Resolution SBS No. 5060-2018: Regulation for the Prevention of Money Laundering and Terrorist Financing Applicable to Savings and Credit Cooperatives Not Authorized to Operate with Public Funds

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 Lima, December 26, 2018 Resolution S.B.S.
No. 5060-2018

The Superintendent of Banking, Insurance and Private Pension Fund Administrators

CONSIDERING:

That, Law No. 27693, Law creating the Financial Intelligence Unit – Peru, provides that it is the function and authority of the Superintendency of Banking, Insurance and Private Pension Fund Administrators to regulate, in coordination with the supervisory bodies of obligated subjects, the guidelines, requirements, sanctions and other aspects related to the prevention systems of subjects obligated to report and of reports of suspicious operations and the format for recording operations, among others, in accordance with the scope of what is established in the aforementioned law and its regulation, approved by Supreme Decree No. 020-2017-JUS;

That, Article 3 of Law No. 29038, Law incorporating the Financial Intelligence Unit of Peru (UIF-Peru) into the Superintendency of Banking, Insurance and Private Pension Fund Administrators (SBS), modified by Legislative Decree No. 1249, Legislative Decree that dictates measures to strengthen the prevention, detection and sanction of money laundering and terrorism, establishes the list of subjects obligated to report to UIF-Peru, among them, savings and credit cooperatives;

That, through Law No. 30822, the Twenty-Fourth Final and Complementary Provision of Law No. 26702, General Law of the Financial System and Insurance System and Organic Law of the Superintendency of Banking and Insurance, and other concordant norms, are modified regarding the regulation and supervision of savings and credit cooperatives that only operate with their members and are not authorized to capture public resources (COOPAC) under the Superintendency of Banking, Insurance and Private Pension Fund Administrators, which will enter into force from January 1, 2019;

That, currently, savings and credit cooperatives that only operate with their members and are not authorized to capture public resources are regulated by the Regulation for the Management of Money Laundering and Terrorist Financing Risks, approved by Resolution SBS No. 2660-2015;

That, according to subsection 2.8 of numeral 2 and subsection 7.2 of numeral 7 of the Twenty-Fourth Final and Complementary Provision of Law No. 26702 mentioned, COOPACs – based on their total assets – are assigned to three levels of a modular scheme, corresponding to the SBS to exercise the functions of supervisory body in matters of AML/CFT prevention for COOPACs of levels 2 and 3 and UIF-Peru for COOPACs of level 1;

That, the Twelfth Complementary Final Provision of the aforementioned Law No. 30822 provides that the SBS must issue the regulation for the application of the Twenty-Fourth Final and Complementary Provision of Law No. 26702;

That, in this context, it is necessary to approve the Regulation on the prevention of money laundering and terrorist financing applicable to COOPACs, with the aim of establishing specific criteria in matters of AML/CFT prevention in accordance with the modular scheme indicated in Law No. 30822, respecting cooperative principles and considering international standards, best practices on the matter and the aspects identified in prevention and supervision work; as well as to leave without effect the application of the Regulation for the Management of Money Laundering and Terrorist Financing Risks approved by Resolution SBS No. 2660-2015, for COOPACs;

That, likewise, it is necessary to clarify the scope of the Standard that establishes the requirements and characteristics of Suspicious Operation Reports (ROS) that the supervisory bodies of obligated subjects to report issue to UIF-Peru, approved by Resolution SBS No. 6414-2014, by which the supervisory bodies of obligated subjects to report, such as savings and credit cooperatives not authorized to operate with public resources, must issue Suspicious Operation Reports (ROS), when in the exercise of their supervision functions they detect indications of money laundering or terrorist financing, as established in Article 10 of Law No. 27693;

That, in order to collect opinions from the general public regarding the normative proposal, the pre-publication of the draft resolution on the matter was ordered on the electronic portal of the Superintendency, under the authority of what is established in the Thirty-Second Final and Complementary Provision of the General Law, numeral 2 of the Fifteenth Complementary Final Provision of Law No. 30822 and Supreme Decree No. 001-2009-JUS and its modifying norms;

Having the previous technical and positive viability report of the norm from the Deputy Superintendent of Cooperatives and the approval of the Deputy Superintendencies of Cooperatives and Legal Advisory; and the Financial Intelligence Unit of Peru; and

In exercise of the powers conferred by numerals 7 and 9 of Article 349 of the General Law of the Financial System and Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its modifying norms, as well as Law No. 27693, Law No. 29038 and Law No. 30822;

RESOLVES:

Article First.- Approve the Regulation for the prevention of money laundering and terrorist financing applicable to Savings and Credit Cooperatives not authorized to operate with public resources, with the following text:

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 3 / 40

REGULATION FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING APPLICABLE TO SAVINGS AND CREDIT COOPERATIVES NOT AUTHORIZED TO OPERATE WITH PUBLIC FUNDS

TITLE I
COMPLIANCE AND MANAGEMENT OF AML/CFT RISKS

CHAPTER I
GENERAL PROVISIONS

Article 1.- Scope
This Regulation applies to savings and credit cooperatives not authorized to operate with public resources, hereinafter COOPAC.

Article 2.- Definitions and Abbreviations
For the purposes of this Regulation, the following definitions and abbreviations are considered:

a) Board of Directors: body responsible for the administrative functioning of the COOPAC. b) Days: calendar days. c) Executives: members who are titular and alternate members of the Board of Directors, Supervisory Council, Education Committee and Electoral Committee. d) Identity document: national identity document for Peruvians, and the foreigner's ID card, passport or legally established document for the identification of foreigners, as applicable. e) Legal entities: are i) autonomous assets managed by third parties, which lack legal personality or ii) contracts in which two or more persons, who associate temporarily, have a common right or interest to carry out a specific activity, without constituting a legal person. Among others determined by the Superintendency, investment funds, mutual funds for investment in securities, trust assets and consortia are considered in this category. f) Management: executive body responsible for the management of the COOPAC, with immediate responsibility before the Board of Directors. g) AML/CFT: money laundering and terrorist financing. h) General Law: General Law of the Financial System and Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its modifying norms. i) Law: Law creating the Financial Intelligence Unit of Peru – UIF-Peru, Law No. 27693 and its modifying and complementary norms. j) Manual: manual for the prevention and management of AML/CFT risks. k) Compliance Officer: natural person responsible for monitoring the adequate implementation and functioning of the AML/CFT prevention system. It is the contact person of the obligated subject with the supervisory body and an agent in which it relies in the exercise of the control and supervision labor of the AML/CFT prevention system. l) Unusual operation: operation carried out or attempted to be carried out whose amount, characteristics and periodicity do not relate to the economic activity of the member, falls outside the parameters of normality in force in the market or has no evident legal basis. m) Suspicious operation: operation carried out or attempted to be carried out, whose amount or characteristics do not relate to the economic activity of the member or that does not have an economic basis; or that, due to its number, amounts transacted or the particular characteristics of these, can reasonably lead to suspect that the COOPAC is being used to transfer, handle, take advantage of or invest resources coming from criminal activities or intended for their financing. n) Supervisory body: UIF-Peru with respect to Level 1 COOPACs and the Superintendency with respect to COOPACs of levels 2 and 3. o) Politically Exposed Persons (PEP): natural persons, national or foreign, who hold or have held in the last five (5) years prominent public functions or prominent functions in an international organization, either in the national or foreign territory, and whose financial circumstances may be subject to public
interest. Likewise, a direct collaborator of the highest authority of the institution is considered a PEP. p) Regulation: Regulation for the prevention of money laundering and terrorist financing applicable to COOPACs. q) Regulation of the Law: Regulation of the Law creating UIF-Peru, approved by Supreme Decree No. 020-2017-JUS. r) AML/CFT Risks: possibility that the COOPAC is used for AML/CFT purposes. This definition excludes reputation risk and operational risk. s) Member: those who make contributions and/or carry out other operations with the COOPAC. For the purposes of this Regulation, it is understood that the COOPAC member is the client in matters of AML/CFT prevention. t) Superintendency: Superintendency of Banking, Insurance and Private Pension Fund Administrators (SBS). u) Worker: natural person who maintains an employment or contractual link with the COOPAC. v) UIF-Peru: Financial Intelligence Unit of Peru, a specialized unit of the Superintendency.

Article 3.- AML/CFT Prevention System

3.1 COOPACs must implement an AML/CFT prevention system, with components of compliance and management of AML/CFT risks to which they are exposed.

3.2 The compliance component is formed by the policies and procedures established by COOPACs within the framework of the Law, the Regulation of the Law, the General Law insofar as applicable, this Regulation and other provisions on the matter, as well as the measures established by the COOPAC to guarantee the duty of indefinite confidentiality of information related to the AML/CFT prevention system.

3.3 The AML/CFT risk management component comprises, among other procedures and controls detailed in this Regulation, those related to the timely detection and reporting of suspicious operations, with the aim of preventing COOPACs from being used for purposes linked to AML/CFT.

Article 4.- AML/CFT Risk Factors

Among the main AML/CFT risk factors that must be identified and considered by COOPACs are the following:

a) Members.- COOPACs must manage AML/CFT risks related to members, their behavior, background and activities, at the beginning and throughout the associative relationship. The analysis associated with this AML/CFT risk factor incorporates the attributes or characteristics of the members.

b) Products and/or services.- COOPACs must manage AML/CFT risks associated with the products and/or services they offer on their own behalf, during the design or development stage, as well as during their validity. The analysis associated with this AML/CFT risk factor includes risks linked to the distribution channels and payment methods with which they operate.

c) Geographic zone.- COOPACs must manage AML/CFT risks associated with the geographic zones in which they offer their products and/or services, both locally and internationally, taking into account their security, economic-financial and socio-demographic characteristics, the provisions that competent authorities or the Financial Action Task Force – FATF issue with respect to such jurisdictions, among others. The analysis associated with this AML/CFT risk factor comprises the zones in which COOPACs operate, as well as those linked to the operation process.

CHAPTER II
INTERNAL ENVIRONMENT

SUB CHAPTER I
ROLES AND RESPONSIBILITIES

Article 5.- Responsibility of the Board of Directors

5.1 The Board of Directors is responsible for implementing the AML/CFT prevention system and for fostering an internal environment that facilitates its development in the COOPAC. For this purpose, it is the responsibility of the Board of Directors:

a) Take AML/CFT risks into account when establishing associative objectives. b) Approve and periodically review policies and procedures for the management of AML/CFT risks. c) Approve the manual and code of conduct. d) Establish and periodically review the functioning of the AML/CFT prevention system based on the AML/CFT risk profile of the COOPAC. e) Appoint a compliance officer with the characteristics, responsibilities and powers established by current regulations. f) Provide the human, technological and other resources required, as well as the infrastructure that allow the adequate fulfillment of the functions and responsibilities of the compliance officer, considering the size of the COOPAC and the complexity of its operations and/or services. g) Establish measures to maintain the confidentiality of the compliance officer, so that their identity is not known to persons outside the COOPAC. h) Approve the annual work plan of the compliance officer. i) Approve the risk-based training plan, established by the compliance officer.

5.2 What is established in this article is applicable without prejudice to the responsibilities contemplated in the norms on integrated risk management and other related norms issued by the Superintendency.

Article 6.- Responsibility of Management

6.1 The General Manager or the person performing equivalent functions, jointly with the Board of Directors, has the responsibility to implement the AML/CFT prevention system, in accordance with current regulations.

6.2 Managers or persons performing equivalent functions, within their scope of action, have the responsibility to comply with measures associated with the control of AML/CFT risks, in accordance with the defined policies and procedures, supporting the compliance officer in the development of their work.

6.3 What is established in this article is applicable without prejudice to the responsibilities contemplated in the norms on integrated risk management and other related norms issued by the Superintendency.

Article 7.- Compliance Officer

7.1 The compliance officer of Level 1 and 2 COOPACs may have an employment or other contractual link with it and, in the case of Level 3 COOPACs, the compliance officer must have a direct employment link with it.

7.2 The compliance officer must be appointed by the Board of Directors and must depend and report directly to said governing body, enjoying autonomy and independence in the exercise of their functions.

7.3 The compliance officer must have the category of first-level management, considering in this those persons who, regardless of the title given to the position, are direct collaborators of the General Manager in the execution of policies and decisions of the Board of Directors, without this implying a subordination to said body, in the exercise of their functions. For the purposes of this Regulation, the first-level management category does not include those who maintain a relationship of subordination with respect to other first-level managers or lower category.

Article 8.- Requirements of the Compliance Officer

8.1 The compliance officer must meet the following requirements:

a) Have experience in the activities typical of the COOPAC, or experience in AML/CFT prevention or as a compliance officer or as a worker in the area in charge of a compliance officer. b) Not have been convicted of an intentional crime. c) Not have been dismissed from public office or ceased in it for serious fault. d) Not have overdue debts for more than one hundred twenty (120) days in the financial system or in judicial collection, nor protests of documents in the last five (5) years, not clarified to the satisfaction of the Superintendency. e) Not have been declared bankrupt. f) Not be or have been the internal auditor of the COOPAC, if applicable, during the six (6) months prior to their appointment. g) Not be subject to any other impediment, indicated in Article 365 of the General Law, excepting subsection 2 of the aforementioned article. h) Not be subject to the impediments of Article 33 of the General Law of Cooperatives. i) Not be the spouse or cohabitant of any member of the Board of Directors or the General Manager. j) Additionally, in the case of a COOPAC whose compliance officer is not full-time, the executives of the COOPAC, as well as the General Manager or the person performing equivalent functions, cannot hold said position. k) Have a direct contractual or employment link with the COOPAC, as applicable, and enjoy autonomy and independence in the exercise of their responsibilities and functions.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 7 / 40

l) Others established by the Superintendency.
The established requirements can be accredited with a sworn statement.

8.2 The compliance officer who ceases to meet any of the aforementioned requirements cannot continue to act as such and must communicate this in writing to the COOPAC within a maximum period of five (5) business days from the occurrence of the fact. When the COOPAC becomes aware of the non-compliance with the established requirements, even if the compliance officer has not communicated it, it must remove them from office and inform this action to UIF-Peru, justifying the reasons that justify such measure, within a maximum period of five (5) business days from when the non-compliance is known. In this case, the COOPAC must appoint a new compliance officer who meets the conditions of Article 7, the requirements established in paragraph 8.1 and in accordance with what is established in Article 9 of this Regulation.

Article 9.- Appointment, removal and vacancy of the Compliance Officer position

9.1 The appointment of the compliance officer corresponds to the Board of Directors.

9.2 The COOPAC communicates to UIF-Peru the appointment of the compliance officer within a period not greater than fifteen (15) business days from the occurrence of the appointment, in a confidential and reserved manner, through an online appointment request for the compliance officer, which must be presented through the SISDEL platform (plaft.sbs.gob.pe/sisdel) or another electronic means determined by the Superintendency, attaching the information and documentation that supports said request. After the respective verification and deeming it appropriate, UIF-Peru assigns the secret codes that will serve for the identification of the compliance officer.

9.3 The request for appointment of the compliance officer must contain as a minimum the following information: Full names of the person appointed as compliance officer; type and number of identity document; nationality; address; address of the office where they work; contact data: telephone numbers and email; the position held; date of entry; whether full-time or not; sworn statement on the compliance with the requirements of the compliance officer for said appointment; copy of the minutes of the Board of Directors session or the document that accredits the appointment.

9.4 At the time of the appointment of the compliance officer or subsequently, COOPACs may appoint an alternate compliance officer, who must meet the same conditions established for the main officer, to serve as alternate compliance officer only in case of temporary absence or vacancy of the main officer.

9.5 Any change in the information of the compliance officer must be communicated by the COOPAC to the supervisory body and to UIF-Peru, within a period not greater than five (5) business days from the occurrence of the change.

9.6 The removal of the compliance officer by the COOPAC must be supported by the reasons that justify such measure and must be approved by the Board of Directors. The removal, as well as the respective support, must be communicated to the supervisory body and to UIF-Peru, within a period of five (5) business days from the adoption of the decision.

9.7 The vacancy of the compliance officer position cannot last more than thirty (30) days, from the date it occurs and must be communicated to the supervisory body, as well as to UIF-Peru, within a period of five (5) business days from its occurrence. In case of vacancy, the COOPAC

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 8 / 40 must designate a compliance officer in accordance with the provisions of this article and articles 7 and 8 of this Regulation.

9.8 To protect the confidentiality of the compliance officer's identity, UIF-Perú assigns secret codes to the COOPAC, the compliance officer, and the alternate compliance officer.

9.9 The requirements, conditions, obligations, functions, and responsibilities of the compliance officer established in this Regulation apply to the alternate compliance officer, unless otherwise provided.

Article 10.- Exercise of Functions of the Alternate Compliance Officer

10.1 The COOPAC may designate an alternate compliance officer who performs the functions established in this Regulation, solely in the event of temporary absence or vacancy of the principal compliance officer.

10.2 In accordance with paragraph 9.9, the alternate compliance officer must meet the same requirements established for the principal, with the exception of those related to the manager category.

10.3 In cases where it is required for an alternate compliance officer to perform the functions established in this Regulation, without prejudice to complying with the provisions of the preceding article, the following must be considered:

a) In the event of temporary absence or vacancy, the alternate compliance officer may perform their functions until the return or appointment of the new compliance officer, as applicable.

b) In cases where it is required for the alternate compliance officer to perform the functions established in this Regulation, the COOPAC must notify UIF-Perú in writing, no later than five (5) business days prior to the absence of the compliance officer or the vacancy of the position, except in cases of force majeure duly substantiated. The notification must indicate the period of absence, when applicable, and request the activation of the secret codes referred to in article 9, for the alternate compliance officer.

c) The period of temporary absence of the compliance officer cannot exceed four (4) months.

Article 11.- Responsibilities and Functions of the Compliance Officer

The responsibilities and functions of the compliance officer, among others contemplated in this Regulation, are as follows:

a) Propose the COOPAC's strategies to prevent and manage ML/FT risks.

b) Monitor the adequate implementation and functioning of the ML/FT prevention system, including the recording of operations, procedures for timely detection, and reporting of suspicious operations.

c) Implement, evaluate, and verify the application of the policies and procedures of the ML/FT prevention system.

d) Adopt necessary actions for the training of the COOPAC's organizational structure, according to their functions.

e) Verify that the ML/FT prevention system includes the review of lists contributing to the prevention of ML/FT, indicated in Annex No. 1.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 9 / 40

f) Maintain a record of those unusual operations that, after respective analysis, were not determined to be suspicious.

g) Evaluate operations and, where applicable, qualify them as suspicious and report them to UIF-Perú through a ROS, on behalf of the COOPAC, leaving documentary evidence of the analysis and evaluations performed.

h) Prepare and submit the corresponding reports on the status of the ML/FT prevention system and its compliance.

i) Verify the adequate conservation and custody of documents related to the ML/FT prevention system.

j) Serve as the COOPAC's interlocutor with the supervisory body and the Superintendence on matters related to their function.

k) Attend to information requests made by competent authorities.

l) Inform the Risk Committee or the Board of Directors, as applicable, regarding modifications and additions to the list of high-risk and non-cooperative countries published by the Financial Action Task Force - FATF.

m) Verify, with due follow-up, the immediate execution of national freezing measures of funds or assets issued by the Superintendence in cases linked to ML/FT crimes, in accordance with numeral 11 of article 3 of Law No. 27693.

n) Verify, with due follow-up, the immediate execution of freezing measures issued by the Superintendence, in accordance with Resolutions of the United Nations Security Council on terrorism and its financing, as well as the financing of the proliferation of weapons of mass destruction, in accordance with numeral 12 of article 3 of Law No. 27693.

o) Those others that are necessary or established by the Superintendence to monitor the functioning and level of compliance of the ML/FT prevention system.

Article 12.- Annual Work Program of the Compliance Officer

To fulfill the responsibilities and functions set forth in article 11, the compliance officer must prepare an annual work program, which must be submitted to the Board of Directors for prior consideration and approved by them no later than December 31 of the previous year. This program must contain the methodology for the execution of each of the activities contained therein, as well as the dates, roles, and responsible parties for the execution of each activity.

Article 13.- Exclusive Dedication of the Compliance Officer

13.1 The compliance officer of a Level 3 COOPAC performs their functions on an exclusive dedication basis. Exceptionally, Level 3 COOPACs may substantiatedly request authorization to have a compliance officer on a non-exclusive dedication basis, who must comply with articles 7 and 8 of this Regulation. The request must contain information on the following aspects:

a) Functions and composition of the compliance office;

b) Description of the workload distribution of the official who will perform the functions of compliance officer on a non-exclusive dedication basis;

c) Description of other characteristics of the COOPAC;

d) Report describing the level of exposure to ML/FT risks faced by the COOPAC according to what is stated in article 23 of this Regulation; and

e) Justification for the request to designate a compliance officer on a non-exclusive dedication basis.

13.2 The foregoing does not limit that, if in the exercise of their supervisory powers, the supervisory body determines that the practical exercise of the functions of the compliance officer on a non-exclusive dedication basis does not allow for adequate management of the ML/FT risks faced by the COOPAC, it may revoke the authorization to have a compliance officer on a non-exclusive dedication basis.

Article 14.- Non-Exclusive Dedication of the Compliance Officer

14.1 A Level 1 COOPAC is not obligated to have a compliance officer on an exclusive dedication basis.

14.2 A Level 2 COOPAC that does not exceed the threshold of 32,200 UIT may have a compliance officer on a non-exclusive dedication basis. If it exceeds said threshold, the compliance officer must perform their functions on an exclusive dedication basis.

Article 15.- Codes and Confidentiality of the Compliance Officer's Identity

15.1 The COOPAC must safeguard the confidentiality of the compliance officer's identity, in accordance with what is provided by article 10-A of the Law and article 18 of the UIF Law Regulation. For the proper confidentiality of their identity, the designation of the compliance officer must not be registered in the records that make up the National System of Public Registries.

15.2 UIF-Perú assigns secret codes to both the obligated subject and the compliance officer and alternate compliance officer, if applicable, after verifying the documentation and information presented to the Superintendence by the COOPAC. The COOPAC, the compliance officer, and the alternate compliance officer must adopt necessary measures to guarantee the confidentiality of said assigned secret codes.

15.3 When UIF-Perú notifies the obligated subject of the validity of the designation of the compliance officer and alternate compliance officer, if applicable. If the respective designation is valid, the secret codes are communicated by UIF-Perú to the compliance officer and/or the alternate compliance officer, at the address of the obligated subject indicated in the respective designation request, in accordance with what is provided in the General Administrative Procedure Law.

15.4 The assigned secret codes serve solely as identification in all communications sent to UIF-Perú, to guarantee the confidentiality of the compliance officer's identity and the confidentiality of the information sent to UIF-Perú.

Article 16.- ML/FT Risk Committee

16.1 COOPACs may constitute an ML/FT risk committee whose sole function must be to participate, jointly with the compliance officer, in the adoption of policies and procedures necessary for the proper functioning of the ML/FT prevention system.

16.2 COOPACs that opt to constitute this committee must have a regulation for said committee approved by the Board of Directors, containing the provisions and procedures necessary for the fulfillment of its functions, in accordance with standards on comprehensive risk management.

16.3 If this committee is formed, it shall be presided over by the compliance officer and must have at least one (1) titular member of the Board of Directors and officials from the first level of management or those performing equivalent functions, regardless of the title of the positions, in accordance with standards issued by the Superintendence. Preferably, the members of the committee should be those who perform tasks directly related to the social object activities of the COOPACs.

SUB CHAPTER II
INTERNAL NORMS

Article 17.- Manual

17.1 The policies and procedures related to compliance with the ML/FT prevention system, by directors, managers, or persons performing equivalent functions and employees of the COOPAC; as well as ML/FT risk management, must be included in the manual. The manual must contain at least the information indicated in Annex No. 2, and must be approved by the Board of Directors, in accordance with the requirements established in this Regulation for each level of COOPAC.

17.2 COOPACs must record the knowledge that directors, managers, or persons performing equivalent functions and employees have taken regarding the manual and their commitment to comply with it in the exercise of their functions. The record must be kept by the COOPACs, through the mechanism established by them.

17.3 The manual must be updated in accordance with national regulation and international standards on the matter; such modifications must be brought to the knowledge of directors, managers, or persons performing equivalent functions and employees, as applicable.

17.4 COOPACs may establish agreements for the purpose of having a single manual at the group or industry level.

Article 18.- Code of Conduct

18.1 Directors, managers, or persons performing equivalent functions and employees must formally commit to implementing a code of conduct, approved by the Board of Directors, aimed at ensuring the proper functioning of the ML/FT prevention system and establishing measures to guarantee the indefinite duty of confidentiality regarding information related to the ML/FT prevention system.

18.2 The COOPAC's code of conduct must contain, among other aspects, the guiding principles, values, and policies that allow highlighting the mandatory nature of the procedures that integrate the ML/FT prevention system and its proper development, in accordance with current regulations on the matter. The code must establish violations of the ML/FT prevention system considered as infractions, establishing their severity and the application of sanctions, in accordance with the provisions and procedures approved by the COOPACs.

18.3 COOPACs must record the knowledge that directors, managers, or persons performing equivalent functions and employees have taken regarding the code of conduct and the commitment to comply with it in the exercise of their functions within the COOPAC; as well as maintaining the indefinite duty of confidentiality regarding information related to the ML/FT prevention system of which they have taken knowledge during their stay at the COOPAC.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 12 / 40

18.4 The sanctions imposed and the previously mentioned records must be registered by the COOPACs, through the mechanism established by them.

18.5 COOPACs may establish agreements for the purpose of having a single code of conduct at the group or industry level.

SUB CHAPTER III
TREATMENT OF COOPACS ABROAD

Article 19.- Branches and Subsidiaries Abroad

19.1 The branches and subsidiaries of COOPACs located abroad must comply with ML/FT prevention measures and ML/FT risk management compatible with those required in Peru and the recommendations of the Financial Action Task Force - FATF.

19.2 In the event that the local legislation of the country in which they are incorporated prevents adequate compliance with the ML/FT prevention measures defined by the Superintendence, COOPACs have a maximum period of thirty (30) days from the issuance of the norm in the country of incorporation to submit a report to the Superintendence on: i) the limitations presented; said report must have the legal support for the impediment to its application and ii) the measures that will be adopted to manage ML/FT risks.

19.3 For the case of other COOPACs abroad not covered in the preceding paragraph, it must be verified that they have ML/FT prevention measures and ML/FT risk management compatible with those required in Peru and the recommendations of the Financial Action Task Force - FATF.

CHAPTER III
ESTABLISHMENT OF OBJECTIVES

Article 20.- ML/FT Risk Rating for Members

20.1 COOPACs must develop criteria for the ML/FT risk rating of their members, which must take into account, among other aspects, the attributes associated with the "members" risk factor, such as nationality, residence, economic activity they develop, among others that the COOPAC considers; as well as the estimated transactional volume –at the start of the contractual relationship- and actual for subsequent ratings, in accordance with what is stated in article 4 of this Regulation. This rating must be performed for the incorporation of members and must be updated throughout the relationship with the member, at the time determined for such effect by the COOPACs.

20.2 The criteria indicated in the preceding paragraph must be formalized through a risk rating (scoring) system for ML/FT, to which all members must be subjected. The ML/FT risk rating must be recorded through the mechanism established by the COOPACs. Annex No. 3 establishes the minimum criteria that COOPACs must consider in this rating system, without prejudice to the rating being performed according to the requirements established in this Regulation for each level of COOPAC. Likewise, COOPACs must establish the periodicity with which the ML/FT risk rating of members is updated.

20.3 Regarding members subject to the simplified regime, the ML/FT risk rating must take into account the variables required for said regime and information specific to the associative relationship. As long as the member only has products from this regime, the COOPAC may assign the ML/FT risk level of the product for the first ML/FT risk rating of the member, unless the COOPAC suspects that the member is related to ML/FT activities and with due support, decides to apply the enhanced regime.

Article 21.- Launch of New Products and/or Services

21.1 COOPACs must issue a report containing the evaluation of the level of exposure to ML/FT risks to which new products and/or services that will be offered by the COOPACs would be exposed. This report must be sent to the Superintendence, in accordance with what this establishes specifically.

21.2 The evaluation mentioned in the preceding paragraph must take into account, among other aspects, the distribution channel of the product and/or service, as well as other attributes of the "products and/or services" risk factor, and the measures adopted to manage the ML/FT risks associated with these products and/or services.

21.3 Such evaluation must also be performed when COOPACs decide to use new technologies associated with the products and/or services offered or when a change is made to an existing product that modifies its ML/FT risk profile. Said report must be available to the Superintendence.

Article 22.- Incursion into New Geographic Zones

COOPACs must issue a report containing the evaluation of the level of exposure to ML/FT risks to which they would be exposed in the event of incursion into new geographic zones. This evaluation must take into consideration the evaluation of the "geographic zone" risk factor, in accordance with what is stated in article 4 of this Regulation. This report must be available to the Superintendence.

CHAPTER IV
IDENTIFICATION AND EVALUATION OF ML/FT RISKS

Article 23.- Identification and Evaluation of ML/FT Risks

23.1 COOPACs must develop and implement procedures for the identification and evaluation of ML/FT risks, taking into account the ML/FT risk factors to which they are exposed, in accordance with what is established in this Regulation, as well as the market in which the COOPAC performs its activities, as follows:

a) Level 1 COOPACs must evaluate ML/FT risks and review the associated methodology, at least every five (5) years.

b) Level 2 COOPACs must evaluate ML/FT risks at least every three (3) years and review the associated methodology, at least every five (5) years.

c) Level 3 COOPACs must evaluate ML/FT risks at least every two (2) years and review the associated methodology, at least every four (4) years.

23.2 The report containing the results of the evaluation and the methodology used to perform said evaluation must be available to the Superintendence.

CHAPTER V
TREATMENT OF ML/FT RISKS

SUB CHAPTER I
KNOWLEDGE OF THE MEMBER

Article 24.- Determination of Members in Operations Performed with COOPACs

24.1 In addition to what is provided in letter s) of article 2, for the purposes of this Regulation, the treatment as members applies to those who have met the requirements demanded, according to the internal norms of each COOPAC, and with whom, by virtue of this condition, they maintain or establish relationships for the provision of services or supply of products specific to COOPACs, in accordance with their applicable norms and authorized operations, including, in the case of trusts, the settlor or the beneficiary.

24.2 The provisions on risk-based due diligence are applicable to all members of COOPACs, regardless of their particular characteristics or the frequency with which they perform operations.

Article 25.- Knowledge of the Member's Ultimate Beneficiary

25.1 For the ML/FT prevention system, the ultimate beneficiary is the natural person in whose name an operation is carried out and/or who possesses or exercises final effective control over a member in whose favor an operation is carried out. It also includes persons who exercise final effective control over a legal entity or juridical entity.

25.2 COOPACs have the continuous duty to identify the ultimate beneficiaries of all services or products they supply and take reasonable measures to verify their identity, to the extent that due diligence allows, so that they are convinced that they know who the ultimate beneficiary is.

25.3 In the case of legal entities and juridical entities, if it cannot be determined who holds final effective control by majority participation, the person who exercises control by other means is considered; and only when in such cases no natural person is identified, the natural person who performs management and/or direction functions is considered.

25.4 In the case of trusts, the identity of the beneficiary must be determined, and if applicable, the recipient of the residual assets. In the event that there are more than five (5) beneficiaries, the representatives and attorneys appointed by the boards must be identified, except those provided for in article 267 of the General Law.

25.5 The requirements contemplated in this article are applicable regardless of the due diligence regime to which the member is subject.

Article 26.- Stages of Due Diligence in Member Knowledge

26.1 The due diligence process in member knowledge consists of the following stages: i) identification, ii) verification, and iii) monitoring. The partial or total performance of each of the stages is based on the following:

a) Identification Stage.- consists of developing and implementing procedures to obtain information that allows determining the identity of a member or ultimate beneficiary.

b) Verification Stage.- implies the application of verification procedures at the start of the associative relationship with respect to the information provided by members and, if applicable,

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 13 / 40

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 15 / 40

in the case of its beneficial owner, with the objective of ensuring they have been duly identified, and must record this in their personal documentation. To not interrupt the normal course of the associative relationship before verification, COOPACs may verify the member's identity after or during the course of the associative relationship, provided the COOPAC has adopted AML/CFT risk management procedures to determine the conditions under which a member could use the COOPAC's services and/or products prior to verification and the applicable deadlines for carrying it out.

c) Monitoring Stage.- Its purpose is to ensure that the operations carried out by members are compatible with what is established in their profile. Likewise, monitoring allows reinforcing and reaffirming the knowledge COOPACs have about their members, as well as obtaining more information when there are doubts about the truthfulness or currency of the data provided by members. COOPACs must determine their frequency, considering the AML/CFT risks they face.

26.2 When the COOPAC is not in a position to comply with due diligence measures in knowing the member, it must proceed as follows: i) not initiate associative relationships, not carry out the operation and/or terminate the initiated associative relationship; and/or ii) evaluate the possibility of filing a Suspicious Transaction Report (STR) regarding the member.

26.3 In the event the COOPAC has suspicions of AML/CFT activities and considers that carrying out due diligence actions would alert the member, it must report the suspicious transaction to UIF-Peru without carrying out said actions. These cases must be substantiated and documented.

Article 27.- General regime of due diligence in knowing the member

27.1 The minimum information that COOPACs must obtain from their natural person members, when applicable, is the following:
a) Full names. b) Type and number of identity document. c) Nationality and residence. d) Address. e) Telephone number and/or email address. f) Purpose of the relationship to be established with the COOPAC, whenever this does not stem directly from the associative relationship. g) Occupation, trade or profession and name of the workplace. h) If they are or have been a Politically Exposed Person - PEP, indicating the name of the institution, public body or international organization and the position; as well as, if PEP, requiring as a minimum the first and last names of i) their relatives up to the second degree of consanguinity and second degree of affinity, ii) spouse or cohabitant of PEP. i) If they are a relative of a PEP up to the second degree of consanguinity and second degree of affinity; spouse or cohabitant of a PEP, specifying as a minimum the first and last names of the PEP. j) Identification of legal representatives, attorneys-in-fact and agents with powers of disposition, considering the information required in the preceding letters, as well as the document that accredits legal representation or the granting of the corresponding powers (power of attorney by public deed or mandate with representation, as applicable), insofar as it is applicable.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 16 / 40

27.2 The minimum information that COOPACs must obtain from their legal person members, as well as from legal entities, as applicable, is the following:
a) Trade name or corporate name. b) Unique Taxpayer Registry (RUC) or equivalent registry for non-residents. c) Corporate purpose, main economic activity or purpose of constitution of the legal person or legal entity, as applicable. d) Identification of shareholders or members who directly or indirectly hold more than 25% of the share capital, contribution or participation of the legal person and/or legal entity, considering the information required for natural persons, identifying those who are PEPs, when applicable. e) Purpose of the relationship to be established with the COOPAC, whenever this does not stem directly from the associative relationship. f) Identification of legal representatives considering the information required for natural persons, as well as the granting of the corresponding powers, insofar as it is applicable. g) Legal persons linked to the member. h) Address and telephone number of the main office or premises, where they carry out the activities inherent to their business.

27.3 Additionally, COOPACs must perform the AML/CFT risk rating of the member, taking into account the aspects indicated in Article 20 and Annex No. 3 of this Regulation.

27.4 COOPACs must determine the applicable criteria for the verification of information, compatible with the minimum information required for said operations, considering the AML/CFT risks of the products and/or services and the characteristics of the expected relationship with the member. In no case may the verification requirements be lower than those established in the simplified due diligence regime for knowing members.

27.5 COOPACs must record the verifications carried out, which may consist of personal interviews, visits to homes or offices or other procedures that allow COOPACs to ensure that their members and, if applicable, beneficial owners, have been duly identified, indicating the place, date and time of these and their results, as applicable to the type of verification carried out. The aforementioned record must be incorporated into the personal documentation of each member, which may be kept in physical or electronic media.

27.6 COOPACs must monitor members considering review processes in order to ensure that the documents, data and information obtained as a result of the application of due diligence measures remain updated and are valid. COOPACs, based on the identified risks, will determine the periodicity of the monitoring processes.

Article 28.- Simplified due diligence regime for knowing members

28.1 The application of the simplified regime allows COOPACs to reduce some of the minimum information requirements applicable to the member identification stage, when the level of AML/CFT risks so warrants, in accordance with the treatment established by the Superintendency in its regulations or the authorization granted by it on certain products and/or services, at the request of the COOPAC.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 17 / 40

28.2 The minimum information to be obtained under this regime in the case of natural person members, with the exception of those situations in which special regulations establish different minimum information, is the following:
a) Full names. b) Type and number of identity document. c) Address.

28.3 The minimum information to be obtained under this regime in the case of legal person members and legal entities, when applicable, with the exception of those situations in which special regulations establish different minimum information, is the following:
a) Trade name or corporate name. b) Unique Taxpayer Registry (RUC) or equivalent registry for non-residents. c) Identification of legal representatives considering their full names; and type and number of identity document. d) Address of the main office or premises, where they carry out the activities inherent to their business.

28.4 For the corresponding verification, the presentation of the identity document is required in the case of natural persons. In the case of legal persons, public documents that accredit their existence and contain their trade name or corporate name. In the case of legal entities, the constitutive document must be required as a minimum. In the event that the associative relationship is carried out non-presentially, COOPACs may carry out the verification through other procedures, provided they allow them to record the verification carried out.

28.5 To apply the simplified regime to a specific product, COOPACs must request prior authorization from the Superintendency, for which they must present:
a) Information regarding the characteristics of the product and/or service; including its commercial characteristics. b) Information regarding the AML/CFT risk factors related to the product and/or service. c) Information regarding the AML/CFT detection system related to the product and/or service.

28.6 COOPACs must carry out updates when the conditions or characteristics of the product and/or service vary. The Superintendency may invalidate said authorizations when it determines that the product and/or service no longer corresponds to continue within the framework of the simplified regime.

28.7 If a member contracts a product and/or service considered under this regime, but the member presents any of the characteristics indicated in the next article, the simplified regime must prevail for said product and/or service. The foregoing is not applicable when the COOPAC suspects that the member is related to AML/CFT activities, or when it is identified, as a result of the analysis carried out by the COOPAC, the existence of higher risks, in which case a reinforced due diligence regime must be applied.

Article 29.- Reinforced due diligence regime in knowing the member

29.1 COOPACs must develop and implement reinforced due diligence procedures in knowing their members, in addition to those of the general regime, when they identify and register them in the reinforced regime, as well as during the course of the associative relationship, or when these members show a pattern that does not correspond to their AML/CFT risk profile, as well as for those members who could be highly affected by AML/CFT risks.

29.2 The reinforced regime must be applied obligatorily to the following members:

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 18 / 40

a) Nationals or foreigners, non-residents; b) Non-domiciled legal persons. c) Members whose contributions, deposits and other liabilities in the COOPAC present combined balances exceeding the threshold of 10% of the effective equity of the COOPAC at the close of the previous economic year. d) Trusts. e) Non-profit organizations, understood as those persons or legal structures that mainly dedicate themselves to the collection and disbursement of funds for charitable, religious, cultural, educational, social or fraternal purposes or for the realization of other types of charitable or non-profit works. f) Politically Exposed Persons (PEP). COOPACs must also reinforce their member knowledge procedures when one of them becomes a PEP after having initiated associative relationships. g) Identified as: i) relatives of PEPs up to the second degree of consanguinity and second degree of affinity and ii) spouse or cohabitant of PEP. h) Legal persons or legal entities in which a PEP holds 25% or more of the share capital, contribution or participation. i) Those who have the status of members, shareholders, associates or equivalent title, and the administrators of legal persons or legal entities where a PEP holds 25% or more of the share capital, contribution or participation. j) Natural, legal persons or legal entities that receive transfers from countries considered as non-cooperative by the Financial Action Task Force - FATF, with risks related to AML/CFT, with little banking supervision, or countries subject to sanctions by the Office of Foreign Assets Control - OFAC. k) Natural, legal persons or legal entities regarding which there is knowledge that they are being investigated for the crime of money laundering, predicate offenses and/or terrorist financing by the competent authorities. l) Linked to natural or legal persons subject to investigation or judicial processes related to money laundering, predicate offenses and/or terrorist financing. m) Those other situations identified by COOPACs.

29.3 The COOPAC must implement the following due diligence measures for all members registered in the reinforced regime:
a) Regarding PEPs, the names of their relatives up to the second degree of consanguinity and second degree of affinity and of the spouse or cohabitant must be required, as well as the list of legal persons or legal entities where they hold a participation equal to or greater than 25% of their share capital, contribution or participation. b) Increase the frequency in the review of the member's operations. c) Increase the frequency in the update of the member's information; when it comes to legal persons or legal entities, an annual update of their shareholders, members, associates or equivalent title, who directly or indirectly hold more than 25% of their share capital, contribution or participation, if applicable. d) Conduct inquiries and apply additional identification and verification measures, such as: obtaining information about main suppliers and partners, collecting information from public or open sources, carrying out visits to the domicile. e) The decision of acceptance and/or maintenance of the associative relationship with the member is the responsibility of the governing body at the highest level or as established, for these purposes, in the Statute of the COOPAC.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 19 / 40

SUB CHAPTER II
KNOWLEDGE OF THE MARKET

Article 30.- General aspects of market knowledge

30.1 Only COOPACs of level 3 must determine a set of variables that allow them to know the characteristics of the markets in which they operate, develop criteria and procedures with the purpose of estimating the ranges within which the operations of their members would be considered as normal, among other aspects at the discretion of these COOPACs.

30.2 The market is composed of those who participate in the acquisition or use of a product or service offered by COOPACs. Participation may be direct or through third parties, physical or virtual, among others.

30.3 Market knowledge is a complement to member knowledge that allows COOPACs to estimate the ranges within which the usual operations carried out by their members would be located, based on exposure to AML/CFT risks.

SUB CHAPTER III
KNOWLEDGE OF DIRECTORS, MANAGERS, WORKERS, SUPPLIERS, COUNTERPARTIES

Article 31.- Knowledge of directors, managers and workers

31.1 COOPACs must implement a due diligence policy in knowing directors, managers or persons performing equivalent functions. Likewise, for the case of due diligence in knowing workers, this policy must be part of the recruitment and selection program of personnel for their entry, whether permanent or temporary, that ensures their integrity.

31.2 The purpose of due diligence in knowing directors, managers or persons performing equivalent functions and workers is that COOPACs are able to establish their profiles; for this, COOPACs must require and evaluate, at least, the following information:
a) Full names. b) Copy of the identity document. c) Marital status, including the names, last names and identity document number of the spouse or cohabitant. d) Home address and telephone number of their habitual residence. e) Certificate or other documents that present information on their police and criminal records. f) Sworn wealth declaration and of other incomes, different from those received from the labor relationship with the COOPAC, if applicable. g) Occupation within the COOPAC. h) Level of indebtedness in the financial system and in the COOPAC.

This information must be part of the personal documentation of each of the directors, managers or persons performing equivalent functions and workers of the COOPACs.

31.2 COOPACs must comply with the following:

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 20 / 40

a) At the time of selection or hiring and subsequent to the linkage between the parties, verify the lists indicated in Annex No. 1, in order to determine if the directors, managers or persons performing equivalent functions and workers are included in them. b) The sworn wealth declaration referred to in paragraph 31.2 must not be older than two (2) years. c) Prepare alert signals, as well as the procedures to be followed once these are activated, considering -among others- the provisions on suitability applicable to COOPACs.

Article 32.- Knowledge of suppliers

32.1 COOPACs must develop due diligence procedures during the selection of suppliers, considering in this category the companies with which the provision of goods or services that are directly related to the development of the activity for which they are subject to supervision and/or regulation by the Superintendency is contracted. To comply with said procedure, COOPACs must require and verify the following information as a minimum:
a) Full names or trade name or corporate name, in case it is a legal person. b) Unique Taxpayer Registry (RUC), or equivalent registry for non-residents, if applicable. c) Type and number of identity document, in case it is a natural person. d) Address of the main office or premises. e) Years of experience in the market. f) Sectors in which the supplier provides its products or services. g) Identification of shareholders, members or associates who directly or indirectly hold more than 25% of the share capital, contribution or participation of the legal person, and the name of the legal representative, considering the information required for natural persons. h) Sworn declaration of not having criminal records of the supplier, if applicable.

32.2 COOPACs must:
a) At the time of selection of suppliers and subsequent to the linkage between the parties, verify the lists indicated in Annex No. 1, in order to determine if they are or are not included in them. b) Update the information periodically; the update deadline cannot be greater than two (2) years. In case the information has not been modified, this must be recorded. c) Evaluate cases in which, considering the sector where they carry out their economic activities, it is convenient to include in contracts with suppliers the obligation to comply with AML/CFT prevention regulations, as well as aspects related to the duty of confidentiality of the information to which they have access. d) Prepare alert signals related to suppliers, as well as the procedures to be followed once these are activated.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 21 / 40

Article 33.- Knowledge of other counterparties

33.1 Level 3 COOPACs must develop due diligence procedures for the knowledge of these counterparties, which must be similar to those established for the case of their suppliers.

33.2 Other counterparties are considered to be natural or legal persons with whom the COOPAC maintains contractual links and which are not incorporated in the definitions of members or suppliers; this type of contract is not related to the provision of goods or services for which they are subject to supervision and/or regulation by the Superintendency, but rather it is a different kind of contract, such as those of a civil nature.

SUB CHAPTER IV
TRAINING

Article 34.- Training program

34.1 COOPACs must prepare an annual training program that is approved by the Board of Directors, with the purpose of instructing directors, managers or persons performing equivalent functions and workers on current regulations, as well as regarding the policies, regulations and procedures established by COOPACs.

34.2 Training programs must be reviewed and updated by the compliance officer, with the purpose of evaluating their effectiveness and adopting the improvements considered pertinent. The compliance officer is responsible for communicating to all directors, managers or persons performing equivalent functions and workers of the COOPAC the changes in the regulations of the AML/CFT prevention system, whether internal or external.

Article 35.- Training of the compliance officer

35.1 The compliance officer must have training and/or experience associated with AML/CFT prevention and risk management.

35.2 The compliance officer and the workers under their command must have at least two (2) specialized trainings per year, distinct from those given to COOPAC workers, in order to be instructed in detail on AML/CFT risk management.

Article 36.- Information on trainings

36.1 COOPACs must maintain annually updated information on the level of training received by directors, managers or persons performing equivalent functions and workers, compliance officer and personnel under their charge, according to their specialty and functions they perform.

36.2 New directors, managers or persons performing equivalent functions and workers who enter COOPACs must receive training on the scope of the COOPAC's AML/CFT prevention system, according to the functions assigned to them, no later than within thirty (30) days following the date of entry.

36.3 COOPACs must keep a record of the trainings received and the related evaluations carried out, if any, which must be available to supervisory bodies in the personal documentation of each director,

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 22 / 40

manager or person performing equivalent functions and workers. The compliance officer must also keep a record of the trainings received by the compliance team.

36.4 The training program must include, at least, the following topics:
a) AML/CFT regulations applicable to COOPACs. b) COOPAC's AML/CFT prevention policies and procedures. c) Identification and verification of members, suppliers and counterparties. d) Detection of suspicious transactions and reporting obligations. e) Risk management and internal controls. f) Consequences of non-compliance with AML/CFT regulations.

Article 37.- Evaluation of training effectiveness

37.1 COOPACs must evaluate the effectiveness of the training program annually, using indicators such as the number of employees trained, the results of tests or assessments, and the feedback received from participants.

37.2 The results of the evaluation must be documented and made available to the supervisory bodies upon request.

SUB CHAPTER V
INTERNAL CONTROL AND AUDIT

Article 38.- Internal control

38.1 COOPACs must establish an internal control system to ensure compliance with AML/CFT regulations and internal policies.

38.2 The internal control system must include:
a) Clear roles and responsibilities for AML/CFT compliance. b) Regular monitoring of compliance with procedures. c) Mechanisms for reporting non-compliance. d) Corrective actions for identified deficiencies.

Article 39.- Internal audit

39.1 COOPACs must have an internal audit function that is independent and objective.

39.2 The internal audit function must review the effectiveness of the AML/CFT prevention system at least annually.

39.3 The internal audit report must be submitted to the Board of Directors and made available to supervisory bodies upon request.

Article 40.- Independent audit

40.1 COOPACs must undergo an independent audit of their AML/CFT prevention system at least every two years.

40.2 The independent audit must be carried out by an external auditor qualified in AML/CFT matters.

40.3 The audit report must be submitted to the Board of Directors and the Superintendency within thirty (30) days of its completion.

Article 41.- Record keeping

41.1 COOPACs must keep records of all transactions, member identification documents, and suspicious transaction reports for at least five (5) years.

41.2 Records must be kept in a manner that allows for easy retrieval and review by supervisory authorities.

Article 42.- Cooperation with supervisory authorities

42.1 COOPACs must cooperate fully with the Superintendency and other competent authorities in the performance of their supervisory and investigative functions.

42.2 COOPACs must provide access to books, records, documents, and premises as required by supervisory authorities.

Article 43.- Sanctions

43.1 Non-compliance with the provisions of this Regulation may result in sanctions imposed by the Superintendency, including fines, restrictions on operations, and revocation of authorization, in accordance with applicable laws.

Article 44.- Final Provisions

44.1 This Regulation enters into force on the day following its publication in the Official Gazette.

44.2 The Superintendency may issue complementary regulations to facilitate the implementation of this Regulation.

44.3 All provisions contrary to this Regulation are hereby repealed.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 23 / 40

ANNEX NO. 1
LISTS OF SANCTIONED PERSONS AND ENTITIES

United Nations Security Council Sanctions List.
Office of Foreign Assets Control (OFAC) Sanctions List.
Financial Action Task Force (FATF) High-Risk Jurisdictions List.
Internal COOPAC Watchlist.

ANNEX NO. 2
RISK ASSESSMENT METHODOLOGY

Identification of Risks.
Assessment of Likelihood.
Assessment of Impact.
Calculation of Risk Score.
Determination of Risk Level.

ANNEX NO. 3
RISK FACTORS FOR MEMBERS

Geographic Risk.
Product/Service Risk.
Customer Risk.
Delivery Channel Risk.

ANNEX NO. 4
SUSPICIOUS TRANSACTION REPORT (STR) TEMPLATE

Reporter Information.
Subject Information.
Transaction Details.
Suspicious Activity Description.
Supporting Documentation.

ANNEX NO. 5
EMPLOYEE TRAINING CURRICULUM

Introduction to AML/CFT.
Regulatory Framework.
Customer Due Diligence.
Transaction Monitoring.
Reporting Obligations.
Case Studies.

ANNEX NO. 6
INTERNAL AUDIT CHECKLIST

Policy and Procedure Review.
Training Records.
Customer Due Diligence Files.
Transaction Monitoring Logs.
Suspicious Transaction Reports.
Independent Audit Reports.

ANNEX NO. 7
INDEPENDENT AUDIT REPORT TEMPLATE

Scope of Audit.
Methodology.
Findings.
Recommendations.
Management Response.

ANNEX NO. 8
SUPPLIER DUE DILIGENCE FORM

Supplier Information.
Ownership Structure.
Criminal Record Check.
Risk Assessment.
Approval Signature.

ANNEX NO. 9
COUNTERPARTY DUE DILIGENCE FORM

Counterparty Information.
Contract Details.
Risk Assessment.
Approval Signature.

ANNEX NO. 10
DIRECTOR/EMPLOYEE DUE DILIGENCE FORM

Personal Information.
Identity Document.
Criminal Record Check.
Wealth Declaration.
Approval Signature.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 24 / 40

ANNEX NO. 11
RISK RATING FORM FOR MEMBERS

Member Information.
Risk Factors.
Risk Score.
Risk Level.
Review Date.

ANNEX NO. 12
ENHANCED DUE DILIGENCE PROCEDURES

Additional Information Requirements.
Verification Methods.
Approval Process.
Monitoring Frequency.

ANNEX NO. 13
SIMPLIFIED DUE DILIGENCE PROCEDURES

Eligibility Criteria.
Reduced Information Requirements.
Verification Methods.
Approval Process.

ANNEX NO. 14
GENERAL DUE DILIGENCE PROCEDURES

Standard Information Requirements.
Verification Methods.
Approval Process.
Monitoring Frequency.

ANNEX NO. 15
SUSPICIOUS ACTIVITY MONITORING LOG

Date.
Transaction Details.
Suspicious Indicator.
Action Taken.
Analyst Name.

ANNEX NO. 16
SUSPICIOUS TRANSACTION REPORT (STR) FILING LOG

Report ID.
Date Filed.
Subject Information.
Status.
Reviewer Name.

ANNEX NO. 17
TRAINING ATTENDANCE RECORD

Employee Name.
Training Topic.
Date.
Duration.
Attendance Status.

ANNEX NO. 18
TRAINING EVALUATION FORM

Employee Name.
Training Topic.
Date.
Score.
Comments.

ANNEX NO. 19
INTERNAL AUDIT PLAN

Audit Period.
Scope.
Resources.
Timeline.
Responsible Auditor.

ANNEX NO. 20
INDEPENDENT AUDIT ENGLETTER

Auditor Name.
COOPAC Name.
Audit Period.
Scope.
Fees.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 25 / 40

ANNEX NO. 21
SUPPLIER RISK ASSESSMENT FORM

Supplier Name.
Risk Factors.
Risk Score.
Risk Level.
Review Date.

ANNEX NO. 22
COUNTERPARTY RISK ASSESSMENT FORM

Counterparty Name.
Risk Factors.
Risk Score.
Risk Level.
Review Date.

ANNEX NO. 23
DIRECTOR/EMPLOYEE RISK ASSESSMENT FORM

Employee Name.
Risk Factors.
Risk Score.
Risk Level.
Review Date.

ANNEX NO. 24
RISK APPETITE STATEMENT

Definition of Risk Appetite.
Risk Tolerance Levels.
Risk Limits.
Monitoring Mechanisms.

ANNEX NO. 25
RISK REGISTER

Risk ID.
Risk Description.
Likelihood.
Impact.
Mitigation Measures.

ANNEX NO. 26
INCIDENT REPORT FORM

Incident ID.
Date.
Description.
Impact.
Corrective Actions.

ANNEX NO. 27
REGULATORY CHANGE LOG

Change Description.
Date.
Impact Assessment.
Implementation Status.
Responsible Person.

ANNEX NO. 28
COMPLIANCE OFFICER REPORT TEMPLATE

Reporting Period.
Key Activities.
Findings.
Recommendations.
Next Steps.

ANNEX NO. 29
BOARD OF DIRECTORS REPORT TEMPLATE

Reporting Period.
Key Compliance Issues.
Risk Profile.
Training Summary.
Audit Summary.

ANNEX NO. 30
SUPERINTENDENCY REPORT TEMPLATE

Reporting Period.
Suspicious Transactions Reported.
Internal Audit Findings.
Corrective Actions Taken.
Pending Issues.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 26 / 40

ANNEX NO. 31
DATA PRIVACY POLICY

Purpose of Data Collection.
Data Retention Period.
Data Access Controls.
Data Breach Response.

ANNEX NO. 32
WHISTLEBLOWER POLICY

Reporting Channels.
Protection of Whistleblowers.
Investigation Process.
Disciplinary Actions.

ANNEX NO. 33
CODE OF CONDUCT

Ethical Standards.
Conflicts of Interest.
Confidentiality.
Compliance Obligations.

ANNEX NO. 34
BUSINESS CONTINUITY PLAN

Critical Functions.
Recovery Time Objectives.
Backup Systems.
Communication Plan.

ANNEX NO. 35
CYBERSECURITY POLICY

Access Controls.
Data Encryption.
Incident Response.
Employee Training.

ANNEX NO. 36
OUTSOURCING POLICY

Vendor Selection Criteria.
Due Diligence Requirements.
Contractual Obligations.
Monitoring Requirements.

ANNEX NO. 37
CORPORATE GOVERNANCE POLICY

Board Composition.
Committee Structure.
Decision-Making Processes.
Accountability.

ANNEX NO. 38
ETHICS COMMITTEE CHARTER

Purpose.
Membership.
Responsibilities.
Reporting Lines.

ANNEX NO. 39
RISK MANAGEMENT POLICY

Risk Governance Structure.
Risk Identification Process.
Risk Assessment Methodology.
Risk Mitigation Strategies.

ANNEX NO. 40
AML/CFT POLICY STATEMENT

Commitment to Compliance.
Scope of Application.
Roles and Responsibilities.
Review and Update Process.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 22 / 40 gerents or persons performing equivalent functions and workers, in physical and/or electronic media.

Article 37.- Minimum training requirements
37.1 Directors, managers or persons performing equivalent functions and workers must be trained, according to their functions, at minimum on the following topics:
a) Definition of the crimes of money laundering and terrorism financing. b) COOPAC policies on the model for prevention and management of ML/FT risks. c) ML/FT risks to which the COOPAC is exposed. d) Applicable external regulations. e) ML/FT typologies, as well as those detected in the COOPAC or in other COOPACs or in other obligated subjects. f) Internal rules of the COOPAC. g) Alert signals to detect unusual and suspicious transactions. h) Procedure for reporting unusual transactions. i) Responsibility of each director, manager or person performing equivalent functions and worker, as applicable, regarding this matter. j) Freezing of funds or assets in cases linked to ML/FT crimes ordered by the Superintendence, pursuant to numeral 11 of article 3 of the Law and/or the freezing of funds or assets pursuant to United Nations Security Council Resolutions on terrorism, terrorism financing and financing of the proliferation of weapons of mass destruction, pursuant to numeral 12 of the cited article.

37.2 The Superintendence may establish the aspects that the training must meet according to the functions of the persons receiving the training.

SUB CHAPTER V
RELATIONS WITH SHELL BANKS

Article 38.- Operations with banks or shell companies
38.1 A bank or shell company is considered to be a financial system entity constituted and authorized in a country where it has no physical presence and which is not a member of an economic group subject to effective consolidated supervision. Physical presence is understood as management and administrative functions located within a country. The existence of a local representative or low-level personnel does not constitute physical presence.

38.2 COOPACs cannot initiate or continue associative relationships with banks or shell companies; likewise, they must obtain confirmation that foreign institutions with which they maintain associative relationships do not allow the use of their accounts by banks or shell companies.

CHAPTER VI
CONTROL ACTIVITIES

Article 39.- Information systems
COOPACs must develop and implement information systems that allow the management of ML/FT risks in the COOPAC, which range from the communication channels between the compliance officer and the directors, management and other workers of the COOPACs, to the computer tools used in the management of ML/FT risks.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 23 / 40
CHAPTER VII
INFORMATION AND COMMUNICATION

SUB CHAPTER I
REGISTRY OF TRANSACTIONS AND CONTRACTS

Article 40.- Information contained in the transaction registry
40.1 Transactions subject to registration
In addition to the transactions referred to in numeral 9.2 of article 9 of the Law, COOPACs, as applicable to them, must create a registry containing the following transactions that are carried out for amounts equal to or greater than those described in this article:
a) Withdrawal of funds. b) Payment of contributions in the case of savings and credit cooperatives not authorized to operate with public funds. c) Withdrawal of contributions in the case of savings and credit cooperatives not authorized to operate with public funds. d) Deposits in savings accounts, checking accounts, fixed-term accounts, other term modalities and CTS. e) Cancellation of fixed-term deposits. f) Amortization and cancellation services for loans, including early payments. g) Sale of portfolio to third parties. h) Discounting and factoring operations. i) Purchase and/or sale of foreign currency in cash. j) Disbursement of loans and/or credits with or without guarantee. k) Transfer order (between members' accounts in the COOPAC, between COOPACs or using a financial entity). l) Order for issuance, collection, return of checks. m) Granting of guarantees and bonds. n) Realization and/or allocation of assets provided as collateral, indicating the net value. o) Others determined by the Superintendence through a multiple letter.

Transactions carried out on one's own behalf do not require annotation in the transaction registry.

40.2 Registry of single transactions
COOPACs must annotate the aforementioned transactions in the registry considering the following:
a) Transactions equal to or greater than five thousand US dollars (US$ 5,000.00) or their equivalent in national currency or other currencies, if applicable. b) In the case of transfer orders or the net value of realization and/or allocation of assets provided as collateral referred to in letters k) and n) of paragraph 40.1 above, values equal to or greater than two thousand five hundred US dollars (US$ 2,500.00) are included.

40.3 Registry of multiple transactions
COOPACs must keep available to the Superintendence a registry of multiple transactions carried out in one or more offices, establishments or any type of electronic device, which individually exceed the threshold of one thousand US dollars (US$1,000.00) or their equivalent in national currency or other currencies; and additionally, in their entirety, during a calendar month, equal or exceed twenty thousand US dollars (US$ 20,000.00), their equivalent in national currency or other currencies, if applicable.

For each multiple transaction, the detail of the transactions that compose it must be registered; without prejudice to its registration as single transactions pursuant to numeral 40.2. The aforementioned transactions are considered, for the purposes of this registry, as a single transaction.

40.4 General aspects on the registry of single and multiple transactions
The exchange rate applicable to fix the equivalent in national currency or other currencies, if applicable, is obtained by averaging the daily selling exchange rates corresponding to the month prior to the transaction, published by the Superintendence.

The transaction registry is carried out through computer systems containing the information indicated in numeral 9.3 of article 9 of the Law, subsection 24.5 of article 24 of the Law's Regulation and this Regulation. Regarding the natural and/or legal persons intervening in the transaction, the registry of transactions must note the identification of the person who physically carries out the transaction (executor), as well as the person on whose behalf the transaction is carried out (orderer) and the person in whose favor the transaction is carried out (beneficiary or recipient), if any.

COOPACs send the registry of single transactions to the Superintendence through the electronic means established by it.

Article 41.- Sworn declaration
In the event that an annotation of a cash transaction in the transaction registry is made, corresponding to single transactions, COOPACs must request a sworn declaration from the executor of the transaction detailing the origin of the funds used in the transaction subject to registration.

Article 42.- Request for additional information for foreign currency cash transactions
42.1 COOPACs must request additional information to that indicated in article 41, which allows determining and supporting the origin of funds when transactions in foreign currency in cash are carried out, according to what is considered in article 40 of this Regulation, for amounts equal to or greater than:
a) When it comes to purchase and/or sale of foreign currency transactions, the amount is five thousand US dollars (US$ 5,000.00), their equivalent in other foreign currencies, if applicable. b) For transactions not considered in the preceding letters, the amount to consider is twenty thousand US dollars (US$ 20,000.00), their equivalent in other foreign currencies, if applicable.

42.2 COOPACs must incorporate in the Manual or other internal normative document the list of supporting information they will request for this type of cash transactions, as well as the measures they will adopt when the executor of the transaction refuses to provide the requested information.

42.3 COOPACs may establish lower thresholds, according to the risk identification and evaluation they have carried out according to what is indicated in article 23 of this Regulation.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 24 / 40 SUB CHAPTER II COMPLIANCE OFFICER REPORTS

Article 43.- Semi-annual and annual reports
43.1 The compliance officer of Level 3 COOPACs must present to the Board of Directors, semi-annually during the year, a report on the functioning and compliance level of the ML/FT prevention system, which must consider, at minimum, the detailed information in Annex No. 4.

43.2 The compliance officer of Level 1 and 2 COOPACs must present to the Board of Directors, annually, a report on the functioning and compliance level of the ML/FT prevention system, which must consider, at minimum, the detailed information in Annex No. 4.

43.3 The reports are presented to the Board of Directors in the calendar month following the expiration of the semester or year, as applicable, and are sent to the supervisory bodies and the Superintendence, through the electronic means established by it, within fifteen (15) days following the date on which it was presented to the Board of Directors.

SUB CHAPTER III
DOCUMENT RETENTION AND ATTENTION TO REQUESTS

Article 44.- Retention and availability of the transaction registry
44.1 COOPACs must keep the transaction registry accurate and complete from the day the transaction was carried out for a period of no less than ten (10) years, using for this purpose computer, microfilm, microform or similar means that are easy to retrieve. The transaction registry must be available to judicial bodies and competent authorities in accordance with the Law.

44.2 COOPACs must keep a backup copy at the end of each quarter, which is consolidated in five (5) year periods. The backup copy of the last five-year period must be available to the Superintendence and the Public Ministry, within forty-eight (48) business hours of being requested, unless the aforementioned authority establishes a different deadline.

Article 45.- Retention of other documents
45.1 COOPACs must retain information related to the ML/FT prevention system for a period of no less than ten (10) years. This information mainly comprises:
a) Information related to the affiliation and transactions carried out by members, including all information obtained and/or generated in the application of due diligence measures. The aforementioned information must be kept updated, considering for this effect the ML/FT risk analyses and periodicity established by the COOPAC and considered in the manual. b) Information regarding affiliation and transactions with counterparties and suppliers. c) Policies, procedures and analyses carried out and other information regarding compliance with the obligations expressly contemplated in this Regulation.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 25 / 40
45.2 For the purposes of the foregoing, computer, microfilm, microform or similar means are used that allow easy retrieval of information for consultation and internal or external reporting to competent authorities in accordance with the Law.

Article 46.- Attention to information requests from authorities
COOPACs must develop and implement mechanisms for attending to requests made by competent authorities regarding the ML/FT prevention system, taking into account the deadlines and forms established in the legislation and regulation on the matter.

TITLE II
DETECTION AND REPORTING OF SUSPICIOUS TRANSACTIONS

Article 47.- Alert signals
47.1 COOPACs must take into account the list of alert signals in Annex No. 5, in order to detect unusual or suspicious transactions. The foregoing does not exempt COOPACs from considering other alert signals that could give rise to the classification of transactions they consider suspicious according to their ML/FT prevention system. Without prejudice to this, the Superintendence may provide additional information or criteria that contribute to the detection of unusual or suspicious transactions.

47.2 COOPACs must carry out periodic evaluations on all alert signals defined by them and considered in ML/FT risk management.

Article 48.- Suspicious Transaction Report
48.1 The COOPAC has the obligation to communicate to UIF-Peru through its compliance officer, the transactions detected in the course of its activities, carried out or attempted to be carried out, which according to its good judgment are considered suspicious, regardless of the amounts involved. For these purposes, good judgment is considered to be the discernment or judgment formed by the compliance officer based, at least, on the knowledge of the member and the market; it covers experience, training and diligence in ML/FT prevention.

48.2 The communication must be made immediately and sufficiently, that is, within a period that - according to the nature and complexity of the suspicious transaction - allows the compliance officer to prepare, document and send the STR to UIF-Peru, which in no case must exceed twenty-four (24) hours from when the transaction is classified as suspicious. A transaction is classified as suspicious when this category can be presumed after the analysis and evaluation carried out by the compliance officer.

48.3 The compliance officer must leave documentary evidence of the analysis and evaluations carried out, for the classification of a transaction as unusual or suspicious, as well as the reason why an unusual transaction was not classified as suspicious and reported to UIF-Peru, if applicable. Transactions classified as unusual and the documentary support of the analysis and evaluations are retained for a period of no less than ten (10) years, pursuant to article 45.

48.4 The communication of suspicious transactions through the STR that COOPACs carry out through their compliance officers has a confidential and reserved character. Only the compliance officer, or if applicable the alternate compliance officer, may have knowledge of the sending of the STR. For all legal purposes, the STR does not constitute a criminal or administrative complaint.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 26 / 40
Article 49.- Content of the Suspicious Transaction Report (STR)
STRs must contain the following minimum information:
a) Identity of the persons intervening in the transactions indicating full names, date of birth, type and number of identity document, nationality, profession or occupation, address and telephone, for natural persons; as well as trade name or corporate name, Unique Taxpayer Registry number (RUC) or equivalent registry in the case of non-domiciled legal persons, corporate purpose, address, telephone and names and surnames of the legal representative, in the case of legal persons. Regarding the representative, the information required for natural persons must be included. The foregoing is applicable in the case of STRs regarding members, workers, suppliers and/or counterparties. b) When third parties (executors) intervene in the transaction, the full names and surnames of said persons and other information available about them must be indicated. c) Indicate if they have previously carried out a suspicious transaction, indicating the documentation with which said transaction was communicated to competent authorities. d) List and description of transactions carried out mentioning dates, amounts, currencies, accounts used, linked accounts, place of execution, supporting documents attached to the report, such as fund transfers, copies of checks, account statements, among others, as applicable to the type of transaction. e) Irregularities and considerations that led to classifying said transactions as suspicious. f) Other information considered relevant.

Article 50.- Method of sending
50.1 COOPACs communicate the STR and attached or complementary documentation to UIF-Peru through the online suspicious transaction reporting system - ROSEL, using the ROSEL template or another that serves as such, published on the portal for the prevention of money laundering and terrorism financing (plaft.sbs.gob.pe), enabled by the Superintendence for this purpose.

50.2 The compliance officer is responsible for the correct use of the ROSEL system and all information contained in the respective template and its annexes, or another that serves as such, and must adopt the necessary measures to ensure the accuracy and truthfulness of the information, its reserve and confidentiality.

Article 51.- Confidentiality
51.1 Under no circumstances must the identity of the compliance officer or the COOPAC, nor any other element that could contribute to identifying them, be recorded in the STR, except for the secret codes assigned by UIF-Peru.

51.2 In all other communications from the COOPAC addressed to the Superintendence, the compliance officer must only use the secret codes assigned.

TITLE III
EVALUATION OF THE ML/FT PREVENTION SYSTEM

Article 52.- Internal audit
52.1 The design and application of the ML/FT prevention system must be evaluated by its Internal Audit Unit, internal auditor or Supervisory Board, as applicable.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 27 / 40
52.2 The Internal Audit Report (IAI) is made known to the Board of Directors of the COOPAC, within thirty (30) days following the expiration of the respective annual period.

52.3 The COOPAC sends the IAI through the compliance officer, no later than February 15 of the following year, to the supervisory body through the Portal for the Prevention of Money Laundering and Terrorism Financing (plaft.sbs.gob.pe) or other means established by the Superintendence, as an annex to the second semi-annual report and the annual report, as applicable.

Article 53.- External audit
External audit firms must annually issue an independent compliance report, on the evaluation of the ML/FT prevention system of COOPACs, in accordance with what is provided in the External Audit Regulation applicable to COOPACs.

FINAL COMPLEMENTARY PROVISIONS
First.- Annexes
The following annexes form an integral part of this Regulation:
Annex No. 1: Lists that contribute to the prevention of ML/FT.
Annex No. 2: Minimum content of the manual for the prevention and management of money laundering and terrorism financing risks.
Annex No. 3: Minimum criteria for the risk classification system for money laundering and terrorism financing for members.
Annex No. 4: Minimum content of the compliance officer's reports.
Annex No. 5: Alert Signals.

Second.- Compliance with the provisions of this Regulation The information that allows accrediting compliance with the provisions of this Regulation must be available to the Superintendence.

Article Second.- Within a period that must not exceed three hundred sixty (360) days from the entry into force of the Resolution, COOPACs must send to this Superintendence the transaction registry (TR) corresponding to the new transactions included in the Regulation approved in the first article. The instruction for the Transaction Registry is approved by Superintendence Resolution.

Article Third.- Modify article 1 of the Regulation for the Management of Money Laundering and Terrorism Financing Risks approved by Resolution SBS No. 2660-2015 and its modifying norms, according to the following text:

“Article 1.- Scope
This Regulation is applicable, as applicable, to the companies indicated in articles 16 and 17 of the General Law, to the Agropecuario Bank, to the Bank of the Nation, to the Guarantee Fund for Small Industry - FOGAPI, to private pension fund administrators, to the Development Financial Corporation S.A. - COFIDE, to the Mivivienda Fund S.A. and to insurance brokers, hereinafter companies.”

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 28 / 40
Article Fourth.- Modify article 1 of the Standard that establishes the requirements and characteristics of the Suspicious Transaction Reports (STRs) that the supervisory bodies of obligated subjects to report issue to UIF-Peru, approved by Resolution SBS No. 6414-2014, according to the following text:

“Article 1. Scope
This standard is applicable to the supervisory bodies of obligated subjects to report on the prevention and detection of money laundering and terrorism financing, established in the current regulation.”

Article Fifth.- This Resolution enters into force the day following its publication in the Official Gazette El Peruano.

SOCORRO HEYSEN ZEGARRA
Superintendent of Banking, Insurance and Private Pension Fund Administrators

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 30 / 40

ANNEX NO. 1
LISTS THAT CONTRIBUTE TO THE PREVENTION OF ML/FT

In accordance with what is stated in the Regulation for the prevention of money laundering and terrorist financing applicable to Savings and Credit Cooperatives not authorized to operate with public funds, COOPACs must review the following documents.

a) OFAC List: list issued by the Office of Foreign Assets Control of the U.S. Department of the Treasury, which includes countries, persons and/or entities that collaborate with terrorism and illicit drug trafficking. b) Lists of terrorists of the United Nations Security Council, in particular the Lists on persons involved in terrorist activities (Resolution No. 1267) and those that succeed them. c) List of terrorists of the European Union. d) Lists related to the Financing of Proliferation of Weapons of Mass Destruction: Lists issued by the UN Security Council. Includes at least, the Consolidated List Resolution 1718, on the Democratic People's Republic of Korea (North Korea) and the Consolidated List UN Resolution 1737 on Iran. e) List of Non-Cooperative Countries and Territories. f) Lists of Resolutions of the United Nations Security Council. g) Others indicated by the Superintendence, through a multiple letter.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 31 / 40

ANNEX NO. 2
MINIMUM CONTENT OF THE MANUAL FOR THE PREVENTION AND MANAGEMENT OF ML/FT RISKS

The manual for the prevention and management of money laundering and terrorist financing risks, hereinafter the Manual, aims to ensure that directors, managers, and employees have at their disposal the policies and procedures that must be observed in the exercise of their functions within the COOPAC, in accordance with what is required in the Regulation for the prevention of money laundering and terrorist financing applicable to Savings and Credit Cooperatives not authorized to operate with public funds. The Manual must contain, at a minimum, the following information:

General Aspects:
1.1. Relevant definitions related to the prevention and management of ML/FT risks.
1.2. Objective and recipients of the Manual.
1.3. Policies regarding the prevention and management of ML/FT risks.
1.4. Training programs, considering the minimum content developed in this Regulation.
1.5. General guidelines established in the code of conduct with the objective of managing ML/FT risks.
1.6. Infractions and internal sanctions, contemplated in the Internal Work Regulation, the code of conduct, the manual, the ML/FT prevention system, or legal provisions on the matter, for non-compliance with established obligations.
Functions and Responsibilities:
2.1. General obligations applicable to all workers in matters of ML/FT prevention.
2.2. Functions and responsibilities associated with the prevention and management of ML/FT risks of directors, managers, the compliance officer, and employees (business and support units), considering for this purpose the role they perform and their powers.
2.3. Hierarchy, functions, and responsibilities of the compliance officer and personnel under their charge.
General Mechanisms for Managing Money Laundering and Terrorist Financing Risks:
3.1. Description of ML/FT risk factors.
3.2. Description of the methodology applied for the evaluation and management of ML/FT risks.
3.3. Procedure for the participation of the compliance officer in the evaluation of proposals for launching new products, participation in new markets, among others.
3.4. Description of the methodology, criteria for knowing members, market, suppliers, and counterparties, as applicable, indicating the levels or positions responsible for their execution.
3.5. System to evaluate the personal, professional, and asset background of employees, managers, and directors.
3.6. Alert signals to determine unusual conduct of employees, managers, and directors.
3.7. Alert signals to determine unusual or suspicious conduct on the part of suppliers and counterparties, as applicable.
3.8. Alert signals for the detection of unusual or suspicious operations by its members.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 32 / 40

3.9. Procedure for the analysis of alerts, unusual operations, and suspicious operations.

Registration and Communication Procedures:
4.1. The form and periodicity with which directors and general management, among others, must be informed about the COOPAC's exposure to ML/FT risks.
4.2. Procedures for recording, archiving, and conserving information and documentation required, in accordance with current regulation.
4.3. Forms for the registration of operations and reporting of unusual operations.
4.4. Internal procedures for consulting and communicating unusual and/or suspicious operations.
4.5. Procedures for reporting suspicious operations to UIF-Peru within the legal deadline.
4.6. Procedures to attend to information requests or additional information requested by competent authorities.
4.7. Communication channels between COOPAC offices with different internal instances, for the purposes of the ML/FT prevention system.
4.8. Consultation mechanisms between the compliance officer and all COOPAC departments.
International and Regulatory References on the Prevention of Money Laundering and Terrorist Financing

Mechanisms or means by which current regulation in matters of ML/FT prevention and international standards on the matter, their modifications, and substitutions, will be available to COOPAC employees must be indicated.

The development of each of the minimum aspects contemplated in the Manual may be included in this or in another internal normative document, provided that these documents have the same approval procedure. In the latter case, it must be specified in the Manual which aspects have been developed in other internal normative documents, which must be available to the supervisory body.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 33 / 40

ANNEX NO. 3
MINIMUM CRITERIA FOR THE ML/FT RISK RATING SYSTEM FOR MEMBERS

This guide contains a list of minimum criteria that must be taken into account by COOPACs with the aim of implementing the ML/FT risk rating system for members, according to the following:

The initial rating aims to determine the ML/FT risk level of the member. Each COOPAC determines the weight and final value of each criterion in the final score of the ML/FT risk level of each member.
The rating may include more criteria determined by the COOPACs.
The ML/FT risk rating must be registered through the physical or electronic means established by the COOPAC.

COOPACs must determine the periodicity with which the ML/FT risk rating sheets of members are updated.

Member ML/FT Risk Factor: Attributes linked to this factor must be taken into account, such as:
a) Distinction between natural person and legal entity b) Type of legal entity, if applicable 1 c) Size of the legal entity 2 d) Profession – occupation / Economic activity e) Condition of obligated subject as required by current provisions in matters of ML/FT prevention 3 . f) Distinction between member subject to the General Regime / Simplified Regime / Enhanced Due Diligence Regime in Member Knowledge
Product ML/FT Risk Factor: Attributes linked to the product by which the member connects with the COOPAC must be taken into account.
a) Type of product used b) Distribution channel c) Currency
Geographic Zone ML/FT Risk Factor: The list of countries considered high risk by the FATF must be taken into account, as well as those that the COOPAC has determined independently of international lists. Differences between national geographic zones must also be considered.
a) Country and place of birth/nationality (natural person) or constitution (legal entity)

1 It must be taken into account what is stated in the Civil Code and the General Companies Law.
2 Reference must be made to what is stated for types of credits in the Regulation for the Evaluation and Classification of the Debtor and the Requirement of Provisions, approved by SBS Resolution No. 11356-2008 and its modifying norms. 3 COOPACs may take into consideration information on obligated subjects who have designated a compliance officer before UIF-Peru. UIF-Peru makes this information available through the electronic means it establishes for such purpose.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 34 / 40

b) Country and place of residence (natural person) or operation (legal entity)

Other aspects: Other aspects linked to the characteristics of the member and/or operations to be carried out must be considered, such as the estimated and/or actual transactional volume, as well as the purpose of the relationship to be established with the COOPAC, provided that this does not derive directly from the associative relationship.

In the case of members who are under the Simplified Due Diligence Regime in Member Knowledge, the information that is available considering the information requirements and details specific to the associative relationship must be considered.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 35 / 40

ANNEX NO. 4
MINIMUM CONTENT OF THE COMPLIANCE OFFICER'S REPORTS

Semi-Annual and Annual Reports

The report corresponding to the first semester of the year must contain, at least, information related to:

a) Detail of whether the functions of the compliance officer are performed on an exclusive dedication basis or not, as well as, if they have personnel under their charge, in accordance with current regulation. b) Description of new typologies of suspicious operations detected, in relation to the previous report, if any. c) Description of new procedures implemented to prevent and manage ML/FT risks. d) Relevant information on the evaluations of ML/FT risks associated with new products, services, or distribution channels, or incursion into new markets. e) Statistics of unusual operations and suspicious operations, discriminating the information monthly, specifying the amounts involved, or another aspect considered significant. f) Number of Suspicious Operation Reports (ROS) sent to UIF-Peru in the semester, as well as comparative information in relation to the previous semi-annual report, or in its absence, a declaration that considers the non-existence of ROS in the semester. g) Progress and degree of compliance with the annual work program. h) Corrective actions adopted by virtue of observations and recommendations of the internal audit unit, the external audit firm, and the Superintendence, if any. i) Sanctions applied to workers during the semester, due to non-compliance with the ML/FT prevention system. j) Other important aspects, at the discretion of the compliance officer.

The compliance officer's report corresponding to the second semester of the year must comprise, in addition to what is stated for the first semester, an annual evaluation on the adequacy and compliance of policies and procedures, referring to the following minimum aspects:

a) Actions developed in relation to procedures for knowing members, suppliers, counterparties, and the market, if applicable. b) Relevant information on the evaluation of ML/FT risks associated with operations carried out during the last year. c) Training on topics related to ML/FT prevention, including a general description of the training provided and the number of people who have been trained. Likewise, the number of people who were trained more than once a year must be indicated, as well as the detail of differentiated training according to the profile of the recipient and their function, as well as the ML/FT risks they face. d) Compliance with the manual and code of conduct by directors, managers, and workers, indicating those cases in which it has been non-complied with, the sanctions imposed, and corrective measures adopted.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 36 / 40

e) Indicate whether the manual and code of conduct have been approved by the Board of Directors of the COOPAC. f) If the COOPAC has complied with the policies for knowing directors, managers, and workers. g) Results of the analysis and control that the operations register is being properly filled out by the responsible personnel. h) Annual statistics of suspicious operations reported to UIF-Peru, discriminating the information monthly, specifying the amounts involved or another aspect considered significant. i) Changes and updates to the manual and management of ML/FT risks. j) Indicate if it has complied with reviewing and, if applicable, updating with the support of the human resources area or equivalent body, the training programs, as well as that it has complied, if applicable, with communicating to all directors, managers, and workers, the changes in the regulation of the ML/FT prevention system. k) Other important aspects at the discretion of the compliance officer.

In case significant changes occur in the following semester with respect to the annual evaluation of the aspects mentioned above, these changes must be described in the next semi-annual report of the compliance officer, together with the analysis of the impact that these modifications have had on the COOPAC's ML/FT prevention system.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 37 / 40

ANNEX NO. 5
ALERT SIGNALS GUIDE

This guide contains a list of alert signals that COOPACs must take into account with the aim of detecting and/or preventing suspicious operations related to ML/FT. If any of the operations or situations indicated below are identified, these must be analyzed and evaluated to determine if they constitute suspicious operations to communicate them to UIF-Peru.

Each COOPAC must define particular criteria linked to alerts depending on the nature of its operations. Likewise, it must develop alert evaluation procedures, which must be found in the Manual or another internal normative document of similar approval to the Manual, available to the Superintendence.

I. Unusual operations or conduct relative to members

The member refuses to provide the requested information or the information provided is inconsistent or difficult to verify by the COOPAC.
The member indicates an address that is also that of a business different from that declared by the member and/or does not seem to correspond with the occupation declared by him (for example, student, unemployed, self-employed worker, among others).
The member requests to be excluded from the operations register without apparent or justified cause.
The member refuses to fill out the forms required by the COOPAC or to provide the necessary information to complete them or to carry out the operation once asked to fill out the forms.
Frequent use of intermediaries to carry out commercial or financial operations.
The operations do not correspond to the member's profile.
Regarding non-profit organizations, such as associations, foundations, committees, NGOs, among others, operations do not seem to have a logical economic purpose or there does not seem to be a link between the activity declared by the organization and the other parties participating in the transaction.
The financial statements presented by the member reveal a financial situation that differs from that corresponding to similar businesses.
The member insists on meeting with COOPAC staff in a place other than the offices to carry out an operation.
The member tries to pressure a worker not to fill out the forms required by the COOPAC.
That it is known through public media or otherwise, as applicable, that a member is being investigated or prosecuted for the crime of money laundering, predicate crimes, the crime of terrorist financing, and/or related crimes.
Funds generated by a business belonging to individuals of the same nationality or country of residence, coming from countries considered non-cooperative by the FATF or subject to OFAC sanctions, acting on behalf of similar types of businesses.
The member repeatedly carries out split transactions.
The member carries out complex operations without an apparent purpose.
The member constantly carries out operations and unusually uses or intends to use cash as the only means of payment instead of others.

Los Laureles Nº 214 - Lima 27 - Perú Telf.: (511) 6309000 Fax: (511) 6309239 38 / 40

Existence of members among whom there is no relationship of kinship, financial, and/or commercial, depending on whether they are natural or legal persons, however they are represented by the same person, without apparent explanation.
Members domiciled in countries with low or no tax imposition.

II. Unusual operations or conduct relative to workers

The worker's lifestyle does not correspond to their income or there is a notable and unexpected change in their economic situation.
The worker constantly avoids or refuses to take vacations.
The worker presents frequent and unjustified absences.
The worker often remains in the office outside of working hours, without justified cause.
The worker uses their own home to receive documentation from members.
Any business carried out by the worker where the identity of the beneficiary is unknown, contrary to the normal procedure for the type of operation in question.
The worker has or insists on having meetings with members in a place other than the COOPAC offices or outside of working hours, without any justification, to carry out a commercial or financial operation.
The worker is involved in non-profit organizations, such as foundations, associations, committees, NGOs, among others, whose objectives have been duly demonstrated to be related to the ideology, claims, or demands of a national and/or foreign terrorist organization, provided that this is duly demonstrated.
An unusual or sudden increase in the number of operations under the worker's charge is presented.
Notable or unexpected change in the commercial business owned by the worker.
It is proven that the worker has not communicated or has hidden from the compliance officer information related to the change in the behavior of any member.

III. Operations or situations related to COOPAC operations

Cash deposit with payment orders or other instruments for payment to third parties.
The member who frequently carries out operations for large sums of money (deposits, withdrawals, or purchases of monetary instruments, among others) and refuses or avoids giving information about the origin and/or destination of the money or these operations do not relate to their economic activity.
Withdrawals for a significant amount from an account that had little movement or from an account that received an unusual deposit.
Accounts that receive periodic deposits and remain inactive in other periods.
An account shows little or no activity for a long period or contains a minimum sum of money that are transferred abroad or transferred or deposited locally and withdrawn completely or almost entirely. For example, numerous cash deposits or transfer orders, followed by a transfer order of all funds either abroad or locally.
The member frequently makes large cash deposits and maintains high balances, but does not use other services.
The member who routinely makes numerous deposits but rarely makes withdrawals for their daily operations.
Large cash deposits to the account of a person when the apparent commercial activity of the individual or entity would normally be conducted in checks or other payment instruments.

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 39 / 40

Multiple transactions carried out on the same day in the same COOPAC in an apparent attempt to use different counters, without justification for doing so.
Structuring of deposits through multiple COOPAC offices or through groups of individuals who enter the same office at the same time.
The member who makes multiple cash withdrawals for amounts below the limit required for transaction registration.
The deposit of multiple checks in amounts that systematically fall below the limit required for transaction registration, and in particular if the checks are numbered in sequence.
Carrying out numerous cash deposits or withdrawals or transactions below the limit established for transaction registration.
Substantial deposits in large quantities of US$50 and US$100 bills.
The representative or intermediary who makes substantial cash deposits in members' accounts, whose profile does not match such operations.
Deposits of large amounts of money through permitted electronic means or others that avoid direct contact with COOPAC staff.
Large volume of transfer orders deposited in an account whose activity is unrelated to the member's profile.
Loans for high amounts that are not used or are suddenly cancelled partially or fully without a rational explanation of the source of funds, and especially if the cancellation is in cash, foreign currency or other instruments in which the issuer is unknown.
Loans secured by assets deposited in the COOPAC whose value has no relation to the member's profile or whose source is unknown or by third parties who do not appear to have any relationship with the member.
Loans in which the disbursement is requested to be made in another province or department of Peru or in another country, without apparent labor or commercial explanation.
Operations involving members residing in countries considered as non-cooperative by the FATF or subject to OFAC sanctions.
An account for which several people have authorized signature, but among whom there does not appear to be any relationship (whether family ties or business relationships).
An account opened by a legal entity or organization that has the same address as other legal entities or organizations, but for which the same person or persons have authorized signature, when there is no apparent economic or legal reason for such an agreement.
An account opened in the name of a recently created legal entity and in which deposits are made that are higher than expected compared to the income of its founding members.
The opening of multiple accounts by the same person, in which numerous small deposits are made, which, taken together, do not correspond to the expected income of the member.
An account opened in the name of a legal entity that is involved in the activities of an association or foundation whose objectives are related to the ideology, claims or demands of a national or foreign terrorist organization.
An account opened in the name of a legal entity or non-profit organization, such as foundations, associations, NGOs, among others, which is suspected of being related to a terrorist organization and which shows fund movements above the level of expected income.
An account opened temporarily in the name of a legal entity or non-profit organization, such as foundations, associations, NGOs, among others, which shows constant

Los Laureles Nº 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 40 / 40

fund movements inside and outside the country, carried out by people with no apparent labor link to them.
29. Cash deposits in an account from foreign financial system companies, when the frequency and volume of deposits are considerable given the size, nature and location of the member's foreign financial system company.
30. A financing request, when the source of the down payment is not clear, especially if real estate is involved.
31. Financing requests from members who offer cash guarantees, financial assets, foreign currency deposits or guarantees from foreign banks, and whose activity is unrelated to the object of the operation.
32. Existence of individual or joint accounts of members with family relationships, who transfer money to each other, periodically or occasionally, with the instruction to invest, cancel or transfer abroad in the name of the person who does not have a regular source of funds resulting from a business or consistent labor income to said amounts.
34. Opening accounts with cash or transfers, with the apparent proceeds of work or businesses carried out outside the country whose origin is difficult to prove in whole or in part.

Resolution SBS No. 5060-2018: Regulation for the Prevention of Money Laundering and Terrorist Financing Applicable to Savings and Credit Cooperatives Not Authorized to Operate with Public Funds

Lineage: In force

Timeline

Similar documents from other regulators