Resolution SBS No. 4465-2016: Approves the New Regulation for the Expansion of Operations and Amends Other Legal Provisions

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 1/8 Lima, August 17, 2016 S.B.S. Resolution No. 4465-2016 The Superintendent of Banking, Insurance and Private Pension Fund Administrators

CONSIDERING:

That, Article 221 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendence of Banking and Insurance, Law No. 26702 and its modifying norms, hereinafter General Law, establishes the list of operations and services that companies in the financial system may provide, subject to what is provided in Articles 283 to 289 of the General Law;

That, Articles 283 to 289 of the General Law indicate the operations that may be carried out by multiple-operation companies in the financial system according to the type of company, stating that companies may carry out other operations listed in Article 221 of the General Law and different from those described in the aforementioned articles, provided they meet the requirements established by this Superintendence;

That, the Thirty-First Final and Complementary Provision of the General Law establishes that the authorization issued by the Superintendence for the expansion of operations of companies in the financial system will require the prior opinion of the Central Bank when it concerns the operations referred to in said provision;

That, by SBS Resolution No. 11698-2008, the Regulation for the expansion of operations was approved, considering it convenient to modify it so that the authorization procedure relates to the complexity of the operation and/or service that the company requests, and/or with the need to have the prior opinion of the Central Reserve Bank;

That, by SBS Resolution No. 1737-2006 and its modifying norms, the Regulation for the negotiation and accounting of financial derivative products in companies in the financial system was approved, considering it convenient to establish clarifications regarding the requirements that must be met to operate with said products;

That, in light of the new provisions, it is necessary to modify Procedure No. 38 "Authorization to operate with financial derivative products for trading purposes applicable to companies in the financial system", No. 102 "Authorization for the expansion of operations of multiple-operation companies in the financial system" and No. 156 "Authorization to operate with financial derivative products for hedging purposes applicable to companies in the financial system" in the Single Text of Administrative Procedures - TUPA of the Superintendence of Banking, Insurance and AFP, approved by SBS Resolution No. 3082-2011 and its modifications;

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 2/8

That, in order to collect opinions from the general public regarding the proposed modifications to the regulations applicable to supervised companies, the draft resolution was published on the electronic portal of the Superintendence, in accordance with what is provided in Supreme Decree No. 001-2009-JUS;

Having the approval of the Adjunct Superintendencies of Banking and Microfinance, Risks, Economic Studies and Legal Advice; and,

In exercise of the powers conferred by numbers 2, 7 and 9 of Article 349 of the General Law;

RESOLVES:

Article First.- Approve the new Regulation for the Expansion of Operations, in the following terms:

"REGULATION FOR THE EXPANSION OF OPERATIONS

Article 1.- Scope
This Regulation regulates the process of expansion of operations and/or services of multiple-operation companies indicated in numbers 1, 2, 3, 4, 5 and 7 of letter A of Article 16 of the General Law, hereinafter companies.

Article 2.- Definitions
For the purposes of this Regulation, the following definitions shall be considered:
a) Central Bank: Central Reserve Bank of Peru. b) General Law: General Law of the Financial System and the Insurance System and Organic Law of the Superintendence of Banking and Insurance, Law No. 26702 and its modifying norms. c) Superintendence: Superintendence of Banking, Insurance and Private Pension Fund Administrators.

Article 3.- Authorization to carry out additional operations and/or services
Companies that wish to carry out new operations and/or services established in Article 221 of the General Law that require prior authorization from this Superintendence must follow the corresponding procedure according to the type of operation and/or service:

1. Operations and/or services that require only development authorization
   For the following operations and/or services of Article 221 of the General Law, companies must have only authorization for the development of new operations and/or services, whose requirements are established in Article 4 of this Regulation:
   a. Granting mortgage and pledge loans; and, in relation to them, issuing securities, mortgage and pledge instruments, both in national and foreign currency. b. Buying, holding and selling shares of banks or other institutions abroad that operate in financial intermediation or in the securities market, or are auxiliaries of one or the other, in order to give international scope to their activities. Regarding the purchase of these shares, in a percentage greater than three percent (3%) of the recipient's equity, prior authorization from the Superintendence is required.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 3/8

c. Issuing and placing bonds, in national or foreign currency, including ordinary, convertible, financial leasing, and subordinated bonds of various types and in various currencies, as well as promissory notes, negotiable or non-negotiable deposit certificates, and other instruments representing obligations, provided they are of their own issuance.
d. Acquiring, holding and selling shares of companies whose object is to provide complementary or auxiliary services to the companies and/or their subsidiaries. e. Issuing bank certificates in foreign currency and carrying out international exchanges. f. Acting as a financial agent for the placement and investment in the country of external resources. g. Carrying out structured financing operations and participating in securitization processes, subject to what is provided in the Securities Market Law. h. Receiving securities, documents and objects in custody, as well as renting safety deposit boxes.
i. Subscribing temporarily to first issuances of securities with partial or total guarantee of their placement.
j. Buying, holding and selling gold.

After obtaining the development authorization for the aforementioned operations and/or services, for the series issuance of financial instruments and for the issuance of instruments representing subordinated debt, the specific norms issued by the Superintendence for such operations must be taken into account.

2. Operations and/or services that require development and implementation authorization
   For the following operations and/or services of Article 221 of the General Law, companies must first have the development authorization indicated in the previous number, and after having carried out the necessary actions for the implementation of the new operations and/or services and before their launch to the public, they must have authorization for the implementation of new operations and/or services, whose requirements are established in Article 5 of this Regulation:
   a. Receiving demand deposits. b. Receiving time and savings deposits, as well as in custody.
   c. Granting overdrafts or advances on current accounts.
   d. Issuing, advising, confirming and negotiating letters of credit, at sight or at term, in accordance with international usage and in general channeling foreign trade operations. e. Issuing manager's checks. f. Issuing payment orders. g. Issuing traveler's checks. h. Issuing and administering credit and debit cards.
   i. Issuing electronic money.

3. Operations with financial derivative products
   Companies that wish to carry out operations with financial derivative products must request authorization in accordance with what is provided in the Regulation for the negotiation and accounting of financial derivative products in companies in the financial system.

4. Other operations and/or services
   For the operations and/or services referred to in number 44 of Article 221 of the General Law, the company must communicate to the Superintendence the characteristics of the new operation or financial service. Based on this information, the Superintendence will issue its

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 4/8 pronouncement within thirty (30) calendar days of presenting said information, indicating the applicable authorization process.

Article 4.- Request for development authorization of new operations and/or services
To obtain the development authorization for new operations and/or services, companies must send to this Superintendence a development request for new operations and/or services signed by the General Manager, attaching the following documentation:
a. Certified copy of the agreement of the competent social body where the decision to carry out the requested operations and/or services is recorded. b. Market, financial and management feasibility study that includes, at minimum, the following points:
i. Description of the new operations and/or services.
ii. Target market, situation and prospects of the market to which it plans to enter, analysis of the competition and estimation of potential demand.
iii. Channels and marketing strategies.
iv. Description of the operational processes associated with the new operations and/or services.
v. Description of the changes in the business, operational or computer environments of the company.
vi. Information on the areas responsible for executing the processes associated with the new operations and/or services.
vii. Measures adopted to ensure that there is suitable personnel for the management of the new operations and/or services.
viii. Estimation of the required investment and cost-benefit evaluation of the new operations and/or services.
c. Draft modification of the company's bylaws, if applicable, for the case of operations and/or services that only require a development request; or draft modification of the company's bylaws, if applicable, for the cases of operations and/or services that require development and implementation authorization.
d. Report from the Risk Unit, or equivalent area, which contains an evaluation of the risks associated with the new operations and/or services. Said report must include the minimum content indicated in number 3 of Circular G-165-2012, referred to risk reports for new products or important changes in the business, operational or computer environment. e. Report from the compliance officer containing the evaluation of the level of exposure to AML/CFT risks in accordance with what is indicated in Article 23 of the Regulation for the Management of Money Laundering and Terrorism Financing Risks. f. Development and implementation schedule, when applicable, which includes the planned launch date. g. Other information that the Superintendence might require or that the company considers necessary to send for evaluation.

Additionally, to evaluate the granting of the development authorization resolution, the Superintendence will take into account complementary evaluation factors such as the entity's solvency levels, the solidity of corporate governance and the risk management system, among other criteria it considers relevant.

In the case of operations and/or services that only require development authorization, the implementation of the new operation and/or new service may be evaluated by this Superintendence subsequently to the launch of the operation and/or service. In this sense,

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 5/8 the Modified Policies and Procedures Manuals and Organization and Functions must remain available to the Superintendence in accordance with the new operations and/or services, as well as the Report with the opinion of the Internal Audit Unit on the carrying out of the new operations and/or services. Likewise, the company must communicate to the Superintendence when the new operation and/or service begins to be put into operation.

Article 5.- Request for implementation authorization of new operations and/or services
For the operations and/or services indicated in number 2 of Article 3, prior to the presentation of the request for implementation authorization of new operations and/or services, companies must have obtained the corresponding development authorization. To obtain the implementation authorization for new operations and/or services, companies must send to this Superintendence a request signed by the General Manager in which it is indicated that the company has carried out the necessary activities to offer the new operations and/or services, attaching the following documentation:
a. Draft modification of the company's bylaws, if applicable. b. Policies and Procedures Manuals, as well as Organization and Functions, modified in accordance with the new operations and/or services.
c. Report from the Risk Unit, or equivalent area, which contains an updated evaluation of the risks associated with the new operations and/or services. Said Report must include the minimum content indicated in number 3 of Circular G-165-2012, referred to risk reports for new products or important changes in the business, operational or computer environment.
d. Report containing a description regarding the technological infrastructure and information systems that will support the new operations and/or services. Said report must contain the security measures and business continuity strategies implemented or planned. e. Report from the compliance officer describing the actions and/or changes developed in the AML/CFT risk prevention and management system and that have arisen from the evaluation of the level of exposure to AML/CFT risks to which the new operations and/or services would be exposed. f. Report with the opinion of the Internal Audit Unit on the carrying out of the new operations and/or services. g. Other information that the Superintendence might require or that the company considers necessary to send for evaluation.

The company must communicate to the Superintendence when the new operation and/or service begins to be put into operation.

Article 6.- Communication to the Central Bank
The following operations and/or services established in Article 221 of the General Law require prior opinion of the Central Bank for the development authorization issued by the Superintendence:
a. Receiving demand deposits. b. Receiving time and savings deposits, as well as in custody.
c. Granting overdrafts or advances on current accounts.
d. Issuing manager's checks. e. Issuing payment orders. f. Issuing traveler's checks. g. Issuing electronic money.

For this purpose, once the complete documentation indicated in Article 4 of this Regulation, referred to the aforementioned operations, has been received, and the corresponding evaluation has been carried out, the Superintendence will send the aforementioned documentation to the Central Bank, in order for said control body to issue its opinion.

Article 7.- Authorization deadlines, expiration and revocation of authorization
Within a maximum period of ninety (90) business days calculated from the presentation of the complete documentation indicated in Article 4 of this Regulation, and after the corresponding evaluation, the Superintendence, if it considers it appropriate, issues the corresponding development authorization resolution for new operations or services. In the case of operations and/or services listed in Article 6, the request presented will be brought to the knowledge of the Central Bank, in order for said entity to issue its opinion within a period that will not exceed thirty (30) calendar days from receipt of the corresponding letter, in accordance with what is established in the Twenty-Second Final and Complementary Provision of the General Law. Said period is included within the aforementioned ninety (90) business days.

For the operations indicated in number 2 of Article 3, the development authorization resolution for new operations or services expires after two (2) years from issuance.

Within a maximum period of sixty (60) business days calculated from the presentation of the complete documentation indicated in Article 5 of this Regulation, and after the corresponding evaluation, the Superintendence, if it considers it appropriate, issues the corresponding implementation authorization resolution for new operations or services.

In exceptional cases, such as not offering the operation or service for extended periods after the corresponding implementation authorization resolution has been issued, the Superintendence may revoke said authorization.

Article 8.- Verification of requirements
The Superintendence may dispose, before the issuance of the corresponding implementation authorization resolution, the carrying out of an on-site verification on the compliance with the requirements established in this Regulation, in order to evaluate the company's capacity to carry out the additional operations and/or services.

Article 9.- Simplified procedure for issuing and administering credit cards 1

1. Through the simplified authorization procedure, companies that meet the conditions indicated in the following number do not require having previously obtained the development authorization referred to in number 2 of Article 3 of this Regulation, to issue and administer credit cards.

2. Companies must meet the following conditions:
   a) Risk classification in the "B-" risk category or higher in the last semester, considering the highest risk classification granted by rating companies, in accordance with the provisions indicated in the Regulation for the classification of companies in the financial system and insurance companies approved by SBS Resolution No. 18400-2010.

1 Article incorporated by SBS Resolution No. 1049-2021 of April 8, 2021.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511)6309000 Fax: (511) 6309239 6/8

b) Be authorized to issue debit cards. c) Adequate organizational and management structure regarding the new operation, for which they must:
i. Have defined roles, responsibilities, policies and procedures.
ii. Have computer systems that support the administration, processing and monitoring of credit card operations.
iii. Comply with what is provided in the Credit and Debit Card Regulation, approved by SBS Resolution No. 6523-2013 and its modifications, or the norm that replaces it; indicating the action plans established for those requirements in which work is being done to achieve adequate compliance.

3. Companies must present a request for implementation authorization signed by the General Manager, which must be accompanied by the following documents:
   i. Certified copy of the agreement of the competent social body where the decision to carry out the new operation is recorded.
   ii. Sworn declaration, according to the model attached as Annex 1 to this Regulation, of compliance with what is established in number 2 of this article, attaching a report that describes how the company complies with each item established in letter c) of number 2. Said report must be presented according to the format published by the Superintendence on the Supervised Portal, keeping the corresponding supporting information available to the Superintendence. In case the companies consider it convenient, they may attach an external evaluation by a specialized company.
   iii. Market, financial and management feasibility study, which includes the elements referred to in items i, ii, iv and viii of letter b of Article 4 of this Regulation.
   iv. Risk report for new products and important changes, as required in Circular No. G-165-2012, which among the mitigation measures for identified risks must consider insurance for frauds and electronic or cybercrimes, among others.

4. Within a maximum period of thirty (30) calendar days calculated from the presentation of the complete documentation indicated in number 3 of this article, if it considers it appropriate, the Superintendence issues the corresponding implementation authorization resolution to issue and administer credit cards.

5. For companies that do not comply with what is established in numbers 2 and 3 of this article, and wish to issue and administer credit cards, what is provided in Articles 3, 4, 5, 7 and 8 of this Regulation will apply.

Transitory Provision
Sole.- The authorization processes that are pending at the date of entry into force of this Regulation will be governed by the Regulation for the expansion of operations approved by SBS Resolution No. 11698-2008.

In case the company that is processing an expansion of operations through the Regulation approved by SBS Resolution No. 11698-2008 wishes, it may request to invalidate said process and start a new one within the framework of this Regulation."

Article Second.- Modify the third and fourth paragraphs of Article 20 of the Regulation for the negotiation and accounting of financial derivative products

Los Laureles Nº 214 - Lima 27 - Perú Telf. : (511)6309000 Fax: (511) 6309239 8/8 in companies within the financial system, approved by Resolution SBS No. 1737-2006 and modifying norms, according to the following:

“To initiate the authorization procedure, companies must submit a request signed by the General Manager, which must be accompanied by the following:
a) Certified copy of the agreement of the competent social body where the authorization granted for the realization of new derivative financial products is recorded. b) Deed of modification of the company's bylaws, if applicable. c) Report with the opinion of the Internal Audit Unit on the realization of new operations and/or services. d) “Report to carry out operations with Derivative Financial Products” referred to in Article 22 of this norm, with all the information and documentation required therein. e) Minutes of the Risk Committee recording the approval of the “Report to carry out operations with Derivative Financial Products”. f) Other requirements that the Superintendency deems pertinent, in order to demonstrate the company's capacity to operate with derivative financial products.

Once the complete documentation is received, this Superintendency will evaluate it and, provided it finds no objection to its approval, will forward it to the Central Bank for its opinion. In its evaluation, this Superintendency will consider the intention of its contracting, the complexity of negotiation (if applicable), position control, fair value measurement, accounting record, and risk monitoring of the requested products, among other factors. Additionally, to evaluate the granting of the authorization resolution, the Superintendency will take into account the minimum capital, corporate governance, risk management, among other criteria it considers relevant.”

Third Article.- Modify Procedures No. 38
“Authorization to operate with financial derivative products for trading purposes applicable to companies within the financial system”, No. 102 “Authorization for the expansion of operations of multiple operation companies within the financial system” and No. 156 “Authorization to operate with financial derivative products for hedging purposes applicable to companies within the financial system” in the Single Text of Administrative Procedures – TUPA of the Superintendency of Banking, Insurance and Private Pension Fund Administrators, approved by Resolution SBS No. 3082-2011, whose text is attached to this Resolution and is published in accordance with what is established in Supreme Decree No. 004-2008-PCM, regulation of Law No. 29091. (Institutional portal: www.sbs.gob.pe).

Fourth Article.- This Resolution enters into force on October 1, 2016, from which date the Regulation for the expansion of operations, approved by Resolution SBS No. 11698-2008, shall be repealed.

Register, communicate and publish.
JAVIER MARTÍN POGGI CAMPODÓNICO
Superintendent of Banking, Insurance and
Private Pension Fund Administrators (e)