Norm on Corporate Governance of Issuers of Public Offering Securities

1 Resolution CD-SIBOIF-683-1-JUL6-2011 Dated July 6, 2011 NORM ON CORPORATE GOVERNANCE OF ISSUERS OF PUBLIC OFFERING SECURITIES The Board of Directors of the Superintendence of Banks and Other Financial Institutions, CONSIDERING I That in accordance with what is established by Article 4 of Law 587, Capital Markets Law (LMC), it corresponds to the Superintendence to regulate, supervise and oversee the securities markets, the activity of natural and legal persons who intervene directly or indirectly in them and the acts or contracts related to them, with the aim of promoting conditions of transparency and competitiveness that make possible the good functioning of the market, through the dissemination of whatever information is necessary for this end, seeking the protection of investors, as established by Article 1 of the aforementioned Law. II That for this reason, in accordance with what is stated in Article 6, letter c) of the LMC among the functions of the Board of Directors of the Superintendence of Banks and Other Financial Institutions is that of issuing, with general character, accounting and auditing standards, in accordance with international best practices on this matter, as well as the frequency and disclosure of external audits to which supervised subjects must be submitted; adding that, audit firms that provide their services to participants in the securities market, must be subject to the norms issued by said Council. III That based on what is established by the aforementioned Article 6, letter c) of the LMC, with respect to external audits, it is necessary to establish provisions that external audit firms must comply with in the examinations they carry out on issuers; and with respect to the scope of internal control, it is necessary to issue a set of minimum corporate governance measures through which the responsibility of the governing bodies of issuers to issue policies, procedures and controls to ensure the transparency and reliability of the financial information disclosed is established. In exercise of its powers, HAS ISSUED The following:

2 Resolution CD-SIBOIF-683-1-JUL6-2011 NORM ON CORPORATE GOVERNANCE OF ISSUERS OF PUBLIC OFFERING SECURITIES CHAPTER I CONCEPTS, OBJECT AND SCOPE Art. 1. Concepts.- For the purposes of this norm, the terms indicated in this article, both in uppercase and lowercase, singular or plural, will have the following meanings: a. Board of Directors: Board of Directors of the Superintendence of Banks and Other Financial Institutions. b. Corporate governance: Set of guidelines that regulate the internal relationships between the corporate bodies, management, officials and employees; as well as between the issuer, the supervisory body and the public. Likewise, it defines the structure through which the company's objectives are established, the means to achieve them and the way of controlling its performance. c. Economic interest group: Related parties, significant linkages and indirect manifestations of legal entities to which this norm applies. The foregoing in accordance with the guidelines established regarding this matter by Article 55 of Law 561, General Law of Banks, Non-Banking Financial Institutions and Financial Groups and the regulations that govern the matter on concentration limits. d. Institution or financial institution: Banks, branches of foreign banks, financial companies, insurance companies, general warehouses, stock exchanges, stock exchange positions, investment fund management companies, securitization fund management companies, central depository, clearing and settlement societies and other entities regulated by Law 587, Capital Markets Law; as well as special regime financial companies subject to. e. Superintendence: Superintendence of Banks and Other Financial Institutions. f. Superintendent: Superintendent of Banks and Other Financial Institutions. Art. 2. Object.- This norm aims to establish the corporate governance guidelines applicable to issuers of publicly offered securities that, at a minimum, contain a set of policies to achieve adequate administrative organization, operational efficiency, safeguarding of assets and reliability of reports and financial statements that flow from their information systems; as well as the provisions that external audit firms must comply with in the examinations they carry out on issuers. The foregoing with the aim of promoting conditions of transparency that make possible the good functioning of the securities markets. Art. 3. Scope.- This norm is applicable to private issuers of publicly offered securities that are traded both in the primary market and in the secondary market. It is also applicable to public issuers that do not have the joint guarantee of the State referred to in the regulations governing the matter of public offering of securities in the primary market. However, the provisions of this norm will not be applicable to financial institutions, which will be governed by special provisions, both legal and regulatory, on internal control and corporate governance previously established or to be issued by the Board of Directors based on its legal powers. CHAPTER II INTERNAL CONTROL Art. 4. Obligation to issue policies.- The board of directors or equivalent body of the issuer will be responsible for approving corporate governance policies according to the minimum guidelines established in this Chapter. Likewise, it must review said policies at least once a year, making the changes and updates necessary to maintain the good functioning of corporate governance. Art. 5. Corporate governance policies.- The policies that regulate the corporate governance of issuers must include, at least, the following: a. Code of conduct that includes, at a minimum, the aspects indicated by Article 6 of this norm; b. The corporate strategy, so as to allow verifying the success of the institution as a whole and the individual contribution to it; c. Policies for assigning responsibilities and levels of delegation of authority in the hierarchy for decision-making; d. Policies for interaction and cooperation between the board of directors or equivalent body, management, auditors and advisors;

e. Internal control policies appropriate to the nature and scale of their activities, which include clearly defined provisions for the delegation of powers, the liability regime, and the necessary separation of functions; f. Adequate information flows, both internal and for the public; g. The establishment of the necessary mechanisms to verify compliance with the legal and regulatory provisions applicable to it; and h. Policies that establish that no director or official of the issuer will individually have the power to dispose of the assets or encumbrances thereof through unrestricted general powers. Art. 6. Code of conduct.- The board of directors or equivalent body must approve a code of conduct for employees, officials and directors that regulates, at least, the following aspects: a. Conflicts of interest: There is a conflict of interest when the personal interests of any of the persons mentioned above interfere with the interests of the issuer. A conflict can arise when an employee, official or director takes positions or has interests that may hinder the effective and objective performance of their duties. There is also a conflict of interest when an employee, official or director, or a member of their family, receives improper personal benefits as a result of their position in the issuer. The code must include policies or principles that prohibit conflict of interest and provide the means for employees, officials and directors to communicate potential conflicts to the issuer. b. Business opportunities: Employees, officials and directors must be prohibited, whether personally, through intermediaries or through their relatives, from appropriating for themselves business opportunities discovered through the use of the assets, information and position in the issuer; or the use of the assets, information and position in the issuer for the gain of the persons mentioned above. c. Confidentiality: Employees, officials and directors must maintain the confidentiality of the information entrusted to them by the issuer itself and its clients, except in cases where publication is authorized and/or required by law. d. Fair treatment: Each employee, official and director must treat customers, suppliers and other employees of the issuer fairly and equitably. No employee, official or director should take advantage of anyone through manipulation, concealment, abuse of insider information, misrepresentation of material facts or through any other practice of this nature.

e. Protection and appropriate use of assets: All employees, officials and directors must care for the issuer's assets and ensure their efficient use. Theft, negligence and waste have a direct impact on the profitability of the issuer. All assets of the issuer must be used solely for business objectives. f. Compliance with laws, regulations and standards: The issuer must comply with the laws, regulations and standards applicable to it. g. Promote reporting any illegal or unethical behavior: The issuer must proactively promote ethical behavior. The issuer must encourage employees to speak with their supervisors, managers or other appropriate personnel when they have doubts about the best way to deal with a particular situation. Additionally, employees must report violations of laws, regulations, standards or the code of conduct to appropriate personnel. To encourage employees to report such violations, the issuer must assure employees that it will not allow any type of retaliation for reports made in good faith. The code of conduct shall establish the guidelines of what is allowed to be done in accordance with laws, regulations and procedures; as well as the sanctions applicable for non-compliance, including grounds for dismissal or firing, without prejudice to other liabilities corresponding by law. The code of conduct must establish that any dispensation from the precepts of the code with respect to employees, officials or directors can only be obtained through the approval of the board of directors or equivalent body or a committee thereof and must be quickly reported to the issuer's shareholders. The issuer's Web page must contain its code of conduct. The annual information presented to the Superintendent in compliance with the requirements established in the norm on securities trading in the secondary market must indicate that said code is available electronically on its Web page, and physically in its offices, for any investor who requires it, at the expense of the latter. Art. 7. Communication policy.- To ensure compliance with the code of conduct, the board of directors or equivalent body must approve the corresponding communication, monitoring and sanction application policy. At a minimum, said policy must contain the following aspects: a. Require that all current employees, officials and directors, as well as all new ones at the time of their appointment or hiring, sign a statement to the effect that they know the code of conduct and commit to complying with it. b. Establish the necessary controls to ensure compliance with said code, including supervision functions, recording of violations and applied sanctions.

Art. 8. Verification of the reasonableness of financial information and internal control systems.- The board of directors or equivalent body and the general manager or their administrative equivalent will be responsible for ensuring that financial information is reasonable and for establishing the internal control systems necessary to obtain reliable financial information and to ensure an adequate internal control environment. The issuer's board of directors must know and approve the financial statements quarterly, as well as the audited financial statements presented to the Superintendence and to the Stock Exchange where the issuance is authorized. Art. 9. Preparation of financial statements.- The issuer's financial statements must be prepared following the guidelines established by the generally accepted accounting principles in Nicaragua, International Financial Reporting Standards (IFRS) and, failing that, Generally Accepted Accounting Principles in the United States of America (US GAAP). If in any case, the generally accepted accounting principles in Nicaragua, the IFRS or, failing that, the US GAAP accept several alternatives as valid, the most conservative position must always be chosen. Art. 10. Audit committee.- Issuers of publicly offered securities must have an audit committee. The audit committee will be a collegiate body integrated by a minimum of two directors of the board of directors or equivalent governing body. Additionally, the committee may have members external to the organization. For the exercise of its functions, this committee must have at least one member specialized in the financial accounting area who must have, at a minimum, an academic degree in the area of business administration or public accounting and a minimum experience of five years. This requirement may be provided by an external member. The board of directors will be responsible for appointing suitable people to fulfill the objective of this committee. The people who make up this committee will be responsible for fully carrying out the functions entrusted by the board of directors. In the case of securities issuances registered for public offering whose amounts are less than ten million dollars, or its equivalent in national currency, whether issued individually or aggregated, the issuer of these will be exempt from constituting an audit committee. In these cases, the functions of said committee may be assumed by the issuer's board of directors, and such situation must be disclosed in the respective prospectus. Art. 11. Functions.- Without prejudice to what is established in the previous article, in particular the following functions will correspond to the audit committee:

a. Facilitate communication between members of the board of directors or equivalent body, the general manager, the inspector, external and internal audit, if any, and supervisory bodies, as appropriate. b. Know and analyze the results of the evaluations of the effectiveness and reliability of information systems and internal control procedures. c. Follow up on compliance with the annual work program of the inspector or internal auditor, as appropriate. d. Propose to the board of directors or equivalent body the designation of the external audit firm and the contracting conditions, once compliance with the requirements established in this norm has been verified by them. e. Review financial information, both annual and periodic, before sending it to the board of directors or equivalent body, emphasizing accounting changes, accounting estimates, important adjustments such as, results of the audit process, evaluation of business continuity and compliance with current laws and regulations affecting the issuer. f. Review and forward to the board of directors or equivalent body, the audited annual financial statements, the external auditor's report, complementary reports and the management letter. g. Follow up on the implementation of corrective actions formulated by the external auditor and the inspector or internal auditor, as appropriate. h. Propose to the board of directors or equivalent body the procedure for reviewing and approving internal and audited financial statements, from their origin until approval by the members of the respective collegiate body. i. Ensure that the procedure for reviewing and approving internal and audited financial statements is complied with. j. Avoid conflicts of interest that could arise with the external audit firm when hiring them to perform other services for the company. For these purposes, it must establish guidelines and procedures to ensure compliance with what is indicated by Article 16 of this norm. k. In addition to the specific reports required to comply with the functions indicated here, the audit committee must submit a semi-annual report on its activities to the board of directors or equivalent body. In the event that the issuer's board of directors assumes functions belonging to the Audit Committee, without prejudice to those corresponding to it as a society administration body, it will only exercise the functions established in letters b, e, g, h, j referred to above. Art. 12. Audit committee meetings.- The audit committee must meet with the periodicity established by internal regulations, but must do so at least every three months. The general manager, the inspector or internal auditor and the officials that the audit committee considers necessary may participate in the committee sessions without voting rights. The external auditor may also participate when so required by said committee. The agreements adopted in the meetings must be recorded in a minutes book, which must be available to the Superintendent. Art. 13. Audit committee regulations.- The audit committee will elaborate its working regulations, which will contain the policies and procedures for the fulfillment of its functions. Said regulations will adapt to the provisions established in this regulation and others applicable to it. It must establish, among other aspects, the periodicity of its meetings, as well as the reports that will be sent to the board of directors or equivalent body. Said regulations and their modifications will be approved by the board of directors or equivalent body and will be available to the Superintendent. CHAPTER III EXTERNAL AUDIT Art. 14. Mandatory nature of external audit and general obligations of external audit firms.- Issuers must submit their individual and consolidated financial statements, as appropriate, to annual external audit examination. The audit must be carried out by auditors who meet the minimum requirements established in the following article. Additionally, the internal control system implemented by general management and the degree of compliance with applicable laws and standards must be evaluated in the audit. External audit firms must provide the information requested by the Superintendent related to the work carried out on the issuer and allow, when required, access to the respective working papers. It is the obligation of external audit firms to keep for a period of no less than five (5) years, counted from the date of the respective examination, the working papers and all the documentation that adequately supports the audit reports or related services issued by them.

Art. 15. Minimum requirements for contracting.- Issuers may only hire the services of external audit firms that meet the following minimum requirements: a. Be registered in the Register of External Auditors that the Superintendence keeps for such purposes in accordance with what is established in the regulations governing the matter of external audit; b. Have the experience, infrastructure, human and technical resources adequate to the volume and complexity of the operations carried out by the issuer; c. Comply with the independence and suitability requirements established in the following article. d. Comply, insofar as applicable, with the provisions of the articles referring to selection and contracting of firms, minimum conditions of contracts and Audit Planning, of the regulations governing the matter of External Audit. Art. 16. Independence and suitability requirements.- External audit firms, their partners, directors, administrators, lead auditor of the audit work and other members of their team and in general, those who prepare and sign reports, must be independent of the audited issuer at the date of celebration of the service provision contract and during the development of the audit. It is considered that there is no independence when any of the persons mentioned above, as appropriate, find themselves in any of the following situations: a. When the income received by the firm, derived from the issuer or from the legal entities forming part of the economic interest group to which the issuer belongs, derived from the provision of its services, represent together 25% or more of the total income of the firm during the year immediately preceding that in which it intends to provide the service. b. When it has been an important client or supplier of the issuer or of the legal entities forming part of the economic interest group to which the issuer belongs, during the year immediately preceding that in which it intends to provide the service. It is considered that a client or supplier is important, when their sales or, in their case, purchases to the issuer or to the legal entities forming part of the economic interest group to which the issuer belongs, represent together 20% or more of their total sales or, in their case, total purchases. c. When it is or has been during the year immediately preceding its participation within the audit firm, director, manager or principal executive, as well as any employee who holds a position within the two immediate lower levels to the latter in the issuer or in the legal entities forming part of the economic interest group to which the issuer belongs.

10 d. When partners, directors, administrators, the lead auditor of the audit engagement and other members of their team, and in general, those who prepare and sign reports, as well as their spouses and relatives up to the second degree of consanguinity and second degree of affinity, have directly or through legal entities, investments in shares, debt instruments, or derivative instruments on shares of the issuer in question or of the legal entities that are part of the economic interest group to which the issuer belongs. e. When the partners, directors, administrators, the lead auditor of the audit engagement and other members of their team, and in general, those who prepare and sign reports, as well as their spouses and relatives up to the second degree of consanguinity and second degree of affinity, maintain with the issuer, debts from loans or credits of any nature. f. When the issuer or the legal entities that are part of the economic interest group to which the issuer belongs, have investments in the firm performing the audit. g. When the external audit firm, its partners, directors, administrators, the lead auditor of the audit engagement and other members of their team, and in general, those who prepare and sign reports, provide to the issuer, in addition to the audit service, accounting services; information system operation; local network administration; operation, supervision, design or implementation of computer systems (hardware and software); valuations, appraisals or estimates; administration; internal audit; representation and resolution of legal conflicts, consulting, among others. h. When the income that the firm receives or will receive for auditing the issuer's financial statements depends on the result of the audit itself or the success of any operation carried out by them, which is based on the opinion of said financial statements.

External audit firms, their partners, directors, administrators, the lead auditor of the audit engagement and other members of their team, and in general, those who sign reports, must be qualified persons. It is considered that they are not qualified when any of the aforementioned do not meet the qualification requirements established in the regulations governing the matter on External Audit.

Art. 17. Requirement for audit team rotation.- The external audit firm is obligated to rotate the partner, manager, supervisor, and auditor in charge, after three (3) years of having executed audits or related recurrent services to the same issuer. Once the aforementioned period has concluded, a period of at least two (2) years must elapse before any of these persons can return to participate in performing audits or related services with the issuer. The rotation may not be simultaneous for all team members.

11 For the effects mentioned in the previous paragraph, the work carried out by these persons at the issuer is cumulative, even if they were part of another audit firm. The period to determine the rotation requirement referred to in this article will be calculated taking into account the accumulated years up to the date of entry into force of this norm.

Art. 18. Audit of financial statements.- In accordance with what is expressed in article 14 of this norm, issuers must subject their individual and consolidated financial statements, as appropriate, to an annual external audit. The audited financial statements must include the following components: a. Balance sheet; b. Income statement; c. Statement of changes in equity; d. Statement of cash flows; and e. Accounting policies used and other explanatory notes.

Likewise, said report must contain a precise analysis of the following information: • Balance Sheet before adjustment; • Adjusted Balance Sheet; • Income Statement; • Cash Flow Statement; • Detailed report on adjustments and reclassifications proposed and recorded by the issuer; • Foreign Exchange Risk Exposure, when applicable; • Detailed report of transactions with the issuer's economic interest group; • Statement of Changes in Equity; • Any other information of importance that the external auditors deem fit to add.

In the event that the external auditor identifies problems that do not allow the examinations to be carried out adequately, they must communicate this immediately to the Superintendent, and indicate in the respective reports the reasons that prevented such evaluation.

Art. 19. Report on the internal control system.- As expressed in article 14 of this norm, the external audit firm must prepare a report on the internal control system, which must consider, at a minimum, the following: a. Evaluation of compliance and effectiveness of the internal control system and corporate governance policies established in this norm, for which purposes, the detail of findings or deficiencies found, analysis of their origin, and suggestions to overcome them must be reflected. The findings or deficiencies found must be evidenced through the development of the following aspects:

12

1. Condition: It is the revelation of what the auditor found, which must be drafted briefly with sufficient information, with examples of errors or irregularities found; as well as the qualification regarding the relevance and impact of the respective finding (low, medium, high).
2. Criterion: It is the revelation of what should exist or be complied with regarding laws, internal control standards, manuals of functions and procedures, policies, and any other written provision. The identification of the criterion is very important to highlight the importance of the finding or deficiency found.
3. Cause: It is the revelation of the reasons why the deficiency or finding occurred; among which stand out the lack of: i. An adequate organizational structure; ii. The establishment of procedure manuals that include the application of previously established standards and instructions; iii. An adequate delegation of authority; iv. An adequate segregation of functions; v. Establishment of adequate communication between the different areas; vi. Hiring of adequate human resources; vii. Assignment of sufficient material resources for the development of functions; viii. Honesty among officials; ix. Establishment of incentive or motivation policies for operational staff; x. Adequate supervision by control areas; and xi. Others that may arise in the review carried out.
4. Effect: It is the consequence or potential risks that may affect the financial situation of the issuer, if the condition determined by the auditor persists.
5. Recommendation: It constitutes the auditor's suggestion to overcome or correct the findings or deficiencies determined.
6. Management Comments: These are the manifestations of the issuer's management regarding the deficiency pointed out by the auditor and the corrective measures it will implement. It must clearly identify the procedures and mechanisms necessary to be implemented to avoid or prevent the recurrence of such deficiencies and the time period required for their implementation.

13 b. Evaluation of the issuer's information systems, which includes, among other aspects, the flow of information at its internal levels for adequate management and the selective review of the validity of the data contained in the information complementary to the financial statements. c. Evaluation of the issuer's security policies and existence of contingency plans to face risk situations that imply loss of information or damage to the computer equipment used; d. Evaluation of the policies and procedures established by the issuer for the identification, control, measurement, and administration of risks, and e. Evaluation of the degree of compliance with recommendations formulated by internal audit and/or the vigilante and by external audit firms corresponding to the last accounting periods of the issuer.

Art. 20. Execution of external audit work.- External audit firms must execute their work based on the provisions contained in this norm and with the International Standards on Auditing (ISA). The working papers or other audit evidence filing methodology applied by the firm must comply with what is provided in the International Standards on Auditing (ISA), and among others, but not limited to these, must present evidence regarding: a. Audit conclusions. b. Criteria for sample selection, procedures, and scope applied to the accounts and areas reviewed thereof. c. Unaudited aspects and their justification. d. Evidence of review by the partner-manager in charge of the audit. e. Detailed summary of adjustments, readjustments, and/or reclassifications resulting from the review practiced on the financial statements and related statements.

If the external audit firm has indications or certainty that it will have limitations in the scope of its examination or that it will issue a qualified opinion, it must communicate this to the Superintendent in order to achieve the necessary assistance or collaboration.

Art. 21. Responsibilities of the issuer in external audit examinations.- The board of directors or equivalent body, the audit committee, the general management, and the internal auditor and/or vigilante are directly

14 responsible for providing the contracted firm with the information and facilities necessary for it to carry out its examination in an adequate, independent, and timely manner. Likewise, it is the responsibility of said bodies to form a file containing the background and responses to the information requests made by the firm.

Issuers will keep available to the Superintendent a copy of the management letter or internal control report prepared by the firm on the occasion of the preparation of the audited financial statements and the correspondence that the institutions have sent to the Firm in response to its communications.

Art. 22. Knowledge of reports by the board of directors or equivalent body.- The board of directors or equivalent body must be aware of the reports issued by the external auditor and instruct the general manager or their proxy to implement the necessary corrective measures. Likewise, it will be responsible, through the audit committee, for verifying compliance with said corrective measures.

The receipt and knowledge of the reports issued by the external auditor by the board of directors or equivalent body must be recorded in the respective minutes book. Likewise, said reports must be known by the general meeting of shareholders or equivalent body.

Prior to presentation to the board of directors, the external audit firm must bring to the knowledge of the audit committee the reports referred to in the previous paragraphs.

Art. 23. Opinions on financial statements.- The opinion of the external audit firm on the financial statements must contain a clear written expression of opinion on whether the financial statements taken as a whole have been prepared in accordance with Generally Accepted Accounting Principles in Nicaragua, International Financial Reporting Standards (IFRS) and, in default, Generally Accepted Accounting Principles in the United States of America (US GAAP). If in any of the cases the Generally Accepted Accounting Principles in Nicaragua, the IFRS or, in default, the US GAAP accepted several alternatives as valid, the most conservative position must always be chosen.

If there are qualifications to the opinion, these must be clearly identified and, when appropriate, quantified within the same.

Art. 24. Notes to financial statements.- External audit firms must ensure that issuers comply with revealing in the notes to the financial statements, information whose revelation is required by the Generally Accepted Accounting Principles in Nicaragua, International Financial Reporting Standards (IFRS) and, in default, Generally Accepted Accounting Principles in the United States of America (US GAAP). If in any of the cases the Generally Accepted Accounting Principles in Nicaragua, the IFRS or, in default, the US GAAP accepted several alternatives as valid, the most conservative position must always be chosen.

15 Art. 25. Quality control.- External audit firms must carry out quality control of their work in accordance with what is provided in the International Standards on Auditing (ISA) and their own standards and risk management policies in general, which they will make known to the Superintendent when requested.

Art. 26. Deadlines for submission of reports.- The deadline for submission to the Superintendent of the reports of external auditors required by this norm must be carried out within the period established in the regulations governing the matter on trading of securities in the secondary market, for the presentation of annual periodic information.

Art. 27. Publication of audited financial statements and minimum disclosure.- The audited financial statements of issuers will be considered public information. The Superintendent will keep the audited financial statements of issuers available for public consultation in its offices. Likewise, issuers must keep the audited financial statements available for public consultation in general, either by physical or electronic means.

Issuers must prepare their financial statements at the close of the fiscal year on June 30 or December 31 of each year, or according to the approved fiscal regime. Within 90 days after the close of the fiscal year, the general meeting of shareholders must hold an ordinary session to know and resolve on the audited financial statements, sending certification thereof to the Superintendent, and ordering them to be published in La Gaceta, Official Gazette, and in a widely circulated written medium in the National Territory.

Art. 28. Breach of contract and change of external audit firm.- In the event that the external audit firm fails to meet the requirements set forth in article 15 of this norm, the contracting issuer must inform the Superintendent within ten (10) days of the breach occurring. Likewise, the issuer must inform the Superintendent, previously and documentedly, about the reasons that motivate the change of the external audit firm after the respective contract has been signed. In both cases and when the Superintendent deems it pertinent, it may summon the representatives of the external audit firm.

Art. 29. Information on significant events.- External audit firms are obligated to communicate in writing simultaneously to the board of directors or equivalent body of the issuer and to the Superintendent within three (3) days of having taken knowledge, the significant events that they detect in the audit process, without prejudice to including them in the corresponding reports.

For the effects of this norm, significant events are understood as those that expose or that potentially could expose the issuer to risks that may have an impact on its financial situation, to

16 such an extent that there is a possibility of affecting the fulfillment of obligations with its clients, as well as with third parties, as appropriate.

Art. 30. Responsibility of external audit firms.- Audit firms assume full responsibility for the reports they issue and that do not appropriately reveal situations that demonstrate the lack of solvency, insufficient assets and/or acute financial or economic weakness of the audited issuer, at the date of the examination, without prejudice to the sanctions that the Superintendent may apply.

Art. 31. Other requirements.- In accordance with the faculty established by article 8, letter h) of Law 587, Capital Market Law, the Superintendent may require special, additional, or expansive examinations beyond what is prescribed in this norm, as well as to dispose of the non-contracting of a specific audit firm when there are technical and legal reasons that so warrant.

CHAPTER IV FINAL PROVISIONS

Art. 32. Information Requirements.- Issuers who wish to register their securities in the Securities Register of the Superintendent must comply with the provisions of this norm from its entry into force. For these effects, the interested party must include within letter h. of Annex I, minimum content of the prospectus, of the Public Offering Norm in the Primary Market, a subsection h.6., in which aspects are included, such as: the issuer's internal control mechanisms, members and experience of the audit committee, its practices and functions (as established in this norm), location where the code of conduct and its disclosure method can be found, as well as, any other aspect that allows investors to know the issuer's internal control and corporate governance policies.

Art. 33. Repeal.- The Norm on Corporate Governance of Issuers of Securities in Public Offerings, contained in Resolution No. CD-SIBOIF-559-2-NOV5-2008, published in La Gaceta, Official Gazette No. 236, of December 11, 2008, is repealed.

Art. 34. Validity.- This norm will enter into force from its publication in La Gaceta, Official Gazette. (f) Gabriel Pasos Lacayo (f) V. Urcuyo V. (f) Fausto Reyes B. (f) illegible (Silvio M. Casco Marenco) (f) U. Cerna B.

URIEL CERNA BARQUERO Secretary of the Board of Directors SIBOIF