Resolution Reforming Article 42 of the Credit Card Operations Regulation

Resolution No. CD-SIBOIF-962-1-OCTU4-2016 Date: October 4, 2016

NORM REFORMING ARTICLE 42 OF THE REGULATION FOR CREDIT CARD OPERATIONS

The Board of Directors of the Superintendence of Banks and Other Financial Institutions.

CONSIDERING

I

That Article 1 of Law No. 515, Law on the Promotion and Regulation of the Use of Credit Cards, published in La Gaceta, Official Journal No. 11, on January 17, 2005, establishes the Superintendence of Banks and Other Financial Institutions as the body responsible for the regulation and supervision of credit card issuers.

II

That Article 14 of the same Law No. 515, empowers the Board of Directors of the Superintendence of Banks and Other Financial Institutions to issue the necessary regulations for the correct application of this Law.

III

That in accordance with Article 9 of Law No. 793, Law Creating the Financial Analysis Unit, published in La Gaceta, Official Journal No. 117 on June 22, 2012, those supervised by the Superintendence of Banks and Other Financial Institutions are obligated subjects to this law.

IV

That Article 14 of the aforementioned Law No. 793, establishes that the bodies legally charged with supervising and regulating obligated subjects must issue regulations and manuals for the prevention of money laundering, goods and assets derived from illicit activities, and terrorist financing.

V

That through Resolution No. CD-SIBOIF-629-4-MAY26-2010, the Regulation for Credit Card Operations was approved, published in La Gaceta, Official Journal No. 150 and 151, on August 9 and 10, 2010, respectively, which in its Article 4 establishes that banks and other credit card issuing entities included within the framework of the General Banking Law are subject to the control and supervision of the Superintendence; however, other commercial entities not included in the aforementioned law are subject to the regulations established in Law No. 515 and the aforementioned Regulation.

VI

That based on the legal provisions indicated in the above considerations, it is necessary to reform Article 42 of the Regulation for Credit Card Operations, in order to establish the obligation of non-bank credit card issuers to have an Anti-Money Laundering, Terrorist Financing, and Proliferation of Weapons of Mass Destruction Prevention Program (AML/CFT/CP) in accordance with the nature, risk profile, and size of the company, as well as the complexity and volume of their products or services, among other requirements, as well as the applicable sanctions in case of non-compliance with the provisions established in said regulation, or with the instructions issued by the Superintendent within the scope of their competence.

In exercise of its powers,

RESOLVES

CD-SIBOIF-962-1-OCTU4-2016

To issue the following regulation:

NORM REFORMING ARTICLE 42 OF THE REGULATION FOR CREDIT CARD OPERATIONS

FIRST: Article 42 of the Regulation for Credit Card Operations, contained in Resolution No. CD-SIBOIF-629-4-MAY26-2010, published in La Gaceta, Official Journal No. 150 and 151, on August 9 and 10, 2010, respectively, is hereby reformed, which shall read as follows:

“Article 42. Registration and Sanctions.- The registration and sanctions applicable to non-bank credit card issuers shall be governed by the following provisions:

a) Registration: The Registry of Non-Bank Issuers of the Superintendence is created, in which all issuing companies, other than banks or non-bank financial institutions, wishing to issue credit cards must register. To register in the Registry, they must submit an application to the Superintendent and attach the following:

1. Registered deed of incorporation;
2. Power of attorney of the legal representative of the company;
3. Contact data of the company, such as physical address, telephone numbers, email, website, among others;
4. Models of credit card issuance contracts;
5. Policies for the granting of credit cards;
6. Policies for the attention of credit card users; and
7. Any other requirement determined by the Superintendent related to their credit card operations.

Non-bank issuers must have a technological platform for risk management and an Anti-Money Laundering, Terrorist Financing, and Proliferation of Weapons of Mass Destruction Prevention Program (AML/CFT/CP Program), in accordance with the nature, risk profile, and size of the company, as well as the complexity and volume of their products or services.

The AML/CFT/CP Program must correspond, based on its own analysis, to the requirements of legislation, regulations, or guidelines issued by the Superintendence and other competent national authorities, or to the standards and guidelines of the FATF or measures against terrorism and the proliferation of weapons of mass destruction, emanating from the United Nations.

The AML/CFT/CP Program must be approved by the board of directors or equivalent body, and must include, at least, policies, procedures, and internal controls for due diligence for customer knowledge (CDD), personnel selection, training, and code of conduct; tools for the detection, monitoring, and reporting of unusual operations and lists from the United Nations Security Council on terrorists and/or terrorist financiers and/or financiers of the proliferation of weapons of mass destruction; person(s) responsible for the management of AML/CFT/CP risks and the independent evaluation of their Program. This evaluation must be carried out in accordance with the guidelines issued by the Superintendent.

The Superintendence will have a period of two months from the submission of the application with all required documentation to analyze the documentation and proceed with the registration. In case it is found to be in compliance with the provisions of Law No. 515 and this Regulation, it will proceed to register the issuer; if deficiencies are found, they will be communicated to the interested parties so that they may remedy them within the specified period.

All issuing companies, other than banks or non-bank financial entities, that are not registered with the Superintendence as of the date of this resolution must do so within a period of two months counted from the entry into force of this Regulation. Otherwise, they will not be able to carry out the operations referred to in Law No. 515.

Issuers may request the cancellation of their registration at any time. In this case, they will not be able to carry out the operations referred to in Law No. 515.

Any significant change in the information presented by an issuing company must be reported to the Superintendence within five business days following its occurrence.

b) Sanctions: Non-compliance by non-bank issuers with the provisions established in this regulation and with the instructions issued by the Superintendent within the scope of their competence, shall be sanctioned as follows:

1. Reprimand; or
2. Cancellation of registration. After the period of one (1) year counted from the date on which the resolution of cancellation of registration became final, the non-bank issuer may request re-registration in the registry. To this effect, in addition to meeting the requirements required for an initial application, it must demonstrate that it remedied the circumstances that motivated its cancellation.

c) For the application of the aforementioned sanctions, the Superintendent will take into consideration the following criteria:

1. The gravity and/or recurrence of the infringement;
2. The antecedents of the non-bank issuer in compliance with the provisions established in this regulation and the instructions of the Superintendent; and
3. The benefit or profit that the non-bank issuer has obtained from the infringement.”

SECOND: Non-bank issuers will have a period of up to three (3) months, counted from the entry into force of this regulation, to comply with the AML/CFT/CP requirements established in Article 42 of this regulation, and must submit upon the expiration of said period, a report describing the policies, procedures, controls, and tools implemented to comply with the provisions of said article.

THIRD: This regulation will enter into force upon its notification, without prejudice to its subsequent publication in La Gaceta, Official Journal. (s) S. Rosales (s) V. Urcuyo (s) Gabriel Pasos Lacayo (s) Fausto Reyes (s) illegible (Silvio Moisés Casco Marenco) (s) illegible (Freddy José Blandón Argeñal) (s) U. Cerna.

URIEL CERNA BARQUERO Secretary of the Board of Directors SIBOIF