Resolution SBS No. 02648-2024: Standard for the Prevention of Money Laundering and Terrorist Financing Applicable to Virtual Asset Service Providers (VASPs) Under the Supervision of the UIF-Peru

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 [Chapter VIII regarding the Travel Rule enters into force on January 1, 2029] Lima, July 30, 2024 Resolution S.B.S.
No. 02648-2024

The Superintendent of Banks, Insurance, and Private Pension Fund Administrators

CONSIDERING:

That, by Supreme Decree No. 006-2023-JUS, Virtual Asset Service Providers (VASPs) were incorporated as obligated subjects to report to the UIF-Peru. These include any natural or legal person, domiciled or incorporated in the country, not covered under any other Recommendation of the Financial Action Task Force (FATF), which as a business carries out one or more of the following activities or operations for or on behalf of another natural or legal person: i) exchange between virtual assets and fiat or legal tender currencies; ii) exchange between one or more forms of virtual assets; iii) transfer of virtual assets; iv) custody and/or administration of virtual assets or instruments that allow control over virtual assets; and, v) participation and provision of financial services related to the offer of an issuer and/or sale of a virtual asset;

That, Article 3 of Law No. 27693, Law creating the Financial Intelligence Unit – Peru (UIF-Peru), provides that it is the function and authority of the Superintendent of Banks, Insurance, and Private Pension Fund Administrators (hereinafter, the Superintendent), through the UIF-Peru, to regulate, in coordination with the supervisory bodies of the obligated subjects, the general and specific guidelines, requirements, clarifications, sanctions, and other aspects related to the prevention systems of obligated subjects to report and of reports of suspicious operations and operation records, as well as to issue models of codes of conduct, manuals for the prevention of the crime of money laundering and terrorist financing, operation registration formats, among others, in accordance with the scope of the aforementioned law and its regulations;

That, likewise, Article 9-A, paragraph 9-A.8 of Law No. 27693, regarding those obligated subjects to report that lack a supervisory body, the Superintendent, through the UIF-Peru, shall act as such, in matters of prevention of money laundering and terrorist financing;

That, in this context, it is necessary to approve the standard for the prevention of money laundering and terrorist financing applicable to Virtual Asset Service Providers (VASPs), in their capacity as obligated subjects under the supervision of the UIF-Peru;

That, on the other hand, it is necessary to modify the Standard for the prevention of money laundering and terrorist financing applicable to obligated subjects under the supervision of the UIF-Peru, approved by SBS Resolution No. 789-2018, in order to clarify a requirement of the annual report of the compliance officer established in Article 26 of said standard;

That, by SBS Resolution No. 01754-2024, the Standard for the prevention of money laundering and terrorist financing applicable to notaries nationwide and to the Centralized Body for the Prevention of Money Laundering and Terrorist Financing – OCP LA/FT was approved, making it necessary to clarify some aspects related to the origin of funds required for due diligence regimes in customer knowledge and anti-money laundering/counter-terrorist financing (AML/CFT) lists for the purposes of employee knowledge and training;

That, it is necessary to modify the Standard regulating the procedure for handling requests to lift bank secrecy approved by SBS Resolution No. 1132-2015, in order to clarify that requests made by the Comptroller General of the Republic must be directed to the responsible officials designated by the companies, for which the obligation is established that the designation must be communicated to the Superintendent, the Judiciary, and the Comptroller General of the Republic, in order to safeguard the confidentiality of the identity of the compliance officer;

That, on the other hand, it is necessary to modify Article 2 of the Regulation of Infractions and Sanctions in the matter of Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution No. 8930-2012, in order to clarify the obligated subjects under its scope, among which is the Centralized Body for the Prevention of Money Laundering and Terrorist Financing – OCP LA/FT, under the Lima College of Notaries, from whom it depends economically and administratively, as well as to incorporate Annexes No. 2 and No. 3, which establish the infractions applicable to Notaries nationwide and to the Centralized Body for the Prevention of Money Laundering and Terrorist Financing – OCP LA/FT, respectively, in their capacity as obligated subjects;

That, in accordance with the functional autonomy conferred by Article 346 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendence of Banks and Insurance - Law No. 26702 and its amendments, and Article 44 of the Single Text of General Administrative Procedures approved by Supreme Decree No. 004-2019-JUS and its amendments, the Superintendent is authorized to approve modifications to the Institutional Single Text of Administrative Procedures – TUPA, and in this sense, it is necessary to modify procedures No. 142 and 213 of the TUPA in order to adapt them to the regulatory framework approved in the first article of this Resolution;

That, in order to collect opinions from the general public, the draft resolution on the matter was pre-published on the electronic portal of the Superintendent, based on the exceptional conditions established in Article 14 of Supreme Decree No. 001-2009-JUS and its modifying norms;

Having the approval of the UIF-Peru and the Adjunct Superintendent of Legal Advice;

And, in exercise of the powers conferred by Law No. 29038 and Law No. 26702, in concordance with Law No. 27693 and its modifying and regulatory norms;

RESOLVES:

Article First.- Approve the Standard for the prevention of money laundering and terrorist financing applicable to Virtual Asset Service Providers (VASPs), under the supervision of the UIF-Peru, with the following text:

STANDARD FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING APPLICABLE TO VIRTUAL ASSET SERVICE PROVIDERS (VASPs) UNDER THE SUPERVISION OF THE UIF-PERU

CHAPTER I
GENERAL PROVISIONS

Article 1.- Scope of Application
This standard is applicable nationwide to virtual asset service providers (VASPs), domiciled or incorporated in the country, in their capacity as obligated subjects under the supervision of the UIF-Peru, in matters of prevention of money laundering and terrorist financing.

Article 2.- Scope
2.1. VASPs include any natural person with a business or legal person, domiciled or incorporated in the country, that is not covered under any other FATF Recommendation and that, as a business, carries out one or more of the following activities or operations for or on behalf of another natural or legal person:
i. Exchange between virtual assets and fiat or legal tender currencies;
ii. Exchange between one or more forms of virtual assets;
iii. Transfer of virtual assets;
iv. Custody and/or administration of virtual assets or instruments that allow control over virtual assets; and
v. Participation and provision of financial services related to the offer of an issuer and/or sale of a virtual asset.
It includes branches established and registered (domiciled) in Peru of legal persons incorporated and domiciled abroad.
This standard regulates VASPs covered by FATF Recommendation 15. It does not regulate the technology underlying virtual assets or the activities or operations of VASPs.

2.2. In the event that a VASP registered with the UIF as an obligated subject loses this status: i) because it ceases to exercise the activity or ii) due to a regulatory modification, it must communicate this via a request with the character of a sworn declaration to the UIF-Peru, through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS, attaching the information and documentation supporting the request, within a period not exceeding thirty (30) days from the occurrence of the event.
Within fifteen (15) days following the receipt of said request, the UIF-Peru verifies the loss of said status, proceeding to communicate to the requesting VASP that it has effected the cancellation of the secret codes assigned to the VASP and the compliance officer; requiring the delivery of the information subject to conservation referred to in Article 35 of this standard, within a period not exceeding thirty (30) days from the receipt of the communication.

Article 3.- Definitions and Abbreviations
For the application of this standard, the VASP considers the following definitions and abbreviations:

Virtual Assets (VA): Digital representations of value that can be traded or transferred digitally and can be used for payments or investments. They do not include digital representations of fiat currency or securities issued by the Central Bank or the competent authority of the jurisdiction. Likewise, they do not include other securities and other financial assets that are already covered in other parts of the FATF Recommendations.
Beneficial Owner: Natural person included within the scope of Article 3, paragraph 3.1, letter a) of Legislative Decree No. 1372, Legislative Decree that regulates the obligation of legal persons and/or legal entities to report the identification of Beneficial Owners, and its amendments.
Virtual Asset Wallet: Software that allows VASPs to store and manage their clients' virtual assets, directly managing the associated keys. It will be referred to in the regulation as "virtual asset wallet".
Self-Custodied Virtual Asset Wallet: Hardware or software that allows users to store and manage their virtual assets without depending on an intermediary, directly managing the keys associated with their virtual assets.
Client: Any natural or legal person, national or foreign, legal entity or branch established or registered in Peru that carries out with the VASP any of the operations described in Article 2 of this standard.
Code: Code of conduct for the prevention of ML/TF.
Custody and/or Administration: Custody is the service provided by the VASP, consisting of maintaining a VA or its private keys for or on behalf of its client. The term administration refers to any act of VA management for or on behalf of the client, which implies among other cases its conservation, buying and selling, investment, or other management acts, including disposal acts.
Days: Calendar days.
Identity Document: National Identity Document for Peruvians, and the foreigner's ID card, passport, or legally established document for the identification of foreigners, as applicable.
Originator: The natural person who requests or physically carries out the operation.
Orderer: The natural or legal person on whose behalf the operation is carried out.
Beneficiary: The natural or legal person or legal entity in whose favor the operation is carried out.
Legal Entities: They are i) autonomous patrimonies managed by third parties that lack legal personality or ii) contracts in which two or more persons, who associate temporarily, have a common right or interest to carry out a specific activity, without constituting a legal person. Investment funds, mutual investment funds in securities, fiduciary patrimonies, and consortia, among others, are considered in this category.
Terrorist Financing: Crime typified in Article 4-A of Law Decree No. 25475, Law Decree that establishes the penalty for the crimes of terrorism and the procedures for investigation, instruction, and trial, and its modifying norms; as well as in Article 297, last paragraph, of the Penal Code and its amendments.
FP: Financing of the Proliferation of Weapons of Mass Destruction.
FATF: Financial Action Task Force.
Economic Group: Set of two or more legal persons, national or foreign, in which one of them exercises control over the others, or when control over the legal persons corresponds to one or more natural persons acting as a decision-making unit.
ML/TF: Money Laundering and Terrorist Financing.
Money Laundering: Crime typified in Legislative Decree No. 1106, Legislative Decree for Effective Fight against Money Laundering and other Crimes Related to Illegal Mining and Organized Crime, and its modifying norms.
Law: Law No. 27693, Law creating the Financial Intelligence Unit of Peru, UIF-Peru, and its modifying and complementary norms.
Manual: Manual for the prevention and management of ML/TF and FP risks.
Fiat or Legal Tender Currency: Monetary unit of a country comprising banknotes and coins; as well as its digital representation, if applicable, that fulfill the functions of medium of exchange, store of value, and unit of account and that are of mandatory acceptance in any monetary transaction, in accordance with the law. This definition includes any modality of Central Bank digital money, if applicable.
Standard: Standard for the prevention of money laundering and terrorist financing applicable to VASPs, in their capacity as obligated subjects under the supervision of the UIF-Peru in matters of prevention of money laundering and terrorist financing.
Unusual Operations: Operations carried out or attempted to be carried out, whose amount, characteristics, and periodicity do not relate to the client's economic activity, fall outside the parameters of normality current in the market, or lack an evident legal basis.
Without prejudice to the nature and complexity of the operation, information or additional criteria such as the economic activity of suppliers and counterparties, geographical zones or countries at risk of ML/TF, sources of financing, among others, may be considered.
Suspicious Operations: Operations carried out or attempted to be carried out, whose amount or characteristics do not relate to the client's economic activity, or that lack economic basis, or that by their number, amounts transacted, or particular characteristics of these, could reasonably lead to suspect that the VASP is being used to transfer, handle, exploit, or invest resources originating from criminal activities or destined for their financing.
Supervisory Body: The UIF-Peru.
Politically Exposed Persons (PEPs): Natural persons, national or foreign, who hold or have held prominent public functions or prominent functions in an international organization in the last five (5) years, either in national or foreign territory, and whose financial circumstances may be subject to public interest. Likewise, the direct collaborator of the highest authority of the institution is considered a PEP.
Operation Record (OR): Record that the VASP must keep, conserve, and communicate to the UIF-Peru, in which precise and complete information is recorded, both of the operation and of the client and/or participants in each operation carried out, in accordance with what is established in the second paragraph of paragraph 26.2 of Article 26 of this standard.
UIF Law Regulation: Regulation of the Law creating the UIF-Peru, approved by Supreme Decree No. 020-2017-JUS and its amendments.
Travel Rule: Obligation of the VASP to obtain, conserve, and transmit specific information of the originator and beneficiary for VA transfers, in an immediate and secure manner. It applies when VASPs send or receive VA transfers for or on behalf of a client. The term "immediate and secure" means that the information must be sent before, simultaneously, or along with the transfer and that the integrity and availability of the information transmitted and stored by VASPs must be protected.
ML/TF and FP Risks: Possibility that the VASP is used for ML, TF, and FP purposes.
ROSSEL: Online Suspicious Operations Report System. Technological tool developed by the SBS that allows obligated subjects to submit to the UIF-Peru the report of suspicious operations (ROS) by electronic means, under standards that ensure that the information is transmitted with an adequate level of security.
SBS: Superintendence of Banks, Insurance, and Private Pension Fund Administrators.
Alert Signals: Situations or operations that escape normality and constitute a tool for the VASP, through the compliance officer, to identify unusual or suspicious operations.
SPLAFT: System for the prevention of money laundering and terrorist financing.
Worker: Natural person who maintains a labor or contractual link with the VASP; includes the general manager, managers, administrators, or those who hold similar positions; the compliance officer, the alternate compliance officer, the corporate compliance officer, and the corporate coordinator, when applicable.
UIF-Peru: Financial Intelligence Unit of Peru, a specialized unit of the SBS.

CHAPTER II
ON THE IMPLEMENTATION OF THE ML/TF PREVENTION SYSTEM

Article 4.- System for the prevention of money laundering and terrorist financing

4.1. The VASP, in its capacity as an obligated subject, must implement a SPLAFT through the management of ML/TF and FP risks to which it is exposed, in accordance with what is provided by the Law, its Regulation, this standard, and other provisions on the matter.

4.2. The SPLAFT is composed of the policies and procedures established by the VASP, in accordance with the Law, its Regulation, this standard, and other provisions on the matter, considering for this purpose the measures established by the VASP itself, in consideration of ML/TF and FP risk factors, as well as by the procedures and controls linked to the timely detection and reporting of suspicious operations, in order to prevent that as an obligated subject to report or the products or services it provides are used for purposes linked to ML/TF and FP; guaranteeing the duty of indefinite confidentiality of information related to said system.

4.3. VASPs must implement and apply a general SPLAFT, in accordance with what is provided in paragraphs 13.1 and 13.2 of Article 13 of the UIF Law Regulation.
Without prejudice to what is provided by paragraph 13.2 cited above, the SPLAFT is not applicable to workers who perform tasks not directly linked to the activity or activities that determine their status as an obligated subject (cleaning, security, gardening, messenger services, or similar).

4.4. The general SPLAFT to be implemented by the VASP comprises at least the following aspects:

Approve policies and procedures for the management of ML/TF and FP risks.
Designate a compliance officer in accordance with the characteristics, responsibilities, and attributions established by current regulations and communicate it to the UIF-Peru.
Approve due diligence policies for the knowledge of clients, beneficial owners, directors, workers, and suppliers, if applicable.
Train in matters of ML/TF and FP prevention, as provided in this standard.
Approve, implement, apply, update, and conserve the manual and the code.
Conduct internal and external audits of the SPLAFT, as applicable.
Have, keep updated, conserve, and remit the operation record.
Approve procedures to prevent and detect unusual operations, as well as have a record of said operations.
Approve procedures to prevent, detect, and communicate to the UIF-Peru within the established timeframe, suspicious operations that are presumably linked to ML/TF, through a ROS.
Prepare and remit to the UIF-Peru the annual report of the compliance officer (IAOC) on the situation of the SPLAFT of the previous calendar year and its compliance; as well as any other report that the SBS determines.
Register and conserve the SPLAFT information that corresponds, as provided in this standard.
Implement mechanisms for handling information requests made by the UIF-Peru and competent authorities.
Others that are specifically determined in this standard.

4.5. In the event that the VASP develops more than one of the activities indicated in Article 3 of Law No. 29038 and other pertinent norms, it must implement a single SPLAFT, without prejudice to the fact that for each activity it must comply with the corresponding requirements.

4.6. Taking into account, among other aspects, the level of ML/TF and FP risk faced by the VASP, the size of the organization, complexity, and volume of its operations, the UIF-Peru may exempt it from compliance with some of the aspects or requirements indicated in this standard. This exemption may be revoked by the UIF-Peru, by official communication to the VASP, when any of these conditions vary or do not contribute to the prevention of ML/TF.

Article 5.- Compliance Officer

5.1. The compliance officer is the natural person designated by the VASP, responsible for monitoring the adequate implementation and functioning of the VASP's SPLAFT. It is the contact person between the VASP and the supervisory body and an agent on which it relies for the exercise of the control and supervision labor of the SPLAFT.

5.2. The person designated as compliance officer can only be so for one obligated subject at a time, unless it is a corporate compliance officer.

5.3. The compliance officer can perform its functions and responsibilities on a non-exclusive basis, without this implying ceasing to monitor the adequate implementation and functioning of the SPLAFT in the VASP.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

5.4. A VASP that is a natural person with a business may be its own compliance officer.

5.5. A VASP that is a legal entity may appoint a compliance officer at a managerial rank, distinct from the General Manager. The VASP may appoint the General Manager, or their proxy, as a non-exclusive compliance officer, provided they meet the following concurrent characteristics:

a) Have the category of MEPECO (Medium and Small Taxpayers) before the National Superintendence of Customs and Tax Administration; b) Have a maximum of ten workers; c) Not belong to an economic group; and, d) Not develop more than one of the activities provided for in Article 3 of Law No. 29038 and its modifying norms.

In the event that the VASP loses one or more of the aforementioned characteristics, the General Manager, or their proxy, who serves as the compliance officer, may no longer act as such, and they or the VASP must communicate this to UIF-Peru, under a sworn declaration, within a maximum period of five (5) business days from the occurrence of the fact, through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS. In this case, the VASP must appoint a new compliance officer.

5.6. If UIF-Peru determines that the management of the non-exclusive compliance officer does not allow for adequate management of the ML/TF and FP risks faced by the VASP, it may establish the need for the VASP to have an exclusive compliance officer.

Article 6.- Requirements of the compliance officer

6.1. The compliance officer must meet the following requirements:

a) Have experience in the activities inherent to the VASP, or experience in matters of combating ML/TF or experience as a compliance officer or as a worker in the area under the charge of a compliance officer. b) Not have been convicted of the commission of an intentional crime. c) Not have been dismissed from public office or dismissed from it for a serious offense. d) Not have overdue debts for more than one hundred twenty (120) days in the financial system or in judicial collection, nor protests of documents in the last five (5) years, not clarified to the satisfaction of the SBS. e) Not have been declared bankrupt. f) Not be or have been the internal auditor of the VASP, if applicable, during the six (6) months prior to their appointment. g) Not be subject to any other impediment indicated in Article 365 of Law No. 26702, excepting paragraph 2 of the aforementioned article. h) Have a direct labor or contractual link with the VASP and enjoy autonomy and independence in the exercise of their responsibilities and functions.

The established requirements may be accredited with a sworn declaration.

6.2. The compliance officer who ceases to meet any of the requirements provided for in paragraph 6.1 of this article may no longer act as such and must communicate this to the VASP in writing, under a sworn declaration, within a maximum period of five (5) business days from the occurrence of the fact.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

When the VASP becomes aware of the non-compliance with any of the requirements provided for in this article, even if the compliance officer has not communicated it to them, they must remove them from their position and inform UIF-Peru of this action, substantiating the reasons justifying such measure, within a maximum period of five (5) business days from when they become aware of the non-compliance, through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS. In this case, the VASP must appoint a new compliance officer who meets the requirements established in the preceding paragraph 6.1, considering the procedure indicated in Article 7 of this standard.

Article 7.- Appointment, removal, and vacancy of the compliance officer

7.1. The appointment of the compliance officer falls to:

a) The VASP, when it is a natural person. b) The board of directors or equivalent body when it is a legal entity. When the legal entity, according to its Bylaws, is not obliged to have a board of directors, the appointment is made by the general manager, manager, managing partner, or administrator.

7.2. The VASP communicates to UIF-Peru the appointment of the compliance officer within a period not exceeding fifteen (15) business days from the occurrence of the appointment, in a confidential and reserved manner, through an online appointment request for the compliance officer, which must be presented through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS, attaching the information and documentation that supports such request, including additional or complementary information that the VASP considers pertinent for such support. After the respective verification and deeming it appropriate, UIF-Peru assigns the secret codes that will serve for the identification of the compliance officer.

7.3. The online appointment request for the compliance officer contains the following information: First and last names of the person appointed as compliance officer; type and number of identity document; nationality; domicile; address of the office where they work; contact data: telephone numbers and email address; the position held; date of entry; whether it is exclusive or not; sworn declaration on the compliance with the requirements of the compliance officer for such appointment; sworn declaration indicating the person or body that carried out the appointment of the compliance officer, according to what is provided for in paragraph 7.1, attaching a copy of the board of directors meeting minutes or equivalent body, when applicable, or the document that accredits the appointment according to the nature of the appointer; copies of the authorizations from the supervisory bodies, when applicable 1.

7.4. Any change in the compliance officer's information must be communicated by the VASP to the supervisory body, within a period not exceeding five (5) business days from the occurrence of the change.

7.5. The removal of the compliance officer by the VASP must be supported by the reasons justifying such measure and must be approved by the person or body that appointed the compliance officer. The removal, as well as the respective support, must be communicated to UIF-Peru, within a period of five (5) business days from the adoption of the decision. In the case of the removal of the corporate compliance officer, the communication must be sent to the

1 Paragraph modified by Resolution SBS No. 03622-2025, effective from October 15, 2025.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

supervisory bodies and to UIF-Peru and must be signed by the legal representatives of each of the obligated subjects that make up the economic group. In both cases, the communication and the support for the removal that must be sent to UIF-Peru is carried out through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS and, to the supervisory body, through the means determined by it. 2

7.6. The vacancy of the compliance officer position cannot last more than thirty (30) days, from the date it occurs and must be communicated to UIF-Peru, within a period of five (5) business days from its occurrence. In case of vacancy, the VASP must appoint a compliance officer in accordance with what is provided for in this article and Articles 5 and 6 of this standard.

7.7. The requirements, conditions, obligations, functions, and responsibilities of the compliance officer established in this standard are applicable to the alternate and corporate compliance officer, unless otherwise provided.

Article 8.- Alternate compliance officer

8.1. The VASP may appoint an alternate compliance officer, who performs the functions established in this standard, only in the event of temporary absence or vacancy of the primary compliance officer.

8.2. When it is required that the alternate compliance officer performs the functions established in this standard, without prejudice to complying with the provisions contemplated in Articles 5, 6, and 7, the following must be considered:

a) In the event of temporary absence or vacancy of the compliance officer, the alternate compliance officer performs their functions until the return or appointment of the new compliance officer, as applicable. b) In cases where it is required that the alternate compliance officer performs the functions established in this standard, the VASP must communicate this to UIF-Peru, through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS, within a period not less than five (5) business days prior to the absence of the compliance officer or vacancy of the position, except in cases of force majeure duly substantiated. In the communication, the period of temporary absence must be indicated, when applicable, and request UIF-Peru to activate the secret codes of the alternate compliance officer. c) The period of temporary absence of the compliance officer cannot last more than four (4) months.

Article 9.- Corporate compliance officer 3

9.1. The obligated subjects that make up the same economic group may appoint, with prior authorization from the respective supervisory bodies and UIF-Peru, when applicable, and in accordance with what is indicated in the following paragraphs and numerals, a single corporate compliance officer, who must be exclusive and meet the requirements established in this standard. In consideration of what is provided for in paragraph 4.6 of Article 4, UIF-Peru, when applicable, may exempt the economic group from having an exclusive corporate compliance officer, when the obligated subjects that

2 Paragraph modified by Resolution SBS No. 01015-2026, effective from April 09, 2026.
3 Article modified by Resolution SBS No. 01015-2026, effective from April 09, 2026.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

make up the economic group so request and substantiate, in accordance with paragraph 6 of Article 10 of this standard.

9.2. For the authorization of the corporate compliance officer position, the following must be met:

9.2.1. In the event that the economic group is composed solely of obligated subjects under the supervision of the supervisory body:

a) The obligated subjects must present a single authorization request, which must be signed by the legal representative of each of the obligated subjects that make up the economic group, attaching the information referred to in Articles 6, 7, and 10 of this standard. b) The authorization issued by the supervisory body must be supported by a report that must contain as a minimum the analysis of complexity and volume of operations, quality of the information tools used by the obligated subjects that make up the economic group, the level of ML/TF and FP risks they face, if applicable, among others that it considers pertinent. c) The authorization of the supervisory body must be sent to the obligated subjects that formulate the request for the economic group.

9.2.2. In the event that the economic group is composed of obligated subjects under the supervision of UIF-Peru and other supervisory bodies:

a) The obligated subjects must present a single authorization request to the heads of the respective supervisory bodies, which must be signed by the legal representative of each of the obligated subjects that make up the economic group, attaching the information referred to in Article 10 of this standard. b) The supervisory bodies evaluate the request regarding the obligated subjects that are under their supervision. The authorizations issued by the supervisory bodies must be supported by a technical report that must contain as a minimum the analysis of complexity and volume of operations, quality of the information tools used by the obligated subjects that make up the economic group, the level of ML/TF and FP risks they face, if applicable, among others that they consider pertinent. Each of the authorizations of the supervisory bodies must be sent to the obligated subjects that formulate the request for the economic group. c) Once the authorizations from the respective supervisory bodies are obtained, the obligated subjects that make up the economic group present an authorization request to UIF-Peru, which must be signed by the legal representative of each of the obligated subjects that make up the economic group, attaching the information referred to in Articles 6, 7, and 10 of this standard. d) UIF-Peru evaluates the request regarding the obligated subjects that are under its supervision and issues the authorization, if applicable, regarding the entire economic group. e) The pronouncement of UIF-Peru is communicated to the obligated subjects that formulate the request for the economic group and to the respective supervisory bodies.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

9.3. Additionally, in the case of an economic group authorized to have a corporate compliance officer, the obligated subjects that make it up must consider the following:

a) In the case of the appointment of a new corporate compliance officer, the obligated subjects that make up the economic group must present a document informing such appointment to each of the supervisory bodies and to UIF-Peru through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS. Whenever the status of the economic group had not changed substantially with respect to that maintained at the time of the initial authorization, they must present a sworn declaration and consider what is indicated in Articles 6 and 7 of this standard; otherwise, they must attach the support report referred to in Article 10 of this standard. b) For the incorporation of a new obligated subject to the economic group, they must present a single authorization request to the heads of the respective supervisory bodies and to UIF-Peru through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the SBS, which must be signed by the legal representatives of each of the obligated subjects that make up the economic group, in accordance with what is established in paragraphs 9.2.1 and 9.2.2, respectively, including the support report referred to in Article 10 of this standard and a copy of the board of directors meeting minutes or equivalent body, when applicable, or the document that accredits the appointment, according to the nature of the appointer.

9.4. The authorization to have a corporate compliance officer may be revoked by UIF-Peru or the supervisory body, when due to the particular characteristics of the obligated subjects that make up the economic group, the authorization to have a corporate compliance officer is not justified or when any of the conditions under which the authorization was granted are not met.

Article 10.- Authorization to have a corporate compliance officer

For the authorization, the obligated subject must present a report that supports the viability of having a corporate compliance officer, which must contain the following information and/or documentation updated to the date of presentation:

The list of obligated subjects that make up the economic group, including those that are not supervised by the supervisory body, indicating regarding each of them: RUC number, name of the legal representative, main activity, and name of the supervisory body, if applicable.
Technical report signed by the legal representative of each of the obligated subjects that make up the economic group, including those that are not supervised by the supervisory body, that supports the viability of having a corporate compliance officer, based on the ML/TF and FP risks they face. In this report, it must be substantiated that it will not jeopardize or endanger the compliance with current regulations, the correct development and application of the prevention system of each obligated subject that integrates the economic group, whether or not supervised by the supervisory body, as well as exposing what measures will be implemented so that this does not happen.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

The linkage existing between the obligated subjects that make up the economic group, whether or not supervised by the supervisory body, including the following information of each of them:

a) List of shareholders or partners, specifying the respective ownership percentages. b) Number of workers and service providers, detailing the position they hold. c) Number of suppliers and annexed establishments. d) Number of clients. e) Service and distribution channels. f) Type and number of operations carried out in the previous year and current year, including the medium and form of collection and/or payment. g) Income projection corresponding to the following year. h) Type and name of the system through which they register operations. i) Others that the obligated subject considers pertinent for the support of what is requested. 4

The list of workers that will be under the charge of the corporate compliance officer, as well as the list of corporate coordinators who work in each of the obligated subjects that are part of the economic group.
A sworn declaration signed by each of the legal representatives of the obligated subjects that make up the economic group specifying the exclusive dedication of the corporate compliance officer, who will have a managerial level in one of the legal entities comprising the economic group and will have the assistance of sufficient personnel. Regarding the exception request referred to in paragraph 9.1 of Article 9 of this standard, the obligated subjects that make up the economic group must specify the non-exclusive dedication of the corporate compliance officer in the aforementioned sworn declaration.
The exception request referred to in paragraph 9.1 of Article 9 of this standard, to have a corporate compliance officer with non-exclusive dedication, must be duly substantiated and include, in addition to the information indicated in this article, the description of the workload distribution of the person designated as corporate compliance officer with non-exclusive dedication.

Article 11.- Corporate coordinator in matters of ML/TF prevention 5

11.1 Members of an economic group that have a corporate compliance officer may appoint a corporate coordinator in each member of the economic group, which is in charge of coordinating directly with the corporate compliance officer, all matters related to the prevention of ML/TF and FP; without prejudice to the fact that the corporate compliance officer maintains the responsibility of the ML/TF Prevention System (SPLAFT) in each of the obligated subjects that are part of the economic group.

11.2 The appointment of the corporate coordinator must be made by the general manager, managing partner-manager, or administrator. It must contain as a minimum the following information: First and last names of the person designated as corporate coordinator; type and number of identity document; nationality; obligated subject of the economic group in which they exercise their function; the position they hold.

4 Paragraph modified by Resolution SBS No. 01015-2026, effective from April 09, 2026.
5 Article modified by Resolution SBS No. 01015-2026, effective from April 09, 2026.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Article 12.- Functions and responsibilities of the compliance officer

The functions and responsibilities of the compliance officer, without prejudice to its form of contracting, include, among others contemplated in the Regulations of the UIF Law, the following:

a) Be the interlocutor of the VASP before the UIF-Peru, on matters related to its function. b) Propose the VASP's strategies to prevent and manage ML/TF and FP risks. c) Monitor the adequate implementation and functioning of the AML/CFT System, including timely detection procedures and reporting of suspicious transactions. d) Implement, evaluate, and verify the application of the AML/CFT System's policies and procedures. e) Propose and adopt the necessary actions for its training, the training of workers and directors, when applicable, and of the VASP when it is a natural person, at least once a year on the prevention and detection of ML/TF and FP, which includes the adequate management of ML/TF and FP risks. f) Verify, at the beginning and during the commercial relationship with the client, the lists of persons or entities designated by the United Nations Security Council for their link to terrorism and its financing, as well as the financing of the proliferation of weapons of mass destruction, in accordance with Resolutions 1267 (1999), 1718 (2006), 1737 (2006) and 2231 (2015) and the resolutions that succeed them; in order to identify any transaction involving persons or entities designated by the UNSC, in which case it must communicate it without delay to the UIF-Peru. g) Verify, at the beginning and during the commercial relationship with the client, the lists that contribute to the prevention of ML/TF: i) OFAC List: list issued by the Office of Foreign Assets Control of the U.S. Department of the Treasury, which includes countries, persons and/or entities that collaborate with terrorism and illicit drug trafficking, ii) European Union Terrorist List, iii) List of Non-Cooperative Countries and Territories, iv) Listing of United Nations Security Council Resolutions, other than those indicated in letter f), v) Others indicated by the Superintendency. h) Inform the VASP's organizational structure about the modifications and incorporations to the list of high-risk and non-cooperative countries published by the FATF. i) Verify, with due follow-up, the immediate execution of national freezing measures on funds or assets issued by the SBS in cases linked to ML/TF crimes, in accordance with numeral 11 of article 3 of the Law. j) Verify, with due follow-up, the immediate execution of freezing measures issued by the SBS, in accordance with United Nations Security Council Resolutions on terrorism and its financing, as well as the financing of the proliferation of weapons of mass destruction. k) Evaluate transactions and, if applicable, qualify them as suspicious and communicate them to the UIF-Peru on behalf of the VASP through a STR, leaving documentary evidence of the analysis and evaluations performed. l) Keep a record of those unusual transactions that, after the respective analysis, were not determined to be suspicious, in accordance with what is provided in article 27 of this Standard. m) Communicate to the VASP, to workers and directors, if it
has such a governing body, or an equivalent body, about the changes made to the current regulations in the matter of fighting ML/TF crimes and especially the regulations relative to the AML/CFT System, leaving a record of this. n) Prepare and send to the UIF-Peru the annual report of the compliance officer (IAOC). o) Verify the adequate conservation and custody of documents related to the AML/CFT System. p) Attend to information requests requested by competent authorities.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

q) Attend to information requests formulated by the UIF-Peru, including those of periodic submission. r) Those others that are necessary or established by the SBS, to monitor the functioning and level of compliance of the AML/CFT System.

Article 13.- Confidentiality of the compliance officer's identity

13.1. The VASP must safeguard the identity of the compliance officer, in accordance with what is provided in article 10-A of the Law and article 18 of the Regulations of the UIF Law. For the proper confidentiality of its identity, the designation of the compliance officer must not be registered in the records that make up the National System of Public Registries. When the compliance officer is designated in a managerial, administrative, or directorial position, it corresponds to register in the registry entry of the legal entity, only the pertinent part regarding the designation in said position.

13.2. The UIF-Peru assigns secret codes both to the VASP and to the compliance officer, alternate compliance officer and/or corporate compliance officer, if applicable, after verifying the documentation and information presented to the UIF-Peru by the VASP. All of them must adopt the necessary measures to guarantee the confidentiality of the assigned secret codes.

13.3. The UIF-Peru notifies the VASP of the appropriateness or not of the designation of the compliance officer, alternate compliance officer and/or corporate compliance officer, if applicable. Notifications to the obligated subject, compliance officer, alternate compliance officer and corporate compliance officer, are made in accordance with what is provided in the General Administrative Procedure Law.

13.4. The assigned secret codes serve only as identification in all communications sent to the UIF-Peru, to guarantee the confidentiality of the compliance officer's identity and the confidentiality of the information sent to the UIF-Peru. In the case of a corporate compliance officer, the secret codes are assigned once the respective authorizations from the corresponding supervisory bodies have been obtained.

CHAPTER III
ON CLIENT AND BENEFICIAL OWNER KNOWLEDGE

Article 14.- Client and beneficial owner knowledge

14.1. Client knowledge implies that, regarding each transaction, the VASP must identify it at the moment of initiating commercial relations and throughout the relationship with the client, regardless of the particular characteristics of the client or the frequency with which it performs transactions. For this purpose, the VASP must develop policies and procedures with a risk-based approach, which allow compliance with this requirement, applying the stages of customer due diligence knowledge, as applicable.

14.2. The VASP must identify the beneficial owner of all services or products it supplies and take reasonable measures to verify their identity, to the extent that due diligence allows, so that it is convinced that it knows who the beneficial owner is. In the case of legal persons and legal entities, for the purpose of determining the beneficial owner, it must take into account what is established in article 4 of Legislative Decree No. 1372 and its modifying norms.

What is contemplated in this article is applicable regardless of the due diligence regime to which the client is subject.

Article 15.- Stages of due diligence in client knowledge

15.1. The due diligence process in client knowledge implies that the client is identified by the VASP.

15.2. It consists of the following stages:

15.2.1. Identification Stage.- Consists of developing and implementing procedures to obtain information that allows determining the identity of a client or beneficial owner.

15.2.2. Verification Stage.- Implies the application of verification procedures regarding the information provided by clients and, if applicable, their beneficial owner with the objective of ensuring that they have been duly identified.

15.2.3. Monitoring Stage.- Has the purpose of ensuring that the transactions performed by clients are compatible with the information declared by clients (profile). Monitoring allows reinforcing and reaffirming the knowledge the VASP has about its clients, as well as obtaining more information when there are doubts about the veracity or currency of the data provided by clients. VASPs must determine the frequency with which they perform this stage considering the ML/TF and FP risks they face, when applicable.

15.3. When the VASP is not able to comply with the due diligence measures in client knowledge, it must proceed as follows: i) not initiate commercial relations, not perform the transaction, not make the VAs available to the beneficiary and/or terminate the initiated commercial relationship; and, ii) evaluate the possibility of making a suspicious transaction report (STR) regarding the client.

15.4. In case the VASP has suspicions of ML/TF activities and considers that performing due diligence actions would alert the client, it must report the suspicious transaction to the UIF-Peru without performing said actions. These cases must be founded and documented.

Article 16.- Due diligence regimes in client knowledge

The VASP must identify its clients in each transaction, in application of the identification stage in the client due diligence process, according to the following:

16.1 General regime of due diligence in client knowledge

It applies when the client performs transactions for any amount and the payment method used or the amount withdrawn is in cash. Likewise, it applies when the client performs transactions for amounts equal to or greater than one thousand and 00/100 US dollars (US$ 1,000.00) or its equivalent in national currency or other currencies and the payment method used is any other different from cash.

In these cases, the minimum information that the VASP must obtain from the client is the following:

16.1.1 In the case of natural persons:

First and last names.
Type and number of identity document.
Nationality, in the case of foreigners.
Marital status.
First and last names of the spouse.
Address.
Occupation.
Fixed phone number or cell phone number and email address, if applicable.
Purpose of the relationship to be established with the VASP, whenever this does not derive directly from the object of the contract.
Indicate if they are or have been a PEP, specifying if applicable, the position and the name of the institution (public body or international organization). In this case, the provisions of the enhanced regime must be applied. If PEP, refer to: i) their relatives up to the second degree of consanguinity and second degree of affinity, ii) spouse or cohabitant of PEP.
Indicate if they are a relative of a PEP up to the second degree of consanguinity and second degree of affinity; spouse or cohabitant of a PEP, specifying the first and last names of the PEP.
The identity of the beneficiary of the transaction:
i. In case the transaction is performed in favor of oneself, the origin of the funds/assets involved in the transaction.
ii. In case the transaction is performed in favor of a third-party natural person:
ii.1) the first and last names of the natural person, ii.2) type and number of identity document, ii.3) representation data (if acting with power of attorney and if this is by public deed) or mandate, ii.4) indicate if they are or have been a PEP, specifying if applicable, the position and the name of the institution (public body or international organization), and ii.5) the origin of the funds/assets involved in the transaction.
iii. In case the transaction is performed in favor of a legal person or legal entity, insofar as it is applicable to the latter: iii.1) its name or trade name; iii.2) RUC Number, if applicable; iii.3) representation data (if acting with power of attorney and if this is by public deed) or mandate iii.4) origin of the funds/assets involved in the transaction; iii.5) identification of the beneficial owner of the beneficiary of the transaction, in accordance with article 4 of Legislative Decree No. 1372 and its modifying norms, as applicable.
Account number, when this is used to process the transaction, or the virtual asset wallet address, as applicable, if applicable.

16.1.2 In the case of legal persons and legal entities:

The minimum information that the VASP must obtain from its client-legal person, as well as from its client-legal entity insofar as it is applicable to the latter, is the following:

Name or trade name.
Unique Taxpayer Registry Number (RUC) or equivalent registry for non-residents.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Corporate purpose, main economic activity or purpose of constitution of the legal person, as applicable.
Identification of its beneficial owners in accordance with article 4 of Legislative Decree No. 1372 and its modifying norms.
Purpose of the relationship to be established with the VASP, whenever this does not derive directly from the object of the contract.
Identification of the representative (executant), for which it must record the data referred to in items 1 and 2 of numeral 16.1.1. Specify if it has representation by power of attorney or mandate, indicating the data of the public notarial instrument and the number of Registry Entry, heading, entry and Registry Zone of the SUNARP.
Address and phone number of the main office or premises, where it develops the activities inherent to its business.
The identity of the beneficiary of the transaction:
i. In case the transaction is performed in favor of itself, the origin of the funds/assets involved in the transaction.
ii. In case the transaction is performed in favor of a third-party natural person:
ii.1) the first and last names of the natural person, ii.2) type and number of identity document, ii.3) representation data (if acting with power of attorney and if this is by public deed) or mandate, ii.4) indicate if they are or have been a PEP, specifying if applicable, the position and the name of the institution (public body or international organization), and ii.5) the origin of the funds/assets involved in the transaction.
iii. In case the transaction is performed in favor of a third-party legal person or legal entity, insofar as it is applicable to the latter: iii.1) its name or trade name; iii.2) RUC Number, if applicable; iii.3) representation data (if acting with power of attorney and if this is by public deed) or mandate, iii.4) origin of the funds/assets involved in the transaction; iii.5) identification of the beneficial owner of the beneficiary of the transaction, in accordance with article 4 of Legislative Decree No. 1372 and its modifying norms, as applicable.
Account number, when this is used to process the transaction, or the virtual asset wallet address, as applicable, if applicable.

16.2 Simplified regime of due diligence in client knowledge

It applies when the client performs transactions for amounts less than one thousand and 00/100 US dollars (US$ 1,000.00) or its equivalent in national currency or other currencies and the payment method used is any other different from cash.

16.2.1. The application of this regime allows the VASP to reduce some minimum information requirements applicable to the client identification stage established in the general regime.

16.2.2. The minimum information to be obtained under this regime is the following:

Regarding natural persons: (i) First and last names; (ii) type and number of identity document.
Regarding legal persons: (i) Name or trade name; (ii) Unique Taxpayer Registry Number (RUC) or equivalent registry for non-residents; (iii) identification of the legal representative, as provided in item 1 that precedes. In the case of legal entities, the constitutive document must be requested, at minimum.

16.3 Enhanced regime of due diligence in client knowledge

16.3.1. The application of this regime implies that the VASP develops and implements enhanced due diligence procedures in the knowledge of its clients, in addition to those of the general regime. For this, it identifies and registers under this regime clients who demonstrate a pattern that does not correspond to their ML/TF and FP risk profile, as well as those clients who could be highly affected by ML/TF and FP risks.

16.3.2. This regime is applied obligatorily to the following clients:

Nationals or foreigners, non-residents.
Non-domiciled legal persons.
Trusts.
PEPs and identified as: i) relatives of PEPs up to the second degree of consanguinity and second degree of affinity, ii) spouse or cohabitant of PEP; and, iii) legal persons or legal entities where a PEP has the condition of beneficial owner, in accordance with article 4 of Legislative Decree No. 1372 and its modifying norms. It is applicable regarding the client when they become a PEP, after having initiated commercial relations.
Natural persons, legal persons or legal entities regarding which there is knowledge that they are being investigated for the crime of money laundering, predicate crimes and/or terrorist financing by competent authorities.
Linked to natural persons or legal persons subject to investigation or judicial processes related to money laundering, predicate crimes and/or terrorist financing.
Dedicated to correspondent services with foreign companies constituted in countries with low or no tax imposition, according to what is stated by the tax authority, or that do not have banking regulation or supervision.

16.3.3. The VASP must implement the following due diligence measures for all clients registered in this regime:

Regarding PEPs, the name of their relatives up to the second degree of consanguinity and second degree of affinity and of the spouse or cohabitant must be required, as well as the list of legal persons or legal entities where they hold the condition of beneficial owner, in accordance with article 4 of Legislative Decree No. 1372 and its modifying norms.
Increase the frequency in the review of the client's transactional activity.
Perform inquiries and apply additional identification and verification measures, such as: obtaining information about main suppliers and clients, collecting information from public or open sources, conducting visits to the domicile.
The decision of acceptance and/or maintenance of the relationship with the client must be in charge of the highest managerial level of the VASP or similar position, which may delegate this function to another managerial position within the organization or to a committee established for this purpose, retaining responsibility for the acceptance and/or maintenance or not of the client.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

16.4 The VASP must use the sworn statement format of client knowledge under the general regime, which the SBS publishes on the AML prevention Portal on the institutional website (https://www.sbs.gob.pe/prevencion-de-lavado-activos/SupervisadosUIF/Modelo-de-Declaracion-Jurada), which contains the minimum information referred to in this article, being able to employ the necessary digital mechanisms that facilitate the filling and signing of the sworn statement by the client. In addition to said minimum information, the obligated subject may include the information that it had identified as a product of its ML/TF and FP risk analysis.

CHAPTER IV
KNOWLEDGE OF DIRECTORS, WORKERS AND SUPPLIERS

Article 17.- Knowledge of directors and workers

17.1. The VASP must implement a due diligence policy in the knowledge of its workers and directors, in the case that it has such a governing body, except for the exception cases referred to in paragraph 4.3 of article 4 of this standard.

17.2. The purpose of due diligence in the knowledge of directors and workers is that the VASP is able to establish their profiles, for which it must require a sworn statement, which includes at least the following information:

a) Full first and last names. b) Type and number of identity document (including a copy). c) Marital status, specifying the first and last names of the spouse or cohabitant, if applicable. d) Profession or trade. e) Occupation and/or position in the VASP. f) Personal address and telephone number. g) Professional studies and specialized training received. h) Information on police and criminal records. i) Work background: work experience in the last two (2) years, prior to hiring: (i) Name of the company, entity or natural person with whom they worked or provided services. (ii) Position held. (iii) Start date (month/year). (iv) End date (month/year). j) Patrimonial background (patrimonial information and other income generated outside the VASP).

17.3. The minimum information referred to in the preceding paragraph, forms part of the personal documentation of each of the workers and directors, if such a governing body exists, which the VASP must conserve, in physical or electronic medium. Workers and directors are obligated to communicate to the VASP, any change in the information provided, within a period that does not exceed fifteen (15) days from when the change occurred.

17.4. The VASP must comply with the following:

At the time of selection or hiring and subsequent to the link between the parties, verify the lists that contribute to the prevention of ML/TF, indicated in letters f) and g) of article 12 of this standard, in order to determine if the directors, if such a governing body exists, and workers are included in them.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Verify, at least once a year, that the information referred to in paragraph 17.2 is updated, when applicable.
Establish internal mechanisms to sanction violations of the norms on the prevention of ML/FT, as well as the manual and code, where applicable.

17.5. The VASP may use the sworn statement model of knowledge of directors and employees, published by the SBS in the AML prevention Portal on the institutional website (https://www.sbs.gob.pe/prevencion-de-lavado-activos/SupervisadosUIF/Modelo-de-Declaracion-Jurada).

Article 18.- Knowledge of providers

18.1. The VASP must develop due diligence procedures during the selection of providers, considering in this category natural or legal persons with whom the provision of goods or services related directly to the development of the activity for which they are subject to supervision by the UIF-Peru is contracted. To this end, the VASP must request and verify the following minimum information:
a) Full names or denomination or trade name, in case it is a legal person. b) Unique Taxpayer Registry (RUC) or equivalent registry for non-residents, if applicable. c) Type and number of identity document, in case it is a natural person. d) Nationality in the case of foreigners. e) Address. f) Address of the main office or premises. g) Years of experience in the market. h) Sectors in which the provider offers its products or services. i) Identification of the beneficial owner, in accordance with Article 4 of Legislative Decree No. 1372 and its amendments. j) Full names of the legal representative, considering the information required for natural persons, in case it is a legal person. k) Sworn statement of having no criminal record, in the case of the provider being a natural person. In the case of the provider being a legal person, a sworn statement signed by the legal representative, stating that no sanction has been imposed in accordance with Article 105 of the Penal Code, Law No. 30424, or the applicable special criminal law.

18.2. The VASP must:

At the time of provider selection and subsequent to the linkage between the parties, verify the lists that contribute to the prevention of ML/FT, indicated in letters f) and g) of Article 12 of this standard, in order to determine whether they are included in them or not.
Update the information periodically; the update period cannot exceed two (2) years. In case the information has not been modified, this must be recorded.
Evaluate cases where, considering the sector in which they carry out their economic activities, it is convenient to include in contracts with providers the obligation to comply with ML/FT prevention norms, as well as aspects related to the duty of confidentiality of the information to which they have access.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Prepare alert signals related to providers, as well as the procedures that must be followed once these are activated.

CHAPTER V
UTILIZATION OF THIRD PARTIES OR INTERMEDIARIES

Article 19. Utilization and responsibility of third parties or intermediaries

19.1. The VASP, if it deems it necessary, may use third parties or intermediaries to comply with services related to the identification and/or verification of information of clients, directors, employees, and providers.

19.2. The VASP must adopt the corresponding measures to obtain the information, copies of identification data, and other pertinent documentation; as well as a sworn statement by which the third party or intermediary states that it has adopted the necessary measures to comply with the provisions on due diligence in the knowledge of clients, directors, employees, and providers.

19.3. The VASP maintains responsibility for the due diligence process in the knowledge of clients, directors, employees, and providers, even when this has been entrusted to a third party or intermediary, linked or not, being required to supervise compliance with the provisions of current regulations.

CHAPTER VI
ON TRAINING

Article 20. General aspects of training

20.1. Employees and directors, if they have such governing body, as well as the VASP, when it is a natural person, must receive within one calendar year, at least one training on the prevention and detection of ML/FT, except for the exceptional cases referred to in paragraph 4.3 of Article 4 of this standard.

20.2. The training is the obligation of the VASP and may be conducted under any modality, by third parties or specialized entities, which must issue the respective certificate. These certificates must be available to the UIF-Peru, and must be kept together with the information corresponding to each director or employee, in physical or electronic media.

20.3. Without prejudice to what is provided in paragraph 20.2, the training may be conducted solely by the VASP's compliance officer, who must issue the respective certificate as a sworn statement, to be included in the information corresponding to each director or employee. This statement must indicate the date, place, duration, modality, the name(s) of the participants, positions held, and the syllabus. No training certificate issued by the compliance officer in their own favor is acceptable.

20.4. As part of the induction, within thirty (30) days following the entry date of the new employee or director, the VASP through the compliance officer must inform them about the scope of the AML/CFT Model, leaving a record of this. The induction in this matter does not replace the minimum training referred to in paragraphs 20.1 to 20.3 of this article.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Article 21. Minimum training requirements

Training must be provided, according to their functions, to both the VASP if it is a natural or legal person, its directors and employees, at minimum on the following:

Definition of ML/FT crimes.
Policies and procedures established by the VASP on the prevention and management model of ML/FT and TF risks.
ML/FT and TF risks to which the VASP is exposed.
Current regulations on ML/FT prevention.
ML/FT typologies, detected in the activities of the VASP or other obligated subjects.
Internal norms of the VASP.
Alert signals to detect unusual and suspicious operations.
Procedure for communicating unusual operations.
Information on the lists that contribute to the prevention of ML/FT, indicated in letters f) and g) of Article 12 of this standard.
Freezing of funds or assets in cases linked to ML/FT crimes dictated by the SBS, in accordance with numeral 11 of Article 3 of the Law and/or the freezing of funds or assets in accordance with Resolutions of the United Nations Security Council on terrorism, terrorist financing, and financing of the proliferation of weapons of mass destruction, in accordance with numeral 12 of the cited article.
Responsibilities regarding ML/FT prevention, according to their specialty and functions performed.

CHAPTER VII
CORRESPONDENT RELATIONSHIPS AND OPERATIONS WITH BANKS AND SCREEN COMPANIES

Article 22. Correspondent relationships

22.1. When the VASP provides virtual asset services to another national or foreign VASP or a financial institution, to mitigate ML/FT and TF risks, it must have policies and procedures for the prevention of ML/FT and TF.

VASPs must include in their policies and procedures to mitigate ML/FT and TF risks, at minimum, the following:

Gather sufficient information about the VASP or financial institution with which it establishes the correspondent relationship, allowing it to understand the nature of the business of the other VASP or financial institution and its ML/FT and TF risk prevention framework, including what types of clients it intends to provide services to through said relationship.
Obtain sufficient information and determine, from available public information, the reputation of the VASP or financial institution, the quality of its supervision, including whether it has been subject to any investigation or sanction for ML/FT or regulatory actions for deficiencies in its ML/FT and TF prevention systems.
Evaluate the AML/CFT Model developed and implemented by the VASP or financial institution and the services provided to underlying clients through the relationship.
Record compliance with the customer due diligence obligations carried out by the VASP or financial institution regarding the clients of the virtual asset accounts or wallets that can be used directly to carry out business and that the VASP or financial institution is in a position to supply identification data of the clients.

Correspondent contracts must clearly define the obligations and responsibilities of each participant regarding the prevention of ML/FT and TF and must be signed by the highest managerial level of the companies.

22.2. The VASP must develop and implement enhanced due diligence procedures when the correspondent relationship is established with other VASPs or financial institutions that:

Are authorized in jurisdictions classified by the FATF as non-cooperative countries, or that have weak or non-existent regulations or supervision on ML/FT and TF prevention, with strict legal frameworks regarding bank secrecy or classified as countries with low or no tax imposition.
Are subject to or have been investigated or sanctioned for deficiencies in their ML/FT and TF prevention systems.

22.3. The evaluations and other actions carried out on these entities must be kept in a file, which must be available to the UIF-Peru.

22.4. The provisions contemplated in this article are also applicable to relationships of a similar nature that VASPs maintain with other institutions, other than VASPs and financial institutions.

Article 23. Operations with banks or screen companies

23.1. A bank or screen company is considered to be a financial system entity constituted and authorized in a country where it has no physical presence and is not a member of an economic group subject to effective consolidated supervision. Physical presence is understood as management and administrative functions located within a country. The existence of a local representative or low-level personnel does not constitute physical presence.

23.2. VASPs cannot initiate or continue relationships with banks or screen companies; likewise, they must obtain confirmation that foreign institutions with which they maintain relationships (clients) do not allow the use of their accounts by banks or screen companies.

CHAPTER VIII
VIRTUAL ASSET TRANSFERS

Travel Rule

Article 24. Travel Rule

24.1. All virtual asset transfers must be treated as electronic transfers. These transfers are operations carried out through electronic channels or means, as a consequence of the instruction, order, or authorization made by the originator, and may be national or cross-border. VASPs participating in virtual asset transfers, obtain and conserve the following minimum information:

a) The originator: i) their full names, in case it is a natural person or the denomination or trade name in case it is a legal person, ii) their identity document number in case it is a natural person or the Unique Taxpayer Registry (RUC) or equivalent registry in case it is a legal person, iii) account number, when this is used to process the transaction or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows tracking it, iv) address, date and place of birth, and/or operation identification number;

b) The beneficiary of the operation: i) their full names, in case it is a natural person or the denomination or trade name in case it is a legal person, ii) their account number, when this is used to process the transaction or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows tracking it.

24.2. The requirements on information submission are considered met if the VASPs have the identification data of the originator and the data that allow the identification of the beneficiary, and to track or monitor the operation.

24.3. VASPs must have policies and procedures based on ML/FT and TF risks to determine: i) when to execute or not carry out the operation or not make the VAs available to the beneficiary in case the transfer lacks the required information on the originator or beneficiary; and ii) the appropriate follow-up action.

24.4. In the case of a virtual asset transfer made to or from a self-custodied virtual asset wallet, the VASP, in addition to obtaining and conserving its client's information, must request from this client information about its originator or beneficiary, as applicable, in accordance with the scope of numeral 24.1.

In the case that the VASP does not receive the information requested from its client, it must not carry out the operation, not make the VAs available and/or terminate the commercial relationship initiated; and ii) evaluate the possibility of making a Suspicious Operation Report (SOR) in relation to the client.

Without prejudice to the above, the VASP, upon a transfer involving a self-custodied virtual asset wallet, must evaluate its ML/FT and TF risk level, in order to adopt appropriate controls.

24.5. When the VASP participates in virtual asset transfers for amounts less than one thousand and 00/100 US dollars (US$ 1,000.00) or its equivalent in national currency or other currencies, it must obtain and conserve the following information:

a. The originator: i) their full names, in case it is a natural person or the denomination or trade name in case it is a legal person, ii) their identity document number in case it is a natural person or the Unique Taxpayer Registry (RUC) or equivalent registry in case it is a legal person, iii) the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows tracking it.

b. The beneficiary of the operation: i) their full names, in case it is a natural person or the denomination or trade name in case it is a legal person, ii) the virtual asset wallet address or the self-custodied virtual asset wallet address, or if there is no account, the operation reference code that allows tracking it.

The VASP must verify the accuracy of the aforementioned information when there is suspicion of ML/FT and TF in said transfers, in which case, it must verify the information relative to the originator or beneficiary, as applicable.

24.6. The aforementioned obligations, to obtain and conserve information on virtual asset transfers, fall on both the originator VASP and the beneficiary VASP of the operation, as applicable.

Article 25.- Transmission of information

25.1. Originator VASPs transmit to beneficiary VASPs the required information of the originator and the beneficiary immediately and securely.

25.2. The aforementioned information is made available to competent authorities by the originator VASPs or the beneficiary VASPs, as the case may be, upon request and in accordance with the Law.

CHAPTER IX
OPERATIONS RECORD AND SUSPICIOUS OPERATIONS REPORT

Article 26. Operations Record (OR)

26.1. The VASP must keep and maintain an updated Operations Record (OR) in accordance with what is established in this article and according to the procedure included in the OR Instruction. The OR has a confidential nature.

26.2. The following operations are subject to the VASP's OR:

Exchange between virtual assets and fiat or legal tender currency.
Exchange between one or more forms of virtual assets.
Transfer of virtual assets.
Custody and/or administration of virtual assets or instruments that allow control over virtual assets.
Participation and provision of financial services related to the offer of an issuer and/or sale of a virtual asset.

The VASP, for OR purposes, must take into account the following:

Individual operations, for any amount, when the payment method used or the withdrawn amount is made in cash.
Individual operations, for amounts equal to or greater than one thousand and 00/100 US dollars (US$ 1000.00) or its equivalent in national currency or other currencies, when the payment method used is any other distinct from cash.

26.3. In the OR, the VASP registers the operations that its clients carry out on the day they occurred, it is kept in a chronological, precise, and complete manner, in systems and/or computer applications and must maintain a backup copy on backup media such as microfilming, microforms, or others of easy recovery.

26.4. In case the VASP develops more than one of the activities indicated in Article 3 of Law No. 29038 and other pertinent norms, it must keep a separate OR for each of the activities it develops, as applicable.

26.5. The VASP, through the compliance officer, sends the OR in the structure, periodicity, format, and instructions that the SBS establishes by Resolution, as well as any other additional information that it requests.

The OR Template, as well as its Instruction, are published on the AML and TF Prevention Portal - PLAFT Portal (https://plaft.sbs.gob.pe/) enabled by the SBS, to which only the VASP has access, solely through its compliance officer duly registered with the UIF-Peru, in accordance with current regulations.

26.6. The OR contains as minimum for each operation, the information provided in Article 24 of the Regulation and Article 16 of this standard, as applicable.

26.7. The VASP must not exclude any client from the OR, regardless of their habitual nature and the knowledge it has of them.

Article 27. Suspicious Operations Report (SOR)

27.1. The VASP has the obligation to communicate to the UIF-Peru, through its compliance officer, the operations detected in the course of its activities, carried out or attempted to be carried out, that are considered suspicious, regardless of the amounts involved. The communication must be made immediately and sufficiently, that is, within a period that in no case must exceed twenty-four (24) hours from when the operation is qualified as suspicious. The period to qualify an operation as suspicious is subject to its nature and complexity.

27.2. The compliance officer, on behalf of the VASP, qualifies the operation as suspicious and proceeds with its communication to the UIF-Peru, leaving documentary evidence of the analysis and evaluations carried out, for the qualification of an operation as unusual or suspicious, as well as the reason why an unusual operation was not qualified as suspicious and reported to the UIF-Peru, if applicable.

The documentary support of the analysis and evaluations is conserved in accordance with what is provided by Article 35 of this standard; and contains at least the following information:

27.2.1. Identification data of the unusual operation: (i) date on which the operation is carried out; (ii) type of operation; (iii) amount of the operation; (iv) currency in which the operation was carried out; (v) payment method used in the operation; (vi) form of payment; (vii) origin of the funds/assets; (viii) payment receipt number or account number, when this is used to process the transaction, or the asset wallet address, as applicable, or if there is no account, the operation reference code that allows tracking it, if applicable; (ix) description of the operation, indicating the arguments that led to the qualification as unusual; (x) if the operation was qualified as suspicious, specify the SOR number with which it was communicated to the UIF-Peru; (xi) record the analysis and evaluation of the operation and the arguments by which the operation was not qualified as suspicious.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

27.2.2. Identification data of the persons participating in the transaction, whether natural or legal persons, national or foreign, and who act on their own behalf, for their own behalf, or through a representative or agent (ordering party/owner, beneficiary/acquirer, executor); and regarding the legal entity where applicable, recording at least the following:

In the case of a natural person: (i) full first and last names; (ii) type and number of identity document; (iii) nationality, in the case of foreigners; (iv) domicile; (v) marital status, recording the first and last names of the spouse or cohabitant, if applicable; (vi) capacity in which they participate in the transaction regardless of its denomination: seller, buyer, representative or attorney (specify on whose behalf they act), principal or agent (specify on whose behalf they act), among others; (vii) payment voucher number or account number, when this is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows tracking it, if applicable.
In the case of a legal person or legal entity: (i) name or trade name; (ii) Unique Taxpayer Registry (RUC) or equivalent registry for non-residents, if applicable; (iii) domicile; (iv) first and last names of the legal representative, considering the information required for the natural person; (v) identification of the beneficial owner, in accordance with Article 4 of Legislative Decree 1372 and its amendments; (vi) payment voucher number, or account number, when this is used to process the transaction, or the virtual asset wallet address, as applicable, or if there is no account, the operation reference code that allows tracking it, if applicable.

27.2.3. Identified alert signals: (i) description of the alert signal; (ii) source of the alert signal, specifying whether it comes from the Money Laundering and Terrorist Financing Prevention Portal – PLAFT Portal (https://plaft.sbs.gob.pe/) or if it has been identified by the VASP itself. The mere identification of alert signals does not necessarily imply that the transaction is unusual or suspicious.

27.3. The VASP, through the compliance officer, sends the STR and attached or complementary documentation to UIF-Peru through the ROSEL system, using the ROSEL template for this purpose. The ROSEL Template is published on the Money Laundering and Terrorist Financing Prevention Portal - PLAFT Portal (https://plaft.sbs.gob.pe/) enabled by the SBS, to which only VASPs have access, exclusively through their compliance officers duly registered with UIF-Peru, in accordance with current regulations. Under no circumstances should the identity of the compliance officer or the VASP, nor any other element that could contribute to identifying them, be recorded in the STR, except for the secret codes assigned by UIF-Peru.

27.4. The information and documentary support for the STR must be retained for a period of five (5) years, in accordance with Article 35 of this standard, and must be available to UIF-Peru.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

CHAPTER X
INTERNAL NORMS FOR THE PREVENTION OF ML/FT

Article 28. Manual and Code of Conduct for the prevention and management of ML/FT and FP risks

28.1. The VASP must have a Manual and a Code, of mandatory compliance, in accordance with what is established in Articles 26 to 28 of the Regulation of the UIF Law and what is established in this standard.

The VASP that is a natural person and carries out the activity on its own, without having employees for the development of the activity, for which it is subject to this standard, is not obliged to have a manual and a code.

28.2. The Manual contains, in addition to what is provided in paragraph 26.1 of the Regulation of the UIF Law, the development of due diligence procedures in customer and beneficial owner knowledge with a risk-based approach; knowledge of directors, workers, and suppliers; the identification and evaluation of the ML/FT and FP risks of the VASP for the purpose of applying control measures and the periodicity with which the rating of said risks is updated; the development of the procedure for identifying unusual and/or suspicious transactions; the alert signals of the ROSEL system that, considering the activity carried out by the VASP, it must take into account for the purpose of detecting unusual or suspicious transactions, as well as those identified by the VASP in the development of its activities and the criteria to be adopted regarding amounts, time periods, or other aspects of the alert signals. The aspects contemplated and developed in the Manual may be included in said document or in another internal normative document of the VASP, provided that said documents have the same approval procedure.

The FP risk, in accordance with Recommendation 1 of the FATF, must comprise exclusively the possible non-compliance, lack of implementation, or evasion of obligations related to financial sanctions referred to in Recommendation 7 of the FATF.

28.3. The Code contains, in addition to what is provided in Article 27 of the Regulation of the UIF Law, the following: (i) Objective; (ii) Scope; (iii) Ethical principles; (iv) Duties; (v) Infractions for non-compliance with the SPLAFT; (vi) Applicable sanctions for the commission of any infraction identified by the VASP.

28.4. As a minimum, the Code must contain the following infractions: (i) not signing the sworn declaration of receipt and knowledge of the manual and/or code or the document that serves as such; (ii) revealing the identity of the compliance officer, alternate compliance officer, corporate compliance officer; (iii) non-compliance with the provisions of the manual and/or code; (iv) non-compliance with or violation of the procedures, guides, and/or guidelines established by the VASP for due diligence in customer, beneficial owner, worker, director, and supplier knowledge, where applicable; (v) not sending or sending out of deadline to UIF-Peru the AOC, RO, STR, information requests, or other records or reports that are among its functions; (vi) unjustified absence from training; (vii) obstructing or attempting to prevent the work of UIF-Peru in supervisory visits; (viii) excluding any client from the RO; (ix) violating the duty of indefinite secrecy, bringing to the knowledge of any person, client, entity, or organism, under any means or modality, the fact that some information has been requested by UIF-Peru or has been provided to it; (x) not communicating to the compliance officer about the identification of an unusual transaction; (xi) others determined by the VASP.

28.5. The Manual and the Code must be made known to the entire administrative and operational organization of the VASP, its workers and directors, if applicable, and this must be recorded, except for the exception cases referred to in paragraph 4.3 of Article 4 of this standard.

The accreditation of the making known is through a sworn declaration, which includes the subscriber's commitment to comply with what is established in such documents in the exercise of their functions, in accordance with what is established in paragraph 28.6 of Article 28 of this standard.

In the event that the VASP updates or modifies its Manual or Code, it must make known to the entire administrative and operational organization of the VASP, its workers and directors, if applicable, except for the exception cases referred to in paragraph 4.3 of Article 4 of this standard, the new version of the Manual or Code, within thirty (30) days following the approval of the modification or update by the competent body of the VASP, leaving a record of this through the sworn declaration in accordance with what is indicated in paragraph 28.6 of Article 28 of this standard.

28.6. The sworn declaration of receipt and knowledge of the Manual and/or Code contains the following minimum information: (i) express indication that the document has the character of a sworn declaration and contains information updated to the date of its signing; (ii) first and last names; (iii) type and number of identity document; (iv) nationality, in the case of foreigners; (v) express declaration that at the time of signing said document, the declarant has received from the VASP the Manual and/or the Code, specifying whether it is a printed version or in electronic medium; (vi) express declaration that the knowledge of the Manual and/or the Code is of mandatory compliance; (vii) express declaration of knowing that non-compliance with any of its provisions implies being subject to disciplinary sanction by the VASP, as employer/contractor; (viii) ratification of everything stated in the sworn declaration, in sign of which the document is signed; (ix) place of subscription, specifying district, province, and department; (x) date on which the sworn declaration is signed, specifying day, month, and year.

28.7. The sworn declaration of receipt and knowledge of the manual and/or code must be retained for a period of five (5) years and must be available to UIF-Peru.

28.8. When the VASP belongs to a formally constituted guild (legal person), registered in the Public Registries and with a valid RUC, which gathers obligated subjects carrying out the same activity, the VASP may use the manual and code approved at the guild level; without prejudice to maintaining responsibility for its content, approval, update, and dissemination among its workers and directors in accordance with what is established in this article.

CHAPTER XI
TREATMENT OF THE ECONOMIC GROUP

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Article 29. Economic group

Economic groups must develop corporate policies and procedures regarding the SPLAFT, including:

Policies and procedures at the group level in matters of risk management and prevention of ML/FT, which may consist of a single Corporate Manual and/or Code.
Policies and procedures to exchange information within the group for purposes of ML/FT prevention, establishing adequate safeguards on the confidentiality and use of the exchanged information.
Criteria necessary to be adopted by members of the economic group to ensure high standards when hiring workers and appointing directors and managers.
Training program in matters of prevention and detection of ML/FT, which may be a single corporate-level program.

CHAPTER XII
REPORTS OF THE COMPLIANCE OFFICER

Article 30. Annual report of the compliance officer

30.1. The VASP, through the compliance officer, must prepare and send to UIF-Peru an annual report on the compliance with the policies and procedures that make up the ML/FT prevention system implemented in the previous calendar year, called Annual Compliance Officer Report (AOC), which contains as a minimum the following information:

The address and telephone of the VASP, and the email of the compliance officer.
Indication regarding whether the compliance officer exercises the function as a corporate compliance officer or not.
Name, type, and number of identity document of partners, shareholders, or associates and percentage of participation in the VASP, if applicable.
Name, type, and number of identity document of managers or other workers responsible for the management of the VASP's activity, if applicable.
Annual statistics of the RO, indicating the number of registered transactions and the amounts involved, discriminating the information monthly.
Annual statistics of unusual transactions detected, indicating the number of transactions detected, the amounts involved, or other aspect considered significant, discriminating the information monthly.
Annual statistics of suspicious transactions reported to UIF-Peru, indicating the number of transactions reported, the amounts involved, or other aspects considered significant, discriminating the information monthly.
Description of new alert signals for unusual transactions established by the VASP and typologies of suspicious transactions that have been detected and reported, if any.
Procedures for identification and evaluation of ML/FT and FP risks, due diligence procedures in customer, director, and worker knowledge, as well as suppliers and counterparties, if applicable, procedures for identifying unusual and/or suspicious transactions.
Number of workers, number of trainings on topics related to the prevention of ML/FT, the number of people who have been trained; number of people who were trained more than once a year, as well as the detail of the topics subject of training according to the recipient's profile and their function in the VASP, as well as the ML/FT and FP risks they face.
Last update date of the Manual and Code, as well as the level of compliance with these by the directors and workers of the VASP, indicating cases where any has been non-complied with, the sanctions imposed, and the corrective measures adopted.
Corrective actions adopted by virtue of the observations and/or recommendations made by the supervisory body and internal or external auditors, where applicable.
Geographic location of offices, branches, and agencies.
Others determined by the SBS.

30.2. The AOC must have the approval of the board of directors or equivalent body of the legal person VASP; or, failing that, of the general manager, manager, managing partner, or administrator as applicable, provided that the legal person, according to its statutes, is not obliged to have a board of directors. In the event that the VASP is a natural person, the approval of the AOC corresponds to the natural person holding the activity. The report is approved within thirty (30) days following the expiration of the respective annual period.

30.3. The VASP sends the AOC through the compliance officer, no later than February 15 of the following year, to the supervisory body through the Money Laundering and Terrorist Financing Prevention Portal – PLAFT Portal (https://plaft.sbs.gob.pe/) or another means established by the SBS, in the structure and according to the instructions determined by the same means.

30.4. Regarding the corporate compliance officer, this must present an AOC for each of the obligated subjects that are part of the economic group, within the same deadlines indicated in this article.

CHAPTER XIII
ON THE IDENTIFICATION AND EVALUATION OF ML/FT AND FP RISKS

Article 31. ML/FT and FP risk factors

Among the main ML/FT and FP risk factors that must be identified and considered by the VASP, where applicable, are:

a) Clients.- The VASP must manage the ML/FT and FP risks associated with clients, their behavior, background, and activities, at the beginning and throughout the commercial relationship. The analysis associated with this ML/FT and FP risk factor incorporates client characteristics, such as nationality, residence, occupation, or economic activity; age, business seniority in the case of legal persons, as well as the actual and/or estimated transactional volume.

b) Products and/or services.- The VASP must manage the ML/FT and FP risks associated with the products and/or services it offers. The analysis associated with this ML/FT and FP risk factor includes risks linked to the distribution channels and payment methods with which it operates, which must also be carried out when the VASP decides to use new technologies associated with the products and/or services offered or when there is a change in the product and/or service it offers that modifies its ML/FT and FP risk profile.

c) Geographic zone.- The VASP must manage the ML/FT and FP risks associated with the geographic zones in which it offers its products and/or services, both locally and internationally, taking into account their security, economic-financial, and socio-demographic characteristics, the provisions that competent authorities or the FATF issue regarding said jurisdictions, among others. The analysis associated with this ML/FT and FP risk factor comprises the zones in which the VASP operates, as well as those linked to the transaction process.

Article 32. Identification and evaluation of ML/FT and FP risks

The VASP must develop and implement procedures for the identification and evaluation of ML/FT and FP risks, taking into account the ML/FT and FP risk factors to which it is exposed, as well as the results of the National Risk Assessment of ML/FT and FP, which must be reflected in the Manual. For this purpose, it must:

Segment its clients considering as a minimum the risk factors established in Article 31 of this standard.
Identify the ML/FT and FP risks of its activity.
Evaluate the possible occurrences and impact of the identified risks. This evaluation must take into account, among other aspects, the frequency with which the identified segments appear, the distribution channel of the product and/or service, as well as other attributes of the "products and/or services" risk factor, and must be carried out when the VASP decides to use new technologies associated with the products or services offered or when a change is made to an existing product that modifies its ML/FT and FP risk profile.
Adopt and implement adequate control measures to mitigate the different types and levels of ML/FT and FP risks identified considering the risk factors, so that intensified measures can be applied to manage and mitigate major risks and simplified measures for minor risks.
Permanently monitor the results of the applicable controls and their degree of effectiveness, to detect transactions that turn out to be unusual or suspicious and correct existing deficiencies in the ML/FT and FP risk management process.

The report containing the ML/FT and FP risk evaluation as well as the methodology used to carry out said elaboration, must be available to UIF-Peru.

The VASP updates the identification and evaluation of its ML/FT and FP risks, at least every three (3) years.

Article 33. Incursion into new geographic zones

The VASP, where applicable, through its compliance officer, prepares a report containing the evaluation of the level of exposure to ML/FT and FP risks it would be exposed to in the event of incursion into new geographic zones. This evaluation must take into consideration the evaluation of the "geographic zone" risk factor, in accordance with what is indicated in Article 31 of this standard. The aforementioned report must be available to UIF-Peru.

CHAPTER XIV

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

ON THE ATTENTION OF INFORMATION REQUESTS AND INFORMATION RETENTION

Article 34. Attention of information requests

34.1. VASPs must develop and implement mechanisms for attending to requests made by competent authorities regarding the SPLAFT, taking into account the deadlines and forms established in the legislation and regulation on the matter.

34.2. The VASP must attend, within the deadline requested of it, the information requests or information expansion requests made by UIF-Peru, in accordance with current regulations.

34.3. The VASP, through its compliance officer, must send and/or make available to UIF-Peru the reports, the AOC, RO, STR, periodic information requests, and others determined by the SBS through UIF-Peru, as well as all respective documentation or information that allows accrediting compliance with what is established in this standard, where applicable, through the Money Laundering and Terrorist Financing Prevention Portal – PLAFT Portal (https://plaft.sbs.gob.pe/) or another means established by the SBS, in the structure and according to the instructions determined by the same means; identifying itself only with the secret codes assigned to the compliance officer and the VASP, adopting measures that allow the confidentiality of the information and its senders.

Article 35. Information retention

The VASP must retain information related to the SPLAFT and that which supports compliance with the provisions established in this standard for a period of no less than five (5) years. This information comprises, mainly, information related to the linkage and transactions carried out by clients, including all information obtained and/or generated in the application of due diligence measures, RO, and STR; information referred to the linkage and transactions with suppliers; and the policies, procedures, and analyses carried out and other information referred to the compliance with the obligations expressly contemplated in this standard.

The aforementioned information must be kept updated, considering for this purpose the ML/FT and FP risk analyses and periodicity established by the VASP and considered in the Manual, and must be available to UIF-Peru.

For this purpose, computer means, microfilming, microforms, or similar means that allow easy recovery of the information for its consultation and internal or external reporting to competent authorities in accordance with the Law are used.

CHAPTER XV

ON THE SUPERVISION OF THE SPLAFT AND SANCTIONING POWER

Article 36. Supervision of the VASP and sanctioning power

36.1. It corresponds to UIF-Peru to carry out and prioritize its supervisory function, considering the ML/FT and FP risk analysis of the activity carried out by the VASP, using not only its own supervisory mechanisms, but it may also count on the support of the compliance officer, internal audit, and external audit firms, if applicable, in accordance with what is provided in Article 32 of the Regulation of the UIF Law, insofar as applicable.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

36.2. The SBS, through the corresponding bodies, exercises the sanctioning power for non-compliance with the obligations derived from the Law, the Regulations of the UIF Law, and this standard, in accordance with the corresponding Regulation of Infringements and Sanctions.

Article 37. Internal Audit of the VASP

37.1. The design and application of the AML/CFT system must be evaluated by the internal audit area, if the VASP has one; and in its absence, by a manager or equivalent position different from the VASP's compliance officer, provided that the VASP is a legal entity. A VASP that is a natural person is not obliged to have internal audit, without prejudice to this, the SBS through UIF-Peru may determine otherwise taking into consideration, among other aspects, the size of the organization, its complexity, level of operational, administrative, and legal risks, as well as the average volume of operations, number of staff, asset movement, in addition to the particular characteristics of the VASP.

37.2. The internal audit area, if the VASP has one, or the manager or equivalent position different from the VASP's compliance officer, when the VASP does not have an internal audit area, prepares an annual internal audit report (IAI) on the evaluation of the AML/CFT system which includes at least the following aspects:

Development and application of procedures to identify and assess the AML/CFT and TF risks of the VASP and the periodicity with which these risks are updated.
Development and application of policies and procedures that ensure adequate customer, director, worker, and provider knowledge.
Development and application of the procedure for identifying unusual and/or suspicious transactions.
Existence of the Manual and Code, duly approved, disseminated, and mandatory for the entire administrative and operational organization of the VASP, its workers and directors, if applicable, except for the exception cases referred to in paragraph 4.3 of Article 4 of this standard, updated and in accordance with current legislation and compliance level.
Existence of annual training according to the contents provided for in current regulations.
Verify the criteria applied by the compliance officer to not consider certain transactions suspicious.
Implementation, filling out, and timely submission of the STR in accordance with the content, structure, instructions, and medium established in current regulations.
Timely submission of other records, reports, and reports that must be communicated to UIF-Peru, verifying that they contain real information and in accordance with the content, structure, and instructions established for them.
Timely communication of STRs, which in no way implies access to them.
Compliance with regulations on AML/CFT prevention.
Others determined by the SBS.

37.3. The IAI is brought to the attention of the board of directors or equivalent body of the VASP legal entity; or, in its absence, to the general manager, manager, managing partner, or administrator as appropriate, within thirty (30) days following the expiration of the respective annual period.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

37.4. The VASP sends the IAI through the compliance officer, no later than February 15 of the following year, to the supervisory body through the Anti-Money Laundering and Terrorist Financing Prevention Portal – PLAFT Portal (https://plaft.sbs.gob.pe/) or another means established by the SBS, as an annex to the COAR.

Article 38. External Audit of the VASP

The AML/CFT system must be evaluated by an external audit firm, in accordance with what is provided for in Articles 34 and 35 of the Regulations of the UIF Law, provided that the VASP has a legal obligation to have one.

CHAPTER XVI
ON THE DUTY OF CONFIDENTIALITY AND EXEMPTION FROM LIABILITY

Article 39. Duty of confidentiality and exemption from liability of the VASP

39.1. The communications, transactions, records, and other information referred to in this standard are confidential, and all those involved are prohibited from informing any person, entity, or organism, by any means or modality, that such information has been requested and/or provided to UIF-Peru, except for jurisdictional organs or competent authorities according to Law, under the corresponding administrative, civil, and criminal responsibilities.

39.2. The VASP, its directors, and its workers are exempt from criminal, civil, and administrative responsibility, as appropriate, derived from the due compliance with current regulations on AML/CFT prevention.

FINAL PROVISION

Sole. All the provisions provided for in Resolution SBS No. 3862-2016, Standard that regulates the mechanisms and procedures for UIF-Peru to administratively freeze funds or other assets of persons or entities linked to terrorism and the financing of terrorism, as well as those linked to the proliferation of weapons of mass destruction and their financing, identified within the framework of Resolutions of the United Nations Security Council, and issues other provisions, and its modifications, are applicable to VASPs under the scope of this standard.

Second Article.- Approve the Format of Sworn Declaration of Customer Knowledge under the General Regime (applicable to natural person, legal entity, and legal entity), as well as the Model of Sworn Declaration of Knowledge of Directors and Workers, which form an integral part of this Resolution and will be published on the Electronic Portal of the Superintendence of Banks, Insurance, and Private Pension Fund Administrators (https://www.sbs.gob.pe/prevencion-de-lavado-activos/Supervisados-UIF/Modelo-deDeclaracion-Jurada), in accordance with what is provided by Supreme Decree No. 001-2009-JUS and its modifying norms.

Third Article.- Modify Procedure No. 142 “Request to have a Corporate Compliance Officer for the case of obligated subjects included in the Standard for the Prevention of Money Laundering and Terrorist Financing, applicable to obligated subjects under the supervision of UIF-Peru in matters of prevention of money laundering and terrorist financing, approved by Resolution SBS No. 789-2018” and Procedure No. 213 “Request to have a corporate compliance officer exempting the exclusive dedication of their functions, for the case of obligated subjects included in the Standard for the Prevention of Money Laundering and Terrorist Financing, applicable to obligated subjects under the supervision of UIF-Peru in matters of prevention of money laundering and terrorist financing, approved by Resolution SBS No. 789-2018” in the Single Text of Administrative Procedures – TUPA of the Superintendence of Banks, Insurance, and Private Pension Fund Administrators, approved by Resolution No. 01581-2023, in accordance with the text attached to this resolution and published on the Institutional Web Portal (www.sbs.gob.pe), in accordance with what is provided in the Regulations of Law No. 29091, approved by Supreme Decree No. 004-2008-PCM.

Fourth Article. Modify paragraph 10 of paragraph 26.1 of Article 26 of the Standard for the Prevention of Money Laundering and Terrorist Financing, applicable to obligated subjects under the supervision of UIF-Peru in matters of prevention of money laundering and terrorist financing, approved by Resolution SBS No. 789-2018, which shall be drafted as follows:

“Article 26. Annual report of the compliance officer

26.1. The obligated subject, through the compliance officer, must prepare and send to UIF-Peru an annual report on the compliance with the policies and procedures that integrate the AML/CFT prevention system implemented by the obligated subject in the previous calendar year, called Annual Compliance Officer Report (COAR), which contains as minimum the following information:

(…)

Number of workers, number of trainings on topics related to AML/CFT prevention, the number of people who have been trained; number of people who were trained more than once a year, as well as the detail of the topics subject of training according to the profile of the recipient and their function in the obligated subject, as well as the AML/CFT and TF risks they face.

(…)”.

Fifth Article.- Modify paragraph 1 of paragraph 10.4 of Article 10; paragraph 6 of Article 13, subsection i) and iii.4) of subsection 11 of paragraph 23.1.1 and subsection i) and iii.4) of subsection 9 of paragraph 23.1.2 of paragraph 23.1 of Article 23 of the Standard for the prevention of money laundering and terrorist financing applicable to notaries at the national level and the Centralized Organ for the Prevention of money laundering and terrorist financing – OCP AML/CFT, approved by Resolution SBS No. 01754-2024, which shall be drafted as follows:

“Article 10.- Worker Knowledge

(…)

10.4. The obligated subject must comply with the following:

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

At the time of selection or hiring and subsequent to the link between the parties, verify the lists that contribute to the prevention of AML/CFT, indicated in letter e) of paragraph 8.1 of Article 8 of this standard, in order to determine if the workers are included in them.

(…)”

“Article 13. Minimum training requirements

The notary, their workers, and the workers of the OCP AML/CFT must be trained in matters of AML/CFT and TF prevention, at minimum on the following:

(…)

Information on the lists that contribute to the prevention of AML/CFT, indicated in letter e) of paragraph 8.1 of Article 8 of this standard.

(…)”

“Article 23.- Due diligence regimes in customer knowledge

The notary must identify their clients in each operation, applying the identification stage in the process of due diligence in customer knowledge, according to the following:

23.1. General regime of due diligence in customer knowledge

The minimum information that the notary must obtain from the client is the following:

23.1.1. In the case of natural persons:

(…)

The identity of the beneficiary of the operation:

i. In case the operation is carried out in favor of oneself, the origin of the funds/assets involved in the operation when it equals or exceeds the threshold for purposes of the STR.

(…)

iii. In case the operation is carried out in favor of a legal entity or legal entity, insofar as it is applicable to the latter: (…) iii.4) origin of the funds/assets involved in the operation when it equals or exceeds the threshold for purposes of the STR; (…).

23.1.2. In the case of legal entities and legal entities:

The minimum information that the notary must obtain from their client-legal entity, as well as from their client-legal entity insofar as it is applicable to the latter, is the following:

(…)

The identity of the beneficiary of the operation:

i. In case the operation is carried out in favor of oneself, the origin of the funds/assets involved in the operation, when it equals or exceeds the threshold for purposes of the STR.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

(…)

iii. In case the operation is carried out in favor of a third-party legal entity or legal entity, insofar as it is applicable to the latter: (…) iii.4) origin of the funds/assets involved in the operation when it equals or exceeds the threshold for purposes of the STR; (…).”

Sixth Article.- Modify Articles 6 and 8 of the Standard that regulates the procedure for attending requests for lifting of banking secrecy approved by Resolution SBS No. 1132-2015, which shall be drafted as follows:

“Article 6.- Responsibility and designation of the official responsible for attending requests for lifting of banking secrecy

(…)

Companies communicate to the Superintendence, the Judiciary, and the Comptroller General of the Republic, the name, position, telephone, email, or other contact data of the officials - primary and alternate - responsible for attending the requirements for lifting of banking secrecy.

Any change in the designation and/or contact data must be communicated to the Superintendence, the Judiciary, and the Comptroller General of the Republic, as appropriate, within three (3) business days of occurrence.”

“Article 8.- Form and channels for sending information requested by the Superintendent for financial intelligence purposes and by the Comptroller General of the Republic in the framework of a control action

8.1. Requests for lifting of banking secrecy formulated by UIF Peru will be sent through the Communications Module of the UIF Peru PLAFT Portal and addressed to the compliance officer.

In the case of requests formulated by the Comptroller General of the Republic, they will be sent through the software application established for this purpose by the Comptroller General of the Republic and addressed to the responsible officials (primary and alternate) designated according to Article 6 of this standard.

(…)”

Seventh Article.- Modify Article 2 and the title of Annex No. 1 and incorporate Annexes No. 2 and 3 to the Regulation of Infringements and Sanctions in matters of Prevention of Money Laundering and Terrorist Financing, approved by Resolution SBS No. 8930-2012, which shall be drafted as follows:

“Article 2.- Scope

This regulation is applicable to the following obligated subjects, including branches established and registered in Peru of legal entities constituted and with domicile abroad, duly authorized to carry out the activities referred to in this article:

Non-profit Organizations (NPOs) that collect, transfer, and disburse funds, resources, or other assets for charitable, religious, cultural, educational, scientific, artistic, social, recreational, or solidarity purposes or for the realization of other types of altruistic or benevolent actions or works; and facilitate credits, microcredits, or any other type of economic financing.
Loans and/or pawnshops.
Sale and purchase of vehicles and vessels.
Sale and purchase of foreign currency.
Trade in coins, works of art, and postage stamps.
Trade in jewelry, precious metals, and/or precious stones.
Construction.
Real estate.
Real Estate Agent.
Marketing of machinery and equipment included in National Subheadings No. 84.29, No. 85.02, and No. 87.01 of the National Tariff Classification.
Mining companies.
Sale and purchase of aircraft.
Hippodromes and their agencies.
Lottery games and similar.
Legal entities whose corporate object is the provision of legal and/or accounting services, which carry out or intend to carry out in the name of their client or on their behalf, on a habitual basis, the activities established in current legislation, hereinafter, professional legal entities.
Notaries at the national level.
The Centralized Organ for the Prevention of money laundering and terrorist financing, OCP AML/CFT, under the charge of the College of Notaries of Lima, from whom it depends economically and administratively and is responsible for the payment of possible fines imposed on the OCP AML/CFT in the framework of the respective administrative sanctioning procedures.
Virtual Asset Service Providers – VASPs.
Other obligated subjects designated by Law to be supervised in matters of prevention of money laundering and terrorist financing by UIF-Peru and those that do not have a supervisory body.”

“Annex 1

Infringements applicable to obligated subjects under the scope of Resolution SBS No. 789-2018 and to VASPs

(…)”

“Annex 2

Infringements applicable to Notaries

(This annex establishes the typification of infringements applicable to Notaries at the national level)

Minor Infringements

Regarding training

Not having received within a calendar year, a training on prevention and/or detection of money laundering and terrorist financing and TF, established in current regulations, both the notary, their compliance officer, and their workers.
Not providing to workers no later than within thirty (30) days following the date of entry into the obligated subject, the induction on the scope of the money laundering and terrorist financing prevention system, in accordance with what is established in current regulations.
Not keeping a record of the trainings received required according to current regulations.

Regarding the single manual and code of conduct for prevention and management of AML/CFT and TF risks

Not keeping a record of having informed the single manual and code of conduct approved by the OCP AML/CFT and/or any update and/or modification, to their workers, in accordance with what is established in current regulations.

Regarding the compliance officer

Not communicating, within the period established in current regulations, the changes related to the minimum information of the designation of the compliance officer.

Major Infringements

Regarding information requirements made by the Superintendence

Not attending or not delivering within the period requested, the information requested by the Superintendence, through UIF-Peru.

Regarding supervisions

Not providing, within the periods and/or conditions established in each case, the following information and/or documentation, required by the Superintendence, through UIF-Peru:

a) Information required for the preparation and/or during the development of a supervision or any other control procedure;

b) Complementary information required subsequent to a supervision or any other control procedure and that is linked to any of them.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not providing the Superintendence, through UIF-Peru, the facilities required for the start and/or development of supervision visits or any other control procedure, or obstructing such actions.

Regarding the internal audit that the OCP AML/CFT performs on the notary

Not implementing the recommendations of the internal audit carried out by the OCP AML/CFT.

Regarding the manual and procedures for the prevention of money laundering and terrorist financing and TF

Not implementing the single manual for prevention and management of money laundering and terrorist financing and TF risks approved by the OCP AML/CFT

Not approving and/or implementing the annex of the manual for prevention and management of money laundering and terrorist financing and TF risks that incorporates the specific aspects of the AML/CFT prevention system of the notary.

Non-compliance with obligations that have the purpose of developing and/or implementing and/or applying policies and/or procedures for due diligence in customer and worker knowledge, in accordance with what is established in current regulations.

Non-compliance with obligations that have the purpose of developing and/or implementing and/or applying procedures necessary for the detection of unusual transactions established in current regulations on prevention of money laundering and terrorist financing or the internal norms adopted by the notary itself in this matter and/or not having the record of identified unusual transactions.

Regarding the code of conduct for the prevention of money laundering and terrorist financing

Not implementing the single code of conduct approved by the OCP AML/CFT.

Regarding the compliance officer

Not designating a compliance officer.
Not designating compliance officer according to the periods provided and/or the requirements established in current regulations.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not communicating to the Superintendence, through UIF-Peru, the designation, absence, removal, or vacancy of the compliance officer in accordance with what is established by current regulations.
That the compliance officer does not perform on an exclusive dedication basis, when the Superintendence indicates to the notary that they must have a compliance officer on an exclusive dedication basis.
Not providing the compliance officer with the conditions to have absolute autonomy and independence in the exercise of their functions and responsibilities assigned by current regulations or not providing them with the necessary resources and infrastructure for the adequate compliance with their functions and responsibilities.
Maintaining the position of compliance officer in a situation of vacancy or absence for more time than the period established in current regulations.
Not maintaining the confidentiality of the identity of the compliance officer in accordance with current regulations.
Not complying with the functions and responsibilities of compliance officer provided for in current regulations.

Regarding the mandates of the Superintendence

Non-compliance with the implementation of corrective measures ordered by the Superintendence.
Not implementing the recommendations communicated by UIF-Peru, regarding their AML/CFT prevention system.

Regarding the identification and assessment of AML/CFT and TF risks

Not implementing procedures for the identification and assessment of AML/CFT and TF risks, in accordance with what is established in current regulations and/or in the Methodological Guide for the identification and assessment of AML/CFT and TF risks prepared by the OCP AML/CFT.

Regarding the duty to preserve information

Not preserving information related to the AML/CFT prevention system in the form and period established in current regulations.

Regarding the registration and sending of information to the OCP AML/CFT through the BCI

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not integrating into a centralized management system for the prevention of ML/FT under the OCP ML/FT.
Not registering the information of their operations and/or not sending it to the BCI, in accordance with current regulations.
Not performing the synchronization of their operations information, within the timeframes established in current regulations.
Not sending and/or sending with errors and/or incompletely, the information that according to current regulations must be sent to the OCP ML/FT or that which has been requested by it.
Not communicating monthly the alert signals, unusual operations or other information, in accordance with what is established in current regulations.

Regarding the registration of operations
27. Not having a record of operations.
28. Not registering the operations and minimum information, in accordance with what is required in current regulations.
29. Not having a backup copy of the record of operations, during the period established in current regulations.
30. Not making available to the Superintendency, through UIF-Peru; or to the competent authorities, the backup copies of the record of operations, within the timeframe requested and in accordance with what is established in current regulations.
31. Not complying with the provisions issued by the Superintendency, through UIF-Peru, regarding the registration of operations.
32. Not sending the record of operations within the timeframe and manner indicated by the Superintendency, through UIF-Peru.

Very serious infractions

Regarding the duty of confidentiality

Breaching the duty of confidentiality, by informing any person, entity or organism, under any means or modality, of the fact that some information has been requested or provided to the Superintendency, through UIF-Peru.

Regarding the ML/FT Risk Report

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000
2. Not communicating the ML/FT Risk Report to the OCP ML/FT in accordance with what is established in current regulations.

Regarding compliance with the Resolutions of the United Nations Security Council (UNSC) and administrative freezing
3. Failing to comply with the obligation to permanently review the lists of persons or entities designated by the UNSC in accordance with Resolutions 1267 (1999), 1718 (2006) and 2231 (2015), and the resolutions that succeed them, and not to contrast these with their operation records and databases of their clients, users and providers, if applicable, for the purpose of identifying any type of funds or other assets or any operation involving persons or entities designated by the UNSC.
4. Failing to comply with the obligation to communicate without delay to UIF-Peru, the funds or other assets detected belonging to persons or entities designated by the UNSC, in accordance with Resolutions 1267 (1999), 1718 (2006) and 2231 (2015), and the resolutions that succeed them.
5. Failing to comply with the obligation to communicate without delay to UIF-Peru the non-existence of funds or other assets of the persons or entities on which UIF-Peru orders administrative freezing.

Annex 3
Infractions applicable to the OCP ML/FT in charge of the College of Notaries of Lima

Minor infractions

Regarding training

Not having received within one calendar year, training on the prevention and/or detection of money laundering and terrorist financing and proliferation financing (FP), established in current regulations.
Not having received within one calendar year, training on topics of notarial law, its operation and types of acts and contracts most recurrent or of highest risk of ML/FT.
Not providing to workers, at the latest within thirty (30) days following the date of entry into the OCP ML/FT, the induction on the scope of the system for the prevention of money laundering and terrorist financing, in accordance with what is established in current regulations.
Not maintaining a record of the trainings received as required by current regulations.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Regarding the single manual and code of conduct for the prevention and management of ML/FT and FP risks
5. Not making a record of having communicated the single manual and code of conduct approved by the OCP ML/FT and/or any update and/or modification, in accordance with what is established in current regulations.

Regarding the compliance officer
6. Not communicating, within the timeframe established in the regulation, changes related to the minimum information of the designation of the compliance officer and alternate compliance officer.

Regarding the internal audit that the OCP ML/FT performs on the notary
7. Not having the minimum information in the annual internal audit reports on the evaluation of the ML/FT prevention system of each notary at the national level.

Serious infractions

Regarding information requests made by the Superintendency

Not attending or not delivering within the timeframe requested, the information requested by the Superintendency, through UIF-Peru.

Regarding supervisions
2. Not providing, within the timeframes and/or conditions established in each case, the following information and/or documentation, requested by the Superintendency, through UIF-Peru:
a) Information required for the preparation and/or during the development of a supervision or any other control procedure; b) Complementary information required subsequent to a supervision or any other control procedure and which is linked to any of them.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not providing the Superintendency, through UIF-Peru, with the facilities required for the start and/or development of supervision visits or any other control procedure, or obstructing such actions.

Regarding the internal audit that the OCP ML/FT performs on the notary
4. Not elaborating the annual internal audit reports on the evaluation of the ML/FT prevention system of each notary at the national level and/or not sending them to UIF-Peru within the timeframe and in accordance with what is established in current regulations.

Regarding the manual and procedures for the prevention of money laundering and terrorist financing
5. Not elaborating and/or approving and/or updating and/or conserving and/or having the single manual for the prevention and management of money laundering and terrorist financing and FP risks, as established in current regulations.
6. Not having the minimum content of the single manual for the prevention and management of money laundering and terrorist financing and FP risks established in current regulations.
7. Failing to comply with the obligations that have the purpose of developing and/or implementing and/or applying policies and procedures for the due diligence in the knowledge of workers, in accordance with what is established in current regulations.
8.
Regarding alert signals and unusual operations:
a) Not developing and/or not implementing and/or not applying criteria and/or procedures for the identification and evaluation of alert signals and/or that these do not allow the analysis of unusual operations and/or reporting of suspicious operations, in accordance with what is required in current regulations. b) Not having documentary evidence of the analysis and evaluation performed for the classification of an operation as unusual and/or not specifying the reason why an operation was not classified as unusual or suspicious and reported to UIF-Peru, if applicable. c) Not developing and/or not implementing the procedure and/or the evaluation of unusual operations. d) Not keeping a record of operations in which alert signals were activated and/or a record of unusual operations, in accordance with what is established in current regulations.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not elaborating and/or approving and/or updating the format of the sworn declaration of client knowledge under the general regime that the notary must use and/or that does not contain the minimum information established in current regulations.
Not including the minimum information established in current regulations in the reports of suspicious operations.

Regarding the code of conduct for the prevention of money laundering and terrorist financing
11. Not elaborating and/or approving and/or updating and/or conserving and/or having the single code of conduct, as established in current regulations.
12. Not having the minimum content of the single code of conduct for the prevention of money laundering and terrorist financing established in current regulations. 6

Regarding the compliance officer
13. Not designating a compliance officer and an alternate compliance officer.
14. Not designating a compliance officer and alternate compliance officer in accordance with the timeframes provided and/or the requirements established in current regulations.
15. Not communicating to the Superintendency, through UIF-Peru, the designation, absence, removal or vacancy of the compliance officer and the alternate compliance officer, in accordance with what is established by current regulations.
16. That the compliance officer does not perform their duties on an exclusive basis.
17. Not providing the compliance officer with the conditions to have absolute autonomy and independence in the exercise of their functions and responsibilities assigned by current regulations or not providing them with the necessary resources and infrastructure for the adequate fulfillment of their functions and responsibilities.
18. Not maintaining the confidentiality of the identity of the compliance officer and alternate compliance officer in accordance with current regulations.
19. Not complying with the functions and responsibilities of compliance officer and alternate compliance officer provided for in current regulations.

Regarding the annual report of the compliance officer 6 Errata published on August 3, 2024.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not sending to UIF-Peru the annual report of the compliance officer regarding each notary, within the timeframe and manner established in current regulations.
Not having the minimum content of the annual report of the compliance officer regarding each notary, in accordance with what is established in current regulations.
Sending to UIF-Peru the annual report of the compliance officer regarding each notary, with inaccurate information.
Not sending to UIF-Peru the annual report of the compliance officer corresponding to the OCP ML/FT, within the timeframe and manner established in current regulations.
Sending to UIF-Peru the annual report of the compliance officer corresponding to the OCP ML/FT, with inaccurate information.

Regarding the mandates of the Superintendency
25. Failing to comply with the implementation of corrective measures ordered by the Superintendency.
26. Not implementing the recommendations communicated by UIF-Peru, regarding the ML/FT prevention system of the OCP ML/FT.

Regarding the identification and evaluation of ML/FT and FP risks
27. Not elaborating the Methodological Guide for the identification and evaluation of ML/FT and FP risks to be applied by notaries, in accordance with what is established in current regulations and/or not updating it within the timeframe established in current regulations.
28. Not elaborating and/or developing and/or maintaining updated a system for classifying ML/FT and FP risks of the notary's clients (client risk scoring).
29. Not having a methodology that allows identifying the level of exposure to ML/FT and FP risk of each notary (notary scoring).

Regarding the duty to conserve information
30. Not conserving the information related to the ML/FT prevention system in the form and timeframe established in current regulations.

Regarding BCI information

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Not elaborating annually a verification report on the adequate sending of information to the BCI by each notary.

Regarding training
32. Not approving and/or not implementing the Annual Training Plan of notaries at the national level.
33. Not conducting trainings on ML/FT prevention at the national level, directed at notaries and their workers, as well as at the workers of the OCP ML/FT.

Very serious infractions

Regarding the duty of confidentiality

Breaching the duty of confidentiality, by informing any person, entity or organism, under any means or modality, of the fact that some information has been requested or provided to the Superintendency, through UIF-Peru.

Regarding the reporting of suspicious operations
2. Not communicating to UIF-Peru the operations classified as suspicious in accordance with what is established in current regulations.

Regarding compliance with the Resolutions of the United Nations Security Council (UNSC) and administrative freezing
3. Failing to comply with the obligation to permanently review the lists of persons or entities designated by the UNSC in accordance with Resolutions 1267 (1999), 1718 (2006) and 2231 (2015), and the resolutions that succeed them, and not to contrast these with the operation records they send to UIF, the BCI and databases, for the purpose of identifying any type of funds or other assets or any operation involving persons or entities designated by the UNSC.
4. Failing to comply with the obligation to communicate without delay to UIF-Peru, the funds or other assets detected belonging to persons or entities designated by the UNSC, in accordance with Resolutions 1267 (1999), 1718 (2006) and 2231 (2015), and the resolutions that succeed them.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Failing to comply with the obligation to communicate without delay to UIF-Peru the non-existence of funds or other assets of the persons or entities on which UIF-Peru orders administrative freezing.

Article Eighth.- The Standard for the prevention of money laundering and terrorist financing applicable to Virtual Asset Service Providers (VASPs), under the supervision of UIF-Peru, enters into force the day after its publication in the Official Newspaper El Peruano, except for what is provided in Chapter VIII regarding the Travel Rule, which enters into force two years after the publication of said standard.
7

Article Ninth.- For the implementation of the Standard for the prevention of money laundering and terrorist financing applicable to Virtual Asset Service Providers (VASPs), under the supervision of UIF-Peru, VASPs have a period not exceeding one hundred twenty (120) days counted from the entry into force of said standard.

SERGIO JAVIER ESPINOSA CHIROQUE
Superintendent of Banks, Insurance and AFP

7 By Article Fourth of Resolution SBS No. 01917-2026, the entry into force of what is provided in Chapter VIII regarding the Travel Rule was extended until January 1, 2029.

Resolution SBS No. 02648-2024: Standard for the Prevention of Money Laundering and Terrorist Financing Applicable to Virtual Asset Service Providers (VASPs) Under the Supervision of the UIF-Peru

Lineage: In force

Timeline

Similar documents from other regulators