Norms for Entry and Participation in Payment Systems Administered by the Central Reserve Bank of El Salvador of Payment Financial Services Administrating Institutions — BCR — SV

CD - 25/2023
NORMS FOR ENTRY AND PARTICIPATION IN THE PAYMENT SYSTEMS ADMINISTERED BY THE CENTRAL RESERVE BANK OF EL SALVADOR OF INSTITUTIONS ADMINISTERING PAYMENT FINANCIAL SERVICES

Approval:
23/11/2023
Validity: 4/12/2023

THE BOARD OF DIRECTORS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That the Republic of El Salvador is a signatory to the Treaty on Payment Systems and Securities Settlement Systems of Central America and the Dominican Republic, ratified in all its parts through Legislative Decree No. 399 dated August 23, 2007, published in Official Diary No. 177, Volume No. 376 dated September 25 of the same year, which constitutes regional legislation that harmonizes and strengthens payment systems and securities settlement systems of systemic importance in the region, as well as the competencies of central banks over the payment systems of the Contracting States.

II. That Article 11 of the Treaty on Payment Systems and Securities Settlement Systems of Central America and the Dominican Republic prescribes the competencies of Central Banks over the oversight of payment systems, establishing in its numeral 1 that:
the functioning, security and efficiency of payment systems, exercising oversight over these, their administrators and participants, defining principles, norms and standards, and verifying compliance, regardless of whether the systems are operated by the central bank itself or by private administrators. Likewise, numeral 3 provides: the central bank may issue mandatory compliance regulations, coercively request information from administrators and participants of the systems, approve programs of strict execution adjustment, suspend or invalidate decisions of an administrator when absolutely necessary, and formulate [regulations].

III. That Articles 3 and 67 of the Organic Law of the Central Reserve Bank of El Salvador establish that it is the competence of the Central Bank to ensure the normal functioning of internal and external payments, the payment system and securities settlement system, especially those that are fundamental to the efficiency and stability of the financial system; in this sense, it will issue technical norms that define the entry, participation, suspension and exclusion of Participants and Administrators of Payment and Securities Settlement Systems.

IV. That Article 66, subsection 1) of the Organic Law of the Central Reserve Bank of El Salvador [refers to financial institutions, the Central Government, autonomous state institutions and companies, as well as persons and institutions authorized by the Bank to operate habitually in the Foreign Exchange Market, in accordance with the regulations].

V. That on March 15, 2021, the National Council for Financial Inclusion and Education launched the official National Financial Inclusion Policy, which has as one of its strategic areas Digitalization and Financial Innovation, with the objective of fostering a digital ecosystem and financial innovations that promote greater and better financial inclusion of the population.

VI. That it is necessary to foster, among other aspects, the provision of financial and payment services, with an inclusive approach, so that they facilitate access to the Financial System for the traditionally excluded population.

VII. That with the emergence of the digital economy and the diffusion of Information and Communication Technologies, new agents are also configured, some called Fintech Entities, capable of applying these new technologies in the financial field, either as a product or service of their main economic activity or as part of their secondary or complementary activities.

VIII. That technological innovations in payment financial services allow the execution of operations and transactions effectively, interoperably and immediately through various digital payment systems and means, which is why it becomes essential to establish rules for access, entry and participation in the Payment Systems Administered by the Central Bank, for Payment Financial Services Administrating Institutions.

AGREES, to issue the following:

NORMS FOR ENTRY AND PARTICIPATION IN THE PAYMENT SYSTEMS ADMINISTERED BY THE CENTRAL RESERVE BANK OF EL SALVADOR OF INSTITUTIONS ADMINISTERING PAYMENT FINANCIAL SERVICES

TITLE I
OBJECT, SUBJECTS AND DEFINITIONS

Object
Art. 1.- These Norms aim to regulate the requirements for entry, participation, suspension and exclusion in the Payment Systems Administered by the Central Reserve Bank of El Salvador, of Payment Financial Services Administrating Institutions, in accordance with what is stipulated in Articles 66 and 67 of the Organic Law of the Central Reserve Bank of El Salvador.

Obligated Subjects
Art. 2.- The subjects obligated to comply with these Norms are:
a) Legal entities in El Salvador that provide payment financial services, interested in participating in the Payment Systems administered by the Central Reserve Bank of El Salvador and that meet the requirements established for such effect; and b) Authorized Payment Financial Services Administrating Institutions authorized to participate in the Payment Systems administered by the Central Reserve Bank of El Salvador.

Terms
Art. 3.- For the purposes of these Norms, the terms indicated below have the following meaning:

3.1. Central Bank: Central Reserve Bank of El Salvador;
3.2. Beneficiary or Recipient: natural or legal person receiving funds from a payment transaction;
3.3. Client: Natural or Legal Person that uses payment financial services provided by the obligated subjects of these Norms;
3.4. CODE: Electronic Money Control System, administered by the Central Reserve Bank of El Salvador;
3.5. Commerce: Natural or legal persons with whom Payment Financial Services Administrating Institutions have signed a contract, through which the conditions of payment operations by means of Electronic Fund Transfers are regulated;
3.6. Deposit Account: Account that Authorized Institutions maintain at the Central Bank for the settlement of their operations as liabilities on demand, in accordance with what is stipulated in the contract or agreement signed between both parties, for such effect;
3.7. Payment Account or Payment Registry Identifier: An alphanumeric identifier in the name of the Client and/or the Commerce, provided by the payment financial services provider or financial institution, which is used for the execution of payment transactions;
3.8. Backup Account: U.S. Dollar Deposit Account, non-interest-bearing, at the Central Bank, with restricted use for institutions whose business model requires maintaining a reserve for the purpose of responding solely to payment obligations of digital records of the U.S. Dollar balance of their clients resulting from the services offered;
3.9. Technological Devices: Instrument that allows the Client to use payment financial services; these may be: cell phones, prepaid cards, computing terminals, and point-of-service terminals, to instruct the payment and collection of products and services. A technological device is also understood as any other instrument that exists or is created in the future, feasible to be credited in U.S. Dollars that allows the Client to access such services. These technological devices must not allow anonymity;
3.10. Scheme: Set of norms, agreements, practices and standards that make the execution of payment services possible;
3.11. Payment Scheme: Set of elements, regulatory, agreements, technical, technological and business procedures, on which the sum of relations and flows that the use of a payment service will cause is formally regulated;
3.12. Payment Financial Services Administrating Institutions or Institutions: All those legal entities in El Salvador that provide payment financial services to the general population, authorized by the Central Reserve Bank in accordance with this Regulation to participate in the Payment Systems, without prejudice to being subjects of supervision by the Superintendence of the Financial System due to the nature or characteristics of the service they provide;
3.13. Authorized Institution: Payment Financial Services Administrating Institutions that have been authorized for access and participation in the system or systems of Payment Systems Administered by the Central Bank;
3.14. Settlement: Set of norms, principles of common acceptance and procedures executed for the confirmation, fulfillment and extinction of payment obligations;
3.15. Orderer or Payer: Natural or legal person paying funds in a payment transaction;
3.16. Participants: Natural or legal persons subject to the norms, agreements and procedures of a payment scheme, who intervene in the process of providing Payment Financial Services, which among their services include a digital record of the balance in dollars and/or who may have responsibility before the Client, Payment Scheme or other participants to assume the settlement obligations derived from the payment financial services provided;
3.17. Mandatory Adjustment Plan: Set of actions issued by the Central Bank to Authorized Institutions, for mandatory compliance within a specified period, with the purpose of correcting and improving weaknesses identified regarding their risks and control systems implemented to maintain regulatory compliance, resulting from an evaluation of Payment Systems Oversight, to guarantee the good functioning, security and efficiency of these;
3.18. Platform or Technological Platform: Set of hardware and software components, in which information is collected, processed, transmitted and stored, used to provide Payment Financial Services;
3.19. Payment Financial Services: means that facilitate electronic fund transactions for payments between participants, which may be:
3.19.1. Direct Debit: Payment service intended to charge the payment account of the orderer, in which the payment operation is initiated by the beneficiary based on consent given by the orderer to the beneficiary, the beneficiary's payment services provider, or the orderer's own payment services provider;
3.19.2. Payment Aggregation: Service that links, on behalf of an acquiring entity, to commerce and/or service entities established through their service and technological infrastructure to accept electronic payment means, collecting on behalf of such commerce the product of the settlement of authorized payments, to settle them by means of a credit in favor of the commerce or service with which the payment financial service has agreed through a contract;
3.19.3. API or Connectivity Bridges for Payments: Intermediary software that allows payment applications to communicate with each other. It is a technological enabler managed by Institutions that operates as a set of functions and procedures that allows access to the features or data of an operating system, application or other service;
3.19.4. Private Digital Wallets: Digital record in U.S. Dollars, in favor of a natural or legal person, which will be supplied through a digital platform;
3.19.5. Payment Initiator: Payment Financial Services Administrating Institution that initiates a payment transaction on behalf of the Client, with the explicit consent and authorization of the same, acting as an intermediary between the Client and/or the Commerce, in such a way that it facilitates the making of online payments or through mobile devices to or from a beneficiary;
3.19.6. Payment Gateway or Payment Operation Acquisition: Technological platform managed by a Payment Financial Services Administrating Institution and which has agreed through a contract with a Commerce, to accept and process electronic payment operations of its Clients, acting as an intermediary between the Commerce and/or the Client, facilitating the secure transmission of payment information and the authorization of the transaction;
3.19.7. Processor of Money Transfers from Abroad: Institution that channels payment instructions originating from anywhere in the world to a payment account in any Financial Institution or Payment Financial Services Institution in El Salvador; and
3.19.8. Account Information Services: Online service whose purpose is to facilitate aggregated information on one or more payment accounts owned by the Client, whether with another payment services provider, with multiple payment services providers and/or with an institution providing accounts.
3.20. Payment System Operator: Entity that operates a payment system or scheme.
3.21. OVSP: Payment Systems Oversight Office of the Central Reserve Bank of El Salvador;
3.22. Payment Services: The services that allow cash deposits and withdrawals, the execution of payment operations, the issuance and/or acquisition of payment instruments, the provision of money reception and sending services from and to the outside, and any other service related to the transfer of money;
3.23. Payment Systems: Set of norms, agreements, computer systems and procedures whose main objective is the execution of fund transfer instructions between its Participants; and
3.24. Electronic Fund Transfers or Payment Transaction: Operations performed by electronic means that originate charges or credits of money in digital and/or electronic records, such as fund transfers from one record to another, etc.

TITLE II
NORMS FOR ENTRY

Entry and Participation Requirements
Art. 4.- To be a Participant in the Payment Systems administered by the Central Bank, the Payment Financial Services Administrating Institution must meet the following requirements:
a) Be a company incorporated in El Salvador and whose purpose includes providing Payment Financial Services. In the case of foreign legal entities domiciled in another country, jurisdiction or territory, they must form an anonymous company or branch, domiciled in El Salvador and duly registered in the National Registry Center, and whose purpose includes providing Payment Financial Services; b) Provide one or more of the Payment Financial Services detailed in numeral 3.19 of these Norms; c) Comply with the obligations and requirements established in the Money Laundering and Assets Prevention, Terrorism Financing and Proliferation of Weapons of Mass Destruction Financing regulation; and d) In the case of being a Bitcoin Services Provider, they must be duly registered in the Central Bank's registry of Bitcoin services providers, in accordance with what is established in the Bitcoin Law Regulation. Their entry and participation will be exclusively for the settlement of operations in U.S. Dollars. Failure to meet the above requirements will result in the denial of the Application to be a Participant in the Payment Systems administered by the Central Bank, or the suspension or exclusion from these, as applicable.

Application for Entry
Art. 5.- Payment Financial Services Administrating Institutions must submit an application addressed to the Presidency of the Central Bank and signed by the Legal Representative or Attorney-in-Fact of said Institution, in which the objective or reasons for requesting approval are expressed, and must be authorized by its Board of Directors or sole administrator, as applicable, attaching the following information:
a) Copy of the articles of incorporation of the company, and its modifications if any; in the case of those incorporated abroad, they must present the articles of incorporation of the anonymous company or branch domiciled in El Salvador. In both cases, where their due registration in the Commerce Registry is stated; b) Copy of current business license; c) Documentation accrediting the legal personality of the company and the Legal Representative, duly registered in the Commerce Registry; d) Appointment of Sole Administrators or Board of Directors, as applicable, duly registered in the Commerce Registry; e) Description and main characteristics of the Product or Service (Business Operational Model) in accordance with what is established in Article 6 of these Norms. f) General description of the target market and the market segment to which the service is being provided; g) Provide the policies adopted for risk management such as: credit, counterparty, custody, liquidity, market, operational, cybersecurity, reputational, money laundering and assets risk, terrorism financing and proliferation of weapons of mass destruction financing, duly certified by the Internal Auditor of the Payment Financial Services Administrating Institution; and in which it indicates that the institution has all the appropriate processes for effective mitigation of the different types of inherent risks; h) Detail of the procedure for contracting payment financial services by the Client, as well as the notification and acceptance mechanism thereof; i) Detail of the costs, charges or commissions that clients will incur when contracting the product or service. If there are new charges, these must be clearly identified in the contracts or addendums, as well as the client's notification and acceptance mechanism; j) Procedures, deadlines and other rules for attention by the Administrator to its clients regarding: inquiries made, attention and resolution of complaints, claims, among others;

k) Contact information of the Institution, to receive notifications derived from the application; and l) Others that the Central Bank, in accordance with the Law, technical regulations, policies, procedures or technical analysis deems convenient to request in accordance with the characteristics of each business model.

Business Model Description
Art. 6.- The business operational model description must contain at least the following:
a) Business volume handled in the last three years (if applicable) or the projection of the first three years of operation, attaching supporting documentation such as Financial Statements, or criteria used for the preparation of the projection; b) General technical description of the medium through which the service is provided to the client; c) Description of the identification, subscription and registration mechanism of the Commerce and/or Client information to the services, as well as the activation, blocking, deactivation of these, the reversal of operations and the delivery of security keys, as well as the grounds for rejection of operations and the notification procedure to the client of the respective rejection; d) Type of operations that the Commerce and/or Client may perform, accompanied by the respective operational scheme including the role of the requesting Institution, the phases considered in the provision of the service and the measures to ensure the confidentiality, availability, integrity and functionality of the operations; e) Description of mechanisms, procedures and instances within the institution to avoid the prescription of the balance records of its participants or clients, if applicable; f) Description of mechanisms, procedures and instances within the Institution for the attention of complaints or claims from its participants or Commerce and/or Clients; and g) In cases where the Institution provides payment financial services through a Technological Platform, the business operational model description must include the following:
i. Technical description of the technological platform that will support the service through technological devices, in accordance with what is established in Article 7 of these Norms, as well as the mechanisms and computer systems for control and monitoring of said service; and
ii. Description of the operation registration system for all participants.

On the Technological Platform
Art. 7.- Regarding the Technological Platform on which the service is provided through Technological Devices and which will be connected to the payment systems administered by the Central Bank, the requesting institution must present the following:

CD - 25/2023
NORMS FOR ENTRY AND PARTICIPATION IN THE PAYMENT SYSTEMS ADMINISTERED BY THE CENTRAL RESERVE BANK OF EL SALVADOR OF INSTITUTIONS ADMINISTERING PAYMENT FINANCIAL SERVICES

Approval:
23/11/2023
Validity: 4/12/2023

a) Description of the hardware and software for connection with participants that intervene in their business scheme; b) The technical diagram of the sending and receiving of information between the Technological Platform, and the technological devices of the Businesses and/or Clients, which include the role of the participants defined according to the business operating model; c) Cybersecurity scheme implemented in the communication of the components of the technology platform; and d) Description of the hardware and software of the database and data backup mechanisms.

Art. 8.- The Technological Platforms of the requesting institutions that will be connected to the payment systems administered by the Central Bank must possess mechanisms that allow unrestricted and immediate access to all information related to operations performed, when requested by the Central Bank, when this is required for the exercise of its functions and by the respective authorities for the investigation of crimes, providing it through the means they deem convenient, for which extraction and generation mechanisms and procedures for historical information will be implemented and administered.

Processing of the request
Art. 9.- Upon receipt of the documentation in proper form and having verified that what was required in article 5 of these Norms has been fulfilled, the Board of Directors of the Central Bank will authorize access and participation in the system or systems of payments administered by the Central Bank or deny the same, within a maximum period of forty-five (45) business days. If the request is not accompanied by complete information or an inconsistency is identified therein, according to what is established in articles 4 and 5 of these Norms, the Central Bank may require the requesting institution via email, that, within a period of ten (10) business days counted from the day following the notification, present the missing documents or address the observations. The Central Bank may, through a reasoned resolution, extend by up to another ten (10) business days, the period indicated in the previous clause, when the nature of the observations or foreseen deficiencies so require; said resolution will be notified via email. The Central Bank in the same notification will indicate to the requesting institution that, if it does not complete the information within the aforementioned period, it will proceed without further procedure to archive the request, leaving it free to present a new request.

CD - 25/2023
NORMS FOR THE ENTRY AND PARTICIPATION IN THE PAYMENT SYSTEMS ADMINISTERED BY THE CENTRAL RESERVE BANK OF EL SALVADOR OF INSTITUTIONS ADMINISTERING PAYMENT FINANCIAL SERVICES Approval:
23/11/2023
Validity: 4/12/2023
Extension period
Art. 10.- The requesting institution may submit to the Central Bank a request for extension according to the period indicated in the third clause of article 9 of these Norms before the expiration of said period, expressing the grounds on which it is based and proposing, if applicable, the pertinent proof.
The extension period cannot exceed ten (10) business days and will begin from the next business day after the expiration date of the original period.
Suspension of the period
Art. 11.- The period of forty-five (45) business days indicated in the first clause of article 9 of these Norms, will be suspended for the days that elapse between the notification of the request for information or documentation referred to in the first and second clauses of said article, until the requesting institution remedies the observations required by the Central Bank. Regarding the resolution Art. 12.- Once the required documents have been presented in due form, the Central Bank will proceed to respond via email regarding the authorization for access and participation in the system or systems of Payments Administered by the Central Bank, from which point the requesting institution will be responsible for ensuring compliance with these Norms and the applicable regulatory framework of the payment systems in which it participates. Regarding the signing of contracts Art. 13.- Once the authorization for access and participation in the system or systems of Payments Administered by the Central Bank has been notified, the institution must sign the corresponding contracts for the use of the payment systems that will be made available for the functioning of the business model, within the periods established in the applicable regulations for said systems. If the signing of contracts is not carried out within the period indicated in the corresponding regulation, the authorization will be annulled and the request archived without further procedure, leaving it free to present a new request. Once the deposit account and/or reserve account contract is signed, the authorized institution will have a maximum period of 90 calendar days to make adjustments to its internal systems, regarding the processing scheme of operations in the Central Bank's payment systems, for the functioning of the business model. In case of a duly justified request, the President of the Central Bank may authorize requests for extension of the period to carry out adjustments to its internal systems, for a maximum period of 90 calendar days, prior to the opinion and technical valuation of the Office for the Surveillance of Payment Systems, of the causes that justify the extension. Likewise, they will have a stabilization period of 30 calendar days, once the modifications in their systems are implemented, to guarantee their functioning. The activation of the deposit account and/or reserve account will be carried out, once the authorized institution concludes the interconnection with the payment systems and has subscribed to the referred adherence contracts according to what is stipulated in the normative framework of each system.

TITLE III
GENERAL NORMS OF PARTICIPATION AND FUNCTIONING

CHAPTER I
SCOPE

Art. 14- From the subscription of the contracts, the Authorized Institution will have the status of Participant of the payment system administered by the Central Bank, and will be obliged to:
a) Comply with the technical regulations that regulate each Payment System of which it is a Participant; b) Comply with the provisions of the Organic Law of the Central Reserve Bank of El Salvador and other regulations issued by the Board of Directors, in matters of Payment Systems; and c) Comply with the provisions of the Treaty on Payment Systems and Securities Settlement in Central America and the Dominican Republic. Without prejudice to the foregoing, Payment Financial Service Administrators will also be obliged to comply with the general norms of participation and functioning of the Payment Systems directed at this segment, which are developed in the following articles.
CHAPTER II
RESERVE ACCOUNTS
Reserve Account
Art. 15.- Authorized Institutions that consider in their business model the issuance of a digital wallet, must back up one hundred percent (100%) of the balance of their digital records in United States dollars in an interest-bearing-free deposit account at the Central Bank, as a guarantee to respond solely for the non-compliance of payment obligations contracted with the holders of the instruments that register dollars. For the fulfillment of what is established in this article, the wallet administrator must have the respective controls in order to have the backing of the amounts registered in favor of Clients in the wallets at all times. It will be understood that the dollar backups will be variable depending on the flow and movements of the Clients. The real-time status of the backing and its location must be freely accessible at all times for the Central Bank. Adaptations in technological platforms Art. 16.- Institutions that are required to have a reserve account must make the necessary adaptations in their technological platforms to allow the following to be done:
a) By the Central Bank:
i. Control that the amount of the digital record of the dollar balance resulting from the services offered is equal to the amount of the reserve account.
ii. Validate the increase or reduction of the digital record of the dollar balance resulting from the services offered.
b) To the institution:
i. Verify the balance of the reserve account at the Central Bank, prior to enabling the digital record of the dollar balance, resulting from the services offered.
ii. The sending of payment instructions to decrease the balance of the reserve account.
Adaptation to systems
Art. 17.- The adaptations in their systems must be available at the moment of starting operations with the payment systems contracted and administered by the Central Bank, and must comply with the functional requirements in accordance with what is established in the Instruction for the Electronic Money Control System CODE. Decrease of the reserve account balance Art. 18.- The balance of the reserve account may be reduced whenever there is a digital record balance in dollars identified as belonging to institutions that requires a decrease on the technological platform and what is provided in the Instruction for the Electronic Money Control System CODE is fulfilled. Use of payment systems administered by the Central Bank Art. 19.- Institutions that will use the payment systems administered by the Central Bank, through the CODE System, to perform fund transfers to their account or directly to their Clients, must comply with the provisions contained in the corresponding regulatory framework for these systems. Institutions are obliged to ensure that fund transfers derived from payment obligations in dollars to own deposit accounts or those of their Clients, always correspond to the Client who ordered that the record in dollars be paid into a deposit account of the financial system, for which it must implement the corresponding mechanisms to ensure compliance with this provision.

CHAPTER III
CONTROL OF THE DIGITAL RECORD OF THE DOLLAR BALANCE FOR INSTITUTIONS THAT BY THEIR BUSINESS MODEL REQUIRE BACKING

Digital record of the dollar balance
Art. 20.- When an Institution needs to increase the amount of the digital record of the dollar balance it administers, it must make the credit to the reserve account at the Central Bank.
On the other hand, when it requires decreasing the balance of the reserve account, it must previously make the request to the Central Bank, disable the amount equivalent to the digital record of the dollar balance it administers, indicating to the Central Bank the amount to be decreased from the reserve account, the financial institution, the type and number of the account in which it intends to receive the funds. Control of the digital record of the dollar balance Art. 21.- The Central Bank will be responsible for controlling the digital record of the dollar balance that enables the Institution to circulate on its technological platform. The different interfaces to which the Institution's technological platform connects must guarantee control of the digital record of the dollar balance it possesses. The enabling of the dollar balance on the technological platform will be the responsibility of the Institution, guaranteeing that it has sufficient funds in the reserve account at the Central Bank. Art. 22.- Under no circumstances, the digital record balance in dollars that it administers on the Technological Platform may be higher than the amount of the backing deposited in the account at the Central Bank. Each Institution will be responsible for honoring its obligations with its clients, for which it must establish its internal procedures and agreements with its counterparties. Accesses of the technological Platform for Monitoring purposes

Art. 23.- The Institution must provide the Central Bank with two users and their access keys for the purpose of monitoring the digital record of the dollar balance.
Art. 24.- The access keys that the Institution provides to the Central Bank for the purpose of monitoring the digital record of the dollar balance must allow online queries of the following:
a) Digital record of the total dollar balance on its technological platform; b) [Text missing in source, likely referring to institutional balance] c) Record of the dollar balance in favor of third parties (balance of the digital record in dollars of clients who have not executed a payment request within their account); d) Variations of the total balance in a parametrizable manner weekly, bi-weekly, monthly, annually, among others; and e) Variations of the digital record balance in dollars in favor of the Institution and third parties, in a parametrizable manner weekly, bi-weekly, monthly, annually, among others.
CHAPTER IV
INFORMATION TRANSPARENCY AND CONSUMER PROTECTION

Information Transparency
Art. 25.- Payment Financial Service Administrating Institutions must provide the Client and/or Business with the necessary information about the services, in a clear, sufficient, truthful, and timely manner, avoiding the omission of essential data (prices, service commissions, among others).
User attention and guidance
Art. 26.- Payment Financial Service Administrating Institutions must have integrated services for attending inquiries or complaints from the Client or Business as applicable, and they must be attended to in a timely manner. These services may vary according to the business model and may be: chatbots, call centers, email, among others. Art. 27.- Payment Financial Service Administrating Institutions must have a financial education plan oriented towards the use of the offered service and provide timely and objective information about basic security measures and Client rights. Evaluation of quality and service Art. 28.- Payment Financial Service Administrating Institutions must develop periodic evaluations at least once a year, regarding the efficiency and effectiveness of the services provided to know the perspective of the Client and/or Business and their degree of satisfaction. Risk Management Art. 29.- Payment Financial Service Administrating Institutions must maintain optimal measures to protect the Client against risks such as the loss of privacy of personal data or financial transactions performed, exposure to fraud and/or unauthorized transactions, among others.
CHAPTER V
SPECIFIC OBLIGATIONS OF AUTHORIZED INSTITUTIONS

Obligations
Art. 30.- Specific obligations of Authorized Institutions, Participants of the Payment Systems administered by the Central Bank, are the following:
a) Maintain updated the record of transactions, which will serve as a basis to respond for its non-compliance and make effective the guarantee if applicable; b) Fulfill promptly the payment obligations with the Client; c) Remit to the Central Bank the information it requests for the fulfillment of its surveillance functions of the payment systems, within the timeframes and forms that the Central Bank determines; d) Provide to the Financial Investigation Unit of the Attorney General's Office when it requests it without any restriction, information about the Client and/or Business of the transactions they carry out; for this effect, they will have the obligation to archive and conserve the documentation of operations physically or electronically for a period of fifteen (15) years, counted from the date of completion of each operation; e) Keep updated the internal functioning rules and/or policies and other operational provisions; f) Ensure the availability and operability of the offered services during their operating hours, for which it must define contingency and business continuity plans; g) Have cybersecurity procedures that allow minimizing risks in the processing of its operations; and, h) Maintain updated a risk management program of identified risks in its business model, counting at minimum: credit risk, counterparty risk, custody, liquidity, market, operational, cybersecurity, reputational, as well as money laundering and assets risk, terrorism financing and financing of the proliferation of weapons of mass destruction (AML/CFT/Proliferation Financing) that contemplates the realization of a self-assessment, through which the possible risks that could affect the entity operationally are determined.

Access to Information
Art. 31.- The Technological Platforms of Authorized Institutions must allow unrestricted and immediate access to all information related to operations performed, when requested by the Central Bank, when this is required for the exercise of its functions and by the respective authorities for the investigation of crimes, providing it through the means they deem convenient, for which extraction and generation mechanisms and procedures for historical information will be implemented and administered. Generation of statistical information Art. 32.- The Authorized Institution must have an automated system for recording, treatment, storage, transmission, production, security and control of claims or management involving complaints or disagreements, regarding the services provided by the Authorized Institution, by the Client and/or Business, received in the previous month, which must contain among others, the number of cases, reason for complaints, cases in process or finished, according to the format that will be established in the document issued by the Central Bank through its Board of Directors. This system will generate statistics to know which products offered by each Authorized Institution are those that present the highest number of claims or management involving any complaint or disagreement expressed by the Client and/or Business, received in the previous month, related to Financial or payment Services. Authorized Institutions to operate in the payment systems Administered by the Central Bank must provide truthfully and timely to the Central Bank all the information that it requires for the fulfillment of its functions, which they must remit within the timeframe, in the form and by the means that the Central Bank indicates. Minimum security requirements of computer systems Art. 33.- The systems that support the digital payment platforms must comply with the following requirements:
a) Recording, tracking, control, backup and safeguarding of information associated with transactions performed through digital payment platforms, guaranteeing the security and integrity of each operation; b) Provision of necessary information for the reconciliation of transactions carried out, as well as proofs thereof, detailing charges for commissions or other concepts;

c) Provide security to the Client and/or Business, defining in their internal procedures and communicating to the Client and/or Business the moment when transfers are firm and irrevocable; d) Enablement of mechanisms for identification, measurement and control of operational risks associated; e) Control and identification of unusual transactions; f) Provision of security means to guarantee the execution of transactions only by the Client or holders and/or enabled users and the existence of continuous mechanisms for blocking transactions; g) Maintain adequate contingency or Business Continuity procedures, defining responsible persons and actions required to keep operating or re-establish services in a prudent time, in case of failures or interruptions in any of the components of the infrastructure involved in the provision of the service; h) Monitor the security controls of the platforms, such as firewalls, intrusion or detection systems, file integrity monitoring, antivirus, access controls, etc., to ensure they function correctly and as intended; i) Implement robust alternatives for Client identification and authentication such as virtual keyboards, security certificates and biometric techniques such as fingerprint recognition; j) Have adequate mechanisms for backing up information in case of loss, deterioration or theft thereof, as well as restoration and secure remote replication of backup copies; k) Comply with the regulatory framework of El Salvador in matters of Money Laundering and Assets, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction (AML/CFT/Proliferation Financing) and other financial crimes; and l) Have adequate alert mechanisms that allow the identification of failures in the security controls of payment platforms in order to seek solutions in a timely manner.

Availability of Received Funds
Art. 34.- Authorized Institutions shall make available to the beneficiary the funds received by way of payment orders within the timeframes established in the regulations under which they are governed by the payment systems upon which they have contracted with the Central Bank.

Internal Auditor
Art. 35.- The internal auditor of the Authorized Institution must verify compliance with the obligations regulated in these Norms, and with the policies that the Authorized Institution has issued to manage the risks described in literal g) of article 5 of these present norms, and must inform the Central Bank, no later than 5 business days after having issued the definitive internal audit report to the Authorized Institution, of any alleged non-compliance, as well as corrective measures and follow-up results. Authorized Institutions must consider in their annual internal audit plans the frequency and manner of verification of compliance with all their obligations, in accordance with the established risk profile and early alerts defined in monitoring, taking into account their risk management policies established for the type of business.

Responsibility in Matters of Prevention of Money Laundering and Asset Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction Art. 36.- Authorized Institutions shall be directly responsible for compliance with the obligations imposed by the legal and regulatory framework in matters of prevention of money laundering and asset laundering, terrorism financing, and financing for the proliferation of weapons of mass destruction in the operations and services they provide through their Technological Platform. They are also obligated to send the information required by the Central Bank through their Compliance Office in the manner and timeframe that it requires.

TITLE IV
SUPERVISION
Supervisory Functions
Art. 37. The Central Bank will exercise the supervisory function over Financial Payment Service Administrators that are authorized for access and participation in the system or systems of payments administered by the Central Bank and the technical norms issued by the Central Bank for such purposes.
To fulfill these functions, Authorized Institutions must allow the Central Bank to conduct on-site visits to their facilities, including access to other sources of information deemed necessary.
Non-compliance and Sanctions
Art. 38.- For the purposes of articles 67 and 94 of the Organic Law of the Central Reserve Bank of El Salvador, non-compliance with the General Norms of Participation and Operation, established in Title III of this instrument for the segment of Financial Payment Service Administrators, will give rise to the imposition of sanctions of fine, suspension, or exclusion, depending on their impact on the normal functioning of the Payment System, prior to the due legal procedure. Non-compliance with the specific norms that regulate the Payment Systems will be processed in accordance with what is provided in the Instructions, Regulations, and regulations issued for each Payment System of which the Financial Payment Service Administrators are participants. Internal Procedure in Case of Non-Compliance Art. 39.- In case of non-compliance described in these present norms, the following procedure will be followed:
a) Notification of non-compliance. The Head of the Payment Systems Supervision Office or the person delegated by him will notify the identified non-compliances to the Manager of Financial Stability and Public Policies and to the Legal Representative or Attorney-in-fact of the Authorized Institution, no later than within ten business days following, in order to be resolved as soon as possible or through the establishment of a Mandatory Adjustment Plan; b) Establishment of Mandatory Adjustment Plan: Prior to issuing the technical report to initiate the sanctioning procedure, or without prejudice to this; the Payment Systems Supervision Office may establish mandatory adjustment plans for the Authorized Institution, aimed at compliance with the provisions of these present norms, to correct irregularities and/or avoid actions that put at risk the normal functioning and operations of the payment systems in which it participates or of other payment systems, whose supervision corresponds to the Central Bank; c) Technical Report: The Payment Systems Supervision Office of the Central Bank, within a period not exceeding 5 business days after having notified the non-compliance to the Legal Representative or Attorney-in-fact of the Authorized Institution, or upon expiration of the period indicated in the Mandatory Adjustment Plan, as applicable, will issue a technical opinion on the causes that justify the initiation of a sanctioning procedure. The aforementioned period may be extended by another 5 additional business days when the complexity of the case so requires; d) Submission of the file: With the report of the Payment Systems Supervision Office, the Manager of Financial Stability and Public Policies will send the administrative case file to the Legal Management of the Central Bank; and e) Delegation of Competence: Competence is expressly delegated by these present norms to the Legal Management to initiate and process the respective sanctioning procedure, in accordance with what is indicated in Articles 94 and 95 of the Organic Law of the Central Reserve Bank of El Salvador and applying, where applicable, the Administrative Procedures Law. Payment of Fine Art. 40.- The Authorized Institution that has been sanctioned with a fine related to these present norms or to the Payment Systems, must pay the value of the fine through the Real-Time Gross Settlement System (LBTR), within ninety business days following the respective notification by the Central Bank, for which no payment order will be required. When the Authorized Institution does not pay the fine within the specified term, it will be enforced through the executive route and may be suspended as a Participant of the Payment Systems Administered by the Central Bank in which it has been authorized to participate, as a result of a sanctioning process, unless there is a legal cause or judicial action. Precautionary Measures for Technical Failures Art. 41.- The Central Bank may temporarily suspend an
Authorized Institution, for a period of up to 60 calendar days, when it presents repeated technical failures that could affect the normal functioning of the Payment Systems in which it is authorized to participate. During the suspension of an Authorized Institution, the affected party may participate in the Payment Systems in which it is authorized only in the manner determined by the Central Bank. Provisional Measures Art. 42.- Once an administrative sanctioning procedure has been initiated, the Board of Directors may adopt at any time, through a reasoned resolution, provisional measures of a character that are necessary to ensure the effectiveness of the resolution, the proper outcome of the procedure, the cessation of the effects of the infringement, and the requirements of general interests. Among the measures that may be adopted is the suspension of an Authorized Institution to participate in the system or systems of Payments Administered by the Central Bank, either totally or for some service provided within the Payment Systems in which it is authorized to participate, when the alleged non-compliance may affect the normal functioning of the payment systems. In case of suspension, the affected party may participate in the Payment Systems in which it is authorized only in the manner determined by the Central Bank. Communication of Suspension Art. 43.- In all cases, the suspension will be notified in writing by the Presidency of the Central Bank to the Authorized Institution, which will indicate the reasons for the decision and the suspension period. Additionally, the rest of the Participants of the systems in which it is authorized to participate will be notified. The Central Bank will have the necessary mechanisms to allow the continuity of the operations of the system in question. Revocation of Authorization to Participate in Payment Systems Administered by the Central Bank Art. 44.- If an Authorized Institution recurrently fails to comply with the provisions of the General Norms of Participation and Operation, established in Title III of these present Norms and the applicable regulations to the payment systems in which it participates, the Central Bank may revoke the authorization of its participation in said systems that it had conferred through the due process. Suspension or Exclusion of Participation Art. 45.- In the case of losing the authorization to participate in the Payment Systems Administered by the Central Bank due to exclusion, or being suspended by application of a provisional measure, its participation in the System or Systems it Participates in will be withdrawn starting from the same day that the Central Bank receives the notification of such cases, which will be communicated by the Manager of Financial Stability and Public Policies, with a copy to the Financial Operations Management, leaving the Institution disabled in the System or Systems of Payments so that it can no longer perform operations indefinitely or during the
period that the resolution indicates, as applicable. TITLE V FINAL PROVISIONS On What is Not Provided For Art. 46.- Aspects not provided for in operational matters, and that do not require a modification of these Norms, will be resolved by the Presidency of the Central Bank upon proposal of the Manager of Financial Operations or Manager of Financial Stability and Public Policies, both of the Central Bank; aspects of regulation not provided for in these guidelines will be resolved by the Board of Directors of the Central Bank. Validity Art. 47.- These present Norms will enter into force from December 4, 2023.

Similar documents from other regulators