Resolution SBS No. 1297-2022: Approves the External Audit Regulation for Savings and Credit Cooperatives Not Authorized to Attract Public Funds

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Lima, April 20, 2022 S.B.S. Resolution No. 1297-2022 The Superintendent of Banking, Insurance and Private Pension Fund Administrators

CONSIDERING:

That, in exercise of the powers established in numerals 7 and 9 of article 349, as well as in the Twenty-Fourth Final and Complementary Provision of the General Law of the Financial System and of the Insurance System and Organic Law of the Superintendence of Banking, Insurance and Private Pension Fund Administrators - Law No. 26702 and its amendments (General Law), through Resolution SBS No. 741-2001 and its amendments, the External Audit Regulation for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds was approved;

That, Law No. 30822, Law that modifies Law No. 26702, General Law and other concordant norms, regarding the regulation and supervision of savings and credit cooperatives, modified the Twenty-Fourth Final and Complementary Provision of the General Law, establishing new provisions regarding the regulation and supervision of Savings and Credit Cooperatives Not Authorized to Attract Public Funds (Coopac);

That, in numeral 4-A.1 of the Twenty-Fourth Final and Complementary Provision of the General Law, it is established that in matters of regulation, the Superintendence of Banking, Insurance and AFP (Superintendence) issues the norms that are necessary for the compliance with what is established in said final and complementary provision, as well as the other aspects that are necessary for the supervision and regulation of Coopac, which must be consistent with the modular scheme contemplated in numeral 2 of said final and complementary provision and respect the cooperative and proportionality principles applicable to supervision; likewise, in numeral 4-A.3 of said final and complementary provision, the Superintendence is authorized to issue norms on external audit;

That, Law No. 27693, Law that creates the Financial Intelligence Unit – Peru, provides that it is the function and power of the Superintendence to regulate, in coordination with the supervisory bodies of obligated subjects, the guidelines, requirements, sanctions and other aspects related to prevention systems, and that external audit is one of the agents for compliance with the system for the prevention of money laundering and financing of terrorism;

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

That, to the extent that the work carried out by external audit firms constitutes a fundamental mechanism of support for the supervision and control carried out by this Superintendence, in their respective scopes, and is a means of protection for the cooperative member, it is necessary to establish and identify the responsibilities of Coopac, among them, the obligation to hire external audit firms, requirements for hiring, content of contracts; the responsibilities of external audit firms, such as: rotation of the audit firm, partner and audit teams, examinations applicable to Coopac, opinion, aspects related to reports on the internal control system and complementary; among other topics; maintaining consistency with the modular scheme established in Law No. 30822, and respecting the cooperative and proportionality principles applicable to supervision;

That, consequently, this Superintendence considers it necessary to issue a new External Audit Regulation for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds; as well as to modify the Regulation of Integral Risk Management for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds, approved by Resolution SBS No. 13278-2009;

That, for the purpose of collecting opinions from the general public regarding the proposal for regulatory modification, the draft resolution on the matter was pre-published on the electronic portal of the Superintendence, under the provisions of the Thirty-Second Final and Complementary Provision of the General Law, numeral 2 of the Tenth Final Complementary Provision of Law No. 30822 and Supreme Decree No. 001-2009-JUS and its modifying norms;

Having the previous technical and positive viability report of the norm from the Assistant Superintendent of Cooperatives and the approval of the Assistant Superintendencies of Cooperatives and of Legal Advice; and

In exercise of the powers conferred by numerals 7 and 9 of article 349 of the General Law, as well as in numerals 4-A and 9 of the Twenty-Fourth Final and Complementary Provision of the General Law;

RESOLVES:

Article First.- Approve the External Audit Regulation for Savings and Credit Cooperatives Not Authorized to Attract Public Funds, which forms an integral part of this Resolution:

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

“EXTERNAL AUDIT REGULATION FOR SAVINGS AND CREDIT COOPERATIVES NOT AUTHORIZED TO ATTRACT PUBLIC FUNDS

CHAPTER I GENERAL PROVISIONS

Article 1. Scope The provisions of this Regulation are applicable to savings and credit cooperatives not authorized to attract public funds and, where pertinent, to savings and credit cooperative central organizations.

Article 2. Definitions For the application of this Regulation, the following definitions must be considered: a) Audit file: One or more folders or other physical or electronic data storage media that contain the records that make up the audit procedures applied, the relevant audit evidence obtained and the conclusions reached in the examination. b) Central: Central organization of savings and credit cooperatives not authorized to attract public funds, which are those composed exclusively of savings and credit cooperatives and correspond to the homogeneous type indicated in numeral 1.1 of article 59 of the General Law of Cooperatives. c) Internal control: Process carried out by directors, management and staff, designed to provide reasonable assurance in achieving objectives related to the effectiveness and efficiency of operations, reliability of financial information and compliance with applicable laws and regulations. d) Coopac: Savings and credit cooperative not authorized to attract public funds. e) Days: Calendar days. f) Directors: Members who are titular and alternate members of the Board of Directors, Supervisory Board, Education Committee and Electoral Committee. g) Integral risk management: Process carried out by the Board of Directors, Management and staff applied throughout the Coopac and in the definition of its strategy, designed to identify potential events that may affect it, manage them according to their risk appetite and provide reasonable assurance in achieving their objectives. h) Information Security Management: The information security management system is the set of policies, processes, procedures, roles and responsibilities, designed to identify and protect information assets, detect security events, as well as anticipate response and recovery to cybersecurity incidents. The information security management system implies, at least, the objectives of confidentiality, availability and integrity. Likewise, it must be proportional to the size, nature and complexity of its operations. i) Significant events: Those events that may have a significant impact on the financial situation of the Coopac, or on the achievement of its objectives. j) IAASB: International Auditing and Assurance Standards Board, body of the International Federation of Accountants responsible for issuing ISAs.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

k) AML/CFT: Money laundering and/or financing of terrorism. l) General Law: General Law of the Financial System and of the Insurance System and Organic Law of the Superintendence of Banking, Insurance and Private Pension Fund Administrators, approved by Law No. 26702 and its amendments. m) General Law of Cooperatives: Consolidated Text of the General Law of Cooperatives, approved by Supreme Decree No. 074-90-TR and its amendments. n) Business model: Process that determines how the entity generates cash flows to achieve specific objectives; for this purpose, it uses information from the macroeconomic environment, segmentation techniques, efficient use of the agency network and promoting service quality, considering the viability and sustainability of income, as well as vulnerabilities. ñ) Special Affiliation Norms: Special Norms on Affiliation and Economic Group approved by Resolution SBS No. 5780-2015 and its amendments. ñ) ISA: International Standards on Auditing and Related Services issued by the IAASB, approved for application in Peru by the Board of Deans of the Public Accountants Colleges of Peru. ñ) International Financial Reporting Standards (IFRS): Are the Standards and Interpretations officialized by the Accounting Standards Council in Peru. They include: i) International Financial Reporting Standards (IFRS); ii) International Accounting Standards (IAS); and, iii) Interpretations developed by the International Financial Reporting Interpretations Committee (IFRIC) or issued by the previous Interpretations Committee (SIC). ñ) GIR Regulation: Regulation of Integral Risk Management for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds, approved by Resolution SBS No. 13278-2009 and its amendments. ñ) AML/CFT Regulation: Regulation for the Prevention of Money Laundering and Financing of Terrorism applicable to Savings and Credit Cooperatives Not Authorized to Operate with Public Funds, approved by Resolution SBS No. 5060-2018. ñ) RESAE: Registry of External Audit Firms of the Superintendence. ñ) Internal control system: Integrated set of processes, policies, procedures and control techniques established and executed at each level of the organizational structure of the Coopac to achieve adequate administrative organization, operational efficiency, information reliability, appropriate identification and management of the risks it faces and compliance with the legal provisions applicable to it. ñ) Audit firms: External audit firms. ñ) Superintendence: Superintendence of Banking, Insurance and Private Pension Fund Administrators. ñ) UIF-Peru: Financial Intelligence Unit of Peru. ñ) UIT: Tax Unit.

CHAPTER II RESPONSIBILITIES OF COOPAC

Article 3. Obligation to hire audit firms 3.1. Coopac of Levels 2 and 3 must hire audit firms in accordance with the provisions of this Regulation.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

3.2. This provision also applies to Level 1 Coopac that, during the first half of each fiscal year, present total assets exceeding the equivalent of six hundred (600) UIT.

Article 4. Hiring of audit firms 4.1. Coopac must hire audit firms, in accordance with what is established in this Regulation, no later than August 31 of each year, prior to approval by the Board of Directors. 4.2. Coopac must call on audit firms and notify the Superintendence no later than July 15 of each year, those that have presented themselves, attaching the corresponding current habilitation certificate in the RESAE and in the Registry of one of the Departmental Public Accountants Colleges of the Republic and documentation supporting the previous experience of the auditors. The Superintendence, within twenty (20) days of receiving said communication, taking into account the antecedents of the quality of the audit reports of previous years of said firms, if applicable, will make the observations it deems pertinent; and may rule on the list of audit firms presented; otherwise, it will be considered that there are no objections. The Supervisory Board will propose the trio of hireable audit firms that it has preselected to the Board of Directors, in accordance with what is stated in the General Law of Cooperatives. 4.3. A copy of the contract signed between the Coopac and the audit firm, and a simple copy of the Board of Directors meeting minutes where the choice of the audit firm is approved must be sent to the Superintendence within ten (10) days following their signing. The documentation supporting compliance with the hiring requirements referred to in article 5 of this Regulation must be available to the Superintendence.

Article 5. Requirements for hiring Coopac may only hire the services of audit firms that meet the following requirements, which are also applicable, where pertinent, to the partners of said firms: a) Be registered and habilitated in the Registry of one of the Departmental Public Accountants Colleges of the Republic and in the RESAE of this Superintendence; b) Have the infrastructure and adequate human and technical resources for the volume and complexity of the operations carried out by the Coopac, including the audit of information systems; c) Have a minimum experience of three (3) years in audit activities in the financial and/or savings and credit cooperative system; d) The partners and the audit team assigned to provide services to the Coopac must have professional training and experience in topics related to the assignments established by this norm; likewise, the partners and managers or personnel in charge of leading the audit must have a minimum experience of three (3) years in functions typical of external audit; e) Not have been hired by the Coopac to perform services incompatible with external audit in the exercise of their functions during the last three (3) years; f) Not have received a sanction from this Superintendence, or another public or private organism, for omission or non-compliance with the provisions on the activities typical of external audit established in the current regulatory framework, classified as serious or very serious infractions, or their equivalents in the last three (03) years prior to the fiscal year for which the audit work will be carried out; g) Not have affiliation due to single risk according to the Special Affiliation Norms, which will be extended to the partners and the audit team; h) The partners and members of the audit firm's team must not be members of the Coopac.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

i) Not have overdue debts for more than one hundred twenty (120) days in the financial and/or savings and credit cooperative system, or in judicial collection, nor protests of documents in the last five (5) years, not clarified to the satisfaction of the Superintendence; which will be extended, where pertinent, to the responsible partner and the audit team. j) Others indicated by this Superintendence, through norms of a general nature.

Article 6. Minimum conditions of contracts Contracts signed with audit firms must contain the following minimum aspects: a) The start of external audit examinations must be carried out no later than sixty (60) days before the closing of the corresponding fiscal year; b) The scope of the examination and minimum content of the reports of the audit firms, in accordance with the provisions of this Regulation and other complementary norms issued by the Superintendence; c) The declaration of the audit firm, its partners and each of the members of the team that will audit the Coopac, of knowing and accepting the obligations and responsibilities established by this Superintendence and the current regulations on the performance of external audit, the confidentiality of the information obtained and the rotation requirements established in article 11 of this Regulation; d) The deadline for delivering the reports; e) The obligation of the audit firm to keep available to the Superintendence the audit files that support the reports it issues and, if applicable, substantiate the respective report, at the simple request of this Superintendence; f) The obligation of the audit firm to send to the Superintendence, simultaneously with its presentation to the Board of Directors and Supervisory Board of the audited Coopac, a copy of the reports issued in compliance with this Regulation; g) A penalty clause that financially sanctions the delay in the presentation of the reports, with respect to the deadlines established by current regulations, whose amount will be deducted from the fees of the audit firm; h) A clause that states that the audit firm is obliged to reveal, within the framework of the assignments received, situations that demonstrate the lack of solvency, insufficient assets and/or pronounced financial or economic weakness of the audited Coopac, and to reveal any act or omission that violates any provision that Coopac are obliged to comply with; i) The list of all members of the audit team, specifying those hired on a temporary and/or permanent basis, indicating their experience, professional level, time auditing the Coopac and the responsibilities of each of them; which is extended to the partners of the audit firm; j) The commitment of the audit firm not to replace the partner, manager or senior auditor in charge of the audit without the authorization of the Coopac; and, k) The obligation to participate in working meetings, as appropriate, with the Superintendence, the Board of Directors and/or Supervisory Board of the Coopac.

Article 7. Examinations applicable to Coopac Coopac must hire audit firms for the following required examinations: a) The reasonableness of the financial statements and complementary reports in accordance with articles 17 and 20; b) The evaluation of the internal control system in the scope of external audit; and, c) The evaluation of the money laundering and financing of terrorism prevention and risk management system (AML/CFT prevention system).

Article 8. Responsibility of Coopac in external audit examinations 8.1. The Board of Directors and Management are directly responsible for providing the hired audit firm with the information and facilities necessary for it to carry out its work adequately, independently and timely. 8.2. Likewise, it is the responsibility of said bodies to ensure compliance with the provisions established in this Regulation, and Management must communicate to the Supervisory Board under a sworn declaration that access to information has not been limited.

Article 9. Knowledge of reports by Coopac 9.1. The Board of Directors must take note of all opinions and reports issued by the audit firm and order the adoption of necessary corrective measures. 9.2. The receipt and knowledge by the Board of Directors of the reports of the audit firms must be recorded in the respective Minutes Book. Likewise, the opinion on the financial statements must be known by the General Assembly, together with the annual report of the Coopac. 9.3. Simultaneously with the presentation to the Board of Directors, the audit firm must also present to the Supervisory Board the reports referred to in the previous paragraphs.

Article 10. Information to the Superintendence 10.1. Coopac must bring the following information to the knowledge of the Superintendence, within ten (10) days of its occurrence:

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

a) Non-compliance with the contractual obligations of the audit firms, as well as, if applicable, the termination of contracts entered into with audit firms due to such non-compliance; and, b) The application of the penalty indicated in letter g) of Article 6 of this Regulation.

10.2. Likewise, the contracting Coopacs must inform the Superintendency, in writing, of the reasons motivating the change of audit firm after the respective contract has been signed.

10.3. In the cases cited above and when deemed pertinent, the Superintendency may summon the representatives of the audit firm.

CHAPTER III RESPONSIBILITIES OF THE AUDIT FIRMS

Article 11. Requirement for rotation of the Audit Firm, the partner, and the audit team

11.1. The Audit Firm may sign a contract with the Coopac to issue an opinion on the reasonableness of the financial statements for up to three (3) consecutive periods.

The signing of a contract corresponds to each annual period. Once this maximum term has concluded, a period of at least two (2) years must elapse before said Audit Firm can again perform the evaluation of the reasonableness of the Coopac's financial statements.

The audit firm is responsible for the obligation to rotate the partners responsible for issuing an opinion on the reasonableness of the financial statements and all members of the team, after two (2) consecutive annual exercises of having performed audit work in the same Coopac. Once this maximum term has concluded, a period of at least two (2) years must elapse before said persons can again perform the evaluation of the reasonableness of the Coopac's financial statements.

11.2. Regarding the evaluation of the AML/CFT prevention system, this must be performed by an audit firm or a completely distinct team from the one that issued the opinion on the reasonableness of the financial statements. For this purpose, the team includes the partner.

11.3. The rotation required for the financial statement audit is also applicable to the audit firm and the team that prepares the report on the evaluation of the AML/CFT prevention system.

11.4. For all effects mentioned in the preceding paragraphs, the work performed by said persons in the audited Coopac is cumulative, even if they were part of another audit firm.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Article 12. Information on significant facts

12.1. Audit firms have the obligation to communicate in writing to this Superintendency within ten (10) days of becoming aware, of the significant facts they detect in the audit process of Coopacs, without prejudice to including them in the corresponding reports.

12.2. Significant facts must be communicated by the audit firm to the Coopac, simultaneously to the Board of Directors and Management, no later than the day following the determination of said finding. The Coopac must have five (05) days for the corresponding remediation. Audit firms have the obligation to communicate in writing to the Superintendency no later than the day following the expiration of the remediation period, provided that the significant finding had not been remedied.

Article 13. Responsibility of audit firms

13.1. Audit firms assume full responsibility for the reports they issue that do not appropriately reveal situations demonstrating the lack of solvency, insufficient equity and/or acute financial or economic weakness of the audited cooperative, as of the date of the examination.

13.2. In case audit firms identify problems that do not allow the examinations to be carried out adequately, they must communicate this immediately to the Superintendency and indicate in the respective reports the reasons that prevented such evaluation.

Article 14. Application of international audit standards

The examinations that audit firms carry out in accordance with what is provided in this Regulation will be carried out applying the International Standards on Auditing (ISA) and Related Services issued by the International Auditing and Assurance Standards Board (IAASB) of the International Federation of Accountants (IFAC) and approved by the Board of Deans of the College of Public Accountants of Peru, as well as the provisions established by the Superintendency.

Article 15. Conservation of documents supporting the opinion and reports

15.1. The audit firm must document efficiently and completely the audit work performed, to support its opinion and evidence that said work was carried out in conformity with what is established in the Regulation.

15.2. Within thirty (30) days following the signing of the audit report, the audit firm must have the audit file prepared.

15.3 The audit firm must conserve and safeguard the documentation supporting the reports issued, for a period of ten (10) years following the audited exercise.

Article 16. Support of the opinion and reports

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

16.1 This Superintendency may expressly require that the audit firm support the audit reports indicated in this Regulation, in which case the audit firm must make available the working papers and other documentation supporting said request within the timeframe established by the Superintendency.

16.2 The date for this diligence may not be rescheduled except for a single time and through a duly justified request by the audit firm.

16.3 It is considered that the audit firm has not supported the audit reports indicated in this Regulation when: a) The audit firm does not attend the support diligence on the scheduled date; and/or, b) The audit firm attends without sufficient audit documentation to support the audit report.

CHAPTER IV FINANCIAL STATEMENT AUDIT

Article 17. Opinion on the financial statements

17.1. The opinion on the financial statements must contain the audit firm's opinion regarding the reasonableness of the financial statements, in accordance with the provisions issued by the Superintendency, and in case of situations not foreseen in said norms, by what is provided in the International Financial Reporting Standards (IFRS).

17.2. If there are qualifications to the opinion, these must be clearly identified and, when applicable, quantified within the same.

Article 18. Notes to the financial statements

Audit firms must verify that Coopacs comply with revealing in the "Notes to the financial statements" information whose disclosure is required by norms issued by the Superintendency and by the International Financial Reporting Standards (IFRS).

Article 19. Report on the internal control system

The report on the internal control system performed by external auditors forms part of the control component in the comprehensive risk management, focusing on the information objective, mainly of an accounting and external financial nature, which must consider, at least, the following: a) Evaluation of the internal control system in the scope of external audit, which must record the details of deficiencies found, analysis of their origin, and suggestions to overcome them, primarily impacting the critical areas inherent to the nature of the operations of each Coopac; b) Evaluation of the Coopac's information systems in the scope of external audit, which includes, among others, the flow of information at the internal levels of the Coopac for its adequate management, and the selective review of the validity of the data contained in the supplementary information to the financial statements (annexes and reports) that Coopacs present to this Superintendency, according to the current norms on the matter; c) Evaluation of policies and procedures for the identification and administration of risks, in accordance with the provisions established by the Superintendency; and, d) Degree of compliance with the recommendations raised to remedy the observations formulated by the Internal Audit Unit, this Superintendency, and by the corresponding audit firms for the last two exercises.

Article 20. Supplementary reports

Audit firms will review everything that led to the preparation of the financial statements, which includes accounting records, policies, procedures, systems used, and supplementary information associated with the main risks facing the Coopac, based on sampling criteria, as applicable and in accordance with applicable audit standards. Notwithstanding the foregoing, they must prepare the corresponding supplementary reports on the following topics:

1. Review of the classification of debtors in accordance with what is provided in current norms based on a representative sample of the credit portfolio, which must comprise at least fifty percent (50%) of the total amount of the portfolio, and must necessarily include the 20 main debtors of the Coopac. The report must contain the result of the review of the following aspects: a) The additional criteria considered for the determination of the sample of debtors in the credit portfolio; b) Classification of debtors by categories, indicating those that have observations or discrepancies with the Coopac's classification and that signify a deficit of provisions or non-compliance with legal limits, in which case the name or corporate name of the debtor receiving the financing, types of financing granted and their amount, and the nature of the observation and/or classification discrepancy must be indicated; c) Compliance and chronological adequacy of the constitution of provisions required by legal provisions; d) Refinancing of credits, classification, and the sufficiency of their provisions, in accordance with norms issued by the Superintendency, recording those credits with periodic refinancings or that deserve observations; e) Restructuring of credits, compliance with the requirements and limits applicable to each modality; f) Policies and procedures for granting, monitoring, recovery, and write-off of credits; likewise, the admission of the debtor must be evaluated through the assessment of payment capacity; g) Procedures adopted for assets adjudicated and received in payment of debts; and, h) Situation of the guarantees received and the suitability of the valuations made to the guarantees, indicating the selected sample, for debtors other than those classified as normal.

2. Review of the compliance with global and individual limits:

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

a) Verification of the correct calculation of risk-weighted assets and effective equity; b) Verification of the compliance with the operational limits of the Coopac, both global and individual; c) Risk weighting of assets and contingent credits carried out by the Coopac, in accordance with norms on the matter; and, d) Authorized investments.

3. Review of the investment portfolio, which will be carried out based on a sample comprising at least fifty percent (50%) of the total amount of the portfolio, and will incorporate at least the following aspects: a) Verification of the valuation of investments in accordance with norms established by the Superintendency; b) Verification of adequate accounting recording; c) Review of compliance with the constitution of gains and losses by valuation, impairment losses, as well as reversals of impairment, in accordance with current norms. For the impairment of investments available for sale and at maturity, the compliance with the methodology established or authorized by the Superintendency must be reviewed; d) Compliance with the investment policy and policies and procedures regarding the administration of market risks incurred by the Coopac; and, e) Concentration of investments in economic groups and in sectors or economic activities.

4. Review of the existing controls in the Coopac, of the management of the security of the information of the computer systems that produce the financial information, in the scope of external audit.

5. Report on Comprehensive Risk Management.

The report must contain the result of the review of the following aspects, taking into consideration what is provided in the Regulation of Comprehensive Risk Management for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds (GIR Regulation): a) Implementation of the GIR Regulation and its components; b) Policies and/or procedures, as well as the tools and methodologies implemented by the Coopac to manage its risks; c) Methodology used by the Coopac to determine its levels of risk appetite and tolerance; d) Processes carried out for the management of the business model, emphasizing the relevant risks of the material business lines of the Coopac, that is, of that business line that represents the highest income of the Coopac.

6. The Compliance Report related to the executive functions of the Coopac, which must contain the review of what is indicated in letter l) of numeral 1 of the Twenty-Fourth Final and Complementary Provision of the General Law.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

Article 21. Deadlines for submission of opinions and reports

Audit firms must present the following information annually within the following deadlines: a) Report on the evaluation of the internal control system: The submission deadline will be December 20 of the year corresponding to the exercise being audited; b) Opinion and audited financial statements, as well as supplementary reports indicated in Article 20 of this Regulation: The submission deadline is the last business day of February of the year following the audited exercise.

CHAPTER V EXAMINATIONS OTHER THAN FINANCIAL STATEMENT AUDIT

Article 22. Examinations other than financial statement audit

This Superintendency may require the performance of examinations carried out by audit firms, not related to the financial statements.

SINGLE SUBCHAPTER EVALUATION OF THE AML/CFT PREVENTION SYSTEM

Article 23. Evaluation of the AML/CFT prevention system

23.1 The evaluation of the AML/CFT prevention system of Coopacs must contain, at a minimum, the evaluation of the following aspects: a) Internal controls implemented by Coopacs to prevent or detect AML/CFT; b) Alert signals for the detection of unusual operations; c) Identification and knowledge of members; d) Conservation and storage of physical and electronic information corresponding to the documentation of members and operations; e) Records of unusual operations, criteria for not considering them suspicious, as well as evaluation of the procedures of Coopacs to carry out such registration; f) Record of suspicious operations, evaluation of the procedures followed by Coopacs to carry out the registration, as well as for their communication to the UIF-Peru; g) Mechanisms for dissemination of internal and external regulations, as well as procedure manuals; h) Procedures for due diligence in the knowledge of executives, managers, main officials, workers, suppliers, and counterparties (the latter when applicable); i) Knowledge and training of executives, managers, main officials, workers, suppliers, and counterparties (the latter when applicable) of the AML/CFT prevention program; j) Security procedures for the storage of physical and electronic information corresponding to the record of operations; k) Plan and work procedures of the Compliance Officer; l) Plan, procedures, and working papers of Internal Audit;

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

m) Internal sanctions for non-compliance with the Code of Conduct, the AML/CFT prevention Manual, or current norms on AML/CFT prevention; and, n) Others established by the Superintendency.

23.2. The Superintendency may subsequently define the electronic means for the submission of the report, including additional information that facilitates its processing, whose format will be published on the Supervised Portal.

Article 24. Minimum procedures for the evaluation of the AML/CFT prevention system

24.1. The minimum procedures that audit firms must apply to the examination on the evaluation of the AML/CFT prevention system are those cited in the Annex. The update that the Superintendency makes on the procedures contained in the Annex will be disseminated through its institutional portal (www.sbs.gob.pe).

24.2. Audit firms do not have access to information protected by the duty of confidentiality, provided for in Article 12 of Law No. 27693 and its amendments.

Article 25. Report on the evaluation of the AML/CFT prevention system

The structure of the Report on the evaluation of the AML/CFT prevention system must contain, at least, the following information: a) Reason for the performance of the examination and, if applicable, refer to the existence of relevant information or significant facts; b) Objective, scope, and limitations (if applicable); c) Legal regulations; d) Evaluate the implementation of the AML/CFT prevention system, and its components of compliance and AML/CFT risk management, in accordance with what is provided in the AML/CFT Regulation; e) Observations detected and corrective measures recommended to remedy the identified deficiencies, for each of the aspects analyzed in the matter of the examination; f) Firm personnel in charge of the examination; g) Start and end date of the examination; and, h) Signature of the person in charge of the examination, the reviewer of the examination, and the partner of the firm, as applicable.

Article 26. Deadlines for submission of reports

Regarding the Report on the Evaluation of the AML/CFT Prevention System, the submission deadline will be the last business day of February of the year following the audited exercise. Audit firms will directly, simultaneously, send a copy of said report to the Superintendency and another to the Coopac.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000

CHAPTER VI POWERS OF THE SUPERINTENDENCY

Article 27. Powers of the Superintendency

27.1. The Superintendency may order the hiring of a different audit firm or expand the scope of the audit performed, as well as the timing of the examinations, at the cost of the Coopacs, when: a) The results of the audit examinations performed do not comply with what is provided in this Regulation, or are not satisfactory in the opinion of the Superintendency; and/or, b) It is required to carry out complementary examinations to those established in this Regulation.

27.2. In the same way, the Superintendency may require, in cases it deems convenient, the performance of external audits on Coopacs with total assets below six hundred (600) UIT.

27.3. Likewise, it may convene periodic meetings with audit firms, in order to address aspects related to the operations of the audited Coopacs.

27.4. The Superintendency may declare that the audit opinion issued by the audit firm does not comply with the provisions of this Regulation, or when the Superintendency detects material omissions, in line with what is established in the International Standards on Auditing (ISA), not reported by the audit firms that affect its opinion on the information subject to evaluation, being able to order that a new audit report or a new external financial audit be presented.

27.5 The Superintendency may require the performance of examinations carried out by audit firms, not related to the examinations indicated in this Regulation.

COMPLEMENTARY FINAL PROVISIONS

First. - Annual report

The annual report prepared by the Coopac must contain the opinion of external auditors on the financial statements corresponding to the examined exercise, as well as the financial statements and their respective notes.

Second. - Audit fees

In the Annual Report, the Coopac must reveal, in a comparative manner for the last two economic exercises, the services provided by the audit firms, under the following headings: a) Audit Fees. - It must reveal the total of the fees for the audit services provided by the audit firm for each of the last two exercises.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

b) Fees related to Audit. - The total fees for services provided by audit firms for advisory services and services related to the development of the audit or review of the Coopac's financial statements, which are not disclosed in the previous paragraph, must be disclosed. The Coopac will disclose the nature of the services included in this category.

c) Tax Fees. - The total fees billed in the last two fiscal years for professional services provided for tax compliance, tax advisory, and tax planning must be disclosed. The Coopac will disclose the nature of the services included in this category.

d) Other Fees. - The total fees billed in the last two economic years for products and services other than those included in the previous letters will be disclosed. The Coopac will disclose in summary form the nature of the services included in this category.

Third. - Information The sanctions applied by the Superintendency to audit firms will be reported to the RESAE.

Likewise, Coopacs must inform the Superintendency of the resolution of contracts entered into with audit firms and the application of the penalty indicated in letter g) of article 6° of this Regulation.

Fourth. - Coopac in liquidation This Regulation will apply to Coopac in liquidation insofar as pertinent, and they must adhere to the provisions established in articles 36° and 37° of the Regulation of Special Regimes and Liquidation of Savings and Credit Cooperatives Not Authorized to Attract Public Funds, approved with SBS Resolution No. 5076-2018.

Article Second.- The Annex approved in article one of this Resolution is published on the Institutional Portal (www.sbs.gob.pe), in accordance with what is established in Supreme Decree No. 001-2009-JUS and its amendments.

Article Third.- Modify the Regulation of Integral Risk Management for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds, approved by SBS Resolution No. 13278-2009, according to the following:

1. Incorporate the following definition in numeral 1 of letter A: "t) Internal Control System.- Integrated set of processes, policies, procedures, and control techniques established and executed at each level of the Coopac's organizational structure to achieve adequate administrative organization, operational efficiency, reliability of information, appropriate identification and management of the risks it faces, and compliance with the legal provisions applicable to it."

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000

Article Fourth.- This norm enters into force the day after its publication in the Official Gazette El Peruano, from which date the External Audit Regulation for Savings and Credit Cooperatives Not Authorized to Operate with Public Funds, approved by SBS Resolution No. 741-2001 and its amendments, is repealed.

Register, communicate, and publish.

MARIA DEL SOCORRO HEYSEN ZEGARRA Superintendent of Banks, Insurance, and AFP