JPRFM-2026-033-F — Approves Reforms to Chapter LV of the Codification of Monetary, Financial, Securities and Insurance Resolutions to Harmonize with Articles 357 and 358 of the Organic Monetary and Financial Code

RESOLUTION No. JPRFM-2026-033-F THE BOARD OF FINANCIAL AND MONETARY POLICY AND REGULATION CONSIDERING:

That, Article 226 of the Constitution of the Republic of Ecuador prescribes that public servants and persons acting by virtue of state authority shall exercise only the competencies and powers attributed to them in the Constitution and the Law;

That, Article 227 ibid states that Public Administration constitutes a service to the community governed by the principles of effectiveness, efficiency, quality, hierarchy, coordination, planning, among others;

That, the first paragraph of Article 303 of the constitutional norm determines that the formulation of monetary, credit, exchange, and financial policies is the exclusive faculty of the Executive Branch and will be implemented through the Central Bank of Ecuador;

That, on October 13, 2025, the Organic Reform Law of the Organic Monetary and Financial Code was published in the Sixth Supplement of the Official Register No. 142;

That, Article 13 of the Organic Monetary and Financial Code creates the Board of Financial and Monetary Policy and Regulation, part of the Executive Branch, as an organ with functional, technical, and institutional autonomy, and in its decisions, responsible for the formulation of monetary, credit, financial, securities, insurance, and prepaid comprehensive health care services policy and regulation. The Board of Financial and Monetary Policy and Regulation shall be the highest governing body of the Central Bank of Ecuador;

That, Article 17 of the referred Code, in its pertinent part, determines that:

"(...) For the fulfillment of these functions, the Board shall issue regulations in matters within its competence, without being able to alter legal provisions. The Board of Financial and Monetary Policy and Regulation may issue regulations by segments, economic activities, and other criteria. It may even reform or repeal regulations from the former Board of Monetary and Financial Policy and Regulation, the Board of Financial Policy and Regulation, or the Board of Monetary and Financial Policy and Regulation.

RESOLUTION No. JPRFM-2026-033-F Page | 2 All norms and policies issued by the Board of Financial and Monetary Policy and Regulation in the exercise of its functions, duties, and powers must be backed by duly substantiated technical and legal reports (...)";

That, Article 18 ibid establishes the specific functions of the Board of Financial and Monetary Policy and Regulation, in the financial sphere, especially in numeral 2 it is authorized this Institution to issue regulations that allow maintaining the integrity, solidity, sustainability, and stability of the national financial, securities, insurance, and prepaid comprehensive health care services systems;

That, Article 24 of the same Code provides that the acts of the Board of Financial and Monetary Policy and Regulation enjoy the presumption of legality and shall be expressed through resolutions that will have mandatory force, which shall govern from their publication in the Official Register, or from the date of their issuance when so determined by the Board, in accordance with the subject matter;

That, Article 25.2 ibid determines that the Technical Secretariat of the Board of Financial and Monetary Policy and Regulation is exercised by the Central Bank of Ecuador, and Article 25.3 establishes as its functions the elaboration of technical and legal reports that support regulation proposals, provide technical and administrative support to the Board of Financial and Monetary Policy and Regulation, and those assigned to it by said Board;

That, Article 357 of the same Code establishes that the credit reference service shall be provided by the Superintendency of Banks and by legal entities authorized by it. Furthermore, it defines this service as that which, through the receipt of credit risk information, the maintenance, analysis, and processing of this information, allows service users to adequately identify a person and evaluate their credit risk, determine their debt levels, economic solvency, as well as their capacity for debt and payment of obligations. This service may include complementary information as long as it is relevant for the indicated purposes, thereby empowering the Board of Financial and Monetary Policy and Regulation to include information determined by resolution.

That, Article 358 ibid provides that information sources of the financial system will report information through the Superintendency of Banks, the authority that will provide said information to legal entities authorized to provide the credit reference service. Likewise, it determines that credit risk information will not have an age greater than 4 years counted from the last date of validity of the credit operation. Credit information reports will refer only to operations that are current, overdue, or cancelled from the two (2) last years prior to the date of their issuance.

That, General Provision Twenty-Ninth ibid states: "In existing legislation where mention is made, indistinctly, of the Board of Monetary and Financial Policy and Regulation, the Board of Monetary Policy and Regulation; or, the Board of Financial Policy and Regulation, replace and understand as 'Board of Financial and Monetary Policy and Regulation';

That, First Transitional Provision of the Organic Reform Law of the Organic Monetary and Financial Code determines that the members of the Board of Financial and Monetary Policy and Regulation, sworn in on September 16, 2025 by the National Assembly, will continue to exercise their functions for the periods for which they were designated and will maintain their labor continuity and acquired rights;

That, through Office No. T.233-SGJ-25-098, dated September 5, 2025, signed by the Constitutional President of the Republic, addressed to the President of the National Assembly, he sent the list of candidates for the designation of the Members of the Board of Financial and Monetary Policy Regulation; as well as, the temporality of their stay within the initial period;

That, the Plenary of the National Assembly, on September 16, 2025, designated and swore in the members of the Board of Financial and Monetary Policy and Regulation, in the persons of: Gustavo Estuardo Camacho Dávila; Silvia Daniela Moya Arteta; Roberto Javier Basantes Romero; and, María Isabel Camacho Cárdenas;

That, the Board of Financial and Monetary Policy and Regulation, through ordinary reserved session No. 018-2026, in person mode, on August 20, 2026, reviewed the proposal sent via Memorandum No. BCE-BCE-2026-0350-M, dated August 19, 2026, by the General Manager of the Central Bank of Ecuador to the President of the Board of Financial and Monetary Policy and Regulation; as well as, Technical Report No. BCE-GESFM-002-2026 / BCE-SEMF-071-2026, dated August 18, 2026; and, Legal Report No. BCE-GJ-084-2026, dated August 18, 2026; and,

RESOLUTION No. JPRFM-2026-033-F Page | 3

In exercise of its functions and in attention to Article 24 of the Organic Monetary and Financial Code, the Board of Financial and Monetary Policy and Regulation,

RESOLVES:

Article 1. - Substitute Article 7 of Section I "Of Credit Information Bureaus and Payment Obligations that Must Be Recorded in the Credit Reference Service", Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, with the following text:

"Art. 7.- Of the sources of information. - A credit data source is understood as that entity or system that, in accordance with express legal authorization, produces, administers, or reports information directly related to credit risk, financial indebtedness, and the payment behavior of credit subjects.

Sources of an obligatory nature are: entities from the public, private, and popular and solidarity financial sectors; entities participating in the securities market, the commercial sector, insurance and reinsurance companies, and the telecommunications sector.

Sources of a complementary nature are information that supports credit analysis, such as payment of basic services, payment of taxes, provided that such information corresponds to data of a credit nature, linked to the payment behavior, fulfillment of obligations, or indebtedness capacity of the holder.

For the provision of the credit reference service, information sources of the national financial system will deliver information related to credit risk to the Superintendency of Banks, in the format and with the periodicity that it determines, authority that will provide said information to legal entities authorized to provide the credit reference service.

Information sources corresponding to other sectors will report, directly, credit risk information to the entities authorized to provide the service and to the Superintendency of Banks; without prejudice to complying with their legal obligations with the Superintendencies of the Popular and Solidarity Economy, and of Companies, Securities and Insurance, as applicable, under the conditions and periodicity established by the control bodies".

Article 2. - Incorporate, following Article 7 Section I "Of Credit Information Bureaus and Payment Obligations that Must Be Recorded in the Credit Reference Service", Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, the following article:

"Art. 7.1. - Incorporation of new credit information sources. The information that integrates the Credit Data Registration Service may additionally come from other sources not expressly provided for in this regulation, provided that such sources and the information they administer:

a) Contribute objectively and verifiably to the analysis of credit risk and indebtedness capacity of credit subjects; b) Are obtained and treated in accordance with express legal authorization or valid legal basis, respecting the principles and provisions of the Organic Law of Personal Data Protection; c) Respect the principles of specific purpose, proportionality, data minimization, truthfulness, and information security; d) Do not correspond to sensitive personal data, nor to information subject to legal reserve, nor to information protected by special regimes; e) Do not generate discriminatory, exclusionary effects, or contrary to the constitutional rights of persons.

The inclusion of new credit information sources will be determined by a motivated resolution of the Board of Financial and Monetary Policy and Regulation within the scope of its competencies and in accordance with what is provided in the Organic Monetary and Financial Code, prior to technical, legal, and potential effects analysis on the protection of information holders' rights.

This incorporation will not, by itself, constitute any obligation for public or private entities to provide information, nor will it imply the lifting of legal reserves or the automatic authorization of access to protected databases. When

RESOLUTION No. JPRFM-2026-033-F Page | 4 there is sufficient legal authorization for the exchange of information, competent control bodies may coordinate the necessary operational, technical, and institutional mechanisms for its implementation, in accordance with the applicable legal framework".

Article 3.- Substitute Article 14 of Section III "Of Information Requirements regarding Active Credit Operations and Contingent Operations of Institutions of the Financial System and Loans of the Social Security System and other Institutions established in Article 357 of the Organic Monetary and Financial Code and of other Institutions that Register Payment Obligations determined by the Board of Monetary and Financial Policy and Regulation", Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, with the following text:

"Art. 14.- Credit risk information will not have an age greater than four (4) years counted from the last date of validity of the credit operation, that is, from the date on which the credit operation was legally extinguished through one of the modes of extinction of obligations provided for in the law.

Credit information reports will refer only to operations that are current, overdue, or cancelled from the two (2) last years prior to the date of their issuance".

Article 4. - Substitute Article 16 of Section IV "Of the Information available in the Credit Data Registry", Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, with the following text:

"Art. 16.- The information contained in the Credit Data Registry must be maintained for a period of four (4) years, after which it may be eliminated from the online database; however, if deemed necessary, it may be preserved in other media".

Article 5. - Substitute Article 17 of Section IV "Of the Information available in the Credit Data Registry", Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial

RESOLUTION No. JPRFM-2026-033-F Page | 5 System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, with the following text:

"Art. 17.- Without prejudice to credit information including records with a maximum age of four (4) years, reports generated by credit information bureaus and the Credit Data Registry will refer only to the two (2) last years prior to the date of their issuance".

Article 6. - Eliminate the General Provision of Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions; and add the following:

"GENERAL PROVISIONS FIRST.- Without prejudice to what is established in this Chapter, entities authorized to provide the credit reference service may enter into agreements with institutions where payment obligations are registered, for the obtaining of information intended for credit risk analysis, provided that such information is obtained lawfully, has a valid legal basis, and is treated in accordance with the Organic Law of Personal Data Protection. In no case will these agreements constitute authorization for access to sensitive data, information subject to legal reserve, nor will they generate an obligation to provide information.

SECOND.- Cases of doubt that arise in the application of this Chapter will be resolved by the Superintendency of Banks".

Article 7. - Eliminate the Transitional Provisions of Chapter LV "Of the Credit Data Registration Service and Credit Information Bureaus", Title II "National Financial System", Book I "Monetary and Financial System" of the Codification of Monetary, Financial, Securities and Insurance Resolutions; and add the following:

"FIRST.- The Superintendency of Banks must implement the necessary actions for the application of the provisions established in this Chapter, within a maximum of eighteen (18) months.

Within this period, the Superintendency of Banks will coordinate, within the scope of competencies legally attributed to each institution, with the Ministry of Infrastructure and Technology or its equivalent, the Internal Revenue Service, and basic service provider companies, the actions that are legally appropriate for the implementation of what is provided in this Chapter and in Article 357 of the Organic Monetary and Financial Code. This coordination will not imply, by itself, the obligation to provide information nor will it constitute authorization to access, treat, or transfer information subject to legal reserve, including individualized tax information, and must observe the applicable provisions in matters of confidentiality, personal data protection, and institutional competencies".

SECOND.- The Superintendency of Popular and Solidarity Economy must implement the necessary actions for the application of the provisions established in this Chapter, within a maximum of twelve (12) months.

THIRD.- The Superintendency of Companies, Securities and Insurance must implement the necessary normative, operational, and technological actions for the application of the provisions established in this Chapter, within a maximum of eighteen (18) months. Until such adjustments are implemented, the submission of information will continue to be carried out in accordance with the periodicity and reporting procedures applicable at the date of issuance of this resolution".

FINAL PROVISION. - This resolution will enter into force from its issuance, without prejudice to its publication in the Official Register.

The publication on the institutional website and the update of the Codification of Monetary, Financial, Securities and Insurance Resolutions are entrusted to the General Secretariat of the Central Bank of Ecuador.

COMMUNICATE AND PUBLISH. - Given in the city of Quito D.M., on August 20, 2026.

THE PRESIDENT Mgs. Gustavo Estuardo Camacho Dávila The resolution above was processed and signed by Master Gustavo Estuardo Camacho Dávila - President of the Board of Financial and Monetary Policy and Regulation, in the city of Quito D.M., on August 20, 2026.- I CERTIFY.

RESOLUTION No. JPRFM-2026-033-F Page | 6 TECHNICAL SECRETARIAT Law. Ninoska Geovanna Ceballos Pin