Norm Reforming Article 10 of the General Standard on Imposition of Fines

Page 1 of 10 RESOLUTION No. CD-SIBOIF-1269-1-SEP10-2021 Dated September 10, 2021 STANDARD REFORMING ARTICLE 10 OF THE GENERAL STANDARD ON IMPOSITION OF FINES The Board of Directors of the Superintendence of Banks and Other Financial Institutions, CONSIDERING I That by Resolution No. CD-SIBOIF-410-1-MAR14-2006, dated March 14, 2006, the "General Standard on Imposition of Fines" was approved, published in La Gaceta, Official Journal No. 80 of April 25, 2006. II That Article 164, second paragraph, of Law No. 561, "General Law of Banks, Non-Bank Financial Institutions and Financial Groups," published in La Gaceta, Official Journal No. 232, of November 30, 2005, reformed by Law No. 1078, Law Reforming Law No. 561, "General Law of Banks, Non-Bank Financial Institutions and Financial Groups," published in La Gaceta, Official Journal No. 160, of August 26, 2021; establishes that: "The Board of Directors of the Superintendence shall issue the general standards that financial institutions regulated by this Law, which are Obligated Subjects in accordance with the legislation regulating the matter against Money Laundering/Counter-Terrorism Financing/Counter-Proliferation Financing (ML/TF/CPF); as well as the necessary standards in which infractions and administrative sanctions are established, when, in increase of their risks: legal, operational or reputational, they incur in deficiencies or non-compliance with legal, regulatory or normative provisions issued by the competent authority, as well as resolutions, guidelines or instructions of the Superintendent to prevent ML/TF/CPF, which will be sanctioned for each infraction according to the gravity of these…", within the ranges provided for in the aforementioned article. III That it is appropriate to modify Article 10 of the "General Standard on Imposition of Fines" mentioned above, in order to update the ranges and classify infractions according to their gravity, as established in Article 164 of Law No. 561. IV That according to the considerations stated above and based on the faculty established in articles 3, numerals 2), 12) and 13), and 10, numerals 1), 2) and 5) of Law No. 316, "Law of the Superintendence of Banks and Other Financial Institutions" and its reforms. HAS ISSUED

Page 2 of 10 The following, CD-SIBOIF-1269-1-SEP10-2021 STANDARD REFORMING ARTICLE 10 OF THE GENERAL STANDARD ON IMPOSITION OF FINES FIRST: Article 10 of the "General Standard on Imposition of Fines" is reformed, contained in Resolution No. CD-SIBOIF-410-1-MAR14-2006, of March 14, 2006, published in La Gaceta, Official Journal No. 80, of April 25, 2006, and its reforms, which shall read as follows: "Art. 10.- Imposition of fines for infractions to the provisions and/or guidelines for the Prevention of Money Laundering or Assets, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction.- As indicated in Article 164 of the General Law of Banks, with respect to the prevention of money laundering or assets, terrorism financing and financing of the proliferation of weapons of mass destruction, supervised financial institutions will be sanctioned by the Superintendent in accordance with the following: a. Range:

1. Banks: i. Minor infractions: 20,000 up to 50,000 fine units or 0.015% of equity; in the latter case, the amount that results in the higher. ii. Serious infractions: 50,001 up to 250,000 fine units or 0.065% of equity; in the latter case, the amount that results in the higher. iii. Very serious infractions: 250,001 up to 500,000 fine units or 0.150% of equity; in the latter case, the amount that results in the higher.
2. Financial societies: i. Minor infractions: fines of 3,000 up to 8,000 fine units or 0.015% of equity; in the latter case, the amount that results in the higher. ii. Serious infractions: fines of 8,001 up to 15,000 fine units or 0.065% of equity; in the latter case, the amount that results in the higher. iii. Very serious infractions: fines of 15,001 up to 30,000 fine units or 0.150% of equity; in the latter case, the amount that results in the higher.

Page 3 of 10 3. Special regime financial companies: i. Minor infractions: fines of 2,000 up to 6,000 fine units or 0.015% of equity; in the latter case, the amount that results in the higher. ii. Serious infractions: fines of 6,001 up to 10,000 fine units or 0.065% of equity; in the latter case, the amount that results in the higher. iii. Very serious infractions: fines of 10,001 up to 25,000 fine units or 0.150% of equity; in the latter case, the amount that results in the higher. 4. Representative offices of foreign banks and financials: i. Minor infractions: fines of 5,000 up to 20,000 fine units or 0.015% on the amount of the credit portfolio, in the latter case, the amount that results in higher. ii. Serious infractions: fines of 20,001 up to 40,000 fine units or 0.065% on the credit portfolio, in the latter case, the amount that results in higher. iii. Very serious infractions: fines of 40,001 up to 60,000 fine units or 0.150% on the credit portfolio, in the latter case, the amount that results in higher. The percentage will be calculated on the equity registered in the financial statements corresponding to the month of December of the year prior to the application of the fine, reported by the infringing financial institution to the Superintendence and published by it on its website. For the case of representative offices of foreign banks and financials, the percentage will be applied on the average balance of the portfolio reported in the twelve months preceding the month of the application of the fine. Financial institutions that have less than twelve months of operation, will be imposed the sanctions that correspond between the minimum and maximum amount of fine units, referred to above, according to the gravity of the infractions. b. Infractions according to gravity.

1. Minor infractions: i. When the institution notwithstanding having an Annual Operational Plan of Prevention of Money Laundering, Terrorism Financing and Financing

Page 4 of 10 of the Proliferation of Weapons of Mass Destruction (AML/TF/CPF) authorized by its Board of Directors; this is deficient in its programming and/or execution. ii. When the AML/TF/CPF training program is deficient, inadequate or incongruent in relation to the complexity, size or risk profile of the institution; or said program is executed in a deficient manner. iii. When the Code of Conduct exists, it is inadequate or insufficient with respect to the policies adopted by the Board of Directors of the institution for the AML/TF/CPF Program. iv. When the institution notifies changes in its AML/TF/CPF Administrator or substitute late or notifies it failing to meet the information requirements that must be submitted. v. Send outside the established deadline or incomplete or inaccurate the information that institutions must submit to the Superintendence, occasionally or periodically, in accordance with law, standards or instructions of the Superintendent. vi. Send outside the established deadline the monthly cash transaction reports (CTR) that must be submitted in accordance with the laws and regulations of the matter issued by the competent authority. 2. Serious infractions: i. Send outside the established deadline or incomplete or inaccurate the statistical information that institutions must submit to the Superintendence, occasionally or periodically, in accordance with law, standards or instructions of the Superintendent. ii. When the institution does not have or does not evidence having an Annual Operational Plan of AML/TF/CPF authorized by its Board of Directors; which must comply and adjust, to the extent applicable, to the legal framework. iii. When it does not have or does not evidence having an annual and institutional training program on AML/TF/CPF with its budget allocation for its execution, authorized by its Board of Directors. iv. When it does not have a Code of Conduct that meets the policies adopted by the Board of Directors of the institution for the AML/TF/CPF Program. v. When the institution has not updated its individual risk assessment of ML/TF/CPF in accordance with the applicable legal and normative provisions; or has not established in its policies the methodology or the frequency to elaborate or update the aforementioned assessment, increasing the risk profile of the institution.

Page 5 of 10 vi. When the AML/TF/CPF Program presents deficiencies, both in its content and in its execution, the respective sanction will be applied as said deficiencies are determined, among which are mentioned: A. When it does not adjust to the nature or complexity of its products or services or to the size of its activity or to the provisions in accordance with the laws or regulations of the matter. B. When it has not carried out the differentiation of the intensity of the policies, procedures, internal controls, tasks and measures according to the levels of ML/TF/CPF risk classified as high, medium or low of all areas of its business and activities, to its clients and to the size of the institution. C. When its implementation or execution is deficient, increasing the risk profile of the institution. D. When it has not carried out or updated in its AML/TF/CPF Manual the policies, procedures, internal controls, weights, criteria and variables for the determination of ML/TF/CPF risk levels and in its matrix of classification of each of these risks or the results of their application are not documented. E. When the AML/TF/CPF Manual is not updated in accordance with the standard and law of the matter, approved by the Board of Directors of the institution. F. When the AML/TF/CPF Manual exists, it is inadequate or incongruent with respect to the complexity of its products and services financial, service technology and business or risk profile of the institution or the market in which it operates. G. When the AML/TF/CPF Manual exists, it does not contain the specific policies and procedures for: G1. The administration, backing, safeguarding, custody, conservation, maintenance and access controls to records, files, archives and other data, whether in physical or electronic form, that in accordance with the law and regulations for the prevention of ML/TF/CPF are subject to conservation for the legal term, or that, if these procedures exist, they are inadequate or deficient, or are being applied in a deficient manner. G2. The prevention and monitoring of ML/TF/CPF risks through transactions by means of electronic fund transfers or by means of the purchase or sale of foreign currency or instruments of consignment or remittances or of deposits or withdrawals of funds or of credit operations or other transactions or products and services for which the institution is authorized by law, or that, if these procedures exist, they are inadequate or deficient, or are being applied in a deficient manner. G3. The early detection, investigation, analysis or scrutiny, escalation, documentation and decision to report or not report suspicious activities of ML or TF or CPF to the competent authority or that, if these procedures exist, they are inadequate or are being applied in a deficient manner or the tools used for the monitoring of accounts or products or services or transactions are not in accordance with the complexity and volumen of operations of the entity or are ineffective for the early detection of suspicious activities. G4. Reevaluate existing ML/TF/CPF risks in the redesign, modification or innovations of operations, products, services, channels or payment methods or lines of business already existing, through the use and application of new technologies or the appropriate measures to handle and mitigate the identified risks or does not include them in its AML/TF/CPF Manual. G5. The classification of the ML/TF/CPF risk level in new products or sophisticated financial services or that facilitate anonymity or the used for their monitoring and early detection of unusual or suspicious operations of ML/TF/CPF or the systems or tools for their monitoring are not in correspondence with the technology that is being used by the institution in the provision of the same. G6. When the due diligence measures included in the same do not adjust to the risks identified in the national risk assessment of ML/TF/CPF or the sectoral evaluation or its own institutional evaluation of these risks. H. When the physical or electronic documentation in the files is not in accordance with the ML/TF/CPF risk level regarding identification, verification measures and knowledge of the client or its beneficial owner or about the ordering parties or the beneficiaries of fund transfers or remittances is incomplete or inappropriate in accordance with the minimum requirements of the law or regulations of the matter or with respect to the "Know Your Customer" policies of the institution itself, which denote an inadequate or deficient application of Due Diligence. I. Send incomplete or inaccurate the monthly CTRs that must be submitted in accordance with the laws and regulations of the matter issued by the competent authority. J. When the Superintendent determines that the AML/TF/CPF Administrator does not meet one, several or all of the following conditions:

Page 6 of 10 J1. Is not formally and in practice invested with the due authority and autonomy, organic, administrative and functional; J2. Does not have the training, training and experience that this function requires in the matter and industry in which the institution operates; J3. Is not assigned or does not have the adequate personnel and/or the training and training that this function requires; J4. Does not comply or complies deficiently with the functions that correspond to it in accordance with the law and regulations of the matter. J5. The institution cannot evidence that the AML/TF/CPF Administrator or its Substitute, when substituting the holder in their functions, have an administrative treatment comparable in all aspects, to that which grants to the other first-level managerial positions of the structure administrative of the same. K. When the financial, human, technological and material resources assigned by the Board of Directors of the institution to carry out the work of execution of the AML/TF/CPF Program, are not in accordance with the volume, complexity of its products and financial services, service technology and business or risk profile of the institution or the market in which it operates. L. When the internal audit function is insufficient or deficient in the permanent review of the AML/TF/CPF Program in accordance with the law or regulations of the matter or with respect to the audit program of the own institution. M. By the late contracting or realization of the external audit exceeding the deadlines established by the regulations regulating the matter of external audit, for the verification of the efficacy and quality of the AML/TF/CPF Program, in accordance with the law regulatory of the matter. N. By other circumstances, in which by the deficient implementation of the AML/TF/CPF Program or by non-compliance with other provisions legal or normative or instructions of the Superintendent on the matter, the profile and exposure of the institution to these risks is increased. vii. When it does not deliver the information requirements that the Superintendent effectuates to the institution, either for the realization of its activities of supervision in situ, remotely or extra situ or for the monitoring of compliance of periodic obligations or those that particularly require them, or does not provide to the delegated supervisors the minimum conditions required for the development of their inspection tasks.

Page 7 of 10 viii. Not comply with the resolutions ordered by the Superintendent to the institution for it to implement the actions and remedy the deficiencies determined and formulated in the inspection report or that, having established the actions, they do not comply or execute in accordance with the deadlines of the activities communicated to the Superintendent by the institution in its respective Action Plan. 3. Very serious infractions: i. When the institution does not have an AML/TF/CPF Administrator and its respective substitute, appointed by its Board of Directors or equivalent body before whom it must report administratively, organically and functionally, dedicated exclusively to the implementation, training and monitoring of the AML/TF/CPF Program. ii. When the AML/TF/CPF Administrator does not inform the Superintendent or conceal information about facts that prevent the adequate performance of its supervision labor, once they have not been resolved by the management of the entity despite requiring immediate attention, without prejudice to its dismissal according to the gravity of the hidden fact at the technical criterion of the Superintendent and other legal consequences derived from it. iii. When the obligation to inform the competent authority is not met, according to the law of the matter, the CTRs, in accordance with the information required by the law and applicable regulations for said report or in case, by not sending the negative communication of non-existence of reportable cash transactions for the month. iv. By the non-realization of the external audit for the verification of the efficacy and quality of the AML/TF/CPF Program, in accordance with the law and regulations of the matter. v. When the institution has not carried out its individual risk assessment of ML/TF/CPF in accordance with the applicable legal and normative provisions or having carried it out, does not evidence having considered for its realization in what applicable to it the threats, vulnerabilities and risks identified in the National Risk Assessment of ML/TF/CPF or Sectoral Assessments of these risks that have been communicated to it. vi. When it does not evidence that the results of its Individual Risk Assessment of ML/TF/CPF were communicated and approved by the Board of Directors or equivalent body, or that it does not evidence having established an institutional strategy to face the greater and lesser identified risks, with its respective Institutional Action Plan to address them.

Page 8 of 10 vii. When it does not evidence that the measures established in its AML/TF/CPF Program are designed from the results of its Individual Risk Assessment of ML/TF/CPF. viii. When there is no Manual of Policies and Procedures for the Prevention of ML/TF/CPF risks or AML/TF/CPF Manual. ix. When Internal Audit does not evidence having audited at least once a year, the components of the Integrated System of Prevention and Administration of ML/TF/CPF Risks (SIPAR ML/TF/CPF) or the entity's Prevention Program determined according to its ML/TF/CPF risk matrix, evaluating the minimum aspects established in the regulations regulating the matter of ML/TF/CPF; or that having carried it out it does not pronounce in its respective report on the quality, sufficiency and effectiveness of the same. x. When the institution does not have an AML/TF/CPF Program in accordance with the laws and regulations of the matter. xi. When the person holding any of the following categories: legal representative, director, manager, official or AML/TF/CPF Administrator, as responsible for the application of the laws and regulations of the matter, does not comply with their functions or responsibilities that the legislation assigns to them or those that they assign them the policies and internal provisions of the institution itself. xii. When the AML/TF/CPF Program of the institution does not contemplate elaborating the individual risk assessment of ML/TF/CPF for clients, countries or geographic areas, products, services, operations or transactions, distribution and sending channels, use of new technologies for service provision, both new and existing, and other risk factors that they consider pertinent, in accordance with the legal and/or regulatory requirements applicable. xiii. When the institution does not comply with the obligation to report or present the respective report of suspicious operations (SAR) of ML/TF/CPF to the competent authority, according to the law and regulations of the matter. xiv. The person holding any of the following categories: the director, representative, manager, chief executive, official, AML/TF/CPF Administrator, internal auditor or any other employee of the institution that discloses or informs the client that their transaction is being analyzed or considered for a possible Suspicious Transaction Report of ML or TF or CPF or that informs them that said report will be or has been filed. Fine amount: between four and eight monthly salaries of the person involved in the infraction according to the categories cited above. In the case of directors, the fine will be between ten and fifty thousand fine units.

Page 9 of 10 xv. The director, representative, manager, chief executive, official, administrator of the prevention of ML/TF/CPF risks, internal auditor or any other employee of the institution, who alter or distort data or antecedents in the balances, books, statements, accounts, correspondence or any other document or who conceal or prevent them from being known or destroy these elements, with the aim of hindering, diverting or evading the oversight, supervision or inspection that corresponds to exercise by the Superintendence in accordance with the Law, will be sanctioned without prejudice to the corresponding criminal sanctions, with a fine equivalent to a minimum of two times their monthly salary up to six times their monthly salary. For the case of directors the sanction will be a minimum of ten thousand up to fifty thousand fine units, according to the gravity of the offense. In accordance with the faculty granted by Article 164 of the General Law of Banks, the Superintendent, separately or jointly with the monetary sanctions for the infractions committed to the legal and normative framework against ML/TF/CPF, may apply one or more of the range of sanctions following: temporary suspension of certain or all operations affected by the deficiencies of the AML/TF/CPF prevention program, up to cancellation of the authorization granted, action plans for the term that the Superintendent determines, reprimands, temporary separation of officials and employees, including members of the board of directors, representatives, chief executive officer, general manager or chief executive officer, the AML/TF/CPF prevention administrator or their substitute, or the internal auditor. In the case of very serious infractions or recidivism, the Superintendent may accessorily order the permanent removal from office of the infringer.” SECOND: This standard will enter into force upon its notification, without prejudice to its subsequent publication in La Gaceta, Official Journal. (F) legible

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 24,244-character original (99% of the document). The remainder was not translated. The complete original-language text is stored with this document.]