Norms for the Management of Credit Risk and Credit Concentration

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

The Board of Directors of the Superintendency of the Financial System, in exercise of the power conferred by letter c) of Article 10 of the Organic Law of the Superintendency of the Financial System and to comply with Articles 63, the final clause of Article 66, and Article 197 of the Banking Law, letter a) of Article 24 of the Insurance Companies Law, and Articles 41 and 155 of the Cooperative Banks and Savings and Credit Societies Law, agrees to issue the:

NORMS FOR THE MANAGEMENT OF CREDIT RISK AND CREDIT CONCENTRATION

CHAPTER I
OBJECTIVE AND OBLIGATED ENTITIES

Objective
Art. 1.- The objective of these Norms is to provide guidelines for the adequate management of credit risk and criteria for the adoption of policies and procedures related to the development of methodologies for its identification and measurement, as well as for the establishment of limits and mechanisms for monitoring, control, and mitigation of exposure levels to this risk, in accordance with the nature, scale of activities, and risk profile of the entities.

Credit risk is understood as the possibility of loss due to the failure to fulfill contractual obligations assumed by a counterparty, understood as a borrower or a debt issuer.

Credits constitute the loans granted, discounted documents, bonds and other debt securities acquired, sureties, guarantees and collateral granted, and any form of direct or indirect financing or other operation that represents an obligation for the entity.

These Norms complement the provisions established in the "Technical Norms for the Integrated Management of Risks of Financial Entities" (NRP-20), the "Technical Corporate Governance Norms" (NRP-17), the "Norms for Classifying Credit Risk Assets and Establishing Sanitation Reserves" (NCB-022), and the "Technical Norms for Classifying Credit Risk Assets and Establishing Sanitation Reserves for Investment Banks" (NCF-13), issued by the Central Reserve Bank through its Norms Committee. (3)

Subjects
Art. 2.- The subjects obligated to comply with these Norms are those that have credit operations and investments within their assets and contingencies and that by Law are under the supervision of the Superintendency of the Financial System, such as:

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

a) Banks incorporated in El Salvador, their offices abroad, and their subsidiaries; (1) b) Branches and offices of foreign banks established in the country, where applicable; (1) c) Insurance companies, their branches abroad; (1) d) Branches of foreign insurance companies established in the country, where applicable; (1) e) Cooperative banks, savings and credit societies, and federations regulated by the Cooperative Banks and Savings and Credit Societies Law; (1) f) The Mortgage Bank of El Salvador, S.A.; (1) g) The Social Housing Fund, the National Popular Housing Fund, and the Solidarity Fund for the Micro-entrepreneur Family, insofar as they do not contradict their creation laws nor what is provided by the Court of Accounts; (1) h) The Agricultural Development Bank, insofar as it does not contradict its creation law nor what is provided by the Court of Accounts; (1) i) REPEALED; (1) (2) j) Reciprocal guarantee societies and their local re-guarantors; (1) k) The Social Prevision Institute of the Armed Forces; (1) (3) l) Credit card issuers; and (1) (3) m) Investment Banks incorporated in El Salvador, their offices abroad, and their subsidiaries. (3)

Repealed (3)

Terms (3)
Art. 2-A.- For the purposes of these Norms, the terms indicated below have the following meaning: (3) a) Entity or entities: Subjects obligated referred to in Article 2 of these Norms; (3) b) Superintendency: Superintendency of the Financial System; and (3) c) Board of Directors: Collegiate body or equivalent body in charge of the administration of the entity, with supervision, direction, and control functions; in the case of Cooperative Associations, it will be the Board of Administration or as defined in its Creation Law; (3)

CHAPTER II
CREDIT RISK MANAGEMENT

Organizational System
Art. 3.- Entities must establish an organizational or functional structure adequate to their business model and appropriately segregated, which clearly delimits their functions and responsibilities, as well as the levels of dependence and interrelation that correspond to each of the areas involved in credit risk management.

All these aspects must be contemplated in the respective manual, approved by the entity's Board of Directors.

Board of Directors
Art. 4.- The entity's Board of Directors is the body directly responsible for credit risk management, and therefore must:
a) Approve strategies, policies, and manuals for credit risk management and ensure that Senior Management effectively implements them; b) Assign and approve the necessary resources to implement and maintain credit risk management in an effective and efficient manner; and c) Ensure that internal audits are carried out by personnel independent of the area in charge of credit risk.

Senior Management
Art. 5.- Senior Management is responsible for the implementation of credit risk management, strategies, policies, and manuals authorized by the Board of Directors.

Stages of the management process
Art. 6.- For credit risk management, entities must have a continuous and documented process to determine credit assets exposed to credit risk; as well as to identify, measure, control, and mitigate, monitor, and communicate said risk.

Identification
Art. 7.- Entities must establish an identification process consisting of the recognition of factors that may cause an increase in credit risk.

Measurement
Art. 8.- Entities must estimate expected losses derived from credit activity, considering the frequency and severity criteria of defaults.

Control and mitigation
Art. 9.- Entities must implement controls for credit risk management and evaluate their proper functioning. This phase includes the application of measures directed at mitigating the effect on the entity's financial situation that could result from the materialization of this risk.

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

Likewise, the Internal Audit area must include in its work plans the verification of compliance with policies related to credit risk, whether from a commercial or risk management perspective.

Monitoring and communication
Art. 10.- The entity must establish mechanisms for the continuous monitoring of this risk, including processes that help to timely adjust, based on changes in the economic environment, policies, processes, and procedures to manage credit risk. The monitoring activity is the responsibility of Senior Management, the Risk Committee, and the Risk Unit, as well as other instances involved in the process, which will have sufficient and timely information to support decision-making.

CHAPTER III
CREDIT RISK MANAGEMENT POLICIES

Risk management policies
Art. 11.- Entities must have explicit policies for credit risk management, which must be approved by the Board of Directors and be adequate to the characteristics of their products and target market. Such policies must at least be oriented to establish levels of tolerance for exposure to credit risk, as well as to properly value assets based on the probability of portfolio recovery.

Aspects specifically related to credit risk management must be duly documented and identified.

Entity policies must contain aspects of credit granting, follow-up, collection, recovery, and treatment of exceptions to policies. These must be consistently understood by those involved in credit management, and therefore must be widely disseminated.

Procedures manuals
Art. 12.- Entities, based on their policies, must establish adequate processes and procedures for credit granting, follow-up, collection, and recovery, including, in addition, the stages of the credit risk management process. The foregoing must be documented in the respective manual approved by the Board of Directors.

CHAPTER IV
CREDIT CONCENTRATION RISK

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

Credit concentration policies
Art. 13.- Entities must have a policy regarding credit concentration risk, according to the segmentation defined by each entity, which must be duly documented, approved by the Board of Directors, and subject to periodic reviews to take into account potential changes in risk limits and the economic environment; in addition, they must contain the treatment of exceptions to the limits.

Management of credit concentration risk
Art. 14.- Entities must establish adequate internal procedures for the identification, measurement, control, monitoring, and communication of credit concentration risk, in accordance with the nature and scale of their activities.

Establishment of limits
Art. 15.- Entities must establish, according to a prior analysis, the limits, thresholds, or similar concepts of credit concentration, as well as the procedures to be followed in their application, in order to guarantee that the level of credit risk determined by the Board of Directors is not exceeded.

Entities must perform concentration analysis of their credit and investment portfolios, as well as estimates of the trends they present, considering at least the following aspects:
a) Large individual exposures to the same counterparty, related counterparties, and related groups. For these purposes, the definition of related must be broad enough to include exposures linked by common factors, such as ownership, administration, guarantors, or linked guarantors; b) Exposures to counterparties in the same sector or economic segment or geographic region, including exposures for non-domiciled credits; c) Effectiveness of mitigants for credit risk; and d) Similarities between risk factors in non-linked exposures or exposures to common factors.

The above limits must be applied individually and globally, adding each of the operations of each entity that make up a financial conglomerate, where applicable.

The results of these analyses must serve to adjust the procedures and limits established in the management of credit concentration risk.

Monitoring
Art. 16.- The management and communication systems for credit concentration risks must incorporate monitoring functions, such as:

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

a) Review of the risk environment of the sector or segment in question; b) Scenario analysis including stress tests; c) Economic results of large individual exposures; d) Review of authorization levels for new operations; or e) Periodic review of risk mitigants, their value, and legal feasibility in case of recovering the loan with the collateral.

The results of these analyses must be submitted to the Risk Committee or the Board of Directors for them to take pertinent measures.

Risk coverage
Art. 17.- Entities must ensure that their levels of provisions and capital are sufficient to cover credit concentration risk.

CHAPTER V
INFORMATION SYSTEMS AND DETERMINATION OF DATABASES

Managerial information systems
Art. 18.- Entities must have an internal information system to manage credit risk and credit concentration risk, in order to measure their exposure and facilitate decision-making.

The managerial information system must allow the entity to identify, measure, control, monitor, and follow up on credit risk and credit concentration risk.

Databases
Art. 19.- Entities must have databases that allow them to estimate their expected loss, for which they will use the following components:
a) Probability of default; b) Loss given default; and c) Exposure at default.

The elements considered that support the estimation of these components must be documented and available to the Superintendency when required.

The duration of the observation period of the database for the measurement of expected loss must be at least five years.

The database must be constructed in accordance with the nature, scale of activities, and risk profile of each entity, and must also be updated in a timely and consistent manner. (1)

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

CHAPTER VI
OTHER PROVISIONS AND EFFECTIVE DATE

Transitory
Art. 20.- Entities will have a period of twelve months from the effective date of these Norms to adapt and comply with what is established therein, and a period of sixty calendar days to present an activity plan for the development of what is required therein, except for the corresponding to the Database.

Entities that do not have databases to estimate expected loss will have until December 31, 2013, to complete the collection of the necessary information for the construction of said Database. Entities must begin to calculate their expected loss starting in January 2015, using databases with a minimum length of 60 months. (1)

Unforeseen aspects (3)
Art. 21.- Aspects not provided for in regulatory matters in these Norms will be resolved by the Central Bank through its Norms Committee. (3)

Effective Date
Art. 22.- These Norms will enter into force starting on June 1, 2011.

MODIFICATIONS:
(1) Modifications approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-13/2012 dated December 14, 2012, with effect from January 2, 2013.
(2) Modification to Article 2 approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-20/2020 dated December 3, 2020, with effect from December 22, 2020.
(3) Modifications in Articles 1, 2, and 21 and incorporation of Article 2-A, approved by the Norms Committee of the Central Reserve Bank of El Salvador, in Session No. CN-09/2025 dated November 10, 2025, with effect from November 25, 2025.

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

GLOSSARY OF TERMS

a) Credit risk concentration: refers to the exposure that has the potential to produce large losses, sufficient to threaten the stability of an entity or its ability to maintain its main operations. The potential for loss reflects the size of the exposure and the magnitude of the loss given a particular adverse circumstance. Risk concentrations can take many forms, among others: individual counterparties, groups of individual counterparties or related parties, counterparties in specific geographic locations, economic sectors, specific products, service providers. b) Scenarios: are tests or exercises simulating situations, including extraordinary events, to evaluate the impact on credit risk exposure in the entity's active operations. c) Exposure at Default (EAD): is the total amount owed by the debtor at the moment the default occurs. The acronym used is "EAD" from the English "Exposure at Default". d) Loss Given Default (LGD) or Loss Severity: is the percentage of the exposure that the entity loses, in the event that a debtor defaults, after having carried out all efforts to recover the defaulted credits, execute the guarantees, or receive them as payment in kind. It is equal to the expression (1 – Recovery Rate). It represents the net cost of a debtor's default, that is, the unrecovered proportion of the exposure when the borrower defaults, once all costs involved in such recovery (collection costs, judicial costs, etc.) are taken into account. The acronym used is "LGD" from the English "Loss Given Default". e) Expected Loss (EL): is the value corresponding to an average loss per credit risk over a given time horizon, which can be estimated at the level of each individual credit, resulting from the probability of default (PD), the level of exposure at the moment of default (EAD), and the loss severity (LGD), formulated as follows: "EL=PDEADLGD", normally associated with the preventive reserve policy that the institution must have against its credit risks. The acronym used is "EL" from the English "Expected Losses". f) Probability of Default (PD): is the measure of how likely a debtor is to partially or totally fail to fulfill its contractual obligations. Its minimum value is zero, which would indicate that it is impossible for it to default on its obligations, and its

NPB4-49
CREDIT CONCENTRATION
Approval:
04/05/2011
Effective Date: 01/06/2011

maximum value is one when it is certain that it will default. The acronym used is "PD" from the English "Probability of Default"