Norm on the Operation and Processing of Data of the Risk Central

1 RESOLUTION No. CD-SIBOIF-413-1-MAR27-2006 Dated March 27, 2006 The Board of Directors of the Superintendence of Banks and Other Financial Institutions,

CONSIDERING

I

That Articles 115 and 116 of Law No. 561, General Law of Banks, Non-Banking Financial Institutions and Financial Groups, hereinafter "General Law of Banks", stipulate that the Superintendence must establish a Consolidated Information Registry and Classification System for debtors, known as the Risk Central, hereinafter "CDR", the information of which may be accessed by financial institutions.

II

That a timely and reliable CDR constitutes an indispensable tool for supervised financial institutions and the supervisory authority, for the purpose of mitigating credit risk.

III

That the credit information submitted by supervised financial institutions to the CDR must respond to the purpose pursued by banking legislation, which is to measure and control the level of risk of debtors at the level of each financial institution and of the National Financial System, allowing the implementation of corresponding corrective measures, as well as the reasonable use of said information by the members of the CDR.

IV

That the CDR must generate statistical portfolio information from supervised financial institutions, with the purpose of orienting policies, strategies and regulations towards the financial sector.

V

That the Superintendence of Banks and Other Financial Institutions, hereinafter "Superintendence", must provide the national financial system with truthful information about the risk derived from the credit portfolio operations of each supervised financial institution, in order to foresee credit risk within it and systemic contagion risk.

VI

That based on the authority conferred by Article 3, numeral 13 and Article 10 of Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions, reformed by Law No. 552, Law of Reforms to Law No. 316, Law of the Superintendence of Banks and Other Financial Institutions; and the last paragraph of Article 53 of Law No. 561, General Law of Banks;

2 In exercise of its powers,

HAS ISSUED

The following:

NORM ON THE OPERATION AND PROCESSING OF DATA OF THE RISK CENTRAL

Chapter I GENERAL PROVISIONS

Art. 1 Object This norm aims to regulate the receipt, processing and supply of credit information coming from banks and non-banking financial institutions supervised, in order to mitigate credit risk, guaranteeing respect for the rights of its clients, promoting the veracity, confidentiality and appropriate use of the information.

Art. 2 Scope

The provisions of this Norm are applicable to all institutions subject to the supervision of the Superintendence of Banks and Other Financial Institutions. For the purposes of this norm, the entities referred to above shall be called "financial institutions".

Art. 3 Definitions For the purposes of this norm, the following definitions will be used: a) Risk Central (CDR): It is a system whose purpose is to receive and process information provided by financial institutions, related to credit operations, generating individual information per financial institution and consolidated level in the national financial system, regarding client information. Operations derived from entities in liquidation process, as well as from liquidated entities, are included; b) Client: Is the natural or legal person who maintains one or more credit portfolio operations and contingent operations, in one or more financial institutions. c) Credit Information: Client information regarding their credit obligations, payment history, guarantees, debtor classification, principal or as guarantor, surety or endorser, level of indebtedness, among others.

3 d) Risk Central Transaction Manual (Manual): Is a set of instructions, guidelines and procedures that financial institutions must follow, for the sending, processing and handling of the credit information required by the Superintendent of Banks and Other Financial Institutions, hereinafter "Superintendent". The Manual is contained in the attached Annex 1, which is initialed, stamped and signed by the Superintendent.

Chapter II RECEPTION AND VALIDATION OF CREDIT INFORMATION REQUIRED FOR THE RISK CENTRAL

Art. 4 Information to Report.

Financial institutions must send to the CDR the credit information corresponding to one hundred percent (100%) of their debtors, in accordance with what is established in the Manual and the periodicity established by the Superintendent. This information must match the balances recorded in the financial statements as indicated in the Current Single Chart of Accounts (MUC).

Art. 5 Persons Authorized to Access the Risk Central Financial institutions must communicate in writing to the Superintendent, the designation of the persons authorized to supply and receive information from the CDR, in accordance with what is established in the Manual.

Art. 6 Requirement of Legal Identity Document. Financial institutions are obliged to require all their clients, the unique identification document of the persons corresponding according to the Law on the matter.

Art. 7 Notification of Errors The Superintendent will communicate to financial institutions any deficiency found in the received credit information, for the purpose that they proceed to correct it immediately.

Art. 8 Responsibility of Financial Institutions Financial institutions are responsible for the integrity, consistency and veracity of the credit information they must send to the CDR. Likewise, they must adopt the necessary security and control measures to prevent improper handling of the information.

4 Art. 9 Responsibility of Internal Audit The Internal Audit Unit of financial institutions will be responsible for verifying the existence of internal controls of the system that generates the credit information sent to the CDR, including the review of the quality of the generated information and the access processes to the CDR, as well as its use. This responsibility must be included in the Annual Work Plans prepared by the Internal Audit Unit.

Chapter III ACCESS, SUPPLY AND USE OF INFORMATION

Art. 10 Credit References Financial institutions must obtain credit references from natural or legal persons who request credit from them, making requests to the CDR in accordance with the procedures established in the Manual. Likewise, they must access on screen the information of debtors who have not regularized their situation with banks in liquidation or liquidated.

Art. 11 Consolidated Information The Superintendent, in accordance with what is established in the Manual, will supply financial institutions with the consolidated credit information corresponding to their clients. Consolidated information is understood as the credit information that a specific client maintains in all supervised financial institutions.

Art. 12 Use of Information Financial institutions must use the CDR information solely and exclusively for the purposes of credit analysis of their active clients and of natural or legal persons who have requested credit from them. The foregoing is an indispensable element in the information obtaining process.

Chapter IV CLIENTS' RIGHTS

Art. 13 Access to Information Natural or legal persons who manage some credit in a financial institution or are clients thereof, may request from the same all the credit information contained in the credit report supplied by the CDR. Likewise, financial institutions must provide proof of credit history, when so requested by their clients.

5 Art. 14 Rectification Clients who consider that the data contained in the report provided by the CDR are inaccurate, erroneous or incomplete, may request the corresponding financial institution to rectify them. The financial institution is obliged to make the corresponding modifications in its systems and send it duly corrected in the next information submission to the CDR.

Chapter V FINAL PROVISIONS

Art. 15 Modifications of the Manual The Superintendent is authorized to modify the Manual to the extent that its application requires.

Art. 16 Sanctions. Financial institutions that fail to comply with any provision contained in this norm, or provide late, erroneous or incomplete information, will be subject to a monetary fine in accordance with what is established in the General Law of Banks and regulations on the matter issued by the Board of Directors.

Art. 17 Transitional. Financial institutions may continue to use the Risk Central Manual and the Credit Reference Request format contained in the "Prudential Norm for an Information Registry System Named: Risk Central" contained in Resolution No. CD-SIBOIF-255-1-AUGUST20-2003, while the new CDR is definitively implemented in accordance with the provisions established in this norm.

Art. 18 Repeal The "Prudential Norm for an Information Registry System Named: Risk Central" contained in Resolution No. CD-SIBOIF-255-1-AUGUST20-2003 is repealed; excepting the Risk Central Manual and the Credit Reference Request format contained in annexes 1 and 2, respectively, of the referenced norm, which will remain in effect until the CDR is definitively implemented in accordance with the provisions of this norm.

6 Art. 19 Validity. This norm will enter into force upon its notification, without prejudice to its publication in La Gaceta, Official Diary. (f) J. Rojas R. (f) V. Urcuyo V. (f) Antenor Rosales Bolaños (f) Roberto Solórzano Chacón (f) Gabriel Pasos Lacayo (f) A. Cuadra G. (f) U. Cerna B.

URIEL CERNA BARQUERO Secretary of the Board of Directors SIBOIF