Norms for Credit Risk and Credit Concentration Management

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011 The Board of Directors of the Superintendence of the Financial System, using the power conferred by letter c) of Article 10 of the Organic Law of the Superintendence of the Financial System and to comply with Articles 63, the final paragraph of Article 66, and Article 197 of the Banking Law, letter a) of Article 24 of the Insurance Companies Law, and Articles 41 and 155 of the Cooperative Banks and Savings and Credit Societies Law, agrees to issue the:

NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT

CHAPTER I OBJECT AND OBLIGATED ENTITIES

Object Art. 1.- The purpose of these Norms is to provide guidelines for the adequate management of credit risk and criteria for the adoption of policies and procedures related to the development of methodologies for their identification and measurement, as well as for the establishment of limits and mechanisms for monitoring, control, and mitigation of exposure levels to this risk, in accordance with the nature, scale of activities, and risk profile of the entities.

Credit risk is understood as the possibility of loss due to the non-compliance with contractual obligations assumed by a counterparty, understood as a borrower or a debt issuer.

Credits constitute the loans granted, discounted documents, bonds and other debt instruments acquired, sureties, guarantees and collateral granted, and any form of direct or indirect financing or other operation that represents an obligation for the entity.

These Norms complement the provisions established in the "Technical Norms for the Integral Management of Risks of Financial Entities" (NRP-20), the "Technical Norms of Corporate Governance" (NRP-17), the "Norms for Classifying Credit Risk Assets and Establishing Sanitation Reserves" (NCB-022) and the "Technical Norms for Classifying Credit Risk Assets and Establishing Sanitation Reserves for Investment Banks" (NCF-13), issued by the Central Reserve Bank through its Norms Committee. (3)

Subjects Art.2.- The entities obligated to comply with these Norms are those that have credit operations and investments within their assets and contingencies and that by Law are under the supervision of the Superintendence of the Financial System, such as:

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011 a) Banks established in El Salvador, their offices abroad, and their subsidiaries; (1) b) Branches and offices of foreign banks established in the country, where applicable; (1) c) Insurance companies, their branches abroad; (1) d) Branches of foreign insurance companies established in the country, where applicable; (1) e) Cooperative banks, savings and credit societies, and federations regulated by the Cooperative Banks and Savings and Credit Societies Law; (1) f) The Mortgage Bank of El Salvador, S.A.; (1) g) The Social Fund for Housing, the National Fund for Popular Housing, and the Solidarity Fund for the Micro-entrepreneur Family, insofar as they do not contradict their creation laws nor what is stipulated by the Court of Accounts; (1) h) The Agricultural Development Bank, insofar as it does not contradict its creation law nor what is stipulated by the Court of Accounts; (1) i) REPEALED; (1) (2) j) Reciprocal guarantee societies and their local guarantors; (1) k) The Social Prevision Institute of the Armed Forces; (1) (3) l) Credit card issuers; and (1) (3) m) Investment Banks established in El Salvador, their offices abroad, and their subsidiaries. (3)

Repealed (3)

Terms (3) Art.2-A.- For the purposes of these Norms, the terms indicated below have the following meaning: (3) a) Entity or entities: Obligated entities referred to in Article 2 of these Norms; (3) b) Superintendence: Superintendence of the Financial System; and (3) c) Board of Directors: Collegiate body or equivalent body in charge of the entity's administration, with supervision, direction, and control functions; in the case of Cooperative Associations, it will be the Board of Administration or as defined in its creation Law; (3)

CHAPTER II CREDIT RISK MANAGEMENT

Organizational System Art. 3.- Entities must establish an organizational or functional structure adequate to their business model and appropriately segregated, which clearly delimits their functions and responsibilities, as well as the levels of dependence and interrelation corresponding to each of the areas involved in credit risk management.

All these aspects must be contemplated in the respective manual, approved by the entity's Board of Directors.

Board of Directors Art. 4.- The entity's Board of Directors is the body directly responsible for credit risk management, and therefore must: a) Approve strategies, policies, and manuals for credit risk management and ensure that Senior Management effectively implements them; b) Assign and approve the necessary resources to implement and maintain credit risk management effectively and efficiently; and c) Ensure that internal audits are carried out by personnel independent of the area in charge of credit risk.

Senior Management Art. 5.- Senior Management is responsible for implementing credit risk management, strategies, policies, and manuals authorized by the Board of Directors.

Stages of the management process Art. 6.- For credit risk management, entities must have a continuous and documented process to determine credit assets exposed to credit risk; as well as to identify, measure, control, and mitigate, monitor, and communicate said risk.

Identification Art. 7.- Entities must establish an identification process consisting of recognizing factors that may cause an increase in credit risk.

Measurement Art. 8.- Entities must estimate expected losses derived from credit activity, considering the frequency and severity criteria of defaults.

Control and mitigation Art. 9.- Entities must implement controls for credit risk management and evaluate their adequate functioning. This phase includes the application of measures aimed at mitigating the effect on the entity's financial situation that could result from the realization of this risk.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011 Similarly, the Internal Audit area must include in its work plans the verification of compliance with policies related to credit risk, whether from a commercial or risk management perspective.

Monitoring and communication Art. 10.- The entity must establish mechanisms for the continuous monitoring of this risk, including processes that help to timely adjust, based on changes in the economic environment, the policies, processes, and procedures to manage credit risk. The monitoring activity is the responsibility of Senior Management, the Risk Committee, and the Risk Unit, as well as other instances involved in the process, which will have sufficient and timely information to support decision-making.

CHAPTER III CREDIT RISK MANAGEMENT POLICIES

Risk management policies Art. 11.- Entities must have explicit policies for credit risk management, which must be approved by the Board of Directors and be adequate to the characteristics of their products and target market. These policies must at least orient towards establishing exposure tolerance levels to credit risk, as well as performing a correct valuation of assets based on the probability of portfolio recovery.

Aspects specifically related to credit risk management must be duly documented and identified.

Entity policies must contain aspects of credit granting, follow-up, collection, recovery, and treatment of exceptions to policies. These must be consistently understood by those involved in credit management and therefore must be widely disseminated.

Procedure manuals Art. 12.- Entities, based on their policies, must establish adequate processes and procedures for the granting, follow-up, collection, and recovery of credit, including, in addition, the stages of the credit risk management process. The foregoing must be documented in the respective manual approved by the Board of Directors.

CHAPTER IV CREDIT CONCENTRATION RISK

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 5 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011

Credit concentration policies Art. 13.- Entities must have a policy regarding credit concentration risk, according to the segmentation defined by each entity, which must be duly documented, approved by the Board of Directors, and subject to periodic reviews to take into account potential changes in risk limits and the economic environment; in addition, they must contain the treatment of exceptions to the limits.

Credit concentration risk management Art. 14.- Entities must establish adequate internal procedures for the identification, measurement, control, monitoring, and communication of credit concentration risk, in accordance with the nature and scale of their activities.

Establishment of limits Art. 15.- Entities must establish, according to a prior analysis, limits, thresholds, or similar concepts of credit concentration, as well as the procedures to be followed in the application of these, in order to guarantee that the level of credit risk determined by the Board of Directors is not exceeded.

Entities must perform concentration analysis of their credit and investment portfolios, as well as estimates of the trends they present, considering at least the following aspects: a) Large individual exposures to the same counterparty, related counterparties, and related groups. For these purposes, the definition of related must be broad enough to include exposures linked by common factors, such as ownership, administration, guarantors, or linked guarantors; b) Exposures to counterparties in the same sector or economic segment or geographic region, including exposures for non-domiciled credits; c) Effectiveness of mitigants for credit risk; and d) Similarities between risk factors to unrelated exposures or exposures to common factors.

The above limits must be applied individually and globally, adding each of the operations of each entity that make up a financial conglomerate, where applicable.

The results of these analyses must serve to adjust the procedures and limits established in the management of credit concentration risk.

Monitoring Art. 16.- Credit concentration risk management and communication systems must incorporate monitoring functions, such as:

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 6 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011 a) Review of the risk environment of the sector or segment in question; b) Scenario analysis including stress tests; c) Economic results of large individual exposures; d) Review of authorization levels for new operations; or e) Periodic review of risk mitigants, their value, and legal feasibility in case of recovering the loan with the guarantee.

The results of these analyses must be submitted to the Risk Committee or the Board of Directors, so that they take appropriate measures.

Risk coverage Art. 17.- Entities must ensure that their levels of provisions and capital are sufficient to cover credit concentration risk.

CHAPTER V INFORMATION SYSTEMS AND DETERMINATION OF DATABASES

Managerial information systems Art. 18.- Entities must have an internal information system to manage credit risk and credit concentration risk, in order to measure their exposure and facilitate decision-making.

The managerial information system must allow the entity to identify, measure, control, monitor, and follow up on credit risk and credit concentration risk.

Databases Art. 19.- Entities must have databases that allow them to estimate their expected loss, for which they will use the following components: a) Probability of default; b) Loss given default; and c) Exposure at default.

The elements considered that support the estimation of these components must be documented and available to the Superintendence, when required.

The duration of the observation period of the database for the measurement of expected loss must be at least five years.

The database must be constructed in accordance with the nature, scale of activities, and risk profile of each entity; it must also be updated in a timely and consistent manner. (1)

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 7 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011

CHAPTER VI OTHER PROVISIONS AND VALIDITY

Transitory Art. 20.- Entities will have, from the validity of these Norms, a period of twelve months to adapt and comply with what is established in them, and a period of sixty calendar days to present an activity plan for the development of what is required, except for the corresponding to the Database.

Entities that do not have databases to estimate expected loss will have until December 31, 2013, to complete the collection of the necessary information for the construction of the aforementioned Database. Entities must begin to calculate their expected loss starting from January of the year 2015, using databases with a minimum length of 60 months. (1)

Unforeseen aspects (3) Art. 21.- Unforeseen aspects in regulatory matters in these Norms will be resolved by the Bank through its Norms Committee. (3)

Validity Art. 22.- These Norms will enter into force starting from June 1, 2011.

MODIFICATIONS: (1) Modifications approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-13/2012 dated December 14, 2012, with validity starting from January 2, 2013. (2) Modification to Article 2 approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-20/2020 dated December 3, 2020, with validity starting from December 22, 2020. (3) Modifications in Articles 1, 2, and 21 and incorporation of Article 2-A, approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-09/2025 dated November 10, 2025, with validity starting from November 25, 2025.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 8 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011

GLOSSARY OF TERMS

a) Credit concentration risk: refers to the exposure that has the potential to produce large losses, sufficient to threaten the stability of an entity or the ability to maintain its main operations. The potential for loss reflects the size of the exposure and the magnitude of the loss given a particular adverse circumstance. Risk concentrations can take many forms, among others: individual counterparties, groups of individual counterparties or related parties, counterparties in specific geographic locations, economic sectors, specific products, service providers. b) Scenarios: are tests or simulation exercises of situations, including extraordinary events, to evaluate the impact on credit risk exposure in the entity's active operations. c) Exposure at Default (EAD): is the total amount owed by the debtor at the moment the default occurs. The acronym used is "EAD" from the English initials "Exposure at Default" d) Loss Given Default (LGD) or Loss Severity: is the percentage of exposure that the entity loses, in the event that a debtor defaults, after having carried out all actions to recover the defaulted credits, execute guarantees, or receive them as payment in kind. It is equal to the expression (1 – Recovery Rate). It represents the net cost of a debtor's default, that is, the unrecovered proportion of the exposure upon default by the borrower once all costs involved in said recovery (collection costs, legal costs, etc.) are taken into account. The acronym used is "LGD" from the English initials "Loss Given Default". e) Expected Loss (EL): is the value corresponding to an average loss per credit risk over a given time horizon, it can be estimated at the level of each individual credit, resulting from the probability of default (PD), the level of exposure at the moment of default (EAD), and the loss severity (LGD), being formulated as follows: "EL=PDEADLGD", normally associated with the preventive reserve policy that the institution must have against its credit risks. The acronym used is "EL" from the English initials "Expected Losses" f) Probability of Default (PD): is the measure of how likely a debtor is to partially or fully cease to comply with its contractual obligations. Its minimum value is zero, which would indicate that it is impossible for it to default on its obligations, and its maximum value is one when it is certain that it will default. The acronym used is "PD" from the English initials "Probability of Default"

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 9 of 9 CDSSF-15/2011 NPB4-49 NORMS FOR CREDIT RISK AND CREDIT CONCENTRATION MANAGEMENT Approval: 04/05/2011 Validity: 01/06/2011