Resolution SBS No. 504-2021: Approves the Regulation for the Management of Information Security and Cybersecurity, Amending Other Regulations

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239 Lima, February 19, 2021

Resolution S.B.S.
No. 504-2021
The Superintendent of Banking, Insurance and
Private Pension Fund Administrators

CONSIDERING:

That, the Regulation on Corporate Governance and Integrated Risk Management, approved by Resolution SBS No. 272-2017, incorporates provisions aimed at ensuring that supervised companies have adequate risk management and corporate governance;

That, through the Regulation for the Management of Operational Risk, approved by Resolution SBS No. 2116-2009, provisions are included that companies must comply with in the effective management of operational risk;

That, this Superintendence issued Circular G-140-2009 with the aim of establishing minimum criteria for adequate information security management;

That, it is necessary to update the regulations on information security management through the approval of a regulation, complementary to the Regulation for the Management of Operational Risk, taking into account international standards and best practices on information security, including those published by the National Institute of Standards and Technology and the ISO/IEC standards family;

That, the growing interconnectivity and greater adoption of digital channels for service provision, as well as the virtualization of some products, in the financial, insurance, and private pension systems, makes it necessary for companies in these supervised systems to strengthen their cybersecurity capabilities and authentication processes;

That, likewise, it is necessary to modify the Regulation on Credit and Debit Cards, approved by Resolution SBS No. 6523-2013 and its modifying norms; the Regulation on Electronic Money Operations approved by Resolution SBS No. 6283-2013 and its modifying norms; the Internal Audit Regulation, approved by Resolution SBS No. 11699-2008 and its modifying norms; as well as the External Audit Regulation, approved by Resolution SBS No. 17026-2010 and its modifying norms;

That, to collect public opinions, the draft resolution on the matter was pre-published on the electronic portal of the Superintendence, under the provisions of Supreme Decree No. 001-2009-JUS;

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239 With the approval of the Adjunct Superintendencies of Banking and Microfinance, Private Pension Fund Administrators, Insurance, Risks, Market Conduct and Financial Inclusion, and Legal Advice; and,

In exercise of the powers conferred by paragraphs 7 and 9 of Article 349 of the General Law of the Financial System and the Insurance System and the Organic Law of the Superintendence of Banking and Insurance, Law No. 26702 and its amendments, and paragraph d) of Article 57 of the Law on the Private System for the Administration of Pension Funds, whose Unified Text of Ordained Norms is approved by Supreme Decree No. 054-97-EF;

RESOLVES:

Article First.- Approve the Regulation for the Management of Information Security and Cybersecurity, as indicated below:

REGULATION FOR THE MANAGEMENT OF INFORMATION SECURITY AND CYBERSECURITY

CHAPTER I
GENERAL PROVISIONS

Article 1. Scope
1.1. This Regulation applies to the companies indicated in Articles 16 and 17 of the General Law, as well as to Private Pension Fund Administrators (AFP), hereinafter referred to as companies, as well as those referred to in paragraphs 1.2 and 1.3.

1.2. It also applies to the National Bank, the Agricultural Bank, the Development Financial Corporation (COFIDE), the MIVIVIENDA Fund S.A., and the Benefit Distributions and Benefit Funds under the control of the Superintendence, insofar as they do not conflict with specific regulations governing the activities of said institutions.

1.3. It applies to insurance brokerage companies in accordance with the provisions of the Fourth Final Complementary Provision of this Regulation.

Article 2. Definitions
For the purposes of applying this Regulation, the following definitions shall be considered:

a) Information Asset: Information or the medium on which it resides, which is managed according to business needs and legal requirements, so that it can be understood, shared, and used. It has value for the company and has a lifecycle.

b) Threat: An event that can adversely affect the operations of companies and their information assets, by exploiting a vulnerability.

c) Authentication: For the purposes of this norm, it is the process that allows verifying that an entity is who it claims to be, for which it uses the credentials assigned to it. Authentication can use one, two, or more independent authentication factors, so that the unauthorized use of one of them does not compromise the reliability or access to the other factors.

d) Digital Channel: Medium used by companies to provide services whose storage, processing, and transmission are carried out through the representation of data in bits.

e) Cybersecurity: Protection of information assets through prevention, detection, response, and recovery from incidents that affect their availability, confidentiality, or integrity in cyberspace; which in turn consists of a complex system that has no physical existence, in which people, devices, and computer systems interact.

f) Credential: Set of data generated and assigned to an entity or user for authentication purposes.

g) Directory: Directory or equivalent body.

h) Entity: User, device, or computer system that has an identity in a system, which makes it separate and distinct from any other in said system.

i) Event: An occurrence or series of occurrences that can be internal or external to the company, originating from the same cause, that occurs during the same time period, as defined in the Regulation on Corporate Governance and Integrated Risk Management.

j) User Authentication Factors: Those factors used to verify the identity of a user, which may correspond to the following categories:

• Something only the user knows.
• Something only the user possesses.
• Something the user is, which includes biometric characteristics.

k) Identity: A collection of attributes that exclusively define an entity.

l) Incident: An event that has been determined to have an adverse impact on the organization and that requires response and recovery actions.

m) Information: Data that can be processed, distributed, stored, and represented in any electronic, digital, optical, magnetic, printed, or other medium, which is the fundamental element of information assets.

n) Application Programming Interface: Collection of invocation methods and associated parameters that software can use to request actions from other software, which defines the terms in which they exchange data. Also known as API.

o) Cloud Services: Data processing service provided through a technological infrastructure that allows convenient and on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal effort from service providers.

p) Regulation: Regulation for the Management of Information Security and Cybersecurity.

q) Regulation on Corporate Governance and Integrated Risk Management: Regulation on Corporate Governance and Integrated Risk Management, approved by Resolution SBS No. 272-2017 and its modifying norms.

r) Regulation for the Management of Operational Risk: Regulation for the Management of Operational Risk, approved by Resolution SBS No. 2116-2009 and its modifying norms.

s) Superintendence: Superintendence of Banking, Insurance and Private Pension Fund Administrators.

t) Data Processing: The set of processes consisting of the collection, registration, organization, structuring, storage, adaptation, retrieval, consultation, use, transfer, dissemination, erasure, or destruction of data.

u) User: Natural or legal person who uses or may use the products offered by companies.

v) Vulnerability: Weakness that exposes information assets to threats that may originate incidents affecting said information assets, and others of which they are part or with which they interact.

Article 3. Information Security and Cybersecurity Management System (SGSI-C)
3.1. The information security and cybersecurity management system (SGSI-C) is the set of policies, processes, procedures, roles, and responsibilities designed to identify and protect information assets, detect security events, as well as anticipate response and recovery from cybersecurity incidents.

3.2. The information security and cybersecurity management system (SGSI-C) implies, at least, the following objectives:
a) Confidentiality: Information is only available to authorized entities or processes, including measures to protect personal and proprietary information; b) Availability: Ensure timely access to and use of information; and c) Integrity: Ensure non-repudiation of information and its authenticity, and prevent its improper modification or destruction.

Article 4. Proportionality of the information security and cybersecurity management system (SGSI-C)
4.1. The information security and cybersecurity management system (SGSI-C) of the company must be proportional to the size, nature, and complexity of its operations.

4.2. The provisions described in Chapter II, Subchapters I, II, III, and IV of this Regulation are mandatory for the following companies (General Regime):
a) Banking Company; b) Financial Company; c) Municipal Savings and Credit Cooperative - CMAC; d) Popular Credit Municipal Cooperative - CMCP; e) Rural Savings and Credit Cooperative - CRAC; f) Insurance and/or Reinsurance Company, as provided in paragraph 4.4; g) Cash Transportation, Custody, and Administration Company; h) Private Pension Fund Administrator; i) Credit and/or Debit Card Issuing Company; j) Electronic Money Issuing Company; and k) The National Bank.

4.3. The provisions described in Chapter II, Subchapter V of this Regulation are mandatory for the following companies (Simplified Regime) 1:
a) Investment Bank; b) Insurance and/or Reinsurance Company, not contemplated in paragraph 4.4; c) Small and Micro Enterprise Development Entity – EDPYME; d) Fund Transfer Company; e) Benefit Distribution and Benefit Fund under the control of the Superintendence; f) The Development Financial Corporation – COFIDE; g) The MIVIVIENDA Fund S.A.; h) Bonding and Guarantee Companies; and i) The Agricultural Bank.

4.4. Insurance and/or Reinsurance Companies whose average asset volume over the last three (3) years is greater than or equal to 450 million soles are included in the General Regime of this Regulation.

1 Paragraph modified by Resolution SBS No. 1515-2021 of 05/24/2021.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

4.5. The companies indicated in Article 1, not listed in paragraphs 4.2 or 4.3 above of this Regulation, may establish an information security and cybersecurity management system (SGSI-C) in accordance with the provisions of this Regulation.

4.6. In case the companies of the Financial System and the electronic money issuing companies listed in paragraph 4.2 find material limitations to comply with the General Regime, they may request authorization to apply the Simplified Regime of this Regulation, for which they must present a report supporting the reasonableness of the request, in terms of the size, nature, and complexity of their operations, which will be responded to by the Superintendence within sixty (60) business days 2.

4.7. The provisions described in Chapter II, Subchapter VI (Reinforced Regime) of this Regulation are mandatory for companies subject to a requirement for effective equity due to market concentration risk, as indicated in the Regulation for the requirement of additional effective equity, approved by Resolution SBS No. 8425-2011 and its modifying norms.

Article 5. Responsibilities of the Board of Directors
The Board of Directors is responsible for approving and facilitating the actions required to have an SGSI-C appropriate to the company's needs and risk profile, including:
a) Approving policies and guidelines for the implementation of the SGSI-C and its continuous improvement. b) Assigning the technical, personnel, and financial resources required for its implementation and proper functioning. c) Approving the organization, roles, and responsibilities for the SGSI-C, including guidelines for dissemination and training that contribute to a better understanding of the risks involved.

Article 6. Responsibilities of Management
6.1. The General Management is responsible for taking the necessary measures to implement the SGSI-C in accordance with the Board's provisions and what is established in this Regulation.

6.2. The managers of the business and support units are responsible for supporting the proper functioning of the SGSI-C and managing the risks associated with information security and Cybersecurity within the framework of their functions.

Article 7. Functions of the Risk Committee
7.1. In addition to the functions that have been established for the Risk Committees of companies by Superintendence regulations, the following related to information security and cybersecurity are included:
a) Approve the strategic plan of the SGSI-C and recommend actions to be taken. b) Approve the training plan to ensure that personnel, management, and the Board have the necessary competencies in information security and Cybersecurity. c) Foster a risk culture and awareness of the need for appropriate measures for its prevention.

2 Paragraph modified by Resolution SBS No. 1515-2021 of 05/24/2021.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

7.2. To fulfill the functions indicated in paragraph 7.1, the company may constitute a Specialized Committee on Information Security and Cybersecurity (CSIC). For companies included in the simplified regime, which do not have a Risk Committee or a CSIC, the aforementioned functions are assigned to the General Management.

Article 8. Information Security and Cybersecurity Function
8.1. The responsibilities of the information security and cybersecurity function are:
a) Propose the strategic plan of the SGSI-C and develop operational plans. b) Implement and manage the daily operations necessary for the effective functioning of the SGSI-C. c) Implement authentication processes to control access to the information and systems used by the company, and to the services it provides. d) Report periodically to the Risk Committee on the risks the company faces in terms of information security and cybersecurity. e) Report information security incidents to the Risk Committee or CSIC, according to the guidelines established by it, and to government entities as required by current regulations. f) Evaluate security threats in the business continuity strategies defined by the company and propose risk mitigation measures, as well as report to the Risk Committee or CSIC. g) In general, do what is necessary to duly comply with what is established in this Regulation.

8.2. Companies must implement the information security and cybersecurity function. They must also have a multidisciplinary team for managing cybersecurity incidents, which must be trained to implement the plan and procedures for managing them, composed of representatives from areas that allow anticipating legal, technical, and organizational aspects, consistent with the cybersecurity program requirements established in this Regulation.

8.3. Companies included in the simplified regime must have an information security and cybersecurity function that complies at least with letters a), e), f), and g) of paragraph 8.1 of this article.

Article 9. Information to the Superintendence
As part of the periodic reports on operational risk management required by the Regulation for the Management of Operational Risk, companies must include information on the management of information security and cybersecurity.

CHAPTER II
INFORMATION SECURITY AND CYBERSECURITY MANAGEMENT SYSTEM (SGSI-C)

SUBCHAPTER I
GENERAL REGIME OF THE INFORMATION SECURITY AND CYBERSECURITY MANAGEMENT SYSTEM (SGSI-C)

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

Article 10. Objectives and requirements of the SGSI-C
The objectives of the SGSI-C are the following:

1. Identify information assets, analyze associated threats and vulnerabilities, and formulate programs and measures aimed at reducing the possibility of incidents in the following aspects:
   a) The design and implementation of new products and processes, projects, and operational changes. b) Information security obligations derived from regulatory provisions, internal norms, and contractual agreements. c) Relationships with third parties, in the broadest sense, including service providers and companies with which there are subcontracting relationships. d) Any other activity that, in the company's opinion, exposes its information assets due to internal or external causes.

2. Periodically review the scope and effectiveness of the minimum controls indicated in Article 12 of this Regulation and have detection, response, and recovery capabilities for information security incidents.

3. Establish the relationship with emergency, crisis, and continuity plans established as provided in the corresponding regulations.

Article 11. Scope of the SGSI-C
The scope of the SGSI-C must include the functions and organizational units, existing physical locations, technological and communications infrastructure, as well as the control perimeter associated with third-party relationships, which are under the responsibility of the company, in accordance with the provisions established on subcontracting in the Regulation on Corporate Governance and Integrated Risk Management.

Article 12. Minimum information security measures to be adopted by companies
Companies must adopt the following minimum information security measures:

1. Human Resource Security:
   a) Implement information security protocols applicable in the recruitment and incorporation of personnel, upon change of position, and termination of the employment relationship. b) Disciplinary processes in case of non-compliance with information security policies.

2. Physical and Logical Access Controls:
   a) Prevent unauthorized access to information, as well as to the systems, equipment, and facilities through which it is processed, transmitted, or stored, whether presencial or remote. b) Implement access administration procedures, which must include access accounts with administrative privileges; ensuring segregation of duties to reduce the risk of error or fraud, following the principles of least privilege and need to know. c) Implement authentication processes to control access to information assets; in particular, for access to services provided to users via digital channels, the authentication processes must comply with the requirements established in Subchapter III of Chapter II of this Regulation.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

3. Security in operations:
   a) Ensure and foresee the continuous functioning of processing, storage, and information transmission facilities. b) Maintain the operation of computer systems in accordance with previously established procedures. c) Control changes in the system operational environment, and keep development, testing, and production environments segregated. d) Implement controls that ensure the integrity of transactions executed in services and computer systems. e) Restrict the installation of software on operating systems and prevent the exploitation of information security vulnerabilities. f) Have incident response and recovery protocols for malware; generate and test backup copies of information, software, and elements that facilitate restoration. g) Define, implement, and maintain secure configuration baselines for the use of devices and implementation of computer systems. h) Have a backup strategy and information restoration procedures in case of possible incidents, of internal or external origin, that compromise the availability of information for operations and of the productive environment of the data processing center.

4. Security in communications:
   a) Implement and maintain the security of communication networks in accordance with the information transmitted through them and the threats to which they are exposed. b) Ensure that communication networks and network services are managed and controlled to protect information. c) Segregate available information services, users, and systems in the company's networks. d) Implement secure protocols and security controls for the transfer of information, within the organization and with external parties. e) Ensure that remote access, the use of personal equipment on the company's network, mobile devices, and interconnection between own and third-party networks have controls in accordance with existing security threats.

5. Acquisition, development, and maintenance of systems:
   a) Implement and maintain security in services and computer systems in accordance with the information processed and the threats to which they are exposed. b) Ensure that information security practices are included in the planning, development, implementation, operation, support, and decommissioning of applications and computer systems. c) Limit access to the modification of source code libraries and maintain strict change control. d) When the operational platform is changed, critical applications must be reviewed and tested to avoid adverse effects on their security. e) Ensure that technical, functional, and information security tests are carried out on computer systems before going into production. f) Implement and verify compliance with procedures that include secure development practices for services and computer systems.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

6. Cybersecurity incident management:
   a) Implement procedures for the management of cybersecurity incidents, in accordance with paragraph 8.2 of Article 8 of this Regulation; as well as exchange information when appropriate, in accordance with Article 16 of this Regulation. b) Implement a methodology to classify cybersecurity incidents and foresee response and recovery protocols. c) Have an information security operations service, which includes capabilities for detection and response, monitoring of communications on the internal network, and the degree of functioning of the technological infrastructure. d) Have access to threat intelligence, vulnerabilities, and incident information, as well as knowledge bases of techniques and tactics used by threat actors. e) Implement internal reporting mechanisms for cybersecurity incidents, in accordance with what is stated in Article 8 of this Regulation, and to the Superintendence in accordance with Article 15 of this Regulation. f) Identify possible improvements for incorporation into cybersecurity incident management after their occurrence. g) Preserve evidence that facilitates forensic investigations after the occurrence of information security incidents.

7. Physical and environmental security
   a) Implement controls to avoid unauthorized physical access, damage, or interference to the company's information or processing facilities. b) Adopt measures to avoid loss, damage, theft, or compromise of information assets and interruption of operations, by protecting equipment and devices taking into account the environment in which they are used.

8. Cryptography
   a) Use cryptography to ensure the confidentiality, authenticity, and integrity of information, both when associated data is in storage and in transmission. b) Implement the necessary procedures to administer the lifecycle of cryptographic keys to be used.

9. Information asset management
   a) Identify information assets through an inventory, assign their custody, establish guidelines for acceptable use of them, and their return at the end of the agreement by which they were provided. b) Ensure that the level of protection and treatment of information is carried out in accordance with its classification in terms of legal requirements, value, criticality, and sensitivity to unauthorized disclosure or modification. c) Establish measures to avoid unauthorized disclosure, modification, deletion, or destruction of information, in the use of removable devices.

Article 13. Planned activities
Within the framework of the ISMS-C Strategic Plan, the company must maintain operational plans, at least for the following purposes:
a) Identify information assets, classify them, analyze associated threats and vulnerabilities, and take corresponding treatment measures.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

b) Subject the ISMS-C to periodic evaluations, reviews, and tests to determine its effectiveness, through internal and external services, and based on the level of complexity and threats to associated information assets. Based on the results obtained, it must incorporate improvements or adopt corrective measures. c) Address training and dissemination needs, as appropriate to roles and functions in the organization, in matters of information security and cybersecurity to ensure the effectiveness of the ISMS-C. d) Develop the cybersecurity program, in accordance with Subchapter II of Chapter II of this Regulation. e) Periodically review and update, when appropriate, the information security policies established to implement the requirements set forth in Article 12 of this Regulation.

SUBCHAPTER II
CYBERSECURITY

Article 14. Cybersecurity program
14.1 Every company that has a presence in cyberspace must maintain, on a permanent basis, a cybersecurity program (CSP) applicable to operations, processes, and other associated information assets.
14.2 The CSP must foresee a diagnosis and an improvement plan for its cybersecurity capabilities, for which it must select an international reference framework on the matter, which allows it to do at least the following:
a) Identification of information assets. b) Protection against threats to information assets. c) Detection of cybersecurity incidents. d) Response with measures that reduce the impact of incidents. e) Recovery of technological capabilities or services that could be affected.

Article 15. Reporting of significant cybersecurity incidents
15.1 The company must report to the Superintendence, as soon as it detects the occurrence of a cybersecurity incident that presents a significant adverse impact, verified or presumed, of:
a) Loss or theft of the company's or clients' information. b) Internal or external fraud. c) Negative impact on the company's image and reputation. d) Interruption of operations.
15.2 The company must carry out a forensic analysis to determine the causes of the incident and take measures for its management. The resulting report from said analysis must be available to the Superintendence, which must have an executive content as well as the corresponding technical detail.
15.3 The Superintendence, through a general nature norm, establishes the minimum content, format, and additional protocols to be used in said report.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

Article 16. Exchange of cybersecurity information
16.1 The company must make the necessary arrangements to have information that allows it to take timely action against cybersecurity threats and for the treatment of vulnerabilities.
16.2 When exchanging information related to cybersecurity, the company may sign agreements with other companies in the sector or with relevant third parties, on a bilateral, collective, or industry basis, for which it will define the pertinent criteria.
16.3 Through a general nature norm, the Superintendence may establish specific requirements to be incorporated into the exchange of cybersecurity information.

SUBCHAPTER III
AUTHENTICATION

Article 17. Implementation of authentication processes
17.1 The company must implement authentication processes, in accordance with the definition established in this Regulation, to control access to the services it provides to its users through digital channels, prior to which it must formally evaluate and take measures on:
a) The authentication factor or factors that will be required. b) Current cryptographic standards, based on software or hardware, and their expected confidentiality or integrity performance. c) Timeframes and conditions under which it will be mandatory to require the user to re-authenticate, which includes and is not limited to cases due to periods of inactivity or prolonged use sessions of systems. d) Baseline of information security controls required to prevent threats to which the authentication process is exposed, which includes, and is not limited to, the maximum number of failed authentication attempts, the prevention of interception and manipulation of message attacks. e) Guidelines for the retention of audit logs for the detection of known threats and information security events.
17.2 Authentication processes must be re-evaluated whenever the technology used for their implementation no longer has manufacturer support, or after the discovery of new vulnerabilities that may expose them.
17.3 The company must maintain and protect detailed records of actions taken in each user enrollment, authentication attempt, and each operation that requires prior authentication.
17.4 The company must have tools and procedures to implement transaction monitoring that allows taking measures to reduce the possibility of fraudulent operations, which incorporates known fraud scenarios, and the theft or compromise of elements used for authentication.

Article 18. User enrollment in services provided through digital channel
18.1 The enrollment of a user in a digital channel requires at least:
a) Verify the user's identity and take necessary measures to reduce the possibility of identity spoofing, which includes the use of two biometric factors or the use of two factors of different and independent categories, according to letter j) of Article 2 of this Regulation, unless they are insurance products included in the simplified customer due diligence regime, in accordance with what is established in Article 31 of the Regulation for the Management of Money Laundering and Terrorism Financing Risk, approved by SBS Resolution No. 2660-2015 and its modifying norms, in which case the use of a single biometric factor may be used 3. b) Generate credentials and assign them to the user.
18.2 The company must manage the lifecycle of the credentials it generates and assigns to its users, for which it must foresee procedures for their activation, suspension, replacement, renewal, and revocation; as well as, when appropriate, ensure their confidentiality and integrity.

Article 19. Strong authentication for operations through digital channel
Strong authentication is required for those actions that may originate fraudulent operations or other abuse of the service to the detriment of the client, such as operations through a digital channel that imply payments or transfer of funds to third parties, registration of a trusted beneficiary, modification in contracted savings/investment insurance products, contracting of a product or service, modification of limits and conditions, for which it is required:
a) Use a combination of authentication factors, according to letter j) of Article 2 of this Regulation, which, at least, correspond to two distinct categories that are independent of each other. b) Have a control against man-in-the-middle attacks, which may include a unique code generated through cryptographic methods, from the specific data of each operation, which must be used only once 4. c) When the operation is successful, notify the operation data to the user.

Article 20. Exemptions from strong authentication for operations through digital channel
20.1 The following operations performed through a digital channel are exempt from the strong authentication requirement indicated in Article 19 of this Regulation, with the exception of that indicated in letter c) 5:
a) Payment operations, periodic payments, or transfer to a beneficiary previously registered by the user as a trusted beneficiary, as the usual recipient of such operations. b) Payment operations, periodic payments, or transfers to accounts in which the client and the beneficiary are the same person, whether natural or legal, and provided that such accounts are maintained in the same company.
20.2 Payment and transfer operations that present a low fraud risk level, as a result of an online risk analysis per operation, are exempt from strong authentication, provided that the company complies with 6:
i. Implementing one of the payment industry standards, EMV 3DS and EMV payment tokenization, in their most recent versions.
ii. Defining the threshold amount per operation below which the exemption due to said risk analysis will apply.

3 Paragraph modified by SBS Resolution No. 03797-2023 of 11/17/2023, effective from 11/18/2023.
4 Paragraph modified by SBS Resolution No. 03797-2023 of 11/17/2023, effective from 11/18/2023.
5 Paragraph modified by SBS Resolution No. 3240-2023 of 10/03/2023.
6 Paragraph modified by SBS Resolution No. 3240-2023 of 10/03/2023.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

iii. Periodically measure the fraud ratio of payment operations by channel and type of operation.
iv. Periodically update the rules applicable in the risk analysis based on the fraud risk indicator.
v. Use the data available for each type of operation, which includes, but is not limited to, those associated with user behavior, the medium used, and those that can be obtained from it for risk analysis purposes.
20.3 The company is responsible for losses, unless it proves the user's responsibility, for unrecognized operations by clients that have been carried out through a digital channel without meeting the strong authentication requirement, or in application of the exemption indicated in paragraph 20.2 of this article, or that were carried out after the user reported the theft or loss of their credentials. 7

Article 21. Use of API for the provision of online services
21.1 The use of application programming interfaces, to provide services to perform operations, through third-party services, requires that the following measures be implemented:
a) Associated risk analysis and implementation of mitigation measures. b) Mutual authentication of systems and users. c) Authorization of operations by users. d) Encryption of data in storage or transmission. e) Secure API development practices and review of secure coding practices. f) Vulnerability analysis and penetration testing. g) Security of the technological infrastructure that supports it. h) Fault tolerance and contingency mechanisms. i) Access control in the data, systems, and infrastructure environment. j) Monitoring of information security events and management of them when they constitute incidents.
21.2 The company must take international standards and reference frameworks as a reference, and when feasible, adopt them within the framework of industry or sectoral agreements, for the implementation of data exchange and encryption, as well as authentication and operation authorization, without this being a restrictive list.
21.3 The technical specifications of the APIs used must be documented in a way that facilitates their audit and the necessary implementation for their use.
21.4 Companies must implement the necessary measures to guarantee that the third party authorized by the user accesses only the information indicated by the latter.

7 Paragraph modified by SBS Resolution No. 2286-2024, effective from 06/29/2024, with an adaptation period in accordance with Article seven of the same SBS Resolution No. 2286-2024.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

SUBCHAPTER IV
PROVISION OF SERVICES BY THIRD PARTIES

Article 22. Services provided by third parties
In the case of services provided by third parties in aspects related to information technology management, information security management, or data processing, the company, in addition to complying with the requirements established in the Regulation for Corporate Governance and Integral Risk Management and the Regulation for the Management of Operational Risk, must:
a) Evaluate information security threats and vulnerabilities in the provision of goods and services and implement treatment measures. b) Ensure that the contractual arrangement with the provider and its implementation allow compliance with the obligations established in this Regulation. c) Establish the roles and responsibilities that the provider assumes contractually regarding information security and ensure that the company carries out the corresponding complementary implementations to address the requirements of this Regulation.

Article 23. Use of cloud services
To make use of cloud services, the company must implement information security policies and procedures that are specifically applicable, taking into account an international framework of good practices for the use of these services, and that, in addition to the requirements of Article 22 of the Regulation, include the following aspects:
a) Information security requirements that cloud services must meet and procedures to ensure implementation before their use. b) Guidelines for network segregation that allow the isolation of the company's information from that of third parties in the shared environment of the cloud service. c) Evaluation of the availability of event logging (log) that the cloud service provider offers and attention to the need for additional records for information security monitoring. d) Provision of a training plan for managerial levels, administrators of these services, personnel in charge of their implementation, and those who use them, on what is necessary for the handling of information security in these.

Article 24. Significant data processing services
24.1 The contracting of a significant service provided by a third party for data processing, including cloud services, must be considered as a major change in the computer environment, being applicable the definition of significant service established in the Regulation for Corporate Governance and Integral Risk Management and the current regulations associated with new products and major changes.
24.2 The company must comply with the following aspects regarding the contracting of a significant service provided by a third party for data processing, which includes cloud services, in a complementary manner to what is established in Articles 22 and 23 of this Regulation, as appropriate:
a) Ensure adequate access to information, within reasonable times and only upon request, by the Superintendence, Internal Audit, and the External Audit Firm, under normal operating conditions and special regimes.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

b) Manage information security incidents, in accordance with paragraph 6 of Article 12 and develop the planned activities provided for in Article 13 of this Regulation, as applicable to the significant data processing service in question. c) Have an exit strategy for the services under the provider's charge that allows resuming operations on its own or through another provider. This strategy must foresee, among other aspects, the necessary actions for the migration of information to the company's resources or another provider. d) Maintain an inventory of the services that the provider, in turn, contracts with third parties (chain contracting) and that are related to the services contracted by the company. e) Ensure that confidential information in the provider's custody is permanently deleted upon termination of the contractual agreement. f) Annually verify that the data processing service provider has information security controls, in accordance with current regulations on information security, as applicable to the service provided. This can be supported by independent reports and audit reports that include in their scope the verification of said controls. g) When it comes to cloud services, to comply with what is required in the previous letter, the company must annually demonstrate that the provider maintains valid ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27018 certifications, and has a SOC 2 type 2 report or other equivalents, relevant to the service provided and to the zone or region from which the service is provided.

24.3 The company must inform this Superintendency about the contracted service, the provider involved, the agreed service levels, the technological infrastructure used, as well as the procedures and responsible parties to comply with letters a) to f), and as applicable, g) of the previous paragraph; at the latest thirty (30) calendar days after starting the provision of data processing.

Article 25. Authorization for contracting significant data processing services provided by third parties from abroad

25.1 The company must request authorization from the Superintendency, prior to contracting a significant data processing service provided by third parties from abroad, in case said service presents limitations to comply with the requirements established in paragraph 24.2 of Article 24 of this Regulation, which will be responded to by the Superintendency within sixty (60) business days. To request such authorization, companies must present with their request, a report with the legal grounds for the identified limitations and a proposal for an implementation plan for compensatory measures.

25.2 The authorization granted by this Superintendency is specific to the service provider, and to the country and city from which it is received, as well as to the general conditions that were the subject of the authorization, so that if there are modifications in them and, if the limitation cited in the previous paragraph persists, a new authorization procedure before the Superintendency is required.

8 Paragraph modified by SBS Resolution No. 1515-2021 of 05/24/2021.
9 Paragraph modified by SBS Resolution No. 1515-2021 of 05/24/2021.
10 Article effective as of 02/24/2021

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

SUBCHAPTER V
SIMPLIFIED REGIME OF THE ISMS-C

Article 26. Simplified information security management system

26.1 The simplified information security management regime requires the planning and execution of the following minimum activities, whose periodicity must be at least annual:
a) Identify with the business and support units, which information is of greatest importance, due to existing regulatory or contractual obligations, and due to the need to operate. b) Identify the devices that connect to the internal network and all software that is installed on the technological infrastructure, and ensure that they are in accordance with a previously established secure configuration. c) Identify user accounts with enabled access permissions and in particular those that possess administrative privileges with the possibility of adding software to the infrastructure, and maintain the principle of least privileges granted. d) Implement and maintain a security baseline in operating systems and applications used, including those corresponding to mobile devices, workstations, servers, and communication devices. Identify and evaluate the enabling of security functions integrated in the operating systems. e) Prioritize and manage identified security vulnerabilities, for whose timely identification it must have the necessary information services. f) Develop an awareness campaign for the adoption of secure practices directed at employees, management, and board members.

26.2 In case the company provides any of the operations indicated in Article 19 of this Regulation through digital channel, insofar as its implementation is concerned, it must comply with the provisions established in Subchapter III of Chapter II of this Regulation.

26.3 In case it uses significant services provided by third parties, insofar as its implementation is concerned, the company must comply with the provisions established in Subchapter IV of Chapter II of this Regulation.

26.4 The company must maintain a cybersecurity program, in accordance with Subchapter II of Chapter II of this Regulation, with a scope that at least includes the services indicated in paragraphs 26.2 and 26.3 of Article 26 of this Regulation.

SUBCHAPTER VI
ENHANCED REGIME OF THE ISMS-C

Article 27. Additional requirements for companies with market concentration

27.1 The board of directors must designate a director as responsible for ensuring the effectiveness of the information security management system, which includes the development of the ISMS-C strategic plan.

27.2 The company must periodically submit the scope and effectiveness of the ISMS-C to an independent evaluation; said evaluation may be carried out by the internal audit unit or another team that meets the independence requirement, provided it has previous experience and international certifications that demonstrate the necessary technical preparation.

FINAL COMPLEMENTARY PROVISIONS

First.- The company may have a framework for the management of risks associated with information security, which must be integrated, as applicable, into operational risk management, in accordance with the guidelines established in Article 22 of the Regulation on Corporate Governance and Integrated Risk Management.

Second.- The reports referred to in letters g) and h) of Article 12, and Article 27 of the Regulation on Corporate Governance and Integrated Risk Management must include the evaluation of risks associated with information security.

Third.- In the event of events that affect operational continuity and whose probable cause is an information security incident, what is stated in Article 15 of the Regulation for the Management of Business Continuity, approved by SBS Resolution No. 877-2020, regarding the reporting of significant interruption events, is applicable.

Fourth.- The application of this Regulation extends to insurance brokerage companies in segment 1, according to the segmentation established in Article 36 of the Regulation for the Supervision and Control of Insurance Brokers and Auxiliaries approved by SBS Resolution No. 809-2019; to said companies, paragraph 26.1 of Article 26, Subchapter V, Chapter II, of this Regulation is mandatory.

Second Article.- Modify the Internal Audit Regulation, approved by SBS Resolution No. 11699-2008 and its amendments, as follows:

In the Annex "Planned Activities", substitute paragraph 3 of Section I, paragraph 1 of Section II, paragraph 1 of Section III, paragraph 2 of Section IV, paragraph 3 of Section V, and paragraph 1 of Section VI, in accordance with the following texts:

"I. COMPANIES INDICATED IN LETTERS A, B AND C OF ARTICLE 16 OF THE GENERAL LAW (EXCEPT GUARANTEE AND SURETY COMPANIES), BANCO DE LA NACIÓN, BANCO AGROPECUARIO, FONDO MIVIVIENDA AND DEVELOPMENT FINANCING CORPORATION (COFIDE) (…)
3) Evaluation of operational risk management and compliance with procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity;
(….)"

"II. INSURANCE AND/OR REINSURANCE COMPANIES:

1. Evaluation of the management of risks other than technical insurance risks, which include operational risk, market risk, credit risk, among others, and of the provisions of current regulations on business continuity management and information security and cybersecurity;
   (...)"

"III. COMPLEMENTARY AND RELATED SERVICE COMPANIES

1. Evaluation of operational risk management and compliance with procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity.
   (...)"

"IV. GUARANTEE AND SURETY COMPANIES
(…)
2) Evaluation of operational risk management and compliance with procedures used for the administration of operational risks; as well as, the provisions of current regulations on information security and Cybersecurity.
(...)"

"V. PENSION DRAINS AND PENSION BOXES
3) Evaluation of operational risk management and compliance with procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and Cybersecurity;
(...)"

"VI. PRIVATE PENSION FUND ADMINISTRATORS (AFP):

1. Evaluation of operational risk management and the provisions of current regulations on business continuity management and information security;
   (...)"

Third Article.- Modify letter b) of the second paragraph of Article 20 Report on the internal control system of the External Audit Regulation, approved by SBS Resolution No. 17026-2010 and its amendments, according to the following text:

"Article 20.- Report on the internal control system (…) b) Evaluation of the company's information systems in the scope of external audit, which includes, among others, the information flow at the company's internal levels for its adequate management, and the selective review of the validity of the data contained in the supplementary information to the financial statements (annexes and reports) that companies present to this Superintendency, according to current regulations on the matter; where the systems that were part of the scope of said evaluation must be specified; and, (….)"

Fourth Article.- Modify procedure No. 123 relative to the "Authorization of Main Processing Abroad" to "Authorization for contracting the significant data processing service provided by third parties from Abroad" and incorporate procedure No. 198 relative to "Authorization to apply the Simplified Regime of the Information Security and Cybersecurity Management System" in the Single Text of Administrative Procedures of the Superintendency of Banks, Insurance and Private Pension Fund Administrators, approved by Resolution No. 1678-2018, whose text is attached to this resolution and published on the Institutional Web Portal (www.sbs.gob.pe).

Fifth Article.- Modify the Regulation on Corporate Governance and Integrated Risk Management, approved by SBS Resolution No. 272-2017 and its amendments, as follows:

1. Incorporate into Article 2 of the Regulation on Corporate Governance and Integrated Risk Management, approved by SBS Resolution No. 272-2017, the following text:
   "rr) Provider: third party hired to provide goods and/or services to a company, even under the subcontracting modality. Companies that are part of the same economic group as the contracting company are also considered as third parties."

d) Modify in Article 2 Definitions and/or references, letter jj) Subcontracting, as follows:
"jj) Subcontracting: Modality by which a company hires a provider to deliver goods and/or services that could be developed by it."

3. Substitute Chapter IV, as well as its reference in the Index of said Regulation with "Goods and/or Services Provided by Third Parties", with the following text:

"CHAPTER IV
GOODS AND/OR SERVICES PROVIDED BY THIRD PARTIES

Article 35.- General aspects
35.1. Goods and/or services provided by third parties are those delivered to the company by a provider.
35.2. In case it is a good and/or service that could be developed by the company but decides to request it through a third party, the subcontracting modality is configured.
35.3. Significant goods and/or services provided by third parties are those that, in case of failure or suspension, can put the company at significant risk by affecting its income, solvency, operational continuity, or reputation. In case any significant good and/or service is provided by a third party under the subcontracting modality, the subcontracting is considered significant.
35.4. A provider is considered significant when it provides significant services, whether or not under the subcontracting modality.

Article 36.- Goods and/or services provided by third parties
36.1 The risks associated with the delivery of goods and/or services provided by third parties must be managed as part of the company's integrated risk management framework.
36.2 The company is responsible for the results of goods and/or services provided by third parties under the subcontracting modality.
36.3 The company must perform an evaluation of the risks associated with significant services provided by third parties, whether or not under the subcontracting modality. Said evaluation must be presented to the board of directors for approval.
36.4 In the case of significant subcontracting, clauses must be included that facilitate an adequate review of the respective service by the companies, the internal audit unit, the external audit firm, as well as by the Superintendency or the persons it designates, in the contracts signed with providers.
36.5 The subcontracting of risk management functions is considered significant for the purposes of this Regulation.
36.6 This Superintendency may define additional requirements for some specific goods and/or services provided by third parties.

Article 37.- Authorization for contracting significant goods and/or services provided by third parties
The contracting of the following significant goods and/or services requires prior authorization from this Superintendency and must be subject to what is established in specific regulatory norms:
a) Significant subcontracting of internal audit, in accordance with what is established in the Internal Audit Regulation or the norm that replaces it; b) Others indicated by the Superintendency through general norm."

Sixth Article.- Modify the Operational Risk Regulation, approved by SBS Resolution No. 2116-2009, as indicated below:

1. Substitute letter i of Article 2 and Article 14, in accordance with the following text:
   "Article 2.- Definitions
   (…)
   i. Subcontracting: Modality by which a company hires a provider to deliver goods and/or services that could be developed by it.
   (…)

2. Substitute Article 14 in accordance with the following text:
   "Article 14.- Goods and/or services provided by third parties The company must have appropriate policies and procedures to manage risks associated with services provided by third parties, and have a register of these. The company must implement a procedure for the identification of those significant providers, specifying the cases in which they are under the subcontracting modality. In the cases of significant services, whether or not under the subcontracting modality, and of subcontracted services, the company must consider the following aspects:
   a) Implement a service provider selection process. b) Have a contract, which must include service level agreements; clearly establish the responsibilities of the provider and the company; establish the jurisdiction that will prevail in case of conflict between the parties; and incorporate the required information security levels. c) Manage and monitor risks associated with these services. d) Maintain a register that must contain at least:
   i) Provider name ii) Main business activity of the provider iii) Description or list of services provided iv) Countries, regions, and/or geographic zones from which the service to be contracted is provided v) Agreed service levels for its provision vi) Whether the subcontracting is or is not considered significant by the company vii) Service start date viii) Last renewal date, if applicable ix) Service expiration date or next contract renewal date, as applicable"

Seventh Article.- Modify the Credit and Debit Card Regulation, approved by SBS Resolution No. 6523-2013 and its modifying norms, as indicated below:

1. Substitute Articles 6 and 12, in accordance with the following text:
   "Article 6.- Minimum information, conditions and validity applicable to the credit card Credit cards with physical or digital support are issued as non-transferable and must include as a minimum the following information:
2. Corporate name of the company issuing the credit card.
3. Trade name that the company assigns to the product.
4. Identification of the credit card system (brand) to which it belongs, if applicable.
   In the case of cards with physical support, the name of the credit card user must be included; information from which one may dispense if the company complies with Subchapter III of Chapter II of the Regulation for the Management of Information Security and Cybersecurity, approved by SBS Resolution No. 504-2021. The validity period of credit cards cannot exceed five (5) years, shorter expiration periods may be agreed.

Article 12.- Minimum information, conditions and validity applicable to debit cards
Debit cards with physical or digital support are issued as non-transferable and must include as a minimum the following information:

1. Corporate name of the company issuing the debit card.
2. Trade name that the company assigns to the product.
3. Identification of the debit card system (brand) to which it belongs, if applicable.
   For their use, they additionally require the presence of a secret key, signature, electronic signature, or other mechanisms that allow identification of the user, in accordance with what was agreed.
   The validity period of debit cards cannot exceed five (5) years, shorter expiration periods may be agreed."

Eighth Article.- Modify the Electronic Money Operations Regulation approved by SBS Resolution No. 6283-2013 and its modifying norms, as indicated below:

1. Substitute Article 4, in accordance with the following text:
   "Article 4.- Supports for use of electronic money The supports through which electronic money can be used may be the following:
   a) Mobile phones. b) Prepaid cards. c) Any other equipment or electronic device, that fulfills the purposes established in the Law.
   These devices must include as a minimum the following information:
2. Corporate name of the company issuing the support through which electronic money is used.
3. Trade name that the company assigns to the product.
4. Identification of the card system (brand) to which it belongs, if applicable.
   This information must be displayed in a visible and easily accessible space for the user.
   A single support can be used and/or associated to perform transactions with more than one electronic money account."

Ninth Article.- Deadlines and Adaptation Plan

1. Within a period that must not exceed sixty (60) calendar days counted from the day following the publication of this Resolution, companies must present to the Superintendency, an adaptation plan to the Regulation for the Management of Information Security and Cybersecurity approved in Article One of this Resolution, previously approved by the board of directors, in which it includes: a) a preliminary diagnosis of the existing situation in the company; b) the actions planned for total adaptation to the Regulation; c) the officials responsible for compliance with said plan; and, d) an adaptation schedule.

2. The provisions indicated in Subchapter III of Chapter II and the Third Final Complementary Provision of the Regulation for the Management of Information Security and Cybersecurity approved in Article One of this Resolution have an adaptation deadline until July 1, 2022.

Los Laureles Nº 214 - Lima 27 – Perú Telf.: (511) 6309000 Fax: (511) 6309239

3. Within a period not exceeding thirty (30) calendar days counted from the day following the publication of this Resolution, companies that have a significant data processing service provided by third parties from abroad, whose applicable legal framework prevents or limits compliance with the measures defined in paragraph 24.2 of Article 24 of the Regulation for Information Security and Cybersecurity Management, approved in Article One of this Resolution, must submit a report containing: i) the limitations presented, said report must have the legal support for the impediment to its application and ii) the compensatory measures.

Article Tenth.- Validity

This Resolution enters into force on July 1, 2021, on which date Circular G 140-2009 is repealed, with the exception of the following:

a. Paragraphs 25.1 and 25.2 of Article 25 of the Regulation for Information Security and Cybersecurity Management, approved by Article One, enter into force the day following the publication of this Resolution, on which date Article 7A of Circular G 140-2009 is repealed.

b. Article Two of this Resolution enters into force starting from the audit corresponding to the 2022 fiscal year.

c. Articles Seventh, Eighth, and Ninth of this Resolution enter into force the day following the publication of this Resolution, with the exception of what is indicated in subsection d. of this Article.

d. The requirement associated with the joint inclusion of information on the corporate name of the issuing company and the trade name that the company assigns to the credit and/or debit card product, indicated in Article Seventh of this Resolution, as well as the requirement associated with the inclusion of said information in electronic money support devices, indicated in Article Eighth of this Resolution, enter into force on January 1, 2022.

Register, communicate, and publish

SOCORRO HEYSEN ZEGARRA
Superintendent of Banks, Insurance, and Private Pension Fund Administrators