Participants process final and irrevocable fund transfers between them. Likewise, in this System Transfer365 settles its operations.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 12 of 60

3.24. Mass Payments System (MPS):
Payment system administered by the BCR (hereinafter referred to as Transfer365 System or Transfer365), through which, Participants remit fund transfers, credit card payments, loans, recurring payments, among others, instructed by their clients and which has the following components:

3.24.1. Digital or Electronic Channels:
For this Instruction, the following shall be understood as digital or electronic channels: personal banking, corporate banking and mobile banking.

3.24.2. Clearing System:
It is the main system within which Transfer365 operates and whose function is the processing of credit transfer files, returns, confirmations and account verification files for processing, as well as the download of the Gateway and the generation of reports and queries.

3.24.3. Payment Originator (PO):
It is an application to be used by Participants as a contingency for the manual registration and authorization of credit transfer and return files in case of failures in their automatic processes or communication links.

3.25. Account Verification Requests:
Submission of files with account validation requests by the Origin Participant to the Destination Participant, in order to verify that the account is valid in the Entity. Such validation can be performed when there are new accounts and/or updates.

3.26. System to System (Straight Through Processing - STP): Automated process of electronic system-to-system fund transfers, which accelerates financial transactions, by processing without manual intervention, thus completing the processing cycle from start to finish, continuously.

Payments and Values Department	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sep/2026
	Page 13 of 60

3.27. SSF:
Superintendency of the Financial System.

3.28. Monetary Transfers:
Are the types of transfers whose objective is the mobilization of funds between the Participants of the System, which can generate the following actions:

3.28.1. Fund Transfers:
Transfer from an originator or orderer, which can be the same Origin Participant, to a final beneficiary, which can be the same Destination Participant, with the reference of the banking product to which the transaction will be applied.

3.28.2. Return of Fund Transfers:
Fund transfer returned by the Destination Participant, because due to one of the causes defined in Annex No. 4 "Reasons for Return of Credit Transfers", it is not possible to apply the funds to the final beneficiary.

3.29. Emergency Maintenance:
It is the unplanned and immediate attention maintenance that is carried out when a failure or affectation occurs in the normal functioning of Transfer365. Its objective is to restore the service in the shortest possible time and reduce the impact on clients.

3.30. Technical Failures:
It is an anomaly or malfunction in the systems, applications, technological infrastructure or communications of the Participant, which affects totally or partially the availability, continuity or the normal processing of the operations of the Transfer365 System.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 14 of 60

4. General Rules

4.1. The BCR will be the Administrator of the Transfer365 System and responsible for ensuring, regulating, and disseminating the regulations governing its operation, as well as establishing operating hours and days.

4.2. Participants of Transfer365 may be any Financial Entity that, according to Art. 66 of the Organic Law of the BCR, can open an account at the Central Bank and those that, in accordance with what is established in Art. 67 of the Organic Law of the BCR, have been authorized by the Board of Directors of the Central Bank.

4.3. Fund Transfers will be irrevocable when validly accepted by the system, and their finality will be once they are credited to the final beneficiary.

4.4. Each Participant must send its Files, defined in this Instruction, through the Automatic STP Process.

4.5. Participants must enable and make available to all their clients through the Transfer365 System, fund transfer services, credit card payments, loan payments, recurring payments, or any other service that the BCR establishes as administrator of the Transfer365 Payment System, under the following conditions:

4.5.1. Without costs or commissions.
4.5.2. Through their electronic channels for personal banking, corporate banking, mobile banking, and branches.
4.5.3. Returned or rejected operations, as well as the follow-up or investigation management for the resolution of these, will not constitute a chargeable event for commission or fee to clients.
4.5.4. For the Transfer365 Mobile option, Participants must provide facilities for linking and unlinking the cell phone number with the bank account, from electronic channels, branches, and call centers.
4.5.5. For the recurring payments service, Participants must provide this option within the template, where the information of the Fund Transfer to be made in Transfer365 and Transfer365 Mobile is registered.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 15 of 60

4.6. Payment instructions resulting from Transfer365 will be settled automatically in the deposit accounts of Participants at the BCR, provided there are available funds for their execution. If there are insufficient funds, action will be taken in accordance with what is established in paragraphs 5.5.2.2.2.2 or 5.5.2.8.2, according to the applicable settlement process of this Instruction.

4.7. It is the responsibility of Participants to maintain a sufficient balance in the deposit account to constitute their fund reserve and/or settlement, as appropriate, on the payment instructions issued. The BCR will not grant credits, overdrafts, or guarantees of any kind.

4.8. Participants must use the ISO 20022 messaging standard and the formats defined by the BCR for the electronic transmission of Files.

4.9. The Participant must have two dedicated communication links, supplied preferably by two different providers and directed towards the BCR infrastructures, located in the Government Center, Juan Pablo II Alameda Building and in the Center Building, located on First West Street, between 5th and 7th North Avenue, respectively, or the facilities of the BCR Recreation and Sports Center located at Km. 10 ½ Highway to the Port of La Libertad, in order to guarantee service availability in the event of a failure of one of the links.

4.10. For the sending of Account Verification Files and Credit Transfer Files submitted through Transfer365, the standardized account format will be used, which is incorporated in the technical documentation provided to Participants.

4.11. The BCR through the OVSP will perform the function of surveillance of payment systems, through which the objectives of security and efficiency are promoted through the follow-up and monitoring of Transfer365, evaluating its operation and verifying compliance with the rules, principles, and standards established in this Instruction. For the fulfillment of these functions, Transfer365 Participants must allow the Central Bank to conduct on-site visits at their facilities, including access to other sources of information deemed necessary.

Participants will designate the person who will have the function of External Liaison, principal or alternate, with the Central Bank, to receive notifications and attend requirements that

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 16 of 60

the OVSP performs, having to notify by means of a letter signed by the Legal Representative or Attorney-in-fact of the entity addressed to the OVSP, annually in the first fifteen (15) calendar days of the month of January and in the first (3) business days after its assignment when it is for the first time or when a change is made; and must detail the name, phone, email, and position of the designated Principal or Alternate Liaisons.

Participants must notify the BCR by means of the email info.sp@bcr.gob.sv, when one of their Liaisons, principal or alternate, ceases in the performance of said function, addition of a new Liaison, or modification of the contact information of the liaisons, in accordance with what is provided in the preceding paragraph of this instruction.

4.12. The BCR will establish measures for the prevention of the risk of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, in accordance with international standards by the Financial Action Task Force (FATF), among others, as well as, the considerations in the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, its regulations, and other applicable norms.

4.13. Participants are responsible for applying controls for the prevention of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction and any other obligation contained in laws and norms, related to the prevention or sanction of financial crimes.

The controls must be automated and not consider discretionary actions that cause a delay in the processing times of Transfer365 operations defined in this Instruction.

4.14. The settlement of Transfer365 System operations is carried out immediately for the crediting of funds to final beneficiaries, according to the times established in this Instruction and under a net settlement process for settlement in the accounts of Participants according to determined cycles; except for those Participants who, with prior authorization by the BCR, use the continuous settlement process.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 17 of 60

4.15. Participants who provide the Transfer365 and Transfer365 Mobile Service to their clients, must make available the recurring payment mechanism for credit transfers, loan payments, and credit card payments.

5. Specific Rules

5.1. The BCR as Administrator of Transfer365 will have the following obligations:

5.1.1. Subscribe to the contract in Transfer365 with Participants, as well as any subsequent modification to it.
5.1.2. Maintain the normal functioning and operation of Transfer365; so that Participants can process their files in a timely manner and propose improvements that allow achieving such purpose; as well as, adopt measures aimed at correcting deficiencies or failures in the correct functioning of the System.
5.1.3. Comply and ensure compliance by Participants, of the administrative instruments and dispositions applicable to Transfer365, as well as keep them duly updated.
5.1.4. Ensure the integrity and confidentiality of Participant information in Transfer365, as well as that received in components managed by the BCR.
5.1.5. Monitor the System in order to ensure its correct functioning and the timely processing of files.
5.1.6. Define the technical documents (messaging format, Gateway, among others) of Transfer365, which contain the technical specifications for interconnecting with Transfer365, as well as the formats for the processing of Files, which will be sent to Participants for compliance. In the case of new Participants, the referred documents will be sent once their authorization as a Transfer365 Participant is notified and in the case of modifications to the documents, they will be sent within a maximum of ten (10) business days after their modification.
5.1.7. Administer the issuance, renewal, suspension, and restoration of PKI Token or any other security mechanism that is defined, which will be sent

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 18 of 60

by correspondence to the Manager of Financial Operations or its equivalent in the Participant, at the start of operations of the users; and define the Information Security Guidelines, as established in Annex No. 1 of this Instruction.

5.1.8. Inform Participants by means of the Head of the DPV, with at least fifteen (15) business days in advance, about the entry or withdrawal of another Participant; once the date for the same is defined, unless, by communication of a competent authority, this must be made known immediately.
5.1.9. Inform by means of the DPV, to the OVSP of the BCR, the different incidents or contingencies that occur in the operability of Transfer365.
5.1.10. Ensure high availability of the technological platform for the Transfer365 System.
5.1.11. Issue a brand manual which contains the definition of the specifications of the functionalities and the visualization of the services of the Transfer365 System, in order to standardize the integration and presentation of said services in the electronic channels of Participants, ensuring a consistent and uniform user experience.
5.1.12. Prepare and make available to Participants within the brand manual the standardized message templates, which must be used obligatorily by them when communicating to their clients any service interruption, whether due to scheduled maintenance or failures. These templates will have the purpose of guaranteeing uniformity in communication, avoiding confusion among users, and preventing incorrect attribution of incidents to the Transfer365 system.

5.2. Process to become a Participant of Transfer365:

5.2.1. Entities that comply with what is established in paragraph 4.2, that wish to be Participants of Transfer365; must send to the President, a letter signed and sealed by the Legal Representative requesting their participation and account opening in accordance with what is established in the LBTR Regulation, when applicable.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 19 of 60

5.2.2. The President of the BCR will resolve on the authorization to be a Participant of the Transfer365 System or its denial, for which, previously the following procedure will be carried out: The Head of the DPV will send the request to the Compliance Office and the OVSP for the issuance of their respective opinion. If additional information from the requesting Entity is required, this will be managed by the Manager directly with said Entity, so that it is sent as appropriate. When the Entity has been previously authorized by the Board of Directors of the BCR to participate in the Transfer365 System, the process will continue in accordance with the applicable regulations; however, in those cases where there are commitments, observations, or action plans derived from previous evaluations, the opinion of the referred units will be requested before advancing with the process of entry or participation in the payment systems administered by the BCR.

Once the information is received in its entirety, it will be analyzed and the respective opinions will be issued, which will be incorporated into the comprehensive technical evaluation that the DPV will carry out, sending them to the Manager no later than two (2) business days after the receipt of the final opinion from the Compliance Office and the OVSP. The comprehensive evaluation will be submitted to the Presidency to resolve what corresponds.

If unfavorable, the Manager will notify the response to the Entity, no later than three (3) business days after. If favorable, the Manager will notify the Entity providing the corresponding technical documentation for the performance of their developments. The resolution of the request must be made, within a period not exceeding thirty (30) business days, counted from the complete receipt of the information that the applicant has sent.

Regarding entities that intend to be Participants of Transfer365 under the application of the "Rules for Entry and Participation in Payment Systems Administered by the Central Bank of Reserve of El Salvador of Institutions Administering Payment Financial Services" and the "Rules for the Participation of Digital Asset Service Providers in Payment Systems", the previous process is not applicable, as it corresponds to the Board

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 20 of 60

Directivo to issue a prior authorization so that said entities begin the process to be Participants of the Transfer365 System.

With said authorization, the DPV will manage for this entity in process, the subscription of the Deposit Account Contract with the Legal Management of the BCR, as regulated in the LBTR Regulation. Once signed, the Manager will deliver the technical specifications so that they begin the developments, according to the deadlines established in the aforementioned regulations, also requesting a work plan, which includes the necessary developments for the interconnection between their system and Transfer365, their respective tests and BCR certification, which must not exceed the maximum deadline of one hundred eighty (180) days. Said plan must be sent no later than 5 business days after the delivery of the technical specifications, to the email transfer365_bcr@bcr.gob.sv and UVSP@bcr.gob.sv. The deposit account will remain in an inactive state until the technological developments are completed and the adherence contract as a Participant of Transfer365 is signed.

Once the developments are certified, the DPV will proceed to manage with the Legal Management of the BCR the subscription of the Contract to be a Participant of Transfer365. Once the contract is signed, the deposit account activation will proceed and the entity acquires the status of Participant of the Transfer365 System.

5.2.3. If an entity does not complete the developments within the time established in paragraph 5.2.2, it must notify the BCR within a maximum of 5 business days after the expiration of the development completion deadline for the corresponding internal analyses.

5.2.4. Having completed the testing process, the Head of the DPV, within a maximum of five (5) business days, will issue a certification that accredits the satisfactory completion of the process, provided there are no pending observations, commitments, or action plans derived from previous evaluations. Said certification must include the verification of the use of the PO module as a contingency plan, in accordance with what is established in paragraph 5.4.7, as well as the certification issued by the Compliance Office of the BCR, regarding validation

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 21 of 60

of the tests of the list control system for the management of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction risks and of any other component applicable to the operation of Transfer365.

Once the certification is issued, the Entity will be notified that it must subscribe to the Transfer365 participation contract with the BCR, for which, it will have a maximum deadline of thirty (30) calendar days. If not formalized within said deadline, the Entity must restart the incorporation process.

5.2.5. During the period to subscribe to the contract, the BCR through the DPV will send to the Participant the security components and their configuration for the interconnection between their system and Transfer365 in a production environment.

5.2.6. After the subscription of said Contract, the Legal Representative of the Participant or the official they delegate will send to the Head of the DPV, a request for users, attaching the User Registration Format for Operating in the Mass Payment System (INS-MP02-GOF-004-FOR-001), established in Annex No. 2, with the names of the users and the separation of functions and roles. Likewise, it must include the name of the person who will be assigned the PKI Tokens associated with the Participant's internal system, which will be interconnected with Transfer365 for its main processing and its alternate center, according to the profiles defined in Annex No. 3 "Administration of Participant Users" of this Instruction. The DPV will have a maximum of thirty (30) calendar days to respond and deliver the respective tokens to the Participant.

5.2.7. To be a Participant of Transfer365, you must carry out your developments under the net settlement scheme; except for those cases that by special authorized disposition use the continuous settlement scheme.

5.3. Administration of Users and Roles (profiles)

5.3.1. No later than five (5) business days after receiving the User Registration Request for Operating in the Mass Payment System (INS-MP02-GOF-004-FOR-001), see Annex No. 2, the BCR will assign the users of

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 22 of 60

in accordance with what is established in Annex No. 3 "Administration of Participant Users" and coordinate the corresponding delivery.

In the case of reassignment, modification, addition, or replacement of user token, the Participant will assume a cost for digital certificate, PKI token, or other associated security mechanism per user, according to the costs defined by BCR, which must be made through the LBTR System and notified to the DPV through the email transfer365_bcr@bcr.gob.sv.

5.3.2. The operations carried out in Transfer365 by users will be the sole and direct responsibility of each Participant. Each of its users will be responsible for the use of their passwords and devices assigned to them, maintaining their confidentiality.

5.3.3. The request for incorporation of a new user must be made at least three (3) business days in advance.

5.3.4. In the case that a person ceases to be a user of Transfer365 or that for any reason their access is withdrawn, the Legal Representative or delegated official of the Participant must notify immediately by letter or email to the Head of the DPV for its deletion, no later than the next business day; otherwise, any undue entry by said user will be under the responsibility of the Participant.

5.3.5. In order to maintain an efficient administration of users, the Participant through users with the "Participant Administrator" role, can request by email, to the email transfer365_BCR@bcr.gob.sv of the DPV, temporary role changes among its users, detailing the reason and date of the change (User Registration Request for Operating in the Mass Payment System (INS-MP02-GOF-004-FOR-001), see Annex No. 2). Permanent role changes must be informed to the Head of the DPV by the Legal Representative or delegated official. The referred requests will be attended by the DPV within a maximum of three (3) business days.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 23 of 60

5.3.6. Once users are delivered, the Administrators of the Participants must configure in the Compensation System the alert notifications that each of the users can receive and their contact information.

5.4. Obligations of Participants

5.4.1. Comply with the rules and provisions issued by the Board of Directors or Presidency of the BCR for Transfer365, as well as with the schedules for sending the Files established in this Instruction.

5.4.2. Comply with the technical documents and message templates defined by the BCR, including those defined in sections 5.1.6, 5.1.11, and 5.1.12, established in this Instruction.

5.4.3. Implement internal regulations that guarantee compliance with the necessary technological and security measures to ensure the integrity, confidentiality, and availability of the data contained in the files they receive and process; ensuring that these are not rejected for non-compliance with any element or information required in the XML structure according to technical requirements previously sent to Participants.

5.4.4. Guarantee the integrity of fund transfers sent to Transfer365, as well as the structure of the files, in accordance with what is established in the Transfer365 technical documents.

5.4.5. Be responsible for the actions of their users in Transfer365, regarding the regulated processes in this Instruction.

5.4.6. Notify the DPV at least three (3) business days in advance of any change in the equipment of their users that interconnect with Transfer365, in order to grant access and permissions in the system and communication of the equipment.

5.4.7. Have contingency plans that allow them to ensure the continuity and proper functioning of Transfer365; which must be communicated to the DPV for subsequent submission to the OVSP, at least once a year, and include the uploading and downloading of Credit Transfer Files from their internal system to the BCR System (PO Module). In case of modifications to contingency plans, Participants must notify the DPV within a maximum of five (5) business days after their definition.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 24 of 60

5.4.8. Correct, within a maximum of thirty (30) calendar days thereafter, the faults detected in their systems, to guarantee proper functioning and reduce the impact associated with such faults in Transfer365; without prejudice to initiating an Administrative Sanctioning Procedure, if applicable. The corrections must be communicated to the DPV for subsequent submission to the OVSP, within a maximum of five (5) business days once executed. In the case that the remediation of a fault requires a period longer than defined, they must send a request for reconsideration to the Head of the DPV with the corresponding justifications.

5.4.9. Inform the DPV of non-compliance by other Participants, as established in this Instruction, within a maximum of the following five (5) business days after the non-compliance.

5.4.10. Submit information requested by the Manager, the Compliance Office, the DPV, or the OVSP of the BCR, regarding operations detected in the System monitoring activities, related to their obligations as a obligated subject in the prevention of Money Laundering and Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction, or compliance with rules and processes, within the timeframes determined for them.

5.4.11. Comply with the legal requirements established in the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction, its Regulation, and other binding regulations on said matter and applicable to the BCR; likewise, attend and submit within the timeframes, form, and quantity of information requests, inquiries, and other requests made by the BCR's Compliance Office as part of Due Diligence and application of the BCR's Know Your Customer Policy.

5.4.12. Preserve the records of data sent through Transfer365, for the period provided in the Special Law for the Prevention, Control, and Sanction of Money

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 25 of 60

Laundering, Terrorism Financing, and Proliferation of Weapons of Mass Destruction, its Regulation, and other binding regulations on said matter and applicable to the BCR.

5.4.13. Define the mechanisms and procedures to handle cases of claims by originators and final beneficiaries, which must be sent to the DPV for subsequent submission to the OVSP within a maximum of thirty (30) calendar days after the contract signing, in order for them to be verified and analyzed. Likewise, have the conditions, personnel, and infrastructure necessary to allow direct and immediate attention to everything related to the Transfer365 Service, maintaining a 24/7 support and attention service to be able to attend to Transfer365 clients' claims.

5.4.14. In cases where the Destination Participant faces difficulties in processing an operation, they must apply the funds once the inconveniences are resolved, using as the value date, that on which the client ordered the transaction.

If, as a result of a technical fault attributable to the Participant, a client incurs charges for late payment, interest, or presents any disagreement related to the service, the DPV will notify the OVSP to carry out a prior analysis to determine the validity of the claim. Based on this assessment, it may send a report to the Superintendence of the Financial System or to the Consumer Ombudsman, as appropriate, so that the pertinent responsibilities are derived.

5.4.15. Guarantee the proper functioning of the Transfer365 System through all its electronic channels and branches. In case of service interruptions, whether due to scheduled maintenance or that hinder its operation, Participants must comply with the following:

5.4.15.1. Service interruptions, maintenance, and technical failures.
Participants must notify the BCR of any service interruption that affects or may affect the operation of the Transfer365 System, whether due to scheduled maintenance, emergency maintenance, or technical failures, via electronic mail directed to the official addresses defined by the BCR for the administration of the Transfer365 System and the OVSP: transfer365_bcr@bcr.gob.sv and UVSP@bcr.gob.sv. The foregoing applies in cases where such interruptions extend.

The notification must include, at a minimum, the following information:

a) Type of event: scheduled maintenance, emergency maintenance, or technical failure. b) Start date and time. c) Estimated end date and time or service recovery, when applicable. d) Description of the event, maintenance, or technical failure. e) Type of impact on incoming and/or outgoing operations, according to the typification established in Annexes Nos. 6 and 7 of this Instruction. f) Corresponding justification, when it comes to emergency maintenance.

Maintenance must not be carried out on vacation days, payroll payment days, holidays, non-working days, or tax payment days, given the high transactional demand of clients. The foregoing as established in Annex 8 of this Instruction.

5.4.15.2. Scheduled Maintenance.
When the interruption results from scheduled maintenance in Participants' systems, they must notify the BCR at least one business day in advance, so that the DPV informs the rest of the Participating Entities. It is required that such maintenance be carried out during hours of lower transactional volume, for which they must incorporate the analysis or information supporting that the proposed time window corresponds to a period of low transactional flow, striving to minimize the impact on clients and

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 26 of 60

guarantee, as much as possible, the continuity of incoming operations.

5.4.15.3. Emergency Maintenance.
When the maintenance is of an emergency nature, the Participant must previously request the approval of the Head of the DPV, sending the corresponding justification and the minimum information indicated in this section.

5.4.15.4. Technical Failures.
In case of technical failures that affect the operation of the system, the Participant must notify the incident within a maximum of thirty minutes counted from its detection, indicating the level of criticality (Critical, High, Medium, or Low) and the estimated time for service recovery. Likewise, they must comply with what is provided in section 5.4.17.

5.4.16. For scheduled maintenance, emergency maintenance, or any technical failure that prevents providing the Transfer365 service normally, the Participant must inform their clients promptly, through their digital channels, email, text messages, WhatsApp, social media, or other available means, about the service interruption, the estimated time of impact, and possible inconveniences in their transactions. Likewise, they must communicate when the service has been restored.

5.4.17. Submit a detailed technical report to the DPV with a copy to the OVSP, regarding the origin of the problem no later than within three business days following the presentation of the fault. The Report must include as a minimum: Root cause, impact generated, downtime, affected clients, corrective actions.

5.4.18. Promote the Transfer365 Services to all their clients, providing facilities for access to it, in all their electronic channels and branches. Likewise, provide daily follow-up on reported cases of their client users of transfer365 through their electronic channels, branches, and social media.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 27 of 60

5.4.19. Place in a visible and easily accessible manner in their electronic channels the Transfer365 option for carrying out operations, detailing that it is a 24/7, free, and immediate settlement service, in accordance with the format guidelines that the BCR establishes and informs to Participants.

5.4.20. Guarantee the functioning of Transfer365 in the timeframes established in section 5.5.1.

5.4.21. Obligations of the Originating Participant

5.4.21.1. Ensure the quality of the information sent in Transfer365 and the financial obligations derived from their participation, being responsible to final beneficiaries for the operations carried out through Transfer365, as well as assuming responsibility for errors derived from the same, attributable to the Originating Participant.

5.4.21.2. Assign a unique reference number to each of the individual credit transfers of the batch, which must be supplied to the Destination Participant, for the purpose that it provides it to the final beneficiary in case of any claim.

5.4.21.3. Incorporate standardized accounts based on the IBAN Code for the ordering party and the final beneficiary in each payment instruction, according to what is defined in the technical specifications.

5.4.21.4. Ensure that each Item or Fund Transfer contains the following fields:

5.4.21.4.1. Name and surname or business name or denomination of the Ordering Party and the Beneficiary.

5.4.21.4.2. Standardized Bank Account Number of the Ordering Party, standardized Bank Account Number or cell phone number of the Beneficiary, loan number or credit card number or other products that are incorporated, prior consultation and notification to Participants.

5.4.21.4.3. Reference number, amount, and payment concept.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 28 of 60

5.4.21.4.4. For fund transfers or payments sent to the BCR whose destination participant is Pay, the ordering client must not be shown the type of product associated with the operation. The BCR will define the specific guidelines to show this option within the electronic channels of Participants.

5.4.21.5. Have funds available in the deposit account at the BCR, for the settlement of payment instructions, when these instructions come from an ordering party and correspond to the continuous settlement process; in the case of the net settlement process, for the constitution of the fund reserve and settlement when their resulting net position is debtor.

5.4.21.6. Notify at least through electronic channels, email, and WhatsApp or text message (SMS) to the Originating Client if their fund transfer or payment has been approved or returned, within a maximum of two (2) minutes. from the receipt of the Confirmation or Return of Credit Transfer Files, as applicable. The notification message must contain as a minimum the following information: that it is an operation of Transfer365, beneficiary name, amount of the operation, status of the transaction, date and time of application, the type of product (Fund Transfer to a savings or current account, loan payment or credit card payment) and; if it was rejected, the reason for the return. Likewise, notify the origin client if the fund transfer or payment has not been executed from the electronic channel of the Originating Participant and release or return the funds to their client within a maximum of two (2) minutes.

Likewise, the information contained in said notification message must be incorporated in the detail of the account movements detailed in the electronic channel of the Originating Participant related to the fund transfer or payment.

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 29 of 60

5.4.21.7. Return the funds to the Originating Client in the case that their fund transfer or payment has been rejected, within a maximum of two (2) minutes, once they receive the file of return or cancellation of credit transfer, notifying the cause of the return.

5.4.22. Obligations of the Destination Participant

5.4.22.1. Have the equipment and technology that allows the correct processing of the Credit Transfer Files and Account Verification Files sent by Transfer365.

5.4.22.2. Credit the funds deposited to their benefit in the Final Beneficiary's account, within a maximum of three (3) minutes, after receiving the Credit Transfer File by Transfer365, except in the case of those loan and credit card payment operations, which will be applied according to the internal processes of each Participant, as long as it is guaranteed that the application is made with the same date on which the payment was ordered.

5.4.22.3. Send the Confirmation and Return Files of Credit Transfers within a maximum of three (3) minutes, after having received the Credit Transfer Files, incorporating for the case of returns their cause, according to those defined in Annex No. 4 "Reasons for Return of Credit Transfers" of this Instruction.

5.4.22.4. Notify at least through electronic channels, email, and WhatsApp or text message (SMS) to the final beneficiary the crediting of funds or payments received within a maximum of two (2) minutes, once the processing of the received Credit Files is finished. The notification message must contain as a minimum the following information: that it is an operation of Transfer365, ordering party name, amount of the operation, status of the transaction, date and time of application, the type of product (Fund Transfer to a savings or current account, loan payment or credit card payment).

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 30 of 60

Likewise, the information contained in said notification message must be incorporated in the detail of the account movements located in the electronic channel of the Destination Participant related to the fund transfer or payment received by the final beneficiary.

5.4.22.5. Send the validated Account Verification File, on the same day it is received and once the corresponding internal validation processes are concluded.

5.4.22.6. Accept all Credit Transfer Files validly accepted by Transfer365 sent by any Originating Participant.

5.4.22.7. In the case that the sending of Confirmation Files

Department of Payments and Values	Code: INS-MP02-GOF-004
Instruction for the Administration and Operation of Mass Payments	Version: 7.0
	Validity: 15/Sept/2026
	Page 31 of 60

Instruction for the Administration and Operation of the Mass Payments System

CENTRAL BANK OF RESERVE

Instruction for the Administration and Operation of Mass Payments

Lineage: In force