Norm on Internal Control and Internal Audit of General Warehouses

Resolution No. CD-SIBOIF-697-1-OCTU12-2011 Date: October 12, 2011

NORM ON INTERNAL CONTROL AND INTERNAL AUDIT OF GENERAL WAREHOUSES

The Board of Directors of the Superintendence of Banks and Other Financial Institutions,

CONSIDERING

I

That Article 44 of Law 734, Law on General Warehouses, published in La Gaceta, Official Diary, Numbers 201 and 202, on October 21 and 22, 2010, respectively, in its relevant parts establishes that, without prejudice to the surveillance and oversight of the Warehouses and branches of foreign Warehouses corresponding to the Superintendent, said Warehouses and branches must have an internal auditor whose responsibility will be the inspection and oversight of the operations and accounts of the respective Warehouse or branch of foreign Warehouse. Likewise, it provides that the Board of Directors may issue general rules that internal auditors of the Warehouses must comply with in the performance of their functions.

II

That in accordance with the above and based on the powers established in Article 10, items 2) and 10), of Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions, and its reforms.

In exercise of its powers,

HAS ISSUED

The following:

Resolution No. CD-SIBOIF-697-1-OCTU12-2011

NORM ON INTERNAL CONTROL AND INTERNAL AUDIT OF GENERAL WAREHOUSES

CHAPTER I GENERAL PROVISIONS

Article 1. Concepts.- 1 For the purposes of this norm, the terms indicated in this article, both in uppercase and lowercase, singular or plural, shall have the following meanings:

a) Unplanned activities: Special examinations that are not foreseen in the annual work plan and that are necessary for the evaluation of the functioning of the internal control system and its different components.

b) Planned activities: Activities authorized by the board of directors of the general warehouse, which must be executed promptly by the Internal Audit Unit, with the objective of examining, evaluating, and monitoring the adequacy and effectiveness of the internal control systems.

c) Warehouse or Warehousing Company: General Warehouse, an auxiliary credit institution authorized and subject to the supervision of the Superintendence.

d) Audit committee or committee: The Audit Committee appointed by the board of directors of the warehousing company.

e) Days: Calendar days, unless it is expressly established that it refers to business days.

f) Significant events: These are constituted by those events that may have a material impact on liquidity, solvency, image, among other aspects of the institution. The materiality of an event will depend on whether it has the potential to cause an important impact, whether quantitative or qualitative, on an important business line of the institution or on its operations in general. To this effect, the internal auditor must apply their best professional judgment to determine those events that they consider may potentially impact the institution and require reporting due to their significant nature.

g) Board of Directors: The main administrative body of the warehousing company.

h) Institute of Internal Auditors: International association dedicated to the continuous professional development of the internal auditor and the internal audit profession, better known by its English acronym as IIA.

i) Warehouse Law: Law 734, Law on General Warehouses, published in La Gaceta, Official Diary, Numbers 201 and 202, on October 21 and 22, 2010, respectively; contained in Law No. 974, Law of the Nicaraguan Legal Digest of the Banking and Finance Matter, published in La Gaceta, Official Diary No. 164, on August 27, 2018, and its reforms.

j) General Banking Law: Law 561, General Law of Banks, Non-Banking Financial Institutions and Financial Groups, published in the Official Diary Gazette No. 232, on November 30, 2005; contained in Law No. 974, Law of the Nicaraguan Legal Digest of the Banking and Finance Matter, published in La Gaceta, Official Diary No. 164, on August 27, 2018, and its reforms.

k) Manual: Internal Audit Manual containing the policies, procedures, and audit techniques to be used to evaluate the functioning of the warehousing company's internal control system.

l) Accounting Framework: Refers to the Accounting Framework for General Warehouses.

m) International Standards for the Professional Practice of Internal Auditing: Standards issued by the Institute of Internal Auditors that serve as an international reference in the matter.

n) Plan: Annual work plan containing the general guidelines, objectives, scope, and planned activities developed by the internal audit unit during each fiscal year.

o) Internal control system: Set of policies, procedures, and control techniques established to provide reasonable assurance in the achievement of adequate administrative organization and operational efficiency, reliability of reports flowing from its information systems, appropriate identification and management of the risks it faces in its operations and activities, and compliance with applicable legal provisions.

p) Superintendence: Superintendence of Banks and Other Financial Institutions.

q) Superintendent: Superintendent of Banks and Other Financial Institutions.

r) Internal Audit Unit or IAUs: Refers to the internal audit unit under the responsibility of an internal auditor.

Article 2. Object.- The object of this norm is to regulate the scope of internal audits and establish guidelines so that the board of directors of the warehousing company, through its IAUs, permanently oversees the efficiency of the internal control systems and compliance with its regulations with the aim of minimizing risks, using the principles established in this norm and in generally accepted audit techniques.

Article 3. Scope.- The provisions of this norm are applicable to general warehouses supervised by the Superintendence.

CHAPTER II INTERNAL CONTROL

Article 4. Mandatory Internal Control.- The warehousing company is obligated to have an internal control system that, at a minimum, contains a set of policies, procedures, and control techniques established by the institution to provide reasonable assurance in the safeguarding of assets and to achieve adequate administrative organization and operational efficiency, reliability of reports flowing from its information systems, appropriate identification and management of the risks it faces, and compliance with applicable legal provisions.

Article 5. Policies and Procedures.- 2

The policies and procedures mentioned in the previous article shall comprise, at a minimum, the following aspects:

a) Financial Aspects:

1. Cash and cash equivalents
2. Portfolio at Fair Value with Changes in Profit or Loss
3. Portfolio at Fair Value with Changes in Other Comprehensive Income
4. Portfolio at Amortized Cost
5. Accounts and Documents Receivable
6. Other Debtors
7. Tangible Assets
8. Assets received from recoveries
9. Non-Current Assets Held for Sale
10. Intangible Assets
11. Fiscal Assets
12. Other Assets
13. Miscellaneous Assets
14. Supplementary Asset Accounts
15. Financial Liabilities at Amortized Cost
16. Fiscal Liabilities
17. Deferred Taxes
18. Payables and Provisions
19. Subordinated Obligations and/or Convertible into Capital
20. Other Liabilities
21. Equity
22. Other Comprehensive Income
23. Contingent Accounts
24. Off-Balance Sheet Accounts
25. Income Statement Accounts

b) Operational Aspects:

1. The issuance, administration, and settlement of deposit certificates and pledge bonds and the safekeeping of unused title forms.

2. The administration of insurance, which the warehouse is obligated to contract by law and regulations.

3. Storage, custody, conservation, and handling of goods received in deposit.

4. Inventory of goods and coverage of goods in pledge.

5. Prevention of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction Risks.

6. Information Technology.

7. Human resources.

8. Compliance with internal and external provisions.

9. Budget and strategic plan.

10. Internal and external audit.

CHAPTER III BOARD OF DIRECTORS

Article 6. Responsibilities of the Board of Directors.- Regarding internal control, the board of directors is responsible for adopting, at a minimum, the following measures:

a) Establish mechanisms, guidelines, procedures, and policies oriented to establish an adequate internal control system. These measures must include the way to keep board members permanently informed.

b) Meet at least once every three months, without prejudice to extraordinary meetings, to address matters that require prompt attention.

c) Keep a minutes book where the topics addressed are recorded, signed by each of the members, so that the analysis, discussion, and decision-making on said topics can be verified, as well as an exercise of follow-up on the implementation of decisions and measures adopted.

d) Establish the audit committee.

e) Form an IAUs under the responsibility of an internal auditor who complies with what is established in Article 44 of the Warehouse Law, the requirements established in this norm, and the regulations governing the matter on requirements to be a director, general manager and/or chief executive and internal auditor of financial institutions.

f) Delimit the functions and responsibilities of the administrative, control, and audit bodies.

g) Ensure that the IAUs develops its functions with absolute technical independence according to the provisions established in the law and this norm.

h) Ensure that the members of the IAUs are effectively separated from administrative and/or operational functions, improper to the independent function of auditing.

i) Ensure that the administrative and control bodies implement and execute the provisions established in guidelines and procedures emanating from the board of directors.

j) Monitor the effectiveness of the design and functioning of the internal control structure and environment, to determine if it is functioning according to its objectives, and modify it when necessary.

k) Take immediate action and adopt the necessary corrective measures on any significant situation or finding detected that requires its prevention or correction.

CHAPTER IV INTERNAL AUDIT UNIT

Article 7. Characteristics of the Audit Unit.- Warehouses must have an IAUs, which shall have the following characteristics:

a) It will be in charge of an internal auditor appointed in accordance with what is ordered in Article 44 of the Warehouse Law, and with the requirements established in this norm and in the regulations governing the matter on requirements to be a director, general manager and/or chief executive and internal auditor of financial institutions.

b) Its members must be effectively separated from the administrative and operational functions of the institution.

c) It will depend organically, functionally, and administratively on the board of directors of the warehousing company.

d) It will fulfill its functions and objectives promptly, independently, effectively, and efficiently.

e) It will have access to all corporate books, among others: those of a accounting nature, of the credit committee, of the share register, of board of directors, of general meetings of shareholders; as well as to the records, documents, and information it considers necessary for the exercise of its functions.

f) It must have appropriate infrastructure and adequate human, technical, and logistical resources to the magnitude and complexity of the institution's operations, as well as to the risks it faces.

The warehouse's board of directors is responsible for ensuring appropriate conditions for the development of the internal audit function.

The internal auditor and other auditors who make up the IAUs must receive permanent training in matters related to their functions, for which it corresponds to the internal auditor to present the training needs regarding the members of the IAUs, indicating the main areas of training and the number of hours required annually, a request that must be presented and discussed in the audit committee and authorized by the board of directors.

All information obtained by the IAUs is subject to banking secrecy, as provided in Article 113 of the General Banking Law.

Article 8. Functions of the Audit Unit.- The IAUs shall have the following minimum functions:

a) Evaluate the design, execution, effectiveness, and sufficiency of the internal control system.

b) Evaluate compliance with the legal and regulatory provisions governing the institution.

c) Evaluate the reliability, confidentiality, availability, effectiveness, integrity, and functionality of information technology and the control and usage mechanisms established by the warehousing company to guarantee its security and protection.

d) Evaluate compliance with the manuals of policies and procedures and other internal norms of the warehouse.

e) Carry out permanent follow-up on the implementation and compliance with orders, instructions, and/or recommendations formulated by the Superintendent, by external auditors, and by the IAUs itself.

f) According to audit standards and based on the Warehouse's Audit Risk Matrix, design the annual work plan and submit it to the board of directors through the audit committee for approval, and send it to the Superintendent for their knowledge. Likewise, comply with the planned activities in the annual work plan and prepare the respective reports.

g) Carry out unplanned activities when deemed necessary or at the express request of the board of directors or the Superintendent.

h) Verify the effectiveness of the internal controls proposed and designed for an operation, service, or product in the stage prior to its launch, and/or participate in the strategic management committee.

i) Evaluate the internal controls and the level of compliance of the anti-money laundering and terrorism financing prevention system.

j) Evaluate compliance with other aspects determined by the board of directors, the audit committee, and the Superintendent.

Article 9. Qualities of the Audit Unit.- The persons who make up the IAUs must possess the knowledge, technical aptitudes, experience, and other qualities required for the fulfillment of their responsibilities according to the specificities, risks, products, and services of the warehouse.

Article 10. Outsourcing.- Warehouses may outsource functions assigned to the IAUs in order to access advantages of a technical, resource, methodological nature, among others. This type of outsourcing must comply with what is established in Article 130 of the General Banking Law, with the requirements indicated in this norm, and with what is established in the regulations governing the matter on contracting service providers for the performance of operations or services in favor of financial institutions.

Regardless of the level of outsourcing, the internal auditor remains responsible for ensuring that internal audit functions adequately and effectively, and in accordance with what is provided in this norm and according to the service agreement or contract signed with the provider.

The internal auditor is responsible for supervising compliance with the service contract, ensuring the general quality of the activities, reporting to the audit committee, as well as carrying out follow-up on the results of the contracted work.

Article 11. Audit Procedures and Techniques.- The audit procedures and techniques employed by the IAUs must comply with the provisions established in this norm and what is established in the International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors. Likewise, said audit procedures and techniques must be contained in the respective internal audit manual.

CHAPTER V INTERNAL AUDITOR

Article 12. Appointment of the Internal Auditor.- The IAUs will be in charge of the Internal Auditor, a full-time official with exclusive dedication, whose appointment corresponds to the General Meeting of Shareholders in accordance with Article 44 of the Warehouse Law.

In the case of financial groups, the Superintendent may authorize, upon request and presentation of pertinent justifications, that the Internal Auditor of the responsible coordinator or of the controlling company, when it is located in the country, be appointed as Internal Auditor of a warehouse.

In order to avoid possible conflicts of interest, warehouses may not appoint as internal auditor persons who in the last twelve (12) months have held positions in the accounting area or managerial positions in operational areas or business units, in the same institution.

Article 13. Requirements of the Internal Auditor.- The interested party who wishes to provide their services to a warehouse as an internal auditor must comply with the qualification criteria and information requirements established in the regulations governing the matter on requirements to be a director, general manager and/or chief executive and internal auditor of financial institutions; as well as with the requirements established in this norm. The Superintendent may consider the appointment of an internal auditor who does not have the minimum requirement of five (5) years of experience at an adequate level of magnitude and complexity of the responsibility to be performed, established in the aforementioned norm.

To prove compliance with the established requirements, the warehouse must present the documentation required by the regulation governing the matter on requirements to be a director, general manager and/or chief executive and internal auditor of financial institutions.

Article 14. Responsibilities of the Internal Auditor.- The internal auditor is responsible for complying, at a minimum, with the following:

a) Report in writing to the Superintendent in case of temporary absence from their position for more than thirty (30) days and on any other modification in the composition of the IAUs that significantly affects its functioning and independence.

b) Verify that practices favoring partners, directors, or administrators of the institution do not occur, which could constitute a detriment to the interest of clients.

c) Communicate the occurrence of significant events immediately, directly, and simultaneously, to the supervisor elected by the general meeting of shareholders or to the head office when it concerns branches of foreign institutions, to the Superintendent, to the audit committee, and to the board of directors of the warehouse. Such communication must be made no later than three (3) days following the knowledge of the events.

Article 15. Removal of the Internal Auditor.- The removal of the internal auditor before the expiration of their term must have the vote of a majority of two-thirds of shareholders present at the General Meeting and be submitted to the consideration of the Superintendent for non-objection, indicating the reasons that justify such measure. The Superintendent may request a report from the internal auditor, who must present it no later than on the date indicated to them. After the aforementioned term has elapsed, the Superintendent within eight (8) business days thereafter, by reasoned resolution, will determine what they consider pertinent.

In this case, the lack of an internal auditor cannot last more than sixty (60) days.

Article 16. Interim Internal Auditor.- With prior authorization from the Superintendent, the IAUs may be in charge of an interim internal auditor appointed by the board of directors for a period of up to six (6) months, except in the case of removal of the internal auditor, in which case, the IAUs may be in charge of them for a period of up to sixty (60) days as provided in the previous article. The interim auditor must comply with the same requirements established in this norm for the case of the internal auditor.

CHAPTER VI ANNUAL WORK PLAN

Article 17. Minimum Content of the Annual Work Plan.- The preparation of the annual work plan will be the responsibility of the IAUs, which must be in accordance with the volume and complexity of the operations. The plan must be presented to the audit committee and approved by the board of directors within the last quarter of the year immediately preceding its execution and a copy must be sent to the Superintendent in the first half of January of the following year, and must contain, at least, the following aspects:

a) Annual objectives and scope of the IAUs plan.

b) Schedule of planned activities, whose minimum content is that provided in the annex of this Norm, which forms an integral part of it. Said schedule must include the dates and deadlines detailed by activity, probable dates for the presentation of reports and reports, and the follow-up on observations formulated by the Superintendent.

c) Human, technical, and logistical resources available for the fulfillment of the plan, indicating the administrative structure, the structure of the personnel who make up the IAUs, the positions they hold, and the professional training of these, indicating, if necessary, the need to hire specialized services.

Article 18. Modifications to the Annual Work Plan.- Substantive modifications made to the plan must be communicated to the Superintendent within five (5) days of their approval, accompanied by a copy of the agreement of the respective board of directors session where the reasons that gave rise to them are specified. The Superintendent may object to said modifications by resolution or suggest others.

11 Article 19. Report on the Progress of the Plan.- The internal auditor must submit a quarterly progress report on the Annual Work Plan to the audit committee and to the supervisor elected by the general meeting of shareholders or to the parent company when dealing with branches of foreign institutions. This report must be forwarded by the audit committee to the warehouse's board of directors, with a copy to the Superintendent, within twenty (20) days following the close of each quarter. The report will consist of a summary of scheduled activities not carried out and the date on which they will be executed, of activities carried out but not scheduled according to said plan; as well as, a consolidated detail of the audit reports carried out to date, which describes the findings, the recommendations to remedy them and the follow-up and degree of compliance with them. It will be the responsibility of the internal auditor to indicate in the aforementioned quarterly progress report that no significant fact was detected that should have been communicated, if applicable. CHAPTER VII AUDIT REPORTS AND ARCHIVES Article 20. Presentation of Reports.- The internal auditor must present to the audit committee all the reports they prepare in compliance with their functions. Said committee will evaluate the respective final reports and no later than in the immediate next session will present them to the board of directors. The opportunity at which said committee becomes aware of the reports and the decisions adopted with respect thereto, must be recorded in the respective minutes book. Article 21. Minimum Content of the Reports.- The reports prepared by the Internal Audit Unit must contain, at least, the following aspects: a) Objective and scope of the evaluation. b) Methodology, audit procedures and techniques employed; as well as, description of the work performed. c) Evaluation of the situation of the activity or operation as of the date of the report, identifying the risks detected and their impact on the institution, as well as, the evaluation of the procedures and controls used by it. d) Corrective measures recommended and/or adopted to remedy the identified problems or deficiencies, as appropriate. e) Name of the officials responsible for the evaluation; and

12 f) Start and end date of the evaluation. Article 22. Filing and Preservation of Documents.- The Internal Audit Unit must maintain a file containing the reports prepared (scheduled and unscheduled) and other communications it maintains with the different units or areas of the warehouse, as well as, the working papers and the supporting documentation thereof. This information must be available to the Superintendent and to external auditors. The Internal Audit Unit must preserve electronically or physically, for a period of no less than five (5) years, counted from the date of delivery of the final report of the respective examination, the working papers and all the documentation that adequately supports the audit reports issued by them. CHAPTER VIII THE AUDIT COMMITTEE Article 23. Audit Committee.- The board of directors must constitute an audit committee by resolution to assist it in the fulfillment of its oversight responsibilities for the financial information process, business risks, internal control, audit and the process used by the warehouse to monitor compliance with laws, regulations, rules, code of conduct, among others. The audit committee must be composed, at a minimum, of three members of the board of directors, which shall be presided over by one of them, who shall be appointed by said board. The president, the executive director, the general manager, internal auditor, external auditor and any other official they consider pertinent may participate in the audit committee as guests, with voice but without vote. Article 24. Conflicts of Interest.- When any member of the audit committee has a personal interest or conflict of interest on any matter addressed by said committee, they must abstain from knowing the case, not be present during the discussion, nor influence the related topic, which must be recorded in the minutes. Article 25. Obligations of the Audit Committee.- The members of the audit committee will have the following minimum obligations: a) Meet ordinarily at least every three months, without prejudice to extraordinary meetings to deal with matters that require prompt attention. b) Inform the board of directors, at least every three months, the results of the final audit reports presented by the internal auditor.

13 c) Keep a Minutes Book where the topics addressed are reflected, signed by each of the members, so that the analysis, discussion and decision-making on said topics can be verified, as well as, a follow-up exercise on the implementation of decisions and measures adopted. d) Know and analyze the terms of external audit contracts and the sufficiency of the relevant plans and procedures, in accordance with the standards issued by the Superintendent. e) In addition to the tasks entrusted to it by the board of directors, it must perform the following:

1. Serve as a means of communication between the board of directors and the Internal Audit Unit and between the board of directors and external audit, with respect to matters detailed below: i. Quarterly, semi-annual and annual financial statements. ii. Scope and results of semi-annual and annual examinations. iii. Accounting and financial practices of the warehouse. iv. Effectiveness and quality of the internal control system. v. Scope of other services provided by external auditors. vi. Any other matter related to the audit of the warehouse's accounts and its financial aspects, which the committee deems necessary to consider, at its discretion.
2. Ensure compliance with the Annual Work Plan of the Internal Audit Unit and propose modifications to it.
3. Recommend to the board of directors the removal or re-election of the internal and external auditor.
4. Attend to the proposals formulated by the Internal Audit Unit aimed at strengthening the internal control system and attend to situations that prevent its work. Article 26. Main Functions of the Audit Committee.- The audit committee will have the following functions: a) With respect to financial statements: Review the financial statements at the close of the period, with the general manager or principal executive and with the external auditors themselves, in order to determine:
5. If they are presented in accordance with the MUC.
6. If all matters and transactions or special events that must be disclosed in notes to the financial statements have been appropriately considered.
7. If the decisions taken by management are reasonable with respect to the significant areas of asset valuation and determination of obligations, when the criterion is an important factor in the determination.
8. The way in which the most important financial problems found in the preparation of the financial statements were resolved.
9. The wide exchange of ideas with management and with external auditors on the most important aspects and items of the financial statements and notes thereto. In certain cases, however, it will be necessary a detailed analysis of each of the components of the financial statements, due to the fact that the preparation and content thereof is the responsibility of management. In many cases, however, the committee will probably want the external auditors to participate in the review.
10. If the necessary actions have been implemented to adequately comply with the recommendations given by the Superintendent, as well as, with the recommendations emanating from internal and external audit. b) With respect to external auditor reports: Review the result of the examination of the external auditors with them, considering:
11. The content of the audit report, especially any limitation to the scope of the work or other matter that could have generated qualifications in the opinion.
12. Any difference between the scope of the planned work and that finally carried out, which had not previously been communicated to the attention of the committee.
13. The solution of the most important audit problems treated during previous meetings.
14. Any difference of criterion between management and external auditors, with respect to accounting principles, treatment of transactions or specific events, disclosures in the financial statements and adjustments resulting from the examination.
15. The recommendations of the external auditors for the improvement of the warehouse's accounting procedures and internal accounting control system.
16. The written comments of the external auditors with respect to irregular matters that may have been noted during the examination.
17. The views of the external auditors with respect to the technical competence of the accounting management. c) With respect to internal control: It is convenient that the audit committee inform itself carefully of the internal control conditions of the warehouse and be interested in knowing the result of the studies and efforts that it carries out with the purpose of maintaining optimal controls. Emphasis must be placed on the activities of its internal auditors, management and external auditors. In this aspect, the committee must inform itself directly if the internal auditors study and evaluate the efficiency and compliance of the internal control system and its regulations periodically, covering the following:
18. The way in which those studies and evaluations are made.
19. If the warehouse's policies and procedures clearly and appropriately define them, and if they are duly communicated to all personnel.
20. If the internal auditors have provided effective suggestions to improve those areas of accounting and administration where the warehouse's policies and procedures are not being adequately complied with, and if the results of the reviews and compliance with its policies and controls have been dealt with management.
21. With respect to meetings with management, the committee must deal at the appropriate level of management with matters concerning the definition of the warehouse's policies and procedures, with respect to existing internal controls and compliance with applicable regulations. Special care must be taken that said matters have been appropriately treated by general management. Likewise, the audit committee must obtain the views of management with respect to the recommendations of the internal and external auditors on internal control policies and to the analysis of the cost / benefit relationship in the execution of those recommendations.
22. The audit committee must periodically and in writing inform its activities to the board of directors, this will allow each director to be informed of financial and administrative or warehouse management matters, which will serve so that they can better fulfill their responsibilities with respect to the quality of the institution. The fulfillment of the functions described above in no way means that the audit committee, nor the directors who compose it, will replace the external auditors nor the internal auditor in the execution of the technical work but, on the contrary, that the Committee (and through them the entire board of directors) has an active participation, not only in the process of contracting external auditors, but also in the knowledge of the scope of their work and the result of their examinations and reviews. Article 27. Validity Period of the Audit Committee.- The warehouse's board of directors will determine the duration of the mandate of its representatives in said committee, which in no case may be greater than three years, or until the end of the term of the board of directors, if it concludes before that term. CHAPTER IX FINAL PROVISIONS

16 Article 28. Modification of Annex.- The Superintendent is authorized to make the necessary modifications to the annex of this Norm, which is an integral part of it. Article 29. Inapplicability of Legal Provisions.- From the entry into force of this norm, the legal provisions provided for in the Norm on Internal Control and Audit, contained in Resolution No. CD-SIBOIF-596-1-SEP9-2009, of September 9, 2009, published in La Gaceta, Official Journal No. 203, of October 27, 2009, will be inapplicable to General Warehouses. Article 30. Validity.- This Norm will enter into force from its notification, without prejudice to its publication in La Gaceta, Official Journal. ANNEX 3 SCHEDULED ACTIVITIES FOR GENERAL WAREHOUSES The scheduled activities contained in the Annual Work Plan for general warehouses must include the following aspects, without prejudice to the Superintendent being able to issue instructions on other activities that must be included in said plan: a) Cash and cash equivalents: Internal audit must review the operational and accounting controls in this area, in particular it will review and determine the adequacy and validity of the operations by performing the following activities:

1. Authorization levels with adequate documentation.
2. Segregation of functions.
3. Account reconciliation programs.
4. Internal control mechanisms to know the degree of their accounting application. b) Portfolio at Fair Value with Changes in Results: The internal audit responsibility in this area will be to periodically evaluate compliance with the standards (IAS/IFRS), policies and existing procedures, in particular it will verify:
5. The correct classification of the financial instrument
6. Verification of the business model used.

3 Annex reformed on December 6, 2018 – Resolution CD-SIBOIF-1088-4-DIC6-2018

17 3) The organizational structure to verify that there is a clear definition and delimitation of functions and responsibilities (authorization, accounting recording and risk review or control functions must be segregated). 4) The correct measurement and valuation of financial instruments 5) The accuracy and periodicity of the information. 6) Periodically evaluate the results and procedures for the evaluation and classification of the portfolio. c) Portfolio at Fair Value with Changes in Other Comprehensive Income: The internal audit responsibility in this area will be to periodically evaluate compliance with the standards (IAS/IFRS), policies and existing procedures, in particular it will verify:

1. The separation of debt instrument operations, repo operations and receivables on these investments.
2. The correct classification of the financial instrument
3. Verification of the business model used
4. The correct measurement and valuation of financial instruments
5. The accuracy and periodicity of the information.
6. Periodically evaluate the results and procedures for the evaluation and classification of the portfolio. d) Portfolio at Amortized Cost: The internal audit responsibility in this area will be to periodically evaluate compliance with the standards (IAS/IFRS) policies and existing procedures, the review of the effectiveness of the established operational and accounting controls, in particular it will verify:
7. The separation of debt instrument operations, repo operations, time deposits, credit portfolio and receivables on these investments and of the credit portfolio.
8. The correct classification of the financial instrument
9. Verification of the business model used
10. The correct measurement and valuation of financial instruments
11. The accuracy and periodicity of the information.

18 6) The degree of compliance with current regulations for the Credit Portfolio. 7) Periodic review of credit portfolio recovery and evaluation procedures. e) Accounts and Documents Receivable: The internal audit responsibility in this area will be to periodically evaluate compliance with existing standards, policies and procedures. The review of the effectiveness of the established operational and accounting controls, in particular it will verify:

1. The organizational structure to verify that there is a clear definition and delimitation of functions and responsibilities (authorization, accounting recording and risk review or control functions must be segregated).
2. The degree of compliance with the policies, provisions and guidelines issued by the board of directors.
3. The degree of compliance with current regulations.
4. Periodic review of accounts and documents receivable recovery and evaluation procedures.
5. The identification and classification of accounts and documents receivable. f) Material Assets: The internal audit responsibility in this area will be to periodically evaluate compliance with existing policies and procedures. The review of the effectiveness of the established operational and accounting controls, in particular it will verify:
6. That the assets registered in this account comply with what is established in the IAS/IFRS applicable to them.
7. Know the material asset investment policies.
8. Assess the dimension of the assets, their efficiency or excess considering both the activity developed and the expansion plans and strategies.
9. Know and evaluate internal control mechanisms, in particular: i. Purchase, sales and service contracting control mechanisms. ii. Legal safeguard mechanisms for assets (control of registry inscriptions, litigation with third parties, etc.). iii. Asset coverage control mechanisms through insurance policies.

19 iv. Physical safeguard mechanisms for assets (inventories, withdrawal control, etc.). v. Internal accounting control mechanisms. vi. Accounting measurement and valuation of goods. vii. Amortizations and depreciations practiced. viii. Results recognized in real estate operations. g) Assets Received from Recoveries:

1. Evaluate compliance with established procedures for the award of assets (award, valuation, accounting recording, provisions, etc.).
2. Verify the existence of management criteria established for the alienation of awarded assets as the last stage of the credit recovery process.
3. The degree of compliance with the regulations governing the matter.
4. Know and evaluate internal control mechanisms, in particular: i. Service contracting control mechanisms (Appraisers, technicians, administrators, etc.). ii. Legal safeguard mechanisms for assets (control of registry inscriptions, litigation with third parties, etc.). iii. Asset coverage control mechanisms through insurance policies. iv. Physical safeguard mechanisms for assets (inventories, withdrawal control, etc.). v. Internal accounting control mechanisms. h) Non-Current Assets Held for Sale: The internal audit responsibility in this area will be to evaluate if the balances established in this account comply with what is established in the IAS/IFRS applicable to it. i) Intangible Assets: The internal audit responsibility in this area will be to periodically evaluate compliance with existing standards, policies and procedures, the review of the effectiveness of the established operational and accounting controls, in particular it will verify:

20

1. Compliance with what is established in the IAS/IFRS applicable to it.
2. Compliance with established procedures for intangible assets (Acquisition, valuation, accounting recording)
3. Correct accounting classification.
4. Authorization levels and adequate documentation.
5. Internal control mechanisms, in particular: i. Purchase and service contracting control mechanisms. ii. Legal safeguard mechanisms for assets (control of registry inscriptions, litigation with third parties, etc.). iii. Internal accounting control mechanisms. iv. Mechanisms for evaluating the economic returns of an intangible asset. v. Amortizations practiced and impairment losses. vi. Mechanisms used in the research and development phases for the recognition of other intangible assets. j) Fiscal Assets: The internal audit responsibility in this area will be to periodically evaluate compliance with existing standards, policies and procedures, the review of the effectiveness of the established operational and accounting controls, in particular it will verify:
6. The degree of compliance with the Law governing the matter.
7. The appropriate application of the IAS/IFRS applicable to it.
8. Tax recovery procedures.
9. Authorization levels and adequate documentation.

21 5) Tax reconciliations at least once a year. k) Other Assets: The internal audit responsibility in this area will be to periodically evaluate compliance with existing norms, policies, and procedures, review the effectiveness of established operational and accounting controls, and in particular verify:

1. Authorization levels and adequate documentation.
2. Amortization expenses and the calculation method used.
3. Compliance with regulations governing the matter.
4. Correct accounting classification and its adequate measurement and valuation. l) Financial Liabilities at Amortized Cost: The internal audit unit will verify that all warehouse obligations are adequately classified, in accordance with the norms applicable to them and according to internal procedures and controls, in particular it will verify:
5. The organizational structure to verify that there is a clear definition and delimitation of functions and responsibilities (the functions of authorization of loan requests and negotiation, accounting recording, and internal review or control must be segregated).
6. The degree of compliance with norms, policies, and provisions regulating the matter.
7. Correct accounting classification, measurement, and valuation.
8. Correct recording of obligations with financial institutions and other financing, repo operations, creditors for financial lease contracts.
9. The separation of short-term and long-term obligations and the provision of corresponding interest.
10. Obligations for financial leases and interest.

22 m) Provisions: Internal audit will verify:

1. The existence of uncertainties regarding the amount or maturity of provisions, other benefits, and other provisions, correct classification, and accounting recording.
2. The recording of personnel provisions before the balance sheet closing, as established in NIC/IFRS concerning employee benefits. n) Fiscal Liabilities: The internal audit responsibility in this area will be to periodically evaluate compliance with tax laws and policies, review the effectiveness of established operational and accounting controls, as well as the correct application of the corresponding NIC/IFRS. o) Other Liabilities: The internal audit responsibility in this area will be to periodically evaluate compliance with existing provisions, policies, and procedures, review the effectiveness of established operational and accounting controls. Likewise, it will verify that all amounts owed by the Warehouse are duly registered. p) Equity: Internal audit must periodically verify compliance with norms, policies, and procedures, as well as the review of the effectiveness of established operational and accounting controls, in particular it will verify:
3. Paid-in share capital: Partners' contributions to the institution and the integration of the paid-in share capital account based on the value of subscribed and paid shares, subscribed but unpaid shares, and treasury shares.
4. Contributions to be capitalized.
5. Obligations convertible into capital.
6. Patrimonial Reserves.
7. Accumulated results and results of the period. q) Net Other Comprehensive Income (OCI): The internal audit responsibility in this area will be to periodically evaluate compliance with norms (NIC/IFRS), policies, and procedures, as well as the review of the effectiveness of established operational and accounting controls, in particular it will verify:
8. Adjustments for Revaluation of Property, Plant, and Equipment
9. Exchange Rate Differences on Financial Instruments
10. Amounts transferred to the Statement of Results
11. Other Reclassifications
12. Taxes on Gains Related to Components of Other Comprehensive Income.

23 r) Contingent Accounts and Off-Balance Sheet Accounts: The internal audit responsibility will be to periodically evaluate compliance with existing norms, policies, and procedures, review the effectiveness of established operational and accounting controls, in particular it will verify the accounting recording of received merchandise, insurance contracts covering the merchandise, goods owned by the Warehouse, contracted guarantees, credit lines, claims, among others. s) Result Accounts: The internal audit responsibility will be to verify that only income, expenses, and costs corresponding to the period have been accounted for, as well as compliance with existing control norms, policies, and procedures, in particular:

1. Income from Operational Services
2. Financial Income
3. Income from Exchange Effects
4. Income from Recovery of Sanitized Financial Assets
5. Increases in the Fair Value of Financial Instruments with Changes in Results
6. Gain on Sale of Investments
7. Decrease in Provision for Uncollectibles
8. Decrease in Losses from Impairment of Investments

24 9) Decrease in Impairment of Non-Financial Assets 10) Gains from Reclassifications of Other Comprehensive Income 11) Other Income 12) Expenses for Operational Services 13) Financial Expenses 14) Expenses from Exchange Effects 15) Expenses from Monetary Adjustments 16) Expenses from Sanitization of Financial Income 17) Decreases in the Fair Value of Financial Instruments with Changes in Results 18) Loss on Sale of Investments 19) Expenses for Uncollectibility of Credit Portfolio, Accounts, and Documents Receivable 20) Expenses for Constitution of Reserves for Impairment of Investments 21) Expenses for Impairment of Non-Financial Assets 22) Losses from Reclassifications of Other Comprehensive Income 23) Administrative Expenses 24) Other Expenses 25) Profit or Loss before Income Tax 26) Expenses for Income Tax 27) Result of the Period t) Strategic Plan: The audit unit must verify that follow-up is being given to the warehouse's strategic plan and that monthly verification of the fulfillment of the goals exposed in its budget is carried out. u) Substantive Areas: The audit unit must review and evaluate the controls established to ensure adequate processes, at least on the following aspects:

25

1. Review of operational controls, and legal and regulatory compliance in the issuance, administration, and settlement of deposit certificates and pledge bonds.
2. Evaluation of the administration of insurance for merchandise, movable and immovable property, employee fidelity, including in the case of merchandise received in deposit, the review of the sufficiency of insured sums by location, validity of policies, and coverage of risks and locations.
3. Review of controls in the storage, custody, conservation, and handling of merchandise received in deposit, including the physical and security conditions of the warehouses.
4. Conducting merchandise inventories, to verify that issued and valid titles are duly backed.
5. Verification of the sufficiency of coverage for inventories in deposit and pledge that back the issuance of deposit certificates and pledge bonds.
6. Confirmation of the legal compliance of the warehouse's clients, such as, articles of incorporation, powers of representation, certifications of board of directors and general shareholders' meetings, election of boards of directors, identification documents, among others, as applicable and that the corresponding legal opinion exists.
7. Confirmation of the validity and coverage of lease, sublease, loan, warehouse enabling contracts, and appointment of warehouse keepers, security, and other legal documentation, as applicable, related to the premises where the merchandise received in deposit is stored and its legal opinion.
8. Evaluate compliance with the AML/CFT Program (SIPAR) of the warehouse and related norms on Prevention of Money Laundering, Terrorist Financing, and Financing of Proliferation of Weapons of Mass Destruction (AML/CFT/PWMD), in particular compliance with the six fundamental pillars in the Prevention of Money Laundering and Terrorist Financing. Assess the content of the SIPAR in accordance with norms related to the AML/CFT/PWMD matter.

26 v) Information Technology: Evaluate the procedures and controls established in the IT area, in particular:

1. Administration of changes to production environments
2. Automatic processing
3. User administration
4. Information system in production environment
5. Information Technology Administration
6. Security administration
7. Segregation of functions
8. Business continuity, information backups, and contingency plan (f) Gabriel Pasos Lacayo (f) V. Hurtado (f) Fausto Reyes (f) illegible (Silvio Moisés Casco Marenco) (f) U. Cerna B. URIEL CERNA BARQUERO Secretary of the Board of Directors SIBOIF