Norm on Private Risk Centers

1 Resolution No. CD-SIBOIF-577-1-MAR18-2009 Dated March 18, 2009

NORM ON PRIVATE RISK CENTERS

The Board of Directors of the Superintendence of Banks and Other Financial Institutions.

CONSIDERING

I

That Article 115 of Law No. 561, General Law of Banks, Non-Bank Financial Institutions and Financial Groups, establishes that Private Risk Centers shall be subject to the approval and regulation of the Superintendence of Banks and Other Financial Institutions, being subject to confidentiality as indicated in Article 113 of the same Law;

II

That based on the legal authority referenced in the preceding consideration, it is necessary to establish the mechanisms for the approval and regulation of Private Risk Centers, so that they can provide consolidated and classified information services to financial institutions and companies that, in order to mitigate their exposure to credit risk, so require;

III

That the establishment of Private Risk Centers (hereinafter referred to as CRP) implies the handling of credit information with high technology, such that the products and services of the CRPs will be available to a greater number of establishments that grant credit and, therefore, more people will have greater access to credit.

IV

That having access to the products and services of the CRPs implies greater security against fraud and agility in the handling of credits and, therefore, lower cost in such operations.

V

That Article 3, numeral 14, of Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions, reformed by Law No. 552, "Law of Reforms to Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions", establishes that for the fulfillment of its purposes, the Superintendence has the authority to issue the norms and provisions necessary for the fulfillment of the object of said Law.

In exercise of its powers

RESOLVES

To issue the following Norm:

NORM ON PRIVATE RISK CENTERS Resolution No. CD-SIBOIF-577-1-MAR18-2009

CHAPTER I GENERAL PROVISIONS

Article 1. Concepts.- For the purposes of this Norm, the terms indicated in this article, both in uppercase and lowercase, singular or plural, shall have the following meanings:

1. Database: Set of information managed by the Private Risk Center (CRP), regardless of the form or modality of its creation, organization, storage, systematization and access, which allows relating it to itself; as well as, processing it with the purpose of providing it to third parties authorized or empowered to receive it.

2. Private Risk Center: Legal entity constituted as a joint-stock company in accordance with the provisions of the Commercial Code, whose main business will be to receive, process and provide credit information, as well as activities related to the main business, at the discretion of the Superintendent.

3. Days: Calendar days, unless it is expressly established that it refers to business days.

4. Supervised Entities: Refers to banks and non-bank financial institutions supervised by the Superintendence of Banks and Other Financial Institutions.

5. Firm: Refers to the External Audit Firm, which is a private and independent legal entity, whose main object is to provide external audit services.

3

6. Group of economic interest: Related parties, significant linkages and indirect manifestations of the legal entities to which this norm applies. The foregoing in accordance with the guidelines established for this purpose by Article 55 of Law 561, General Law of Banks, Non-Bank Financial Institutions and Financial Groups and the regulations governing the matter on concentration limits.

7. Significant events: Those events that expose or that may potentially expose the supervised entity to risks that may have an impact on its financial situation, such that there is a possibility of affecting the fulfillment of obligations with its clients, as well as with third parties, as appropriate.

8. Credit Information: Information related to a natural or legal person, regarding their obligations or financial background or any other information linked to the characteristics, historical and present, of their borrowing capacity, history and payment behavior.

9. General Law of Banks: Law No. 561, General Law of Banks, Non-Bank Financial Institutions and Financial Groups, published in La Gaceta, Official Gazette, Number 232, of November 30, 2005.

10. Accounting period.- Refers to the period between January 1 and December 31 of each year. For this purpose, the CRP must request the corresponding permit from the General Directorate of Revenues for the change of fiscal period.

11. Information collection: Any operation or set of operations or technical procedure that allow the CRPs to obtain information.

12. Registry: Registry of External Auditors of the Superintendence.

13. Credit report: Any written communication or contained in some optical or magnetic medium provided by a CRP with credit information referred to an identified natural or legal person.

14. Superintendence: Superintendence of Banks and Other Financial Institutions.

15. Superintendent: Superintendent of Banks and Other Financial Institutions.

4

16. Holder: Any natural or legal person to whom the credit information provided by the CRP refers.

17. User: The natural or legal person who has written authorization from the Holder to request and receive credit information from the CRP.

18. Occasional Users: Those who occasionally request information from the CRP, prior to the physical delivery of the Holder's authorization.

19. Permanent Users: Those who habitually grant credit and therefore have signed a contract with the CRP to receive credit information from Holders who have authorized it.

Article 2. Object.- This Norm aims to regulate the approval of the constitution and operation of CRPs, referred to in Article 115 of the General Law of Banks. In accordance with the aforementioned article, the credit information handled by CRPs coming from banks and non-bank financial institutions supervised shall be subject to confidentiality as indicated in Article 113 of said Law.

It also aims to regulate the handling of credit information coming from banks and non-bank financial institutions supervised, guaranteeing respect for the rights of the Holders thereof, recognized by the Political Constitution and current legislation, promoting the truthfulness, confidentiality and appropriate use of such information.

Article 3. Scope.- The CRPs subject to the provisions of this Norm are those that administer information coming from banks and non-bank financial institutions supervised by the Superintendence, without prejudice to the fact that they administer information from unsupervised entities.

CHAPTER II CONSTITUTION AND OPERATING LICENSE OF CRPs

Article 4. Constitution Requirements.- Interested parties who wish to obtain approval to constitute a CRP must manifest, in writing, their intention in a communication addressed to the Superintendent, attaching, at a minimum, the following:

1. Draft of the deed of constitution and its bylaws;

5

2. Curriculum Vitae of the persons who would hold positions as directors and principal officials;

3. Proposal of the shareholding composition;

4. Evidence of at least one year of experience of the administrators in a CRP established in any country;

5. Reference letters from supervised entities or commercial entities within or outside the country that evidence the capacity of the administrators to provide CRP services and the quality thereof;

6. General operating program containing as a minimum:

a. Organizational chart of the CRP.

b. Description of the technological systems provided for, as well as the design of the information collection and handling processes.

c. Characteristics of the products and services that will be provided to Users.

d. Draft format containing the information fields that will be stored.

e. Service provision policies.

f. Code of Conduct.

g. The planned security and internal control measures.

h. Contingency plans.

7. Present the audit reports indicated in Article 28 of this Norm, issued by a Firm registered in the Registry of the Superintendence, as established in subsection a) of Article 17 of these provisions.

8. Minute denoting deposit in the current account of the Superintendence, for the value of one hundred thousand cordobas, for the processing of the application. Once operations have begun, said deposit will be returned to the promoters. In case the application is denied, ten percent (10%) of the deposit amount will be paid to the Treasury of the Republic; the balance will be returned to the interested parties. In case of withdrawal, fifty percent (50%) of the deposit will be paid to the Treasury;

9. Present notarial declaration referred to in the following article; and

10. The other information and documentation that the Superintendent considers reasonable to evaluate the respective application.

In the case of societies that were constituted upon the entry into force of this Norm and manifested their intention to operate as a CRP, they must adopt their social pact and bylaws in accordance with what is established here and for such purposes, they must comply with the requirements indicated in this article and Articles 5 and 6 subsequent.

Article 5. Impediments.- Persons subject to the causes indicated in Article 29, numerals 1, 5, 6, 7 and 8 of the General Law of Banks are impeded from being directors or managers of a CRP. For the purposes of this article, the persons indicated above must present a notarial declaration of not being subject to the impediments of Article 29 previously specified according to the model established in Annex 1, which becomes an integral part of this Norm.

Article 6. Authorization for the constitution of the CRP.- To obtain the resolution of authorization for the constitution of a CRP, the following procedure will be followed:

1. Authorization process: Presented the information referred to in the preceding articles, the Superintendent will submit it, with its respective recommendation, to the consideration of the Board of Directors of the Superintendence, who will grant or deny the authorization to constitute as a CRP, all within a period not exceeding sixty (60) days, from the date that all the required information has been received.

2. Application for approval to start operations: Once the constitution of the CRP is authorized, within the period of sixty (60) days counted from the notification of the resolution of authorization to constitute, it must present to the Superintendent the following:

a. Testimony of the deed of constitution and its bylaws with the corresponding reasons for registration in the Public Registry;

7

b. Opening balance sheet;

c. Certification of the appointments of the directors for the first period, the manager or principal executive; and

d. Certified copy of the Single Taxpayer Registry (RUC).

For the societies constituted referred to in the final part of Article 4 of this Norm, they must additionally present the audited financial statements of the last period.

3. Automatic expiration of the authorization: If the period of sixty (60) days referred to in this article has elapsed, without the interested parties having complied with the requirement for the authorization to start operations, or if ninety (90) days have elapsed from the notification of the resolution that authorizes the entity to start operations, without it having started its operations, the resolutions to constitute as a CRP, as well as the authorization to start operations, will become void.

CHAPTER III OPERATION OF CRPs

Article 7. Information Sources.- The entities supervised by the Superintendence may conclude agreements individually with authorized CRPs and supply them with information on their active operations, in accordance with what is established in the last paragraph of Article 115 of the General Law of Banks. The supply of this information will have no cost for the CRP.

The CRP must handle credit information with due impartiality, confidentiality and respect for the individual rights of the Holders, it being understood that Users must use such information only for the purposes authorized by the Holder.

Article 8. Supply of credit information.- For the supply of credit information, the CRP must establish automated procedures for the transmission, communication or access of data by Users, safeguarding at all times the rights of the Holders.

For the CRP to supply credit information to Users, they must previously obtain the written authorization of the Holder of the information identifying themselves with the corresponding legal document.

In the case of Occasional Users, the Holder's authorization to request credit information must be delivered to the CRP in advance each time said Occasional User makes use of the services provided by it.

With regard to Permanent Users who habitually grant credits, they must sign contracts with the CRP to request credit information. The written authorization obtained from the Holder by the User will remain in the custody of the latter without the need for prior delivery to the CRP. In such contracts, it will be established that the Holder's authorizations to obtain credit information from the CRP will remain available in the User's files, who in turn authorizes the Firm contracted by the CRP to carry out audit procedures, extra situ or in situ in its offices, in order to verify the existence of such authorizations.

No CRP may prevent its Users from requesting information from another CRP.

Article 9. Collection and processing of information.- To protect the rights of the Holder, CRPs must observe, at a minimum, the following general guidelines for the administration of credit information:

1. The obtaining of information cannot be collected by means other than those established in this Norm;

2. The information obtained can only be used for the purposes indicated in this Norm; and

3. The information must be accurate, truthful and updated, such that it responds to the real situation of the Holder of the information at a given moment. If the information turns out to be inaccurate, erroneous or outdated, in whole or in part, they must, prior to consultation with the User provider of the information, adopt corrective measures immediately by the CRP for its modification or suppression.

Article 10. On the database.- The database of CRPs will be integrated with information on credit operations and others of an analogous nature that is provided to it by Users, or from other sources of public information.

The information obtained cannot be modified ex officio by the CRP. The change in these records must come directly from the sources that provide the information, the CRP must seek mechanisms that guarantee permanent updating of the information registered in its databases.

CRPs will establish standardized operational manuals that must be observed by Users, to carry out the registration of information in their database, as well as for the issuance, rectification and interpretation of the Credit Reports issued by the CRP.

Article 11. Security in the handling of databases.- The CRP must adopt the security and control measures that are necessary to avoid the improper handling of information. For this purpose, improper use or handling of information is understood as any act or omission tending to cause or causing harm to the Holder of the information in their person or property, to the person of whom information is held, as well as any action that translates into a patrimonial benefit, or of any other nature, in favor of the officials and employees of the CRP or of the latter, provided that it does not derive from the proper performance of its object.

Article 12. Maintenance of information.- CRPs are obliged to conserve the information provided to them by Users for a period of five years, counted from the date when:

1. The User collects in full the credit granted to the Holder;

2. From the final judgment that has condemned the Holder to pay the obligations derived from the corresponding credit;

3. The right of the plaintiff or claimant to request the execution of said judgment expires, or

4. The User's action to collect the credit owed by the Holder prescribes.

CHAPTER IV RIGHTS OF HOLDERS

Article 13. Right of access to information.- Holders will have the right to request the CRP to send their Credit Report, free of charge, once a year, and paying a fee that covers the processing cost, as many times as they wish.

The CRP must formulate the requested Credit Report in a clear and complete manner, such that it explains itself or with the help of an attached instruction, and send it or make it available to the Holder within a period of five business days counted from the date on which the CRP received the corresponding request. The Credit Report must allow the Holder to know clearly and precisely the condition in which their credit situation is.

For the purposes of the delivery of the Credit Report, CRPs must, at the choice of the Holder:

1. Make it available at the offices of the CRP;

2. By visualizing the data on screen; or

3. Send it to the postal or electronic mail address indicated in the corresponding request.

Additionally, Holders who manage any credit before a User, may request from said User the data that they have obtained from the CRP in order to clarify any situation regarding the information contained in the Credit Report.

Article 14. Right of rectification.- When Holders are not satisfied with the information contained in their Credit Report, they may present a request for rectification. Such request must be presented in writing to the CRP or through the User, attaching a copy of the Credit Report in which the informational records that are challenged are clearly indicated.

Article 15. Rectification Procedure.- The CRP must deliver to the challenged User the written statement presented by the Holder, within a period of five business days counted from the date on which the CRP received it. The User in question must respond to the CRP in writing within a period of ten business days.

Once the CRP notifies the respective User in writing of the claim, it must include in the record in question the legend "challenged record", which will be removed until the rectification procedure concludes.

If the User accepts totally or partially what is stated in the claim presented by the Holder, they must immediately make the corresponding modifications in their database and send it again to the CRP duly corrected. Likewise, the CRP must send the corrected credit report to the Holder and to the Users to whom it has provided such information in the six months prior to the date of verification of the problem.

In case the User accepts partially what is stated in the claim or points out its inaccuracy, they must express in their response the elements they considered regarding the claim, which the CRP must send to the Holder, within five business days following receipt of the User's response. The Holder may manifest in a text of no more than sixty words the arguments by which, in their opinion, the information provided by the User is incorrect and request the CRP to include said text in their future Credit Reports.

If the User does not send their response to the claim presented by the Holder to the CRP within the established period, the CRP must temporarily remove the challenged information from the credit report. The challenged information may be incorporated again into the credit report, once the User has pronounced itself on the matter. If the user does not respond within thirty days, the Superintendent will impose the corresponding monetary sanction in accordance with what is established in the General Law of Banks and in the norm that regulates the matter of fines.

In case there is no agreement or resolution in the differences between a User and a Holder, the one who considers themselves harmed, may assert their rights in the corresponding way.

In case the errors object of the claim presented by the Holder are attributable to the CRP, it must correct them immediately.

CHAPTER V CONTRACTING OF FIRMS

Article 16. Contracting of Firms.-

1. CRPs must contract annually, at the latest within the third quarter of the year to be audited, the services of Firms registered in the Registry. Likewise, CRPs must communicate to the Superintendent the name of the selected Firm within a maximum period of five (5) days, counted from the signing of the contract, attaching a copy of the certification of the board of directors meeting act where the contracted firm is approved and indicating names and positions of the audit team.

1 Art. 16, reformed on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

12 The documentation supporting compliance with the hiring requirements referred to in the following article must be available to the Superintendent. The Superintendent may order the non-hiring of a selected Firm when there are duly substantiated technical, legal, or other reasons justifying such action. Article 17. Minimum requirements for hiring.- Private Risk Centers (CRPs) may only hire the services of Firms that meet the following minimum requirements: a) Be registered in the Registry. In the event that the CRP has service centers (databases) located outside the country, the audit may be performed by a local Firm or by hiring a Firm of recognized prestige in the country where the service center is located. In the latter case, the hiring must contain, at least, the clauses established in the following article. b) Have the experience, infrastructure, human and technical resources, with the qualification appropriate to the volume and complexity of the operations performed by the CRP; c) Comply with the independence and suitability requirements established in Annex 3 of this Norm, which is an integral part of it. Article 18. Minimum conditions of contracts.- 2 In external audit service contracts, the following minimum conditions must be incorporated: a) The start of the audit engagement must take place no later than thirty (30) days before December 31 of each year. b) The scope of the audit engagement and the content of the reports issued by the Firms must comply with the International Standards on Auditing (ISA). c) The obligation of the Board of Directors, the partners of the Firm, and each member of the team that will audit the CRP, to present a notarized declaration in accordance with Annex 2 of this Norm, which is an integral part of it.

2 Art. 18, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

13 d) The deadline for delivering the reports must include a penalty clause indicating the monetary fines that will be deducted from the Firm for non-compliance with the quality and time of delivery of the corresponding reports, unless such non-compliance is caused by circumstances attributable to the CRP. e) The obligation of the Firm to inform in writing to the Superintendent and to the Board of Directors of the CRP, any significant fact that puts at risk the access, handling, and safeguarding of information of its Holders, as well as the financial stability of the CRP or regarding the existence of illegal operations determined during the course or completion of the audit being performed. This report must be made no later than within three (3) business days following knowledge of the significant fact. f) The obligation of the Firm to make available to the Superintendent the working papers, the audit programs applied, and other documentary and electronic information supporting the reports they issue and, if applicable, substantiate the respective report, upon simple request by the Superintendent. g) The obligation of the Firm to send to the Superintendent, simultaneously with its presentation to the Board of Directors of the audited CRP, a copy of the reports issued in compliance with this Norm. h) The commitment of the Firm not to replace the partner, manager, supervisor, or auditor in charge of the audit, without the authorization of the Board of Directors of the CRP. Those cases are excepted when they cease to work for the Firm, have completed the rotation period established in Article 22 of this Norm, or due to duly justified force majeure cases, for which the Superintendent must be informed indicating the name, position, and experience of the person replacing them.

14 i) The participation of the Superintendency, when it deems it necessary, in work meetings held by the Firm with the Board of Directors of the CRP, its management team, internal auditor and/or audit committee, if they exist. Article 19. Responsibilities of the CRP in external audit examinations.- 3 The Board of Directors, the General Management, and the internal audit, if it exists, are directly responsible for providing the hired Firm with the necessary information and facilities so that it can perform its audit engagement appropriately, independently, and timely. Likewise, it is the responsibility of these bodies to ensure compliance with the provisions established in this Norm and to form a file containing the background and responses to information requests made by the Firm. CRPs will keep available to the Superintendent a copy of the management letter or internal control report prepared by the Firm in connection with the preparation of the audited financial statements, supplementary reports, and the correspondence that the CRPs have sent to the Firm in response to their communications. Article 20. Knowledge of reports by the Board of Directors.- The Board of Directors must be aware of the reports issued by the Firm and instruct the General Manager or whoever acts on their behalf within the CRP to implement the necessary corrective measures. Likewise, it will be responsible, through the internal auditor and the audit committee, if they exist, for verifying compliance with such corrective measures. The receipt and knowledge of the reports issued by the Firms by the Board of Directors, as well as the derived corrective actions, must be recorded in the respective Minutes Book. Article 21. Breach of contract and change of Firm.- In the event that the Firms fail to meet the requirements set forth in Articles 17 and 18 of this Norm, the contracting CRPs must inform the Superintendent within ten (10) days of the occurrence of the breach. Likewise, they must inform, previously and documentedly, the Superintendent about the reasons motivating the change of Firm after the respective contract has been signed. In both cases and when the Superintendent deems it appropriate, they may summon the representatives of the Firm.

3 Art. 19, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

15 CHAPTER VI GENERAL DUTIES APPLICABLE TO FIRMS Article 22. Requirement for rotation of the audit team.- 4 The Firm has the obligation to rotate the partner, manager, supervisor, and auditor in charge, after three (3) years of having executed audits or related recurring services to the same CRP. Once the aforementioned period has concluded, a period of at least two (2) years must elapse before any of these persons can return to participate in performing audits or related services with the CRP. The rotation may not be simultaneous for all members of the team. For the effects mentioned in the previous paragraph, the work performed by these persons in the CRP is cumulative, even if they have been part of another Firm. CRPs must inform the Superintendent about the reasons that may eventually motivate a change of Firm before they sign the respective contract with the new Firm, attaching certification of the minute point where the change was agreed. In any case, both the hiring of the Firm and the termination of contracts must be communicated to the Superintendent within a period of ten (10) days, counted from the date on which the respective agreement was taken. In the event that the Superintendent detects situations that may constitute omissions or the existence of commitments or links between the executives or officials of the CRP and its external auditors, which affect the independence of opinion of the latter, or for any other reason based on inspection results, the Superintendent may require the hiring of another Firm, without prejudice to the sanctions it may impose on the previously hired Firm or the CRP. Article 23. Audit planning.- The Firm must present to the CRP the technical and economic offer that includes and documents an audit or related service work plan. This plan must describe, among other aspects, the nature, timing, and scope of control tests and substantive procedures; the summary and time budget for each activity to be developed in each of the stages of the work; the work program; the schedule and functions of the work team; and the evaluation and designation of the participation of specialists in specific areas. Likewise, it must clearly indicate the start date of the work to be performed and the delivery dates of the draft report and the final report.

4 Art. 22, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

16 Article 24. Execution of external audit work.- 5 Firms must execute their work based on the International Standards on Auditing (ISA). The working papers or other methodology for archiving audit evidence applied by the Firm must comply with what is provided in the International Standards on Auditing (ISA), and among others, but not limited to these, must present evidence regarding: a) Audit conclusions. b) Criteria for sample selection, procedures, and scope applied to the accounts and areas reviewed thereof. c) Unaudited aspects and their justification. d) Evidence of review by the partner-manager in charge of the audit. e) Detailed summary of adjustments and/or reclassifications resulting from the review practiced on the financial statements and related statements. If the Firm has indications or certainty that it will have limitations in the scope of its audit engagement or that it will issue a modified opinion of the type: "Qualified Opinion", "Adverse Opinion" or "Disclaimer of Opinion", it must communicate this to the Superintendent in writing, no later than within twenty-four (24) business hours following. CHAPTER VII AUDIT REPORTS Article 25. Applicable audit engagements.- 6 Firms must evaluate and issue a report, at least at the close of each accounting period, opining on the reasonableness of the financial statements of the CRP, considering the integral functioning of the internal control system and the evaluation of compliance with the laws and regulations applicable to said entities, primarily those issued by the Superintendency.

5 Art. 24, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019 6 Art. 25, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

17 The Firm's report on the financial statements must be attached with the following information:

1. Statement of Financial Position.
2. Audited Statement of Results.
3. Other Comprehensive Income.
4. Audited Statement of Changes in Equity.
5. Audited Statement of Cash Flows.
6. Notes to the Audited Financial Statements required by this Norm.
7. Detailed report on the adjustments and reclassifications proposed recorded by the entity, specifying the effects of debits and credits in each of the accounts of the financial statements.
8. Any other information of importance that the External Auditors deem fit to add. Article 26. Opinion on the financial statements.- 7 The auditor must issue their opinion as an independent auditor regarding the reasonableness of said financial statements taken as a whole, in accordance with the comprehensive accounting basis established for these entities. If there are qualifications to the opinion, these must be clearly identified and, when applicable, quantified within the same. Article 27. Notes to the financial statements.- 8 Firms must verify that CRPs comply with revealing in the Notes to the Financial Statements information whose disclosure is required by the International Financial Reporting Standards (IFRS). Article 28. Supplementary reports.- Firms must issue individual supplementary reports on each of the following aspects:
9. Evaluation of the Internal Control System inherent to the process of collecting, maintaining, and updating credit information of Holders; as well as, the appropriate handling of their information based on the provisions of Article 113 of the General Banking Law and others established in this norm.
10. Evaluation of existing security measures and controls in the information systems and the mechanisms established by said entity for their protection;

7 Art. 26, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019 8 Art. 27, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

18 3. Evaluation of the Contingency Plan established by the CRP; Article 29. Findings.- 9 Each finding revealed in the reports described above must contain the following attributes: a) Condition: It is the revelation of what the auditor found, which must be drafted briefly with sufficient information, with examples of errors or irregularities found; as well as the qualification regarding the relevance and impact of the respective finding (low, medium, high). b) Criterion: It is the revelation of what should exist or be complied with regarding laws, internal control standards, manuals of functions and procedures, policies, and any other written provision. The identification of the criterion is very important to highlight the importance of the finding or deficiency found. c) Cause: It is the revelation of the reasons why the deficiency or finding occurred; among which stand out the lack of: i. An adequate organizational structure; ii. The establishment of procedure manuals that include the application of previously established standards and instructions; iii. An adequate delegation of authority; iv. An adequate segregation of functions; v. Establishment of training policies for personnel; vi. Establishment of adequate communication between different areas; vii. Hiring of adequate human resources; viii. Assignment of sufficient material resources for the development of functions; ix. Code of ethics, business conduct, and honesty among officials; x. Establishment of incentive or motivation policies for operational personnel; xi. Adequate supervision by control areas; and

9 Art. 29, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

19 xii. others that may arise in the review performed. d) Effect: It is the consequence or potential risks that can affect the integrity and financial situation of the institution, if the condition determined by the auditor persists. e) Recommendation: It constitutes the auditor's suggestion to overcome or correct the findings or deficiencies determined. f) Management Comments: These are the mandatory manifestations of the management of the audited entity, regarding the deficiency pointed out by the auditor and the corrective measures it will implement. It must clearly identify the procedures and mechanisms necessary to be implemented to avoid or prevent the recurrence of such deficiencies and the time period required for their implementation. In the event that Firms identify problems that do not allow the performance of audit engagements appropriately, they must communicate this immediately to the Superintendent, and indicate in the respective reports the reasons that prevented such evaluation. Article 30. Deadlines for the presentation of reports.- The deadline for presenting the report on the audited financial statements, the report on the evaluation of the internal control system and on compliance with the Law and this Norm; as well as, the supplementary reports required in this Norm, must be carried out within ninety (90) days following the close of each audited fiscal year. Article 31. Information on significant facts.- 10 Firms have the obligation to communicate in writing to the Superintendent and to the Board of Directors of the CRP within three (3) business days of having taken knowledge, the significant facts they detect in the audit process of the CRPs, without prejudice to including them in the corresponding reports. CHAPTER VIII SANCTIONS, SUSPENSION OF AUTHORIZATION AND DISSOLUTION Article 32. Sanctions.- The Superintendent may establish the following sanctions for the irregularities incurred by the CRP:

10 Art. 31, amended on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

20

1. Monetary sanction, as established in the General Banking Law and the regulations governing the matter of fines;
2. The temporary suspension of access to the database coming from supervised entities; and
3. The definitive suspension of access to said database. Article 33. Monetary Sanction.- The Superintendent may apply a monetary sanction as established in the General Banking Law and in the regulations governing the matter of fines, when any of the following situations are incurred:
4. Requesting and providing information other than that authorized as established by this Norm;
5. Performing activities other than their main object;
6. Refusing to facilitate access to credit information, to the Holder thereof;
7. Denying a request for review or a request for rectification of the Holder's credit information;
8. Refusing to modify or cancel the information of a Holder after this has had a favorable pronouncement according to the procedure established in Chapter IV of this Norm;
9. Altering, modifying, or repeatedly eliminating any record from its database, except for the cases provided for in this Norm;
10. Refusing to provide information and documents to the Superintendency; and
11. That infringes any other provision established in this Norm. CRPs are responsible for incurring the infractions previously typified, without prejudice to the responsibility that may correspond to the sources from which they had collected the information.

21 Article 34. Temporary Suspension.- The Superintendent, without prejudice to the corresponding sanctions, may temporarily suspend the use of information coming from supervised entities contained in their databases, when there is a repeated occurrence of any of the situations contained in the previous article. Article 35. Definitive Suspension.- When the CRP incurs, in a serious manner, in the judgment of the Superintendent, in any of the situations mentioned in Article 33 of this Norm or in violations of what is provided in Article 113 of the General Banking Law, the Superintendent, without prejudice to the corresponding sanctions, by resolution issued to that effect, may order the definitive cancellation of the authorization to use the database with information coming from supervised entities. Article 36. Dissolution and Liquidation.- When the dissolution and liquidation of the CRP is agreed upon, said CRP must comply with the procedures that the Superintendent indicates to it regarding the handling and control of the information coming from supervised entities, contained in its database. CHAPTER IX FINAL PROVISIONS Article 37. Responsibility before the Superintendency.- The CRP must immediately inform the Superintendent when changes in shareholding composition occur, attaching the supporting documents that back up said changes. Any modification to the corporate statutes of the CRP must be submitted to the prior approval of the Superintendent, for subsequent registration in the Public Registry. In the fulfillment of its corporate object, the CRP must respond to observations made by the Superintendent in the performance of its activities, for which effect, the latter may request at any time all the information necessary to evaluate claims, complaints, or irregularities detected. All information that the CRP obtains from supervised entities must be permanently available to the Superintendency. Article 38. Area in charge of attending inquiries and complaints.- CRPs will establish the necessary internal procedures to provide efficient, effective, and timely attention to rectification requests presented by Holders in case they consider that the information contained in the databases is inaccurate, erroneous, or outdated.

22 Article 39. Modification of annexes.- The Superintendent is authorized to make the necessary modifications to the annexes of this Norm, which are an integral part of it. Article 40. Transitional.- CRPs that are operating at the time of entry into force of this norm must comply with the following:

1. Adjust the existing contracts they have signed with Permanent Users in accordance with what is established in Article 8 of these provisions, no later than within a period of sixty (60) days counted from the entry into force of this Norm;
2. For the fulfillment of aspects related to external audits, the first period to be considered will be the financial statements as of December 31, 2009. Article 41. Repeal.- The Norm on Private Risk Centers contained in Resolution No. CD-SIBOIF-454-2-NOV28-2006, dated November 28, 2006, published in La Gaceta, Official Journal No. 24, of February 2, 2007, is hereby repealed. Article 42. Validity.- This Norm will enter into force from its publication in La Gaceta, Official Journal. ANNEX 1 MINIMUM CONTENT OF NOTARIAL DECLARATION FOR SHAREHOLDERS, DIRECTORS OR MANAGERS OF CRP The undersigned declares before a Public Notary that:
3. They are not directly or indirectly, a delinquent debtor of any bank or institution subject to the supervision of the Superintendency of Banks, nor have they been judicially declared in a state of insolvency, bankruptcy, or liquidation;
4. They are not directly or indirectly, holder, partner, or shareholder with controlling share or administrative interest in companies that have overdue credits for more than ninety (90) days or for a number of three times during a period of twelve months, or that are in judicial collection in the same company or in another of the Financial System;

23 3. Has not been sanctioned in the previous fifteen (15) years for causing patrimonial damage to a bank, or to public faith by altering its financial statements; 4. Has not participated as a director, manager, deputy manager, or official of equivalent rank in a bank that has been subjected to intervention processes and declaration of forced liquidation status, nor have responsibilities, presumptions, or indications been established against him/her by judicial or administrative resolution of the Superintendent, linking him/her to the aforementioned situations; 5. Has not been convicted of intentional crimes deserving penalties greater than corrective ones.

ANNEX 2 MINIMUM CONTENT OF NOTARIAL DECLARATION BY DIRECTORS AND MEMBERS OF THE FIRM The undersigned declares before a Public Notary that:

1. He/She meets the requirements of independence and suitability referred to in this Norm.
2. He/She knows the international financial reporting standards, international auditing standards, banking and financial laws, and prudential norms issued by the Superintendence of Banks and Other Financial Institutions, and commits to complying with them.
3. He/She knows the legal provisions regulating the activities of Private Risk Centers (CRP) and commits to staying updated regarding changes they undergo.
4. He/She knows and accepts the obligations and responsibilities established by law and current regulations regarding banking secrecy and confidentiality of obtained information.
5. All information and documentation presented to the Superintendence is true and, therefore, is subject at all times to the verifications that administrative authorities require, well aware of the consequences implied by false testimony.

24 ANNEX 3 11 REQUIREMENTS OF INDEPENDENCE AND SUITABILITY Firms, their partners, directors, administrators, managers, supervisors, auditor responsible for the audit work, and other members of the audit team, who sign reports and any other official who could influence the results of the audit, must be suitable and independent persons from the audited CRP at the date of celebration of the service provision contract and during the development of the audit. It is considered that there is no independence and suitability when any of the aforementioned persons, as the case may be, falls under any of the following situations:

I. INDEPENDENCE: a) When the annual income received by the Firm from the CRP or from the legal entities forming the economic interest group to which the CRP belongs, derived from the provision of all its services, represent together 25% or more of the total income of the Firm during the year immediately preceding that in which it intends to provide the service. b) When it has been an important client or supplier of the CRP or of the legal entities forming the economic interest group to which the CRP belongs, during the two years immediately preceding that in which it intends to provide the service. An important client or supplier is considered one whose sales or, as the case may be, purchases to the CRP or to the legal entities forming the economic interest group to which the CRP belongs, represent together 20% or more of their total sales or, as the case may be, total purchases. c) When it is or has been during the two years immediately preceding its participation within the Firm, a director, manager, or main executive, as well as any employee occupying a position within the two levels immediately below the latter in the CRP or in the legal entities forming the economic interest group to which the CRP belongs.

11 Annex 3, reformed on September 10, 2019 - Resolution No. CD-SIBOIF-1129-3-SEP10-2019

25 d) When the partners, directors, managers, supervisors, administrators, auditor responsible for the audit work, and other members of the audit team, who sign reports and any other official who could influence the results of the audit, as well as the spouse and relatives of these, up to the second degree of consanguinity and second degree of affinity, have directly or through a legal entity, investments in shares, debt instruments, or derivative instruments on shares of the CRP or of the legal entities forming the economic interest group to which the CRP belongs. e) When the CRP or the legal entities forming the economic interest group to which the CRP belongs, have investments in the Firm that performs the audit. f) When the Firm or any of its partners, directors, managers, supervisors, administrators, auditor responsible for the audit work, and other members of the audit team, who sign reports and any other official who could influence the results of the audit, provide in turn to the CRP or to the legal entities forming the economic interest group, in addition to the audit service, services of accounting; of operation of information systems; of administration of its local network; of operation, supervision, design, or implementation of computer systems (hardware and software); of valuations, appraisals, or estimates; of administration; of internal audit; of representation and resolution of legal and tax conflicts; of personnel recruitment; of training; of consultancies, among others. g) When the income that the Firm receives or will receive for auditing the financial statements of the CRP depends on the result of the audit itself or on the success of any operation carried out by them, which has as its basis the opinion of said financial statements.

SUITABILITY: a) Those who are delinquent debtors, directly or indirectly, for more than 90 days or for a number of three times during a period of twelve months, of any bank or non-banking financial institution subject to the supervision of the Superintendence;

26 b) Those who have been judicially declared in a state of insolvency, bankruptcy, or liquidation, or who have been judicially qualified as responsible for a culpable or intentional bankruptcy. c) Those who have been administratively or judicially convicted for their participation in a serious violation of laws and norms of a financial nature. d) Those who have been convicted of intentional crimes deserving penalties greater than corrective ones. e) Those who have been sanctioned by the Comptroller General of the Republic.

(f) Antenor Rosales B. (f) V. Urcuyo V. (f) Gabriel Pasos Lacayo (f) Roberto Solórzano Ch. (f) A. Cuadra G. (f) U. Cerna B. URIEL CERNA BARQUERO Secretary of the Board of Directors SIBOIF