Lima, 20 December 2017

S.B.S. Resolution No. 4906 -2017

The Superintendent of Banking, Insurance and
Private Pension Fund Administrators:

WHEREAS:

That, by SBS Resolution No. 272-2017, the Corporate Governance and Comprehensive Risk Management Regulation was approved, which establishes that supervised companies must have comprehensive risk management appropriate to their size and the complexity of their operations and services;

That, among the risks faced by supervised companies in the development of their activities is market risk, which may arise from the possibility of losses in on- and off-balance sheet positions resulting from fluctuations in market prices;

That, for the market risk management of financial system companies, the Superintendency issued the Market Risk Supervision Regulation approved by SBS Resolution No. 509-98 and its amending norm, and the Foreign Exchange Risk Administration Regulation approved by SBS Resolution No. 1455-2003 and its amending norms;

That, it is necessary to issue a new Market Risk Management Regulation, so that it is consistent with the provisions of the Corporate Governance and Comprehensive Risk Management Regulation, with new international standards and with recent developments on the matter;

That, by SBS Resolution No. 11699-2008 and its amending norms, the Internal Audit Regulation was approved, which establishes minimum criteria required for its exercise in accordance with international standards;

That, by SBS Resolution No. 17026-2010 and its amending norms, the External Audit Regulation was approved, which establishes requirements for contracting the services of external audit firms, as well as guidelines for conducting the external audit;

That, by SBS Resolution No. 895-98 and its amending and complementary norms, the Accounting Manual for Financial System Companies was approved, hereinafter the Accounting Manual;

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 2

That, by SBS Resolution No. 816-2005 and its amending norms, the Sanctions Regulation was approved, which establishes mechanisms that allow the exercise of the sanctioning power of this Superintendency;

That, in order to gather the opinions of the general public regarding the proposed amendments to the regulations related to Market Risk Management, the pre-publication of the draft resolution on the matter was ordered on the Superintendency's electronic portal, under the provisions of Supreme Decree No. 001-2009-JUS;

With the approval of the Deputy Superintendencies of Banking and Microfinance, Risks, Economic Studies and Legal Advice; and,

In use of the powers conferred by numerals 7, 9 and 13 of article 349 of the General Law;

RESOLVES:

Article One.- To approve the Market Risk Management Regulation, as indicated below:

"MARKET RISK MANAGEMENT REGULATION

CHAPTER I GENERAL PROVISIONS

Article 1.- Scope

This norm applies to Multiple Operations Companies, Specialized Companies and Investment Banks, included in literals A, B and C of article 16 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance - Law No. 26702 and its amending norms; likewise, it applies to the Banco de la Nación, Banco Agropecuario (AGROBANCO), Corporación Financiera de Desarrollo (COFIDE) and Fondo MIVIVIENDA, insofar as it does not conflict with the specific regulations that govern them; hereinafter companies.

Article 2.- Definitions

For the application of this Regulation, the following definitions must be considered:

a) Risk appetite: the level of risk that the company is willing to assume within its risk capacity, to achieve its objectives.

b) Risk capacity: the maximum level of risk that a company can assume given its current resources, regulatory requirements and contractual obligations.

c) Trading portfolio: as defined in Article 4 of the Regulation for the Effective Equity Requirement for Market Risk, approved by SBS Resolution No. 6328-2009 and its amending norms.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 3

d) Management: Management includes the general manager or equivalent and the first-level managers who collaborate directly with the general manager in the execution of the Board's policies and decisions related to market risk.

e) Investment instruments: debt instruments, equity instruments and other instruments determined by the Superintendency.

f) General Law: General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amending norms.

g) Market liquidity: ability to buy or sell assets quickly and with limited impact on their market price.

h) Accounting Manual: Accounting Manual for Financial System Companies approved by SBS Resolution No. 895-98 and its amending and complementary norms.

i) Balance sheet foreign exchange position: Total assets in foreign currency minus total liabilities in foreign currency.

j) Global position: Sum of the balance sheet foreign exchange position and the net accounting position in financial derivative products.

k) Net accounting position in financial derivative products: Difference between the notional value of the total forward purchase positions of foreign currency and the total forward sale positions of foreign currency in financial derivative products, with or without accounting hedging purposes, in forwards, swaps and futures, only. The amounts to be considered for this calculation shall correspond to those recorded in the corresponding analytical subaccounts of the Accounting Manual.

l) Corporate Governance and Comprehensive Risk Management Regulation: Corporate Governance and Comprehensive Risk Management Regulation approved by SBS Resolution No. 272-2017.

m) Regulation for the Effective Equity Requirement for Market Risk: Regulation for the Effective Equity Requirement for Market Risk approved by SBS Resolution No. 6328-2009 and its amending provisions.

n) Derivatives Regulation: Regulation for the Negotiation and Accounting of Derivative Financial Products in Companies of the Financial System approved by SBS Resolution No. 1737-2006 and its amending provisions.

o) Investments Regulation: Regulation for the Classification and Valuation of Investments of Companies of the Financial System approved by SBS Resolution No. 7033-2012 and its amending provisions.

p) Requirements on Ethical Conduct and Professional Capacity: Requirements on Ethical Conduct and Professional Capacity of Persons participating in the Investment Process of Banking Companies, Insurance Companies and Portfolios Managed by AFPs", approved by SBS Resolution No. 114-2005 and its amending provision.

q) Foreign Exchange Risk: Possibility of losses arising from fluctuations in exchange rates and in the price of gold considered as foreign currency.

r) Commodities Risk: Possibility of losses arising from fluctuations in commodity prices.

s) Price Risk: Possibility of losses arising from fluctuations in the prices of equity instruments.

t) Interest Rate Risk: Possibility of losses arising from fluctuations in interest rates.

u) Overbought: Positive balance of the global position.

v) Oversold: Negative balance of the global position.

w) Business units: are the different units of the company that assume market risks.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 4

x) Registry unit: It is the unit or personnel of the company in charge of operational and accounting processing, as well as the confirmation, settlement and reconciliation of transactions.

Article 3.- Market risk

Market risk refers to the possibility of losses arising from fluctuations in interest rates, exchange rates, prices of equity instruments and other market prices, which affect the valuation of positions in financial instruments. For the purposes of this regulation, market risk refers to the possibility of losses in on- and off-balance sheet positions; it includes interest rate risk and price risk in the trading portfolio, as well as foreign exchange risk and commodities risk on and off the balance sheet.

CHAPTER II MARKET RISK MANAGEMENT

Article 4.- Market risk management

It consists of the processes to identify, measure, assess, control, mitigate, report and monitor market risks in a timely manner.

Companies must carry out adequate market risk management, in accordance with the size and complexity of their operations and services, their risk appetite and capacity, their risk profile, capital strength, systemic importance, macroeconomic situation and the risk of a substantial deterioration in market liquidity; taking into account the criteria established in this Regulation.

Article 5.- Responsibility of the Board of Directors

The Board of Directors is responsible for establishing market risk management that provides a comprehensive view of exposure to this risk. To this end, and in compliance with the provisions of this regulation and other related ones, it is the responsibility of the Board of Directors:

a) To approve policies and procedures for adequate market risk management.

b) To approve the levels of appetite for market risk based on the company's strategy.

c) To establish and periodically review the organizational structure necessary for market risk management.

d) To allocate the necessary resources for adequate market risk management.

e) To establish an adequate system of delegation and segregation of functions for market risk management.

f) To establish effective market risk management, under normal and stress conditions.

g) To know the exposure to market risk.

h) To review the market risk management policy, based on changes in the entity's risk profile, and on events that affect the macroeconomic situation of the markets where it operates.

i) To approve the procedures for dealing with excesses over internal limits.

j) To require the execution of market risk stress tests and backtesting, and to take note of the results of such tests, if applicable.

k) To ensure that the company has effective market risk management, and that the main identified risks are under control within the established limits.

l) To order the necessary measures for compliance with the provisions contained in this Regulation.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 5

Article 6.- Responsibility of Management

It is the responsibility of Management to implement market risk management in accordance with the provisions approved by the Board of Directors or, if applicable, by the Risk Committee or Market Risk Committee.

The managers of the various units are responsible for ensuring consistency between operations and the market risk limits applicable to their area of action, as well as assuming responsibility before the immediately superior manager, with respect to the results of the market risk management corresponding to their unit.

Article 7.- Functions and Responsibilities of the Market Risk Committee

In accordance with the provisions of the Corporate Governance and Comprehensive Risk Management Regulation, the Board of Directors may create a Market Risk Committee. Furthermore, if it deems it necessary, the Superintendency may require the establishment of the Market Risk Committee. As long as the creation of said Committee is not provided for, the Risk Committee or the Board of Directors is responsible for and assumes the functions detailed in this regulation.

If the Market Risk Committee has been created, it must meet at least once a month, and all resolutions adopted must be recorded in minutes, which shall be available to this Superintendency. Furthermore, it must approve a Regulation for the fulfillment of its functions, in accordance with article 10 of the Corporate Governance and Comprehensive Risk Management Regulation. The Committee must be composed of at least three (3) members, one of whom must be a member of the Board of Directors who does not hold an executive position in the company, who shall preside over it. Likewise, the Head of the Market Risk Unit must also be a member of this Committee.

The Market Risk Committee must assume the following functions:

a) Propose to the Board of Directors the policies and procedures for market risk management.

b) Propose to the Board of Directors the market risk appetite that the company is willing to assume.

c) Approve the internal market risk limits and the indicators to be used to measure the entity's risk profile.

d) Establish an information system so that the units involved in the taking, recording and management of market risk are informed of the risks assumed.

e) Approve the manuals for market risk management.

f) Approve the methodologies, models, parameters and scenarios for the measurement and control of market risk.

g) Establish the procedures for the control of excesses over internal limits.

h) Require the implementation of corrective actions proposed by the Market Risk Unit.

i) Review the results of the market risk stress tests, and the results of the backtesting, if applicable.

j) Monitor compliance with the policies and procedures for market risk management.

k) Review the feasibility and results of the market risk contingency plan, if applicable.

l) Approve modifications to the valuation models and market risk measurement models.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 6

Article 8.- Functions and Responsibilities of the Market Risk Unit

In accordance with the provisions of the Corporate Governance and Comprehensive Risk Management Regulation, companies may have a unit specialized in market risk management. The Superintendency may require the creation of a market risk unit if it deems it necessary.

As long as the creation of a Market Risk Unit is not provided for, the Risk Unit, or whoever performs this function, is responsible for and assumes the functions detailed in this regulation.

The Market Risk Unit must maintain an adequate hierarchical level, at least similar to the business units that assume said risk, being independent from them. The functions of the Market Risk Unit are:

a) Propose the policies and procedures for market risk management.

b) Seek the alignment of market risk management policies with the company's risk appetite and capacity levels.

c) Measure the market risk to which the company is exposed.

d) Evaluate compliance with the policies and procedures for market risk management.

e) Develop the methodology to measure market risk, in normal and stress scenarios.

f) Determine the fair value of positions in investment instruments and derivative financial products.

g) Periodically simulate stress tests of market risk factors and perform backtesting, if applicable.

h) Recommend, based on the results of the stress tests, the necessary corrective actions.

i) Monitor exposures to market risk and compliance with regulatory limits and internal limits.

j) Verify that the calculation of the effective equity requirement for market risk complies with the applicable provisions.

k) Analyze the impact that market risk has on the sufficiency of effective equity.

l) Report to the Risk Committee on market risk exposures and compliance with policies and procedures, among others, in accordance with the provisions of article 20 of this Regulation.

Article 9.- Organization, functions and responsibilities delimited

The company must establish an appropriate organizational structure, as well as define and delimit the functions and responsibilities of the units involved in market risk management. Functional independence must be maintained between the market risk unit, the business units and the recording unit, to avoid conflicts of interest and contribute to an adequate control environment.

The company must ensure that the responsibilities of the recording unit are in charge of personnel independent from the unit that originates the positions involving market risk.

Article 10.- Suitable officials and professionals

The officials and professionals responsible for the areas involved in market risk management must have adequate training, knowledge and experience. Likewise, they must

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 7

maintain an adequate level of professional competence and perform their functions and responsibilities with integrity and ethics.

The company must foster a prudent market risk management culture, as well as implement policies and procedures for ongoing training of personnel involved in market risk management.

Where applicable, such personnel must comply with the provisions of the Requirements on Ethical Conduct and Professional Competence. Likewise, the company must establish internal systems that facilitate the timely reporting and investigation of unauthorized, illicit, fraudulent activities and other questionable practices, in accordance with the provisions of the Corporate Governance and Comprehensive Risk Management Regulation.

Article 11.- Personnel incentives

The remuneration system for personnel involved in market risk management must not encourage inappropriate risk-taking, in accordance with the provisions of the Corporate Governance and Comprehensive Risk Management Regulation.

Article 12.- Policies and procedures

The Board of Directors is responsible for establishing policies and procedures to ensure adequate market risk management. Likewise, the Market Risk Committee is responsible for monitoring compliance with such policies and procedures.

Such policies are aimed at safeguarding the company's solvency at all times, and must be established in accordance with the size and complexity of its operations, risk appetite, risk capacity, level of risk faced, capital solvency and systemic importance. Likewise, they must be in accordance with the provisions established in this Regulation.

Article 13.- Market risk limits

The Market Risk Committee is responsible for establishing internal limits to control exposure to market risk. These internal limits must be consistent with the size, complexity of operations, risk appetite, level of risk faced, capital solvency and systemic importance of the company.

Early warning levels must be incorporated to avoid exceeding internal or regulatory limits. The internal market risk limits shall be established by:

a) Type of market risk, considering, among other factors, the maximum permissible accumulated losses during determined periods.

b) Type of position (investment instruments, financial derivative products, credit derivatives, repurchase operations, short sales, among others).

c) Levels of autonomy for carrying out operations, taking into account global amounts, amounts per client, maximum amount per operator or per type of position.

The Market Risk Unit is responsible for the ongoing assessment of compliance with internal and regulatory limits, and must report the monitoring performed to the Market Risk Committee. In the event that non-compliances associated with human errors, process failures, information systems and/or external events are identified, these must be reported to the unit and/or committee specialized in their management.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239

The Market Risk Committee must establish procedures for controlling excesses over internal limits, defining those responsible for granting the corresponding authorizations, as well as the means by which such excesses will be authorized and reported, and the unit responsible for documenting the authorizations. In addition, said Committee must establish mechanisms to reduce the possibility of losses arising from unauthorized practices or operations and/or those exceeding internal limits.

Article 14.- Market risk management manuals

The company must have market risk management manuals that include at least the following:

a) Policies and procedures

b) Internal and regulatory limits

c) Functions and responsibilities of the units involved in market risk management.

d) Internal procedures and valuation models

e) Methodologies and models for measuring market risk

f) Models for stress testing simulation and backtesting, where applicable.

Such manuals must be updated periodically, and must be available to the Superintendency.

Modifications to internal limits, methodologies and market risk measurement models must be aligned with the company's risk appetite and risk capacity. The supporting documentation must be available to the Superintendency.

Article 15.- Market risk of new products

The Market Risk Unit is responsible for identifying, measuring, controlling and reporting the market risk generated by the introduction of new products, and by significant changes in the business environment that may have a material impact on the company's risk profile. The aforementioned work must be carried out in accordance with the established policies and procedures, as well as with the requirements of the Corporate Governance and Comprehensive Risk Management Regulation and Circular No. G-165-2012 regarding the Risk Report for new products or significant changes in the business, operational or information technology environment.

Article 16.- Valuation of positions

The valuation of positions subject to market risk must follow the guidelines set forth in the Investment Regulation and the Derivatives Regulation. The valuation process must be adequately documented. Likewise, the company must have systems and controls that guarantee its proper accounting.

Article 17.- Procedure for portfolio transfers

The company must establish procedures for the transfer of instruments from the trading portfolio to the banking book and vice versa, taking into account the provisions of the Investment Regulation.

For this purpose, the instrument to be transferred must be identified, the reason for the transfer must be specified, the financial impact on results must be determined, and the impact on market risk resulting from the transfer must be determined. Likewise, each transfer must be approved by the Market Risk Committee or by the Asset and Liability Management Committee, depending on whether the instrument corresponds to the trading portfolio or the banking book, respectively.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239

The carrying out of transfers of instruments between the trading portfolio and the banking book, and vice versa, for purposes of regulatory arbitrage is strictly prohibited.

Article 18°.- Diligence in trading

The company must ensure that the trading of investment instruments carried out by the business unit has due diligence. For this purpose, the personnel participating in the investment process must comply with the following guidelines:

a) Execute the closing of the trade at prices that are within the market conditions in force at the time the transactions are carried out.

b) Have adequate support for the price at which the instruments or investment operations are traded.

c) Maintain adequate monitoring of the markets of the instruments or investment operations.

Access to the physical premises where trading is carried out must be restricted only to duly authorized personnel. The unit responsible for verifying due diligence in trading must be independent of the business unit.

Article 19°.- Adequate information systems and computer tools

In accordance with the volume and complexity of its operations, the company must have information systems that allow timely and correct identification, measurement, aggregation, monitoring and reporting of market risk, as well as appropriate mechanisms for its security.

These information systems must allow the company to have complete market risk information, and provide support for the recording and processing of operations, the obtaining of market prices, the valuation of positions, risk analysis, and the presentation of reports to the Board of Directors, General Management and units involved in market risk management. Likewise, such information systems must allow the company, both in normal and stress situations, to promptly generate aggregated information on market risk exposures, operational limits and other levels of aggregation.

The aforementioned information systems must allow compliance with the following requirements, among others, set forth by current regulations:

a) Measures required in current regulations on information security, in the aspects that are applicable.

b) Traceability of operations, from their operational recording to their accounting and vice versa.

c) Validation of the internal limits established in article 13° of this regulation.

d) Support for the segregation of functions in accordance with article 9° of this regulation.

e) Documentation that allows the use and maintenance of the information systems.

Likewise, the company must establish adequate controls in order to reduce the possibility of losses arising from the inability to carry out operations or close positions due to failures and/or operational interruption of the information systems.

Article 20°.- Report on market risk management

The Market Risk Unit must prepare, at least monthly, a report on market risk management addressed to the members of the Market Risk Committee, which must include at least the following information:

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239

a) Summary of the company's aggregate exposure to market risk.

b) Compliance with policies, including the structure of internal and regulatory limits.

c) Results of the valuation of positions in investment instruments and derivative financial products.

d) Market risk measurement indicators, including the results of internal models.

e) Summary of the results of stress tests and backtesting, if applicable.

f) Measures adopted to remedy the deficiencies found by the Market Risk Unit, the internal auditors, the external auditors and the Superintendency.

A copy of the aforementioned monthly report, with information as of the close of the months of June and December, must be sent to the Superintendency, through the Supervised Portal, within fifteen (15) calendar days following its presentation to the Market Risk Committee. Likewise, any information that the Market Risk Unit considers important must be communicated to the Superintendency.

Article 21°.- Information to the Superintendency

The Superintendency may request from the company any information it considers necessary for adequate supervision of market risk management. Likewise, the company must make available to the Superintendency all documents mentioned in this Regulation, as well as audit reports and reviews carried out by the parent company, if applicable. The Market Risk Unit is responsible for sending to the Superintendency the required reports related to market risk.

Article 22°.- Additional requirements and exceptional situations

If the Superintendency considers that a company is highly exposed to a certain market risk or presents deficient market risk management, it may require the adoption of hedging mechanisms, including the closing of positions, the allocation of greater effective equity or other additional prudential measures.

CHAPTER III ADDITIONAL REQUIREMENTS FOR MARKET RISK MANAGEMENT

Article 23°.- Scope of this Chapter

The provisions of Chapter III are applicable to banking companies, investment banks, Banco de la Nación, Banco Agropecuario (AGROBANCO), Corporación Financiera de Desarrollo (COFIDE) and Fondo MIVIVIENDA, and to other companies that the Superintendency determines, based on their level of exposure to market risk.

Article 24°.- Additional requirements for valuation of positions

In addition to the provisions of article 16° of this Regulation, the Investments Regulation and the Derivatives Regulation, the company must consider the following guidelines:

a) The Market Risk Unit must adopt additional measures in the valuation of illiquid investment instruments. Specifically, it must use valuation adjustments (haircuts) to incorporate, among others, model risk, lags in external risk classifications, settlement costs and early termination costs.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 11

b) The valuation process must consider the market sources used, the data use policies, and the significant changes made.

c) Valuation models must maximize the use of observable and relevant data.

d) The valuation models used must undergo periodic validation in order to determine the reliability of the results. This validation must be carried out by an independent internal or external function that has the capabilities, that has not participated in its development and is independent of the business units. This validation must cover the validity of the assumptions, the market sources of the model inputs, the accuracy of the values produced against the prices observed in the market, among others.

e) Evaluate whether price providers consider valuation adjustments.

Article 25°.- Market risk measurement models

The company must use, as an internal market risk management model, the Value at Risk (VaR) method of Variances and Covariances, Historical Simulation or Monte Carlo Simulation. In any of these cases, the company must report the results of Value at Risk (VaR), Stressed Value at Risk (SVaR), Conditional Value at Risk (CVaR), and Stressed Conditional Value at Risk (SCVaR) in Annex Nº 9 “Market Risk Measurement Results” of the Accounting Manual. The results of each of these models must be recorded in aggregate form (total risk) and by type of risk, as specified in Annex Nº 9.

Market risk measurement models must comply with the following minimum requirements:

a) Be duly calibrated, so that, among other characteristics, they explain the historical oscillation of prices, and capture both the magnitude and changes in the composition of risk concentrations.

b) Be robust under market stress situations.

c) Be consistent with the volume and complexity of the company's operations.

d) The assumptions, methodology and mathematical calculations must be validated initially, and upon each subsequent modification, by a qualified independent unit that has not participated in its development.

The company must establish effective controls in order to reduce the possibility of losses due to errors in the design, implementation and/or execution of such models or of the systems that support them. Likewise, the company must provide for the periodic evaluation, at least once a year, of the criteria, parameters and/or assumptions considered in such models. When the company makes significant modifications to these models, it must communicate this to the Superintendency within a period no greater than ten (10) business days after the change is made, attaching a report evaluating the impact of such changes on the company's market risk analysis.

The models referred to in this article must be used for market risk management purposes. If the company wishes to use these models for purposes of calculating the effective equity requirement for market risk, it must comply with the provisions of the Regulation for the Effective Equity Requirement for Market Risk.

Article 26°.- Stress tests

The Market Risk Unit is responsible for using risk measurement models to estimate the potential impact on positions subject to market risk under stress scenarios. The scenarios to be taken into account for such estimation shall be those considered of

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239

greater importance in accordance with the financial structure, investment portfolio, size and complexity of the company's operations.

The results of the stress tests must be reviewed by the Market Risk Committee, and shall be taken into consideration for the evaluation of the sufficiency of effective equity, as well as for the establishment of internal market risk policies and limits.

Stress tests must be carried out at least quarterly. In periods of high volatility, stress tests must be carried out more frequently. The Superintendency may require the use of additional specific scenarios.

Article 27°.- Backtesting

The Market Risk Unit is responsible for carrying out quarterly backtesting in order to calibrate the quality and precision of the market risk model. These tests must compare the losses estimated by its risk measurement models with the results actually generated, for a given period of time. If the results of the backtesting are not satisfactory, within a previously established statistical confidence level, the Market Risk Unit must take the corresponding actions to improve the accuracy of the models.

The Market Risk Committee must take into consideration the results of the backtesting to review the market risk measurement models.

Article 28°.- Market Risk Contingency Plan

The company must prepare a Market Risk Contingency Plan that allows it to face stress scenarios that negatively impact its results. For this purpose, the company must take into account the results of the quarterly stress tests required in article 26° of this regulation. For the preparation of the aforementioned plan, at least the following aspects must be considered:

a) The situations or warning signals that activate its application, for which quantitative indicators and qualitative criteria must be defined.

b) A viable action plan, including strategies and procedures to manage the adverse results of market risk stress tests. For this purpose, strategies for managing the trading portfolio in case of contingency shall be stipulated; in particular, strategies for taking, closing and hedging positions.

c) The procedures and officers responsible for the implementation and evaluation of the sufficiency of the Market Risk Contingency Plan.

The Market Risk Contingency Plan must be incorporated into the policies and procedures for market risk management, and must be reviewed annually. Likewise, the contingency plan must be monitored at least quarterly in the Market Risk Committee.

Article 29°.- Validation of internal models

Internal market risk models must be periodically validated by a qualified independent unit that has not participated in their development. In the event that the company is significantly exposed to market risk, said validation must be carried out by a unit specialized in validation of internal models, which allows determining the quality and accuracy of the market risk models. Said unit may not be the same one that develops the

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 13

model and makes the subsequent modifications and adjustments considered necessary. The Superintendency may require the establishment of said unit. This validation process may be outsourced to third parties that accredit adequate qualification and experience in model validation.

The internal model validation process must include the evaluation of the suitability of the model's assumptions and parameters, the model's capacity to adequately capture the risks relevant to the company and the model's flexibility to capture new instruments, the use of hypothetical portfolios, among other tests to ensure its reliability.

Article 30°.- Annex 9 “Results of Market Risk Measurement models”

The company must submit monthly via the Submodule of Capture and External Validation (SUCAVE) to the Superintendency, within fifteen (15) calendar days after the close of each month, Annex No. 9 “Results of Market Risk Measurement models” of the Accounting Manual. The Market Risk Unit is responsible for sending this information.

CHAPTER IV ADDITIONAL PROVISIONS ON FOREIGN EXCHANGE RISK

Article 31°.- Foreign exchange risk

Foreign exchange risk refers to the possibility of losses in on- and off-balance sheet positions derived from fluctuations in exchange rates and the price of gold considered as a currency. To determine the position in gold that is considered a currency, the provisions of article 36° of the Regulation for the Effective Equity Requirement for Market Risk must be taken into account.

Article 32°.- Responsibility of the company

The company must manage foreign exchange risk considering the levels of risk appetite and capacity, its risk profile, as well as the macroeconomic situation and that of the markets in which it operates. Likewise, it shall be the responsibility of the Board of Directors to approve the policies and procedures for foreign exchange risk management and to ensure that Management adopts the necessary measures to monitor and control this risk.

The Market Risk Unit is responsible for identifying, measuring, evaluating, monitoring, reporting and controlling foreign exchange risk. Likewise, the policies and procedures on foreign exchange risk management must be clearly defined in a Manual of Policies and Procedures.

Article 33°.- Foreign exchange risk measurement models

The company must measure its exposure to foreign exchange risk and the impact of fluctuations in exchange rates, through the analysis of foreign exchange mismatches. Likewise, the company must define its strategy to determine the concrete measures it must adopt to achieve the proposed objective. In addition, the company must take into account adverse scenarios in the evolution of exchange rates.

The analysis must be carried out for all assets, liabilities and off-balance sheet operations of the company, expressed in foreign currencies or whose market value is a function of the evolution of some foreign currency.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 14

Article 34°.- Limits to the global position in foreign currency1

Companies (with the exception of Investment Banks) are subject to the following limits to the global position in foreign currency, which they must comply with daily:

a) Global oversold position: Up to ten percent (10%) of its effective equity.

b) Global overbought position: Up to ten percent (10%) of its effective equity.

For the calculation of these limits, the last effective equity submitted by the company and validated by the Superintendency must be used, as well as the month-end accounting exchange rate published by this Superintendency, corresponding to said effective equity.

The limits on the global position in foreign currency applicable to investment banks are established in subsection ii) of Article 10° of the Investment Banks Regulation, approved by SBS Resolution No. 3544-2015 and its amendments.

Article 35°.- Limit on the net accounting position in foreign currency financial derivative products2

The company is subject to the following limits:

a) Limit on the net accounting oversold position in foreign currency financial derivative products The absolute value of the net accounting oversold position in foreign currency financial derivative products of the companies may not be greater than eighty percent (80%) of their effective equity or one billion five hundred million soles (S/ 1 500 million), whichever is greater.

b) Limit on the net accounting overbought position in foreign currency financial derivative products The absolute value of the net accounting overbought position in foreign currency financial derivative products of the companies may not be greater than eighty percent (80%) of their effective equity or one billion five hundred million soles (S/ 1 500 million), whichever is greater.

For the calculation of these limits, the following must be used: (i) the last effective equity submitted by the company and the month-end accounting exchange rate published by this Superintendency corresponding to said effective equity; and (ii) only contracts that involve some foreign currency and national currency. Likewise, the calculation of these limits shall not include positions in foreign currency financial derivative products classified as for accounting hedging purposes.

Article Two.- Replace numeral 4) and incorporate numeral 16) in section I of the Annex “Programmed Activities” of the Internal Audit Regulation approved by SBS Resolution No. 11699-2008 and its amending norms, according to the following text:

“I. COMPANIES REFERRED TO IN LITERALS A, B AND C OF ARTICLE 16° OF THE GENERAL LAW (EXCEPT BONDING AND GUARANTEE COMPANIES), BANCO DE

[1] Article replaced by SBS Resolution No. 1882-2020, published on 03.08.2020. Subsequently replaced by Resolution No. 0066-2023, published on 13.01.2023, effective as of 12.02.2023.

[2] Article replaced by SBS Resolution No. 1884-2019 of 02/05/2019. Subsequently replaced by SBS Resolution No. 2628-2020, dated 26/10/2020.

LA NACIÓN, BANCO AGROPECUARIO, FONDO MIVIVIENDA AND CORPORACIÓN DEVELOPMENT FINANCE CORPORATION (COFIDE):

(…)

4) Evaluation of market risk management, which must include the review of compliance with the management and operational requirements for operations that generate market risk. Likewise, the evaluation of market risk management must include:

a) Review of compliance with policies and procedures.

b) Review of compliance with regulatory and internal limits.

c) Review of the assumptions and results of market risk measurement models, as well as the models for stress tests and backtesting, if applicable.

d) Review of the quality of the information in the applicable regulatory annexes, verifying compliance with the respective methodological notes, as well as the reasonableness of the assumptions, and the timely submission of information to the Superintendency.

(…)

16) Evaluation of compliance with the Regulation for the Classification and Valuation of Investments of Companies in the Financial System, the Rules for Investment in Instruments Traded through Non-Centralized Trading Mechanisms, and the Regulation for the Trading and Accounting of Financial Derivative Products in Companies of the Financial System.”

Article Three.- Replace numeral 4) and eliminate numeral 5) in section I of Annex I “Complementary Reports under the responsibility of External Audit Firms” of the External Audit Regulation, approved by SBS Resolution No. 17026-2010 and its amending norms, according to the following text:

" I. REPORTS APPLICABLE TO THE COMPANIES REFERRED TO IN LITERALS A, B AND C OF ARTICLE 16° OF THE GENERAL LAW, TO BANCO DE LA NACIÓN, TO BANCO AGROPECUARIO, FONDO MIVIVIENDA AND TO CORPORACIÓN FINANCIERA DE DESARROLLO (COFIDE)

(…)

4) Review of compliance with the management and operational requirements for operations that generate market risk. Likewise, the review of market risk management must include:

a) Review of compliance with policies and procedures.

b) Review of compliance with regulatory and internal limits.

c) Review of the assumptions and results of market risk measurement models, as well as the models for stress tests and backtesting, if applicable.

d) Review of the quality of the information in the applicable regulatory annexes.

Article Four.- Modify the Sanctions Regulation approved by Resolution No. 816-2005 and its amending norms, according to the following indication:

1. Replace numeral 35A) and incorporate numeral 35A1) in the serious infractions of Annex 2,
   referring to “Specific infractions of the financial system and of complementary and related services companies”, according to the following text:

35A) Fail to comply with the global position limits established in the Market Risk Management Regulation.
35A1) Fail to comply with the limits on the net accounting position in foreign currency financial derivative products established in the Market Risk Management Regulation.

Article Five.- Amend the Accounting Manual for Companies of the Financial System in accordance with the Annex attached to this Resolution, which is published on the Institutional Portal (www.sbs.gob.pe), in accordance with the provisions of Supreme Decree No. 001-2009-JUS.

Article Six.- This resolution enters into force on 1 June 2018, from which date the Regulation for the Supervision of Market Risks approved by SBS Resolution No. 509-98 and its amending rules, as well as the Regulation for the Administration of Exchange Risk approved by SBS Resolution No. 1455-2003 and its amending rules, shall be without effect.

Register, communicate and publish,

SOCORRO HEYSEN ZEGARRA
Superintendent of Banking, Insurance and Private Administrators of Pension Funds