Recopilación de Normas de Seguros y Reaseguros - Regulatory Modifications on Simplified Due Diligence (LAFTPADM)

1 Montevideo, June 12, 2025 Ref: INSURANCE AND REINSURANCE NORMS COMPILATION - Regulatory Modifications on Simplified Due Diligence (LAFTPADM)

The market is informed that the Superintendency of Financial Services adopted Resolution SSF No. 2025-213 on May 15, 2025.

CRISITINA RIVERO Financial Supervision Superintendent

2025-50-1-00457 Diagonal Fabini 777 - C.P. 11100 - Tel.: (598 2) 1967 - Montevideo, Uruguay - www.bcu.gub.uy CIRCULAR No. 2481

SUPERINTENDENCY OF FINANCIAL SERVICES – RESOLUTION SUPERINTENDENCY OF FINANCIAL SERVICES

VIEWING: The regulation regarding customer due diligence procedures that insurance companies must implement as part of the system to prevent being used for money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction (LAFTPADM), contained in Book III of the Insurance and Reinsurance Norms Compilation (RNSR).

RESULTING: I) That, following a proposal from the Uruguayan Association of Insurance Companies (AUDEA), within the framework of the tasks defined in the 2024 Regulations Plan, a project was developed that introduces modifications to simplified customer due diligence procedures. II) That the regulatory proposal comprises the unification of Articles 83.1 and 83.2 of the RNSR and the increase of the limits set to enable the use of simplified due diligence procedures in cases where contracts do not allow for early surrenders or partial withdrawals before three years have elapsed from the start of their validity. III) That, likewise, the proposal incorporates into Article 73 of the RNSR the obligation that, at the time of effecting the payment of an indemnity to the beneficiary designated in the contract, their identity and link to the insured or policyholder must be verified. IV) That, finally, the regime of Book III of the RNSR is adapted to what is established in Article 12 of Law No. 19.574 of December 20, 2017, contemplated in Communication No. 2020/167, which states that the requirements regarding LAFTPADM contained in said Book will only apply when insurance companies participate in activities related to the underwriting and placement of life insurance and other insurance related to investment. V) That the regulatory proposal containing the aforementioned modifications was submitted for consultation to supervised institutions and the general public on December 19, 2024. VI) That comments were received from AUDEA and the State Insurance Bank, who expressed that the proposed regulation generates greater requirements than the previous regulation by detailing the information and documentation that companies must collect in certain cases, which does not enable agile, simple, and accessible underwriting for the client.

CONSIDERING: I) That it is understood to be appropriate to adjust simplified customer due diligence procedures in order to contemplate low-risk operations for LAFTPADM developed by insurance companies. RR-SSF-2025-213 Date: 05/15/2025 16:59:03 CIRCULAR No. 2481

II) That the comments received provided elements that allowed improving the original proposal, corroborating the value that the public consultation process has for the regulator. III) That, considering the aforementioned comments, it was decided to continue with the current criterion that establishes that for mandatory insurance, mass-market insurance sold via telephone or digital media, and collective insurance, the information and documentation to be collected is that which companies deem appropriate from a commercial point of view.

ATTENTIVE: To what is provided in literal A) of Article 38 of Law No. 16.696 of March 30, 1995, as amended by Article 2 of Law No. 20.345 of September 19, 2024, Article 12 of Law No. 19.574 of December 20, 2017, and to the reports issued by this Superintendency of Financial Services.

IT IS RESOLVED:

1. SUBSTITUTE in Chapter I – Integral System for the Prevention of Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of Title I – Prevention of the Use of Insurance, Reinsurance, and Mutual Insurance Companies for Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of Book III – Protection of the Financial System against Illicit Activities, Article 67 with the following:

ARTICLE 67 (INTEGRAL SYSTEM FOR THE PREVENTION OF MONEY LAUNDERING, TERRORIST FINANCING, AND FINANCING OF THE PROLIFERATION OF WEAPONS OF MASS DESTRUCTION).

Companies that participate in activities related to the underwriting and placement of life insurance and other insurance related to investment must implement an integral system to prevent being used in money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction in accordance with the provisions of the following articles.

The application thereof must extend to the entire organization, including its branches and subsidiaries, in the country and abroad. In such cases, companies must verify that their branches or subsidiaries abroad adequately apply all prevention and control measures provided for by said integral system. When the minimum requirements regarding money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction of the country of headquarters of the branch or subsidiary are less strict than those of our country, companies must ensure that these implement the requirements of our country, to the extent permitted by the regulations of the country of headquarters. If said country does not allow its implementation, companies must apply appropriate additional measures to manage money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction risks and inform the Financial Information and Analysis Unit.

The management of companies must show total commitment to the functioning of the preventive system, establishing appropriate policies and procedures and ensuring their effectiveness.

RR-SSF-2025-213 Date: 05/15/2025 16:59:03 CIRCULAR No. 2481

2. SUBSTITUTE in Chapter II – Policies and Procedures for Due Diligence Regarding Clients, of Title I – Prevention of the Use of Insurance, Reinsurance, and Mutual Insurance Companies for Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of Book III – Protection of the Financial System against Illicit Activities, Articles 72, 73, and 77 with the following:

ARTICLE 72 (DUE DILIGENCE POLICIES AND PROCEDURES).

Companies must define due diligence policies and procedures that must be applied to all new clients and likewise to existing clients, understood as the insured, policyholders, and beneficiaries of a life insurance policy and other insurance related to investment, which allow them to obtain adequate knowledge of them as well as of the beneficial owner, paying special attention to the volume and nature of the business or other economic activities that clients develop.

Such policies and procedures must also be applied to reinsurance companies with which they establish business relationships.

Companies will not establish business relationships nor execute operations when they cannot apply the aforementioned due diligence procedures. When this possibility is appreciated during the course of the business relationship, companies will terminate it, proceeding to consider the appropriateness of filing a suspicious transaction report with the Financial Information and Analysis Unit in accordance with the regulations on the matter.

The policies and procedures defined by the company must contain, at minimum: a) Reasonable measures to obtain, verify, register, update, and conserve information about the true identity of the client, as well as the beneficial owner. b) Procedures to obtain, verify, register, update, and conserve information regarding the economic activity developed by the client, which allow adequately justifying the source of the funds managed. c) Clear client acceptance rules, defined based on risk factors such as: country of origin, level of political exposure, type of business or activity, related persons, type of product required, volume of operations, etc., which contemplate special analysis mechanisms and more rigorous approval requirements for higher-risk client categories. d) Transaction monitoring systems that allow detecting unusual or suspicious patterns in client behavior.

The policies and procedures to be applied must consider the client's risk level and those special situations requiring intensified due diligence.

Likewise, the policies and procedures may provide that, in exceptional cases, companies do not complete due diligence when they notice that doing so would alert the client, reporting such situation to the Financial Information and Analysis Unit immediately.

RR-SSF-2025-213 Date: 05/15/2025 16:59:03 CIRCULAR No. 2481

ARTICLE 73 (IDENTIFICATION AND VERIFICATION OF CLIENT IDENTITY).

Companies may not process transactions without the proper identification of their clients, must collect information to establish and register their identity by effective means, as well as the purpose and nature of the business relationship.

A definitive relationship must not be established until the client's identity has been satisfactorily verified, for which they must consider the result of the risk assessment performed.

Such verification may be carried out after the commercial relationship has begun if it is necessary to not interrupt the normal course of activity.

To this end, companies will have a maximum period of 60 (sixty) days counted from the start of the link, during which they must carry out more intense monitoring of the client's transactions.

Likewise, companies may not effect the payment of an indemnity to the beneficiary designated in the insurance contract without first verifying their identity and link to the insured or policyholder.

When the beneficiary designated in the contract is a legal entity, the identity of the beneficial owner thereof must be identified and verified.

ARTICLE 77 (INTENSIFIED DUE DILIGENCE PROCEDURES).

Companies must apply intensified due diligence procedures for client categories, commercial relationships, or operations considered higher risk, according to what arises from the risk assessment performed by the institution.

Notwithstanding, the following will be considered higher risk: a) Commercial relationships and operations with non-resident clients from countries that do not comply with international standards regarding money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction. b) Transactions by persons who link with the entity through operations where personal contact is not usual, such as in the case of clients who perform operations through operational modalities that, using new or developing technologies, could favor client anonymity. c) Politically exposed persons, as well as their family members and close associates. d) All those operations that are carried out under unusual circumstances according to the usages and customs of the respective activity. e) Clients who have contracted life insurance with an annual premium greater than USD 10,000 (ten thousand US dollars) or its equivalent in other currencies, and single-premium life insurance greater than USD 200,000 (two hundred thousand US dollars) or its equivalent in other currencies.

In application of intensified due diligence procedures, companies must: i. obtain approval from the main hierarchical levels of the institution when establishing or continuing a relationship with this type of client. ii. prepare a detailed report in which the activity profile assigned to adequately monitor client transactions will be included, and all elements considered to determine said profile will be explicit. The report must be adequately backed by documentation that allows establishing the patrimonial, economic, and financial situation or justifying the origin of the funds managed by the client. To this effect, accounting statements with a Public Accountant's report, tax returns, liability statements, profit distribution minutes, sales contracts, or other documentation that allows complying with the aforementioned must be available. Notwithstanding, in all cases, copies of sworn declarations or equivalent documentation presented to the corresponding tax administration must be available, in the case of clients who have contracted life insurance under the terms of literal e). In the case of persons included in literal c) whose annual transactions, according to their activity profile, reach amounts less than USD 120,000 (one hundred twenty thousand US dollars) or its equivalent in other currencies, or perform transactions up to said amount during a calendar year, only the documentation that allows establishing the patrimonial, economic, and financial situation or justifying the origin of the funds managed by the client will be required. To determine said threshold, the accumulated volume of transactions will be considered. iii. increase the frequency of updating client information. iv. perform more intense monitoring of the commercial relationship, increasing the quantity and frequency of controls applied.

3. SUBSTITUTE in Chapter II BIS – Simplified Due Diligence Procedures, of Title I – Prevention of the Use of Insurance, Reinsurance, and Mutual Insurance Companies for Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of Book III – Protection of the Financial System against Illicit Activities, Article 83.1 with the following:

ARTICLE 83.1 (SIMPLIFIED DUE DILIGENCE PROCEDURES)

Companies may apply simplified due diligence procedures when the conditions established below are met:

i. When the accumulated value of premiums for insurance from the same client, considered annually, does not exceed USD 2,500 (two thousand five hundred US dollars) or its equivalent in other currencies. This limit will be increased to USD 5,000 (five thousand US dollars) when contracts do not allow for early surrenders or partial withdrawals before 3 years have elapsed from the start of their validity. ii. When it concerns insurance whose policyholders are institutions supervised by the Central Bank of Uruguay. iii. When it concerns insurance whose policyholders are state agencies. iv. When it concerns clients who contract – exclusively – the following insurance: a) mandatory insurance b) mass-market insurance sold via telephone or digital media, provided that the accumulated value of premiums for the same client, considered annually, does not exceed USD 200 (two hundred US dollars) or its equivalent in other currencies. This limit will be increased to USD 1,000 (one thousand US dollars) or its equivalent in other currencies, when contracts do not allow for early surrenders or partial withdrawals before 3 years have elapsed from the start of their validity. c) collective insurance, provided that the accumulated value of premiums per person, considered annually, does not exceed USD 200 (two hundred US dollars) or its equivalent in other currencies. This limit will be increased to USD 1,000 (one thousand US dollars) or its equivalent in other currencies, when contracts do not allow for early surrenders or partial withdrawals before 3 years have elapsed from the start of their validity.

The referred procedures that will be applied regarding policyholders, insured, and beneficiaries of the policy will be limited to:

1. Collect the information and documentation indicated below:

• Natural Persons a) full name; b) copy of identity document or proof of its consultation or verification by an official information source; c) address and phone number.
• Legal Entities a) name; b) address and phone number; c) registration number in the Single Tax Registry or in the corresponding tax agency; d) identification of the natural person performing the operation, accrediting their status as representative, according to what is detailed above. In the case of the insurance detailed in numeral iv., companies will collect the information and documentation that, in their judgment, is required from a commercial point of view.

2. Determine whether a client is a politically exposed person.

RR-SSF-2025-213 Date: 05/15/2025 16:59:03 CIRCULAR No. 2481

3. Verify that they do not appear on the lists of individuals or entities associated, prepared in compliance with Resolutions of the Security Council of the United Nations, to prevent money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction.

4. Monitor that the insurance operates within the conditions defined in literals i. to iv. When the referred conditions are modified, institutions must apply the additional due diligence procedures that correspond.

5. Conserve the information in the terms of Article 76.

6. REPEAL in Chapter II BIS – Simplified Due Diligence Procedures, of Title I – Prevention of the Use of Insurance, Reinsurance, and Mutual Insurance Companies for Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction, of Book III – Protection of the Financial System against Illicit Activities, Article 83.2.

7. COMMUNICATE the resolution via Circular.

JUAN PEDRO CANTERA Superintendent of Financial Services

RR-SSF-2025-213 Date: 05/15/2025 16:59:03 Exp. 2025-50-1-00457

Publishable: Yes - Signatory: JUAN PEDRO CANTERA SENCIÓN CIRCULAR No. 2481