"2013 - YEAR OF THE BICENTENARY OF THE GENERAL CONSTITUENT ASSEMBLY OF 1813" COMMUNICATION “A” 5398 02/13/2013

TO FINANCIAL INSTITUTIONS:
Ref.: Circular
RUNOR 1 - 1013
LISOL 1 - 568
OPRAC 1 - 688

Risk management guidelines for financial institutions. Debtor classification.
Minimum provisions for bad debt risk.
Amendments
.

We address you to inform you that this Institution adopted the resolution that, in its pertinent part, is transcribed below:
“1. Replace the rules on “Risk management guidelines for financial institutions” with those accompanying in the Annex to this communication.
2. Replace point 6.2. of Section 6. of the rules on “Debtor classification” with the following:
“6.2. Classification criterion.
The basic evaluation criterion is the debtor's repayment capacity based on the estimated financial flow and, only secondarily, on the basis of the client's asset liquidation, since the granting of financing must respond to their true credit needs and be made under amortization conditions consistent with the real repayment possibilities that their activity and generation of funds allow. In this analysis, emphasis will be placed on measuring the degree of exposure recorded in foreign currency based on their indebtedness and generation of income in that currency, as well as with respect to those income and expenses linked to the evolution of the Reference Stabilization Coefficient. Regarding clients for financing in foreign currency, whatever the source of funds applied, emphasis must be placed on analyzing whether the client has sufficient payment capacity to cover maturities even in the face of significant variations in the exchange rate. To this end, at least two scenarios must be considered that contemplate significant variations in the exchange rate of different magnitudes within a term of up to one year. In the cases of clients residing abroad, the criteria defined in Section 2. of the rules on “Risk management guidelines for financial institutions” related to “country risk” must also be taken into account. Among other aspects,

-2-

regarding the country of residence - of the debtor and its guarantor - the following must be considered: i) the economic situation; ii) the size and structure of external debt in relation to the economy; iii) the implicit weaknesses in the country's current account and iv) the evaluation of the country's financial history. In the cases of financial institutions, the analysis must take into account the liquidity of the debtor intermediary and the quality of its portfolio.”
3. Incorporate as point 2.2.8. of Section 2. of the rules on “Minimum provisions for bad debt risk” the following:
“2.2.8. Treatment of clients or guarantors residing abroad -“country risk”-.
In the cases of clients or guarantors residing abroad, financial institutions must evaluate the appropriateness of constituting a specific provision for “country risk” based on the provisions of point 6.2. of Section 6. of the rules on “Debtor classification” and taking into account the criteria defined in Section 2. of the rules on “Risk management guidelines for financial institutions” related to that risk”.” We send you the sheets that, in replacement of those previously provided, must be incorporated into the rules on “Debtor classification” and “Minimum provisions for bad debt risk”. Likewise, it is recalled that on the page of this Institution www.bcra.gov.ar, accessing “regulations” (“ordered texts”), you will find the modifications made with texts highlighted in special characters (strikethrough and bold). We greet you attentively. CENTRAL BANK OF THE ARGENTINE REPUBLIC Matías A. Gutiérrez Girault Alfredo A. Besio Manager of Issuance of Rules Deputy General Manager of Rules
ANNEX

-IndexSection 1. Risk management process.
1.1. Scope of the guidelines.
1.2. General considerations.
1.3. Economic Capital. Evaluation process.
1.4. General principles.
1.5. Responsibilities.
Section 2. Credit risk management.
2.1. Concepts.
2.2. Responsibilities.
2.3. Credit risk management process.
2.4. Counterparty credit risk management.
2.5. Residual risk management.
2.6. Country risk management.
2.7. Transparency.
Section 3. Liquidity risk management.
3.1. Concepts.
3.2. Responsibilities.
3.3. Liquidity risk management process.
3.4. Transparency.
Section 4. Market risk management.
4.1. Concepts.
4.2. Responsibilities.
4.3. Market risk management process.
4.4. Transparency.
Section 5. Interest rate risk management.
5.1. Concepts.
5.2. Responsibilities.
5.3. Interest rate risk management process.
5.4. Transparency.
Section 6. Operational risk management.
6.1. Concepts.
6.2. Responsibilities.
6.3. Operational risk management process.
Version: 2a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 1
B.C.R.A. ORDERED TEXT OF THE RULES ON “RISK MANAGEMENT GUIDELINES FOR FINANCIAL INSTITUTIONS”

-IndexSection 7. Securitization risk management.
7.1. General considerations.
7.2. Securitization risk management process.
7.3. Operations related to securitizations.
7.4. Residual risks.
7.5. Transparency.
Section 8. Concentration risk management.
8.1. Concepts.
8.2. Situations that can originate risk concentrations.
8.3. Framework for concentration risk management.
8.4. Concentration risk management process.
8.5. Stress tests. Responsibilities.
8.6. Transparency.
Section 9. Reputational risk management.
9.1. Concepts.
9.2. Reputational risk management process.
9.3. Transparency.
Section 10. Strategic risk management.
10.1. Concept.
10.2. Strategic risk management process.
10.3. Responsibilities.
10.4. Transparency.
Section 11. Conducting stress tests.
11.1. Concepts.
11.2. Guidelines.
Correlation table
B.C.R.A. ORDERED TEXT OF THE RULES ON “RISK MANAGEMENT GUIDELINES FOR FINANCIAL INSTITUTIONS” Version: 1a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 2

1.1. Scope of the guidelines.
Financial institutions must have a comprehensive risk management process that includes oversight by the Board of Directors and Senior Management to identify, evaluate, monitor, control and mitigate all significant risks. This process must be proportional to the dimension and economic importance of the financial institution in question as well as to the nature and complexity of its operations, taking into account for these purposes the guidelines contained in this regulation. The comprehensive risk management process must be adequate, sufficiently verified, duly documented and periodically reviewed based on changes in the entity's risk profile and in the market. In addition, the results of that review must be used in the evaluation of capital adequacy referred to in point 1.3.
1.2. General considerations.
These guidelines constitute good practices in risk management and, therefore, are not substitutes for the specific requirements contained in the rules issued by the Central Bank of the Argentine Republic, and must be implemented in accordance with the powers conferred on the Board of Directors by the Shareholders' Meeting or governing body of the company that performs similar functions and in the context of the pertinent legal provisions in force. Information on the comprehensive risk management process implemented by the entity must be available to the Superintendency of Financial and Exchange Institutions. For the purposes of these rules, the following are understood as:
1.2.1. Board of Directors: body or authority that performs administration functions according to the corresponding corporate type.
1.2.2. Senior Management: General Management and those managers who have decision-making power and depend directly on it or on the president of the Board of Directors.
1.2.3. Off-balance sheet operations: those operations that are not recorded in the statement of financial position but that are a potential source of risk exposure for entities, and may be recorded in order accounts or be mentioned in notes to the financial statements, as appropriate.
1.2.4. Counterparty: the one obligated to make an economically valuable consideration to the financial institution, even when the relationship with the entity does not arise from a credit assistance granted directly, such as in the settlement of an operation with securities, or when it is contingent, as in the case of a guarantor or in certain derivative operations.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 1. Risk management process.
Version: 2a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 1

1.2.5. Trading portfolio: the one constituted by positions in monetary regulation instruments of the Central Bank of the Argentine Republic and other financial instruments, which appear in the volatility lists issued by this Institution, destined for trading operations (“trading”).
1.2.6. Investment portfolio: the one constituted by positions in monetary regulation instruments of the Central Bank of the Argentine Republic and other financial instruments, which do not appear in the current volatility list issued by this Institution and those that, being listed there, are valued according to the cost plus yield criterion.
1.3. Economic Capital. Evaluation process.
1.3.1. Concept.
The economic capital of financial institutions is that which they require to cover not only unexpected losses originated by exposures to credit, operational and market risks, but also those that come from other risks - some of them contemplated in these provisions - to which the financial institution may be exposed.
1.3.2. Evaluation.
It is of fundamental importance that financial institutions have an internal, integrated and global process to evaluate the adequacy of their economic capital based on their risk profile (“Internal Capital Adequacy Assessment Process” - “ICAAP”) and with a strategy to maintain their capital levels over time. If as a result of this internal process it is determined that regulatory capital is insufficient, financial institutions must increase it based on their own estimates. Financial institutions must demonstrate that their internal capital objectives are well founded and are in accordance with their overall risk profile and operating environment. The capital adequacy evaluation process must take into account all significant risks to which the financial institution faces. Although not all risks can be measured accurately, financial institutions must develop a comprehensive process for the management of at least credit, operational, market, interest rate, liquidity, reputational and strategic risks, using stress tests to evaluate adverse but possible situations that may affect their capital level. The ICAAP must be carried out both on an individual and consolidated basis and include stress tests that complement and validate any other quantitative or qualitative approach used by the entity, so that the Board of Directors and Senior Management have a more complete understanding of the interaction between different types of risks under stress conditions. Likewise, the ICAAP must consider short- and long-term capital needs and tend to the prudent accumulation of capital surpluses in benign periods of the economic cycle. RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 1. Risk management process.
Version: 2a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 2

The fundamental elements of a rigorous capital evaluation include:
i) Policies and procedures to ensure that the entity identifies, quantifies and reports all important risks; ii) A process that relates economic capital to the current risk level; iii) A process that establishes capital adequacy objectives based on risk, taking into account the entity's strategic approach and its business plan; and iv) An internal process of controls, examinations and audits, with the objective of ensuring that the overall risk management process is comprehensive. The capital level of each entity must be determined according to its risk profile and the adequacy of its risk management process and internal controls, also taking into account external factors such as the effects of the economic cycle and the economic situation. The analysis of the current and future capital requirements of the financial institution in relation to its strategic objectives is an essential element of the strategic planning process. The strategic plan must clearly reflect the financial institution's capital needs, planned capital expenditures - such as losses, profit distributions and other sources of capital reduction -, the desired capital level and external sources of capital. The Board of Directors and Senior Management must consider capital planning as a fundamental element for achieving their strategic objectives. Within the framework of the review of compliance with the rules of the Central Bank of the Argentine Republic - such as the rules on “Minimum capital of financial institutions”, on “Consolidated supervision” and these rules - the Superintendency of Financial and Exchange Institutions will examine the internal process of evaluating the adequacy of the financial institution's economic capital. If after completing said examination, the Superintendency of Financial and Exchange Institutions understands that the results of the ICAAP carried out by the entity are not satisfactory or notices that the conditions and requirements established in the rules are not met, it may consider adopting a wide range of possible actions. The rules on “Minimum capital of financial institutions” establish minimum capital requirements to address a series of risks that affect the financial system as a whole. Nevertheless, financial institutions are also exposed to other uncertainties that specifically affect each of them and that are treated individually taking into consideration the principles and provisions established in these rules. Therefore, the Central Bank of the Argentine Republic expects financial institutions to operate above the minimum limits established in the rules on “Minimum capital of financial institutions” and, if deemed necessary, the Superintendency of Financial and Exchange Institutions may require them to maintain regulatory capital above said minimums. RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 1. Risk management process.
Version: 2a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 3

Additionally, the Superintendency of Financial and Exchange Institutions will evaluate the particular characteristics of each financial institution and the markets in which it operates and, eventually, require higher capital levels than those established in the rules on “Minimum capital of financial institutions”, for example, in the face of certain risks - whether specific to the financial institution or belonging to the economy as a whole - that are not appropriately contemplated in the rules on “Minimum capital of financial institutions”. The Superintendency of Financial and Exchange Institutions will intervene promptly in order to prevent capital from falling below the minimum levels required by the risk profile of each financial institution. Likewise, if regulatory capital is not maintained at the required level or is not recovered to that level, the Superintendency of Financial and Exchange Institutions may adopt or require corrective measures, such as: intensifying supervision of the entity, restricting the payment of dividends, requiring the preparation and application of a satisfactory plan to restore capital adequacy, as well as requiring the immediate integration of additional capital. The permanent solution to difficulties is not always to increase regulatory capital. However, taking into account that the application of some measures - such as the improvement of systems and controls - requires some time, the increase in regulatory capital may be used as a transitional measure while permanent solutions aimed at strengthening the financial institution's capital position are put into practice. Once these measures are adopted and their effectiveness verified by the Superintendency of Financial and Exchange Institutions, that Superintendency may eliminate the temporary increase in capital requirements. Likewise, the Superintendency of Financial and Exchange Institutions will consider the quality of the information system for risk management (“Management Information System” - “MIS”) used by the entity, the way in which the different business lines and their risks are aggregated, as well as the history of managerial response to the appearance of new risks or the modification of existing ones. For the effect of the use of risk coverage techniques to be recognized in the computation of minimum capital, financial institutions must comply with a series of requirements, including the criteria for disclosure of information and risk management. The Superintendency of Financial and Exchange Institutions, in particular, will consider how the mechanisms and instruments that allow reducing capital needs are used and whether the financial institution uses and understands them as an integral part of the risk management process.
1.4. General principles.
Financial institutions must have:
1.4.1. Risk management strategies approved by the Board of Directors.
Risk management must be comprehensive - that is, cover the entity as a whole - and include detailed policies and prudential limits for the main risks based on the activities of the financial institution.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 1. Risk management process.
Version: 1a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 4

The Board of Directors must ensure that policies, practices and procedures for risk management are developed, that appropriate limits are established and that Senior Management adopts the necessary measures to monitor and control all significant risks consistently with the strategy and policy approved by the Board of Directors. Policies, practices and procedures must provide specific guidance for the implementation of business strategies and establish internal limits for the different types of risk to which the entity may be exposed. These limits must consider the role of the entity in the financial system and be defined based on the entity's capital, its total assets, its results or - when it can be adequately measured - its total risk level. Strategies, policies, practices, procedures and limits must be adequately documented, reviewed, updated, communicated to all areas of the entity directly or indirectly involved and implemented. Exceptions to established policies, practices, procedures and limits must receive immediate attention and authorization from the functional level with decision-making capacity in the matter, as well as be documented. In addition, policies, procedures and limits must:
1.4.1.1. Provide, adequately and timely, for the identification, evaluation, monitoring, control and mitigation of risks generated by lending, investment, trading and operations not recorded in the balance of balances - whether or not recorded in order accounts, such as those originating from securitizations -, as well as risks from other significant activities at the business line level and the entity as a whole;
1.4.1.2. Ensure that the economic reality of risk exposures - including reputational risk and uncertainty in valuations - is recognized and fully incorporated into the entity's risk management processes;
1.4.1.3. Be consistent with the objectives established by the financial institution, as well as with its overall financial strength;
1.4.1.4. Clearly delineate responsibility and lines of authority in the different business activities and ensure that there is a clear separation between business lines and the risk evaluation function;
1.4.1.5. Contemplate mechanisms so that breaches of internally set limits for positions are communicated to higher instances and regularized;
1.4.1.6. Analyze new business lines and products to ensure - before the new activity begins - that the financial institution is in a position to manage the associated risks; and
1.4.1.7. Include a schedule and processes to review and update policies, procedures and limits based on needs.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 1. Risk management process.
Version: 1a. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 5

RISK MANAGEMENT GUIDELINES

B.C.R.A. IN FINANCIAL ENTITIES

Section 1. Risk management process.

Version: 1st. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 6

Business plans of entities must be prepared in accordance with the established strategy and reformulated each time their review is carried out.
1.4.2. An internal process that allows them to assess the adequacy of their capital in relation to their risk profile, which must meet the following requirements:
1.4.2.1. Be supervised by the Board of Directors and Senior Management - ultimately responsible for the process -;
1.4.2.2. Ensure a rigorous assessment of capital needs;
1.4.2.3. Allow comprehensive assessment of risks;
1.4.2.4. Operate within the framework of an adequate monitoring and information system; and
1.4.2.5. Be subject to permanent review of internal controls, including by internal and external audits.
The nature of the specific methodology used for this assessment will depend on the size and economic importance of the entities and the nature and complexity of their operations, and they must have a process for validation and testing of the model and/or systems that the entities may eventually use to measure risk components. To carry out this assessment, entities may, without this meaning delegating their responsibility, use tools or models provided by third parties or, where applicable, by their foreign parent companies, provided that those responsible for their application possess adequate knowledge to use them and understand their results.
1.4.3. Adequate information and monitoring systems for the measurement of risks, their assessment and the reporting of the size, composition and quality of exposures.
Financial entities must establish an adequate system to monitor and report on risk exposures and to assess the effect of changes in their risk profile on their capital needs. The Board of Directors and Senior Management must periodically receive reports on the risk profile and capital needs that allow:
1.4.3.1. Estimating the level and trend of relevant risks and their effect on capital needs;
1.4.3.2. Assessing the reasonableness of the basic assumptions used in the capital measurement system and the sensitivity of results to changes in those assumptions;
1.4.3.3. Determining whether the entity has sufficient regulatory capital to cover the various risks and whether it meets the capital adequacy objectives established in the rules; and
1.4.3.4. Considering its future capital requirements based on the risk profile and, accordingly, introducing the pertinent adjustments in the strategic plan.
The information system for risk management MIS must provide the Board of Directors and Senior Management, clearly, concisely and timely, with relevant information regarding the entity's risk profile and capital needs. This information must include exposures to all risks, including those arising from off-balance sheet operations - that is, operations not recorded in the balance sheet, whether or not recorded in memorandum accounts -. In addition, management must understand the assumptions and limitations inherent in specific risk measures. The MIS must allow adaptations and multiple perspectives regarding exposures, to account for changes in assumptions and incorporate uncertainty about risk measures. Additionally, it must be flexible in order to allow generating comprehensive and prospective scenarios that capture management's vision regarding the evolution of market conditions and stress situations. The data entered and other tools provided by third parties - such as risk measures and models - must be subject to initial and ongoing validation over time. The necessary elements for risk aggregation are the existence of an appropriate infrastructure and an MIS that allow: (i) aggregating exposures and risk measures from different business lines and (ii) identifying concentrations and emerging risks based on flexible criteria and according to specifications determined on each occasion. In addition, the MIS must allow assessing the effect of different types of adverse economic and financial scenarios and be flexible enough to incorporate the risk hedges used by the entity, including - where applicable - the basis risk concomitant to such hedges. The MIS must detect breaches of established limits. To do this, among other measures, it must aggregate across different business areas exposures with similar characteristics - whether they belong to the investment or trading portfolio - to identify concentrations or breaches of internal limits for positions. In addition, the entity must establish procedures for immediate reporting of such breaches to Senior Management and to ensure adequate follow-up is carried out.
1.4.4. Internal control reviews. The internal control structure is essential in the capital assessment process. Effective control of this process includes an independent review and, where appropriate, the performance of internal or external audits.
The objective of controls is to ensure that the information on which decisions are based is accurate, such that processes fully reflect management policies and that periodic reporting, including reports on limit breaches and other exceptions, is effective. The financial entity must conduct periodic reviews of its risk management process to ensure its integrity, accuracy and reasonableness. The aspects that must be examined are:
1.4.4.1. The adequacy of the capital adequacy assessment process, which must be proportional to the size and economic importance of the financial entity as well as the nature and complexity of its operations;
1.4.4.2. The identification of large exposures and risk concentrations;
1.4.4.3. The accuracy and completeness of the input data of the assessment process;
1.4.4.4. The reasonableness and validity of the scenarios used in the assessment process; and
1.4.4.5. The performance of stress tests and the analysis of assumptions and input data.
The Superintendency of Financial and Exchange Entities will periodically examine the soundness of the process used by entities to assess their capital adequacy, their risk exposure and required capital levels and the quality of capital maintained. The examination will focus basically on the quality of risk management and control.
1.4.5. Policies and procedures that ensure that new products and risk management initiatives are approved by the Board of Directors.
1.4.6. One or more units responsible for the identification, assessment, monitoring, control and mitigation of risks - such as the Risk Management Department -, depending on the size and economic importance of the financial entity concerned as well as the nature and complexity of its operations. This/these unit(s) must be separate from the areas that originate the risks and be independent from the business lines - in order to ensure adequate separation of tasks and avoid conflicts of interest -, report risk exposures directly to the General Management or the Board of Directors and be subject to periodic review by internal audit.
1.4.7. Rigorous and prospective stress testing programs that identify possible events or changes in market conditions that may have significant negative impact on the entity.
1.4.8. A contingency plan that clearly establishes the strategy to face emergency situations and that contains policies to manage a range of possible stress situations and establish clear lines of responsibility along with adequate processes for each level of stress situation.
1.5. Responsibilities.
1.5.1. The Board of Directors of the financial entity is responsible for:
1.5.1.1. Ensuring that management establishes a system for assessing the various risks, develops a method to relate risk to the necessary capital level and establishes a method for compliance with internal policies;
1.5.1.2. Periodically verifying that the internal control system is adequate to ensure the orderly and prudent conduct of business;
1.5.1.3. Defining the risk tolerance level of the financial entity and ensuring that the risk management framework includes detailed policies regarding prudential limits for the entity as a whole, which must be consistent with its tolerance level and capacity to assume risks;
1.5.1.4. Ensuring that lines of authority and responsibility are clearly determined;
1.5.1.5. Ensuring that the entity has sufficient capital to cover its risks. When rigorously assessing its capital adequacy, the Board of Directors must take into account the specific stage of the economic cycle in which the entity is operating.
1.5.2. The Board of Directors and Senior Management, meanwhile, must:
1.5.2.1. Understand the nature and level of risk assumed by the financial entity and how that risk level relates to adequate capital levels;
1.5.2.2. Ensure that the formalities and sophistication of risk management processes are consistent with the risk profile and business plan of the financial entity;
1.5.2.3. Know the risk exposures at the level of the financial entity as a whole, for which at the Senior Management level the perspectives of key business areas and control functions must be articulated. In addition, to achieve this comprehensive view of risk exposure, information regarding market events, risks and risk hedging techniques relevant to the different business lines must be shared at the Senior Management level;
1.5.2.4. Possess sufficient knowledge about the main business lines to ensure that risk policies, controls and monitoring systems are effective;
1.5.2.5. Have sufficient experience to understand the capital market activities in which the entity is involved - such as securitization and off-balance sheet operations - and the associated risks;
1.5.2.6. Be permanently informed about the risks to which the entity is exposed;
1.5.2.7. Regularly review risk management - leaving documented and substantiated evidence - and understand the consequences and limitations of the information they receive in this matter; and
1.5.2.8. Identify and review changes at the level of the entity as a whole that could arise as a result of initiating new activities or introducing new products, ensuring that the necessary infrastructure and internal controls have been implemented to manage the associated risks. In addition, they must understand the underlying assumptions of business models, valuation and risk management practices and be able to assess risk exposure if such assumptions do not hold, consider possible difficulties in valuing new products and uncertainty about their behavior in a stress situation.
1.5.3. Senior Management must ensure that risk management policies, practices and procedures are appropriate based on the entity's risk profile and its business plan and that they are effectively implemented. In particular, the risk management process that Senior Management establishes must not be limited to the risks addressed in the following sections, but also to other risks that are significant for the financial entity as well as those that, although not significant in isolation, combined with other risks can give rise to considerable losses.

RISK MANAGEMENT GUIDELINES

B.C.R.A. IN FINANCIAL ENTITIES

Section 2. Credit risk management.

Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 1

2.1. Concepts.
2.1.1. Credit risk.
For the purposes of these guidelines, credit risk is understood as the possibility of suffering losses due to the failure of a debtor or counterparty to fulfill its contractual obligations.
Credit risk is present in on- and off-balance sheet operations. It is also present in settlement risk, that is, when a financial transaction cannot be completed or settled as agreed.
Losses from credit risk originate from the failure of the debtor or counterparty to fulfill its obligations and their magnitude depends basically on two factors:
i) The amount of the exposure at the time of default; and ii) The recoveries obtained by the entities, constituted by the payments obtained from the debtor and by the execution of risk mitigators - such as guarantees or credit derivatives - that support the credit operation, limiting the severity of losses. A credit portfolio is a subset of the totality of an entity's financings obtained from some partitioning or segmentation process that groups them based on common characteristics, of the debtors or their debts. Credit risk contemplates different types of risks. Among them it includes country risk and counterparty credit risk. For the purposes of these guidelines, country risk is understood as the risk of suffering losses generated in investments and credits to individuals, companies and governments due to the incidence of economic, political and social events occurring in a foreign country. For its part, counterparty credit risk is the risk that one of the parties to the operation fails to fulfill its obligation to deliver cash or the agreed effects - such as securities, gold or foreign currency - causing an economic loss if the operations - or portfolio of operations with the counterparty - had a positive economic value at the time of default. Unlike credit risk from loans, which is only assumed by the lending financial entity, this type of credit risk entails a potential loss for both parties to the operation, since its market value can be positive or negative for either of them because that value is uncertain and can fluctuate as the underlying market factors vary.
2.1.2. Credit risk management.
2.1.2.1. Concept.
Credit risk management or administration is the process of identification, assessment, monitoring, control and mitigation that involves various processes, among them, the granting of financings, their subsequent monitoring and, in the case of default, their recovery. This management must be carried out at the level of the total financings of the entity in the various portfolios and at the level of individual financings.
2.1.2.2. Assessment and monitoring of financings.
Financial entities must have methodologies that allow them to assess the credit risk of their exposures to each debtor or counterparty, as well as the credit risk of each portfolio. Entities must carry out their own assessment of all exposures and determine whether the risk weights applied to them in the rules on “Minimum capital of financial entities” correspond to their risk. When the entity determines that the risk of an exposure is significantly higher than the risk implicit in the risk weight established in current regulations, it must consider such higher degree of credit risk when assessing its capital adequacy. For more sophisticated entities, the assessment of credit risk for the purposes of determining capital adequacy must involve, at a minimum, four areas: internal rating systems, portfolio-level analysis, securitizations and complex credit derivatives, as well as large exposures and risk concentrations. The assessment of debtors and financings must be carried out individually at the time of their origination, while their subsequent monitoring will be carried out individually or by credit lines or segments, depending on the size of the exposure and the type of debtor. This is with the objective of maximizing risk-adjusted profitability without neglecting the financial soundness of the entity, even in situations of extreme market stress. For these purposes, risk exposure must be maintained within acceptable limits and be adequately covered with accounting provisions and capital, as appropriate.
2.1.3. Framework for credit risk management.
The framework for credit risk management includes the strategy, policies, practices, procedures and organizational structure that financial entities must have for adequate administration of that risk, and must be proportional to the size and economic importance of the entities and the nature and complexity of their operations. In general, it is advisable for entities to have a comprehensive program to manage credit risk that is characterized by having:
i) An appropriate environment for assuming credit risk; ii) A sound credit origination process; iii) An appropriate process for the administration, assessment and monitoring of credits; and iv) Adequate controls of credit risk.
Entities must also have adequate practices to value their assets, to assess the adequacy of accounting provisions and capital and to disseminate information related to their credit risk.
2.1.3.1. Strategy.
Financial entities must develop a credit risk management strategy - that is, the general approach they will apply to manage this risk - that sets the objectives that will guide their credit granting activities and adopt the policies, practices and procedures necessary to carry out such activities. Likewise, entities must establish a credit risk tolerance level defined as the maximum risk level they are willing to assume, which must be appropriate for their business strategies and their role in the financial system - for example, percentage of portfolio more than 90 days past due -. The strategy must:
i) Reflect risk tolerance and expected profitability for the risk assumed; ii) Identify acceptable risk and return levels given their activities; iii) Establish the objectives that guide the credit granting activity; iv) Establish the general guidelines that the entity will follow to manage risk; v) State the credit risk policy that the entity will carry out; vi) Reach activities with significant credit risk exposure; vii) Include quantitative and qualitative objectives that direct credit granting activities - for example quality, profitability, diversification and portfolio growth -; viii) Identify the type of market to which its credit activity will be oriented - for example, by type of credit, debtor, economic sector, currency, geographic location, expected profitability, etc. -; ix) Consider the cyclical aspects of the country's economy - and, where applicable, the foreign country - and the resulting changes in the composition and quality of the credit portfolio; x) Be viable in the long term and through economic cycles; xi) Be effectively communicated - together with credit risk policies - to all areas of the organization directly or indirectly involved; and xii) Be evaluated and updated periodically.
2.1.3.2. Policies.
Credit policies, executed through various processes by the corresponding managements, are guidelines or directives that guide the decisions of the entities with the objective of implementing the credit risk strategy.
Policies must:
i) Define target markets, desired portfolio composition, interest rates and other granting conditions, limits, etc.; ii) Be clearly defined; iii) Be consistent with prudent practices and applicable regulation; iv) Be adequate for the nature and complexity of the entity's operations; v) Be designed and implemented taking into consideration the internal and external circumstances that affect the entity - market position, area or geographic scope of its operations, capacity of its personnel, etc. -; vi) Ensure adequate diversification of the credit portfolio; vii) Seek a review of credits individually and/or by credit lines or segment, depending on the size of the exposure and type of debtor; viii) Establish limits at the level of debtor, counterparties and related groups, industries or economic sectors, geographic regions, countries and specific products; ix) Be disclosed to the areas of the organization directly or indirectly involved and implemented through appropriate processes - on a consolidated basis and at an individual level -, monitored and periodically reviewed; and

x) Allow the entity to:

maintain adequate standards for the granting of credits;
track and control credit risk;
adequately evaluate new business opportunities;
identify and manage problem credits; and
establish criteria for setting the prices of credit products.
2.1.3.3. Organizational structure.
The organizational structure must have the characteristics necessary for the strategy to be effectively implemented and must contemplate the assignment of responsibility for credit risk management to a specific unit or specific person of the financial institutions. All personnel involved in the process must clearly understand the approach adopted by the entities for the granting and administration of credits and must comply with the established policies and procedures. Financial institutions must have credit risk analysts who possess the experience, knowledge and background necessary to prudently judge credit risk at the time of evaluating, approving and managing that risk. Such analysts must be independent of the operations and settlement area, as well as of the commercial area.
2.2. Responsibilities.
2.2.1. Board of Directors.
The Board of Directors is responsible for ensuring that the financial institution has an adequate framework -effective, viable and consistent- and duly documented for the management of credit risk, of the credit risk assumed by the entity and of the manner in which it is managed. To such ends, it must:
2.2.1.1. Approve the strategy, policies and significant credit practices, reviewing them periodically -at least annually- and each time that in its judgment relevant facts or situations related to this risk occur.
These policies must consider the credit risk assumed in all operations, both at the individual level and at the credit portfolio level;
2.2.1.2. Approve the entity's level of risk tolerance;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 5

2.2.1.3. Approve the organizational structure for credit risk management, seeking to include an independent review of the credit granting and management functions to avoid conflicts of interest;
2.2.1.4. Ensure that Senior Management is capable of administering the entity's credit operations and that these are carried out in line with the approved strategy, policies and level of risk tolerance;
2.2.1.5. Guarantee that the policy of economic incentives for personnel is not in opposition to the entity's credit risk strategy, avoiding that it could weaken the entity's credit processes.
When assigning responsibilities, the Board of Directors must recognize possible conflicts of interest, adopting policies of economic incentives for personnel taking into consideration the provisions of the rules on "Guidelines for corporate governance in financial institutions";
2.2.1.6. Determine whether the entity's capital level is adequate for the risks assumed;
2.2.1.7. Approve the introduction of new products and activities of the entity;
2.2.1.8. Track exposures with related persons or companies and ensure that internal audit reviews that information;
2.2.1.9. Approve exceptions to policies and limits that imply a significant deviation;
2.2.1.10. Regularly receive reports to become aware of the credit risk associated with the financings granted and compliance with the established limits; and
2.2.1.11. Receive information in a timely manner and, in the event that problems arise in matters of credit risk -such as growth in concentration, in the delinquency of significant debtors or in lines of business, significant and persistent failures in compliance with limits, etc.-, ensure that Senior Management takes the appropriate corrective actions to address those problems.
For these purposes, the information resulting from the stress tests that are carried out is important, as well as the established contingency plans.
2.2.2. Senior Management.
Senior Management is responsible for implementing the strategy, policies and practices for credit risk management approved by the Board of Directors, as well as for developing the written procedures to identify, evaluate, track, control and mitigate this risk. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 6

Senior Management is responsible for:
2.2.2.1. Ensuring that the activities related to the granting of credits are consistent with the approved strategy and policies;
2.2.2.2. Implementing the structure, responsibilities and controls necessary for credit risk management. The structure must contemplate those responsible who specifically deal with tracking the quality of credits and the associated risk mitigators; it must also guarantee that those responsible for assigning the internal credit risk rating receive sufficient information.
When assigning responsibilities, Senior Management must recognize possible conflicts of interest, implementing policies of economic incentives for personnel taking into consideration the provisions of the rules on "Guidelines for corporate governance in financial institutions";
2.2.2.3. Approving the written procedures, ensuring that they are in line with the policies and practices approved by the Board of Directors and that they are implemented;
2.2.2.4. That the responsibilities for approval and review of credits are assigned clearly and adequately;
2.2.2.5. That sufficient resources are assigned for effective credit risk management;
2.2.2.6. That there is a periodic and independent internal evaluation of the credit granting and administration functions;
2.2.2.7. Defining the procedures and the corresponding approval level for exceptions to limits in accordance with the policy approved by the Board of Directors;
2.2.2.8. That the persons involved in operations with credit risk have the capacity and knowledge necessary to carry out the activity, in accordance with the entity's policies and processes;
2.2.2.9. Communicating to all areas of the entity directly or indirectly involved the credit risk strategy, the key policies to implement that strategy and the structure for the management of that risk.
The persons responsible for the lines of business that develop activities that may affect credit risk must have full knowledge of the strategy and operate in accordance with the policies, processes, limits and controls.
The persons responsible for credit management must be in contact with those who track market conditions, as well as with those who have access to critical information; RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 7

2.2.2.10. Ensuring the existence of adequate internal controls to protect the integrity of the credit risk management process. To such ends, internal audit must regularly review the implementation and effectiveness of the framework used to manage this risk;
2.2.2.11. Tracking frequently and in detail the market trends that may present significant or unprecedented challenges for credit risk management, so that the necessary changes in the credit strategy can be made in adequate time;
2.2.2.12. Ensuring that the stress tests and contingency plans are effective and appropriate for the entity;
2.2.2.13. Ensuring that costs, income and credit risk are appropriately incorporated into the internal pricing system, in the performance measures and in the process of approving new products for the significant activities that are carried out -on-balance-sheet or off-balance-sheet-.
2.3. Credit risk management process.
The entities must have an adequate process -that is, viable, stable, efficient and effective- to manage credit risk that allows them -in a timely manner- to identify, evaluate, track, control and mitigate this risk in all financial products and activities they develop at all their stages -from their prior evaluation until their maturity and even during recovery management-, and must pay special attention to the most complex credit activities, such as in the case of securitizations and credit derivatives. In addition, this process must be in consonance with the risk profile, the systemic importance and the risk policy of the entity. Where applicable, country risk exposures -including those that come from international investments and contracts- must be managed for each geographic region and each country, in addition to for each counterparty or immediate debtor and credit protection provider. The information, risk management and internal control systems must allow aggregating, monitoring and correctly and timely reporting exposures and guaranteeing compliance with the limits set for each country. New products and activities must be previously approved by the Board of Directors, committee or corresponding unit to which said Body has delegated that function -without prejudice to the fact that the final responsibility continues to fall on the Board of Directors- and be subject to adequate controls and processes for risk administration.
2.3.1. Granting.
The entities must operate under sound and well-defined criteria for the granting of credits, which must:
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 8

a) Clearly identify the market to which it is directed and guarantee an adequate level of knowledge of the debtor or counterparty, of the purpose and structure of the operation and of its probability of repayment; b) Define the profile of the credit borrower, as well as the types, amounts and terms and conditions of credit. To such ends, the entities must:
i) Achieve sufficient knowledge of the client prior to granting, and must establish strict policies to avoid relating with persons or companies involved in fraudulent activities.
They must also have processes to detect groups of interrelated debtors -linked- that must be considered as a single client -economic group- and to group risk exposures with the same debtor or counterparty in different lines of business; ii) Carry out, prior to their participation in syndicated loans and other types of credit consortiums, a due diligence procedure independently, seeking their own credit risk analysis and a review of the terms of the operation. iii) Base their credit decisions fundamentally on the debtor's risk of default and only secondarily on the debtor's equity or on the risk mitigators of the operation. The risk of default depends on the debtor's capacity and willingness to repay and to evaluate it comprehensively the entity must have sufficient information; iv) Consider and document at the time of granting, depending on the type of credit exposure -mortgage loans, credit cards, etc.- and the nature of the credit relationship -commercial, commercial assimilable to consumer or consumer or housing categories- the following elements:

the purpose or destination of the credit and its source of repayment;
the terms and conditions of the credit;
the debtor's or counterparty's current risk profile and its risk mitigators, evaluating their integrity, effectiveness, possibility of execution and their sensitivity to the evolution of the economy and the market;
the debtor's historical and current behavior in complying with its obligations;
the debtor's current and future payment capacity, according to its projected cash flows under various scenarios; and
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 9
the debtor's experience in the business, situation of the economic sector to which it belongs and its positioning within that sector, in the cases of commercial credits;
v) Carry out the evaluation of the debtor independently of the existence of risk mitigators; vi) Have, with respect to risk mitigators:
policies that define acceptable risk mitigators;
processes for their periodic evaluation -depending on their nature-; and
processes to guarantee the execution and settlement of the guarantees.
Financial institutions must not disregard the time and cost involved in executing risk mitigators and their effect on the profitability of the operation, nor the potential correlation between the credit quality of the risk mitigator -for example, the market value of a guarantee- and the risk of the credit they intend to mitigate; vii) Evaluate the risk-return relationship of the operation and of the client -for all its operations with the entity and seek that the risks are adequately considered in the determination of costs and in the price of the operation, especially in the evaluation of new products. The price of the credit must be adequate so that the entity is duly compensated for the risks it assumes. In addition, they must evaluate negative scenarios and their possible incidence on debtors and counterparties.
2.3.1.1. Process for the evaluation and approval of credits.
The entities must establish a formal, sound, well-defined and documented process to evaluate, approve and renew or refinance credits that allows identifying those responsible for their approval, for the modification of their terms and for the authorization of exceptions to the origination guidelines. An effective evaluation and approval process must establish the minimum requirements of the information that will serve as support for the analysis of the application. In addition, in the event that evaluations provided by external sources are used, this will not replace or preclude the entity's own evaluation of the credit that the financial institution must carry out. In addition, there must be policies related to the information and documentation necessary to approve new credits, renew or refinance existing credits and/or modify the terms and conditions of those approved. The information received will serve as the basis for the classification of debtors in accordance with the regulations established by the Banco Central de la República Argentina, for the assignment of a rating with the entities' internal rating system and for the subsequent monitoring of the credit and the debtor. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 10

Credit applications must be carefully analyzed by qualified credit analysts who possess experience in accordance with the significance and complexity of the operation and who use the necessary support tools to carry out the task.
Approval must be carried out in accordance with written guidelines approved by the pertinent management level. The entities may create groups of specialists to analyze and approve credits related to types of facilities, industrial sectors or geographic areas of significant importance. There must also be a clear audit trail that documents compliance with the approval process and that identifies the persons and/or committees involved in the granting. The credit review function must verify whether the respective files are complete, whether the established approval process has been followed and all necessary documentation obtained.
2.3.1.2. Limits.
The entities must establish credit assistance limits -considering the results of the stress tests- at the level of the debtor and the economic group or related clients and track exposures against these limits.
The entities must have procedures to make monitoring more frequent and adopt the corresponding measures in the event that exposures approach the established limits.
These limits, which are necessary in all lines of business, must:
i) Consider the different types of exposures both in on-balance-sheet and off-balance-sheet accounts; ii) Avoid concentrations by activity, economic sectors, geographic regions, products, etc.; iii) Contribute to there being an adequately diversified credit portfolio; iv) Be proportional to the debtor's risk taking into account the existence of guarantees, being able for example to be based on their credit classification, with higher limits for those with lower risk.
2.3.1.3. Credit assistance to persons or companies related to the entity.
Credit assistance to related persons or companies must only be authorized exceptionally and subject to strict limits.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 11

The granting and monitoring of these credits must be subject to the same criteria and processes as those established for the general clientele -for example, they cannot be granted on more favorable terms and/or conditions-.
When dealing with significant operations and in which there may be a conflict of interest, additional precautions must be taken.
The identification of related clients, their monitoring and potential indicators of relatedness must be tracked by the Board of Directors and have reports from internal audit.
2.3.2. Monitoring.
2.3.2.1. System for credit administration.
The entities must have a system to permanently administer their portfolios exposed to credit risk, constituting a critical element to maintain their safety and solvency.
To such ends, the financial institutions must:
i) Adapt the organizational structure of the credit administration function in a manner proportional to its dimension, economic importance and complexity; ii) Ensure that the personnel who perform sensitive functions -such as additions, deletions and modifications of limits in the database, custody of key documentation, transfer of funds, etc.- report to superiors who are independent of the credit origination and approval processes; iii) Ensure, when organizing their credit administration areas:

the efficiency and effectiveness of the credit administration operations;
the accuracy and timeliness of the information provided to the management information systems;
the adequate separation of responsibilities;
the existence of sufficient controls for all procedures; and
compliance with the pre-established management policies and processes, as well as with the applicable laws and regulations;
iv) Ensure that the credit maintains the conditions provided at the time of its granting, for which the debtor's file must be updated -for example through the latest available financial information-.
They must also have the signed agreements and the records of the renewals; and RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 12

v) Include in the files all the information necessary to verify the debtor's current financial condition, to consult the decisions adopted and the history of the credit. Depending on the type of credit exposure it must include: current financial statements, cash flows, financial analyses and documentation on the internal classification -if any-, internal memoranda, reference letters, risk evaluations, etc. For the purposes of the different components of credit administration functioning adequately, Senior Management must understand the importance of monitoring and controlling credit risk, which must be reflected in the various aspects related to its management -structure, resources, policies, etc.-.
2.3.2.2. System for the measurement, monitoring, control and reporting of credit risk.
i) Monitoring of individual credits.
The entities must have a system to track the individual situation of credits, of debtors in the different portfolios and the sufficiency of provisions and capital, for which they must develop and implement comprehensive information processes and systems. Such processes must establish criteria to identify and report operations and debtors with potential problems, for the purposes of them being subject to more frequent monitoring and possible corrective actions, as well as modifications in their classification and/or provisions. An effective credit monitoring system must include measures to:

ensure that the entity knows the debtor's current financial situation;
control compliance with existing clauses;
evaluate the sufficiency of coverage with risk mitigators based on the debtor's current financial situation;
timely identify situations of payment arrears and credits with potential problems; and
carry out additional supervision and monitoring of those credits and debtors with deterioration in their ratings;
ii) Portfolio monitoring.
Additionally, the entities must have a system for monitoring the composition, concentration and quality of the different credit portfolios, which must be consistent with the nature, size and complexity of their credit portfolio.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 13

Credit concentrations in loan portfolios are a potential source of problems and occur when entities are highly exposed, directly or indirectly, to a significant number of exposures with similar characteristics - with a counterparty; a group of related counterparties; an industrial or economic sector; a geographic region; a certain credit facility; or with some risk mitigator -. In cases where loans considered sound are granted that generate concentration in the portfolio, the entity must implement mechanisms to reduce or mitigate those concentrations, which may include the allocation of more capital to address potential unexpected losses arising from these concentrations or other methods that are appropriate. In order to manage concentrations, entities may opt for different mechanisms - such as the sale of loans, credit derivatives, securitizations and other structured products - that entail an assumption of risks that must also be identified and managed, and for which they must have adequate policies, processes and controls to manage them; iii) Internal rating system. Depending on the nature, significance and complexity of their activities, entities must develop and use an internal rating system to manage credit risk. Internal risk ratings are an important tool for monitoring credit risk. These ratings must facilitate the identification and measurement of the risk arising from all credit exposures and must be integrated into the entity's overall analysis of credit risk and capital adequacy. A well-structured internal risk rating system classifies debtors and - if applicable, based on the characteristics of the business - their loans into various categories and allows assessing their credit risk, as well as that of the entire portfolio. The rating system must provide ratings for all debtors and counterparties - not only those with problems - individually or by credit lines or segments, depending on the size of the exposure and the type of debtor or counterparty. These systems must allow timely identification of problem loans and risk concentrations and serve to adequately determine provisions and, eventually, capital for credit risk; they may also be used to determine lending rates and measure the profitability of operations or clients adjusted for their risk. When developing these systems, entities must decide whether they will rate the risk of the debtor, the transaction, or both. The internal rating system must:
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 14

react to indicators of current and potential deterioration in credit risk;
facilitate the monitoring of ratings in loan portfolios;
contribute to assessing the need to change the entity's credit strategy; and
serve to produce periodic descriptive reports - for the Board of Directors and Senior Management - on the distribution of ratings in the loan portfolio.
In order to ensure the consistency and accuracy of ratings, the person responsible for assigning or confirming them must be an area independent from the one that originated the loans. Ratings must be reviewed and updated periodically, particularly upon receiving relevant information. The characteristics and functioning of the internal rating system must be adequately documented, and must include at least:
the definition of the expected ratings and a quantification of the risk associated with each of them;
the criteria used to assign a rating to a debtor or operation;
the frequency of rating review;
the data used; and
the responsibilities associated with design, implementation, operation and validation.
It is also important to document the validation process - which must be subject to a competent and independent review -, understood as the comparison of expected results with observed ones. For these purposes, the frequency of its performance, the procedure and the results obtained must be detailed, and must be reported to Senior Management. Likewise, there must be a documented procedure that allows linking the internal ratings of the financial institution with the categories provided in the regulations on “Debtor classification” of the Central Bank of the Argentine Republic; iv) Management information systems. Entities must have information systems - comprehensive and adequate - and analytical techniques that allow measuring the credit risk of all financings and debtors, on and off balance sheet, at an individual and portfolio level, which must provide timely and adequate information on the composition and characteristics of the loan portfolio - concentrations, etc. -. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 15

Management information systems must allow monitoring exposures according to established limits, detecting those that approach those values and reporting exceptions in a timely and adequate manner. They must also allow aggregating the financings of all debtors and counterparties and performing additional analyses of the loan portfolio - for example, stress tests -. Depending on the complexity of the operations and to ensure that it is sufficient, the scope of the information must be reviewed periodically by line managers and Senior Management. The measurement of credit risk must take into account various factors, such as:

the nature of the credit - loan, contingent commitment, derivative, etc. - and its financial and contractual conditions - maturity, reference rate, etc. -;
the profile of the evolution of the exposure until its maturity;
the existence of risk mitigators; and
the risk of default based on its classification.
The risk analysis must be performed with adequate frequency and its results must be contrasted against pre-established limits.
Entities must use appropriate measurement techniques - that identify and recognize deterioration in credit quality early - depending on the complexity and level of risks of their operations, based on reliable data and subject to periodic validation. Their results must contribute to assessing the level of provisions and economic capital for the purposes of adequate coverage against expected and unexpected losses, respectively. The effectiveness of the credit risk measurement process depends on the quality of the information systems, whose data allow the Board of Directors and the various management levels to fulfill their respective functions; the integrity, quality, detail and timeliness of the information are critical aspects to take into account. In particular, information on the composition and quality of the various portfolios must allow a quick and accurate assessment of the entities' credit risk exposure and determine whether it complies with their strategies to manage this risk.
2.3.3. Recoveries.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 16

Credit risk policies must include a formal, solid, well-defined and documented process for managing problem loans, and must contain clear guidelines for following up with counterparties that have breached their contractual obligations and detail the corrective measures to be applied based on the breaches. The responsibility for managing problem loans may be assigned to the originating area, to a special monitoring area, or a combination of both, depending on the significance and nature of the loan and the nature of the problems. The results of this process, as well as all its intermediate stages - including those responsible for regularizing or recovering the loans -, must be articulated with the entities' information system, allowing monitoring of the loans during all stages of collection management and enabling a better assessment of risk in the future. Complete information on recoveries for each type of line and debtor must help in evaluating the adequacy of provisions and economic capital to address the underlying risk of each of them.
2.3.4. Stress tests.
In the evaluation of the risk of individual loans and loan portfolios, potential future changes in economic conditions and the possibility of stress scenarios characterized by an increase in credit risk and lower liquidity must be taken into account. When conducting stress tests, entities must identify those adverse, extreme but possible situations that can increase credit risk losses and evaluate their capacity to face them. These tests may assume simple alterations in one or more risk factors - sensitivity analysis - or simulate the repetition of historical events or new hypothetical scenarios - scenario analysis -. The results of stress tests must be reviewed periodically by Senior Management and imply appropriate actions when estimated losses exceed the tolerated risk, and must be considered to analyze the adequacy of capital and provisions, update policies, and to assign and update limits.
2.3.5. Contingency planning.
Financial institutions must have a contingency plan that clearly establishes the strategy to face emergency situations, that contains policies to manage a range of possible stress situations, and that establishes clear lines of responsibility along with adequate processes for each type of situation. The plan must be regularly reviewed and updated to ensure that it is operationally adequate. The contingency plan must:
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 17

2.3.5.1. Be proportional to the size of the entity, its risk profile, its relative importance in the financial system, and the nature and complexity of its operations;
2.3.5.2. Prepare the entity to handle a range of severe stress scenarios, considering a diversified menu of options so that Senior Management has a view of the potentially available contingency measures;
2.3.5.3. Contain clear policies and procedures that allow Senior Management to make timely and well-informed decisions and communicate them effectively and efficiently. This plan must contemplate, among other aspects, the following:
i) The assignment of responsibilities, including the designation of the authority with the power to activate the plan. The formation of a “crisis team” can facilitate internal coordination and decision-making during periods of stress; ii) The identification of the personnel responsible for implementing the plan and their functions during a critical situation; and iii) The adoption of guidelines for the decision-making process, the definition of who should make them and what issues should be escalated to the higher levels of the entity, in order to ensure effective coordination and communication across the different lines of business.
2.3.6. Controls.
Financial institutions must establish a continuous, independent and efficient system for reviewing credit risk processes, which includes periodic internal audits, whose results must be communicated directly to the Board of Directors or Senior Management - to the extent that they are not involved in the granting process -. The following must be evaluated and reported:
2.3.6.1. The reliability and integrity of the information;
2.3.6.2. Compliance with pertinent laws and regulations and internal policies and processes;
2.3.6.3. The performance of account officers and the credit administration process;
2.3.6.4. The accuracy of the internal rating system; and
2.3.6.5. The condition of the loan portfolio.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 18

The internal review must also detect early those loans with greater potential risk or with problems, so that there is a greater possibility of redirecting the loan or mitigating losses, and it is important that it includes an independent and well-defined loan review process. In addition, it must verify that commercial functions are separate from the area responsible for setting limits - such as limits on country risk exposures -. Entities must also have a formal process of corrective actions that is initiated upon events of increased risk exceeding established limits.
2.4. Counterparty credit risk management.
For the purposes of effectively and comprehensively managing counterparty credit risk, financial institutions must:
2.4.1. Have a framework that includes policies, practices, procedures and organizational structure for adequate management of this risk. This framework must be proportional to the size and economic importance of the financial institution and to the nature and complexity of the exposures that generate counterparty credit risk.
2.4.2. Ensure that the policies for managing this risk comply with the rules contained in this Section as well as the provisions related to stress tests, residual risks associated with techniques to cover credit risk, and risk concentrations. In addition, they must take into account market, liquidity, legal and operational risks that may be associated with counterparty credit risk and, if possible, the interrelationships among them.
2.4.3. Evaluate the solvency of the counterparty prior to negotiating with it, and must take into account the risk at the time of settlement as well as in advance. Both risks must be managed comprehensively, both at the counterparty level - aggregating the counterparty credit risk exposure together with other credit risk exposures associated with the same counterparty - and at the level of the entire entity.
In addition, when analyzing this risk, the published reports referring to the degree of compliance by the counterparty's supervisory authority with applicable supervision principles must be taken into account, such as the Core Principles for Effective Banking Supervision of the Basel Committee on Banking Supervision when it is a financial institution.
2.4.4. Responsibilities.
The Board of Directors and Senior Management must:
2.4.4.1. Actively participate in the counterparty credit risk control process, considering it an essential part of their activity and assigning sufficient resources to it;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 19

2.4.4.2. Know - when using an internal model for measuring that risk - the limits and assumptions used and their possible impact on the reliability of the results;
2.4.4.3. Consider uncertainties in the market - such as the timing of executing guarantees - and operational aspects - such as evaluating irregularities in the transmission of price data -, becoming aware of how this is reflected in the model.
Likewise, Senior Management is responsible for periodically reviewing the results of stress tests, which must be reflected in the policies and limits linked to counterparty credit risk.
Daily reports on the entity's exposure to counterparty credit risk must be reviewed at the management level by persons with sufficient hierarchy or authority to decide the reduction of individual exposures as well as the entity's overall exposure to that risk.
2.4.5. Counterparty credit risk management process.
The counterparty credit risk management system must be used together with the internal limits applicable to operations, regardless of whether they are recorded in the investment or trading portfolio. The limits must be consistent with the entity's risk measurement model, as well as clear and understandable for the Board of Directors, Senior Management and the other areas involved. The quantification of this risk must include monitoring of the daily and intraday use of credit lines. Financial institutions must:
2.4.5.1. Quantify their current exposure both in gross terms and - if applicable - net of assets received as collateral.
The limit monitoring system must include the quantification of the maximum exposure or potential future exposure (PFE) for a confidence level chosen by the entity, both at the portfolio and counterparty level. High or concentrated exposures must be taken into account, for example, by groups of related counterparties, by industry, by markets and by investment strategies.
2.4.5.2. Have:
i) A rigorous and routine stress testing program to complement counterparty credit risk analysis, based on the daily results of the entity's risk measurement model. When these tests reveal a special vulnerability, adequate risk management strategies must be explicitly considered, which may require, for example, hedging such risks or reducing exposures. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 20

ii) A routine process to ensure compliance with a set of internal policies, controls and procedures for the operation of the counterparty credit risk management system. This system must be well documented, for example through a risk management manual describing the basic principles of the system and explaining the empirical techniques used to quantify counterparty credit risk.
2.4.5.3. Regularly conduct an independent examination of the counterparty credit risk management system through an internal audit process, which includes the units that carry out operations, regardless of whether they are recorded in the investment or trading portfolio, as well as the independent unit responsible for their control.
2.4.5.4. Comprehensively review the management process of this risk at regular intervals, preferably with a minimum frequency of one year, and must include at least:
i) The adequacy of the system documentation and processes for counterparty credit risk management; ii) The organization of the collateral management unit; iii) The organization of the counterparty credit risk control unit; iv) The integration of counterparty credit risk measurement into daily risk management; (v) The process for approving the models and valuation systems of the risks used by operators - “front-office” - and registration and control staff - “back-office” -; vi) The validation of significant changes in the risk measurement process; vii) The scope of counterparty credit risks captured by the measurement model; viii) The integrity of the management information system;

ix) That counterparty credit risk data are accurate and complete; x) The verification of the consistency, timeliness and reliability of the data sources used in the models, including the independence of those sources; xi) The accuracy and adequacy of the assumptions on volatility and correlation; RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION “A” 5398 Effective date:
13/02/2013 Page 21

xii) The precision of the calculations for the valuation and transformation of risks; xiii) The verification of the precision of the model through frequent backtesting.
2.5. Management of residual risks
In the use of credit risk mitigation (CRM) techniques, other risks are generated that can affect the effectiveness of those techniques. In these cases, and even when the requirements established in the rules on "Minimum capital of financial institutions" are met, the entity may have a greater exposure to risk than anticipated, examples of such risks being:
i) the impossibility of taking possession of or realizing the asset received as collateral within a reasonable period after the counterparty's default; ii) the refusal or delay in payment by the guarantor; and iii) the ineffectiveness of the documentation. Consequently, financial institutions must implement policies and procedures to control those residual risks and periodically review that such procedures are operational, adequate and effective. These policies and procedures must provide that, when calculating capital requirements, an assessment be made of whether it is reasonable to fully recognize the CRM used. In addition, it must be demonstrated that those policies and procedures are adequate in light of the reduction in the minimum capital requirement granted by the CRM techniques. Otherwise, the Superintendency of Financial and Exchange Institutions may require the immediate adoption of corrective measures or additional capital against residual risk, until the deficiencies have been remedied.
2.6. Country risk management.
2.6.1. Concepts.
Country risk - defined as the risk of suffering losses in investments and credits to individuals, companies and governments due to the incidence of economic, political and social events occurring in a foreign country - is present not only in credits granted to non-residents, but also in operations in which the solvency of the debtor or its guarantor, even if residents, depends significantly on the circumstances of another country, as well as in direct investments abroad and in service contracts with foreign suppliers. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 22

Country risk includes sovereign risk, transfer risk and the other risks that affect the residents of a country. Sovereign risk is the risk of loans granted to a sovereign state or guaranteed by a sovereign state, while transfer risk focuses specifically on the ability of debtors to obtain the foreign currency necessary to meet their debts or other contractual obligations abroad. This risk usually derives from the existence of restrictions on currency exchanges imposed by the government of the country of residence of the debtor and affects only private sector debtors. Sovereign risk, transfer risk and the other risks that affect the residents of a country are highly correlated, which is why sovereign risk usually constitutes a floor for country risk.
2.6.2. Country risk assessment.
The analysis of country risk - which may be qualitative or based on quantitative models - must take into consideration all relevant macroeconomic information, such as:
2.6.2.1. The economic situation: levels of income, savings and investment, GDP growth, degree of openness of the economic system to foreign trade, economic linkage with trading partners, expected evolution of prices that affect international trade and solvency of the financial system.
2.6.2.2. The size and structure of external debt in relation to the economy: total and short-term external debt in relation to GDP and exports, proportion of external debt corresponding to the public sector and the government's capacity to generate income or financing to meet its obligations.
2.6.2.3. Strengths and weaknesses implicit in the country's current account: level of international reserves and import coverage, concentration of exports by product and by market, exchange rate, vulnerability to a fall in the quantities or prices of the main export products, relative prices of imports and exports and level of access to international financial markets.
2.6.2.4. Evaluation of the country's financial history and its relationship with public external creditors, including multilateral financial institutions, and private creditors. Said evaluation must also include the country's regulatory history and its impact on the external payments system, the way in which the local judicial system operates in resolving conflicts linked to this aspect, the quality of financial information and the degree of human development achieved.
The rating must not be based exclusively on the weighting of economic indicators but, in order to obtain a comprehensive view of the country risk exposure in the entity as a whole, the opinions of those responsible for the entity's offices abroad and expectations regarding market developments must also be evaluated. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 23

A record must be kept of the evaluation and of the reviews of the intermediate periods, indicating the hierarchical levels that participated in the preparation and approval of the conclusions.
2.6.3. Responsibilities.
The Board of Directors of the financial institution is responsible for establishing the policies for risk management, for approving both the country exposure limits and their exceptions and for monitoring the sufficiency of the country risk provision. In addition, it must ensure that management controls risks effectively. The Board of Directors and Senior Management, in the process of reviewing limits, must evaluate the effect of the different stress test scenarios on exposures of significant amounts. Senior Management is responsible for implementing the policies and establishing adequate procedures to manage country risk. To that end, it must evaluate the risks of international operations, select the types of business, investments, adequate instruments and propose exposure limits. Likewise, it must ensure that policies and practices are clearly communicated to the rest of the organization.
2.6.4. Limits related to country risk.
2.6.4.1. Limits must be established through a formal process, supervised by the Board of Directors, so that at the level of the financial institution's management these decisions are integrated into the business plan and the risk control of international credit operations.
2.6.4.2. For internal control reasons, it is necessary to separate commercial functions from the responsibility of setting limits.
2.6.4.3. They must be set based on the financial institution's capital and take into account the situation of each country, the volume and nature of the entity's operations and the diversification of its portfolio. In the case of significant operations, limits must be established in a dual manner - measuring exposures with and without transfer of risks to the ultimate obligor -. Sublimits may be established by type of operation or activity - such as holding securities and foreign trade -, by class of debtor - such as governments and financial institutions - and by maturity.
2.6.4.4. When the amount of the exposure is significant, financial institutions must carry out periodic stress tests of their exposures and risk profile. The impact of the different scenarios must be evaluated by the Board of Directors and Senior Management in the process of reviewing limits.
2.6.4.5. The procedures for country risk management must provide for the periodic review of limits, so that they are adjusted in response to changes in risk levels.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 24

2.6.5. Measurement of exposure.
For the purposes of measuring country risk exposure, the procedures and calculation systems may vary according to the quantity and complexity of each entity's operations. However, there are certain basic criteria to be followed for all significant exposures:
2.6.5.1. Imputation to the immediate debtor and to the ultimate debtor or guarantor.
When there is a transfer of risks, a double calculation must be made. In the first, exposures must be imputed to the country of residence of the immediate debtor; while in the second, they must be imputed to the country of the guarantor or ultimate obligor for payment, considering the following:
i) Real guarantees constituted in a country other than that of the immediate debtor may be assimilated, for these purposes, to a personal guarantee. ii) Exposures to branches of financial institutions must be assigned, in the first calculation, to the country in which the branch is located and, in the second calculation, to the country of the head office. iii) Exposures with residents in the country guaranteed by foreign entities are computed only in the second calculation. iv) Exposures with non-residents guaranteed by entities of the country - such as credits covered with export credit insurance - are computed only in the first calculation.
2.6.5.2. Basis of observance.
Country exposure must be measured both on an individual basis and on a consolidated basis; in the latter case, through the consolidation process, cross-border operations carried out within the group are eliminated.
2.6.5.3. Criteria to be observed in determining exposure by country, bloc or region.
i) All operations recorded or not in the balance sheet - in the latter case, even if they are not recorded in memorandum accounts - that represent rights against non-residents, whatever the currency of denomination, must be computed. ii) Credits granted by branches and subsidiaries abroad in local currency must be identified. iii) The maturity of the operations and the type of exposure must be taken into consideration. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 25

iv) Given the propagation of economic situations between neighboring countries or those with strong commercial ties, it is recommended that the Board of Directors and Senior Management also consider aggregate exposures in a broader manner, for example, by bloc or region. v) In case of specific problems, financial institutions must reconsider the nature and magnitude of the exposure and estimate the effect on the country risk provision. In addition, the Board of Directors and Senior Management must monitor the evolution of risks derived from services contracted from foreign suppliers and from credits to residents in the country whose solvency - or that of their guarantors - depends significantly on circumstances occurring in a foreign country. This, even though they do not form part of the cross-border credit exposure consolidation process mentioned in the preceding point.
2.6.6. The country risk management process must have resources and internal controls adequate to the nature and scope of the financial institution's operations. In particular, the information system must allow capturing all exposures with a level of detail that allows adequate control, it being the function of internal audit to ensure the integrity of the information used by the Board of Directors and Senior Management.
2.7. Transparency.
Financial institutions must make known to the public - on a regular basis - through their Internet pages or reports:
2.7.1. Information that allows market participants to evaluate the soundness of the credit risk management framework and its exposure to credit risk, including information individualized for counterparty and country risks;
2.7.2. A description of the framework implemented to manage credit risk, its structure, the roles and responsibilities of the units and committees related to the subject;
2.7.3. Qualitative information that enables market participants to know the manner in which they manage credit risk.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 2. Credit risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 26

3.1. Concepts.
3.1.1. Liquidity risk.
Liquidity is defined as the capacity of financial institutions to fund increases in assets and meet their obligations as they become due, without incurring significant losses.
For the purposes of these provisions, liquidity risk is understood primarily as funding liquidity risk, defined as that in which the financial institution cannot efficiently meet expected and unexpected, current and future cash flows and collateral without affecting its daily operations or its financial condition. Likewise, market liquidity risk is understood as the risk that an entity cannot offset or unwind a position at market price due to:
i) The assets that compose it not having sufficient secondary market; or ii) Alterations in the market.
3.1.2. Liquidity risk management.
Liquidity risk management is understood as the process of identification, evaluation, monitoring, control and mitigation of that risk that involves, among others, the following processes:
3.1.2.1. The administration of cash flows - income and expenses - for the various time bands;
3.1.2.2. The periodic study of the deposit structure;
3.1.2.3. The measurement and monitoring of net funding requirements under various scenarios - including "stress scenarios" -;
3.1.2.4. The monitoring of liquidity ratios;
3.1.2.5. The administration of access to markets; and
3.1.2.6. Contingency planning.
3.1.3. Liquidity risk management framework.
The framework for liquidity risk management includes the policies, practices, procedures and organizational structure that financial institutions must have for adequate management of that risk, and must be proportional to the dimension and economic importance of the financial institutions and to the nature and complexity of their operations and include a liquidity strategy - a concept that comprises the entity's general approach to this risk - that contemplates quantitative and qualitative objectives. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 1

3.1.3.1. Strategy.
The strategy must:
i) Establish the general guidelines for managing liquidity risk; ii) Contemplate the objective of protecting the financial institution's solvency and its capacity to face stress situations in the market; iii) Consider liquidity needs in normal situations as well as the incidences that stress periods may have - of a nature specific to the entity, at market level, or a combination of both -; iv) Include specific policies for the management of said risk, such as:

the composition and maturity of assets and liabilities;
the diversity and stability of funding sources;
the approach to managing liquidity in different currencies, between jurisdictions, lines of business and subsidiaries;
the approach used for intraday liquidity management; and
the assumptions used regarding the capacity to realize assets.
For the formulation of the strategy, entities must take into account their corporate structure - for example, if they have subsidiaries or branches abroad -, the key lines of business, the diversity of markets and products with which they operate and, if applicable, the requirements of the regulators of their subsidiaries and branches abroad.
3.1.3.2. Organizational structure.
The organizational structure must have the necessary characteristics so that the liquidity strategy can be effectively implemented and contemplate the assignment of the responsibility of managing overall liquidity risk to a specific unit or person of the financial institution. That unit, depending on the dimension and economic importance of the entity, the magnitude, complexity and nature of its operations, may take the form of an asset and liability management committee or a risk committee, in which members of Senior Management and the Board of Directors must participate.
3.2. Responsibilities.
3.2.1. Board of Directors.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 2

The Board of Directors is responsible for ensuring that the entity has an adequate framework - effective, viable and consistent - for liquidity risk management, for the liquidity risk assumed by the entity and for the manner in which it is managed. That framework must ensure the maintenance of sufficient liquidity - including a backup of high-quality liquid assets not encumbered as collateral for any operation -, in order to allow the entity to face a range of stress events including those events that involve the loss of traditional funding sources. In this regard, the Board of Directors must:
3.2.1.1. Approve the strategy, policies and significant liquidity practices, reviewing them periodically - at least annually - and each time in its judgment relevant facts or situations linked to this risk occur;
3.2.1.2. Approve the entity's risk tolerance level, defined as the maximum level of risk it is willing to assume, which must be appropriate for its business strategy and importance in the financial system and reflect its financial condition and funding capacity;
3.2.1.3. Ensure that Senior Management communicates risk tolerance and liquidity strategy through clear and operational guidelines and manages risk effectively;
3.2.1.4. Approve the organizational structure for adequate liquidity risk management;
3.2.1.5. Guarantee that the entity has technically qualified personnel, as well as the necessary resources for liquidity risk management;
3.2.1.6. Ensure that the entity has processes and systems to identify, evaluate, monitor, control and mitigate sources of liquidity risk;
3.2.1.7. Understand the existing interactions between funding liquidity risk and market liquidity risk, as well as the incidence of the remaining risks - including credit, interest rate, market, operational and reputation risk - in the entity's global liquidity strategy;
3.2.1.8. Receive regular reports to become aware of the entity's liquidity position;
3.2.1.9. Receive immediate information in case liquidity problems arise, including aspects such as increases in funding costs, concentrations, increases in cash flow mismatches, scarcity of alternative sources of liquidity, significant and persistent failures in compliance with limits, important reductions in the backup of liquid assets or changes in external market conditions that may signal future difficulties;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 3

3.2.1.10. Ensure that Senior Management takes the appropriate corrective actions to address the aspects provided in point 3.2.1.9., for which it is essential that it receive information on the stress tests carried out and the contingency plans established; and
3.2.1.11. Approve exceptions to policies and limits that involve a significant deviation.
3.2.2. Senior Management.
Senior Management is responsible for implementing the liquidity risk management strategy in accordance with the entity's risk tolerance level and the policies and practices, as well as developing written procedures to identify, evaluate, monitor, control and mitigate this risk. Senior Management must:
3.2.2.1. Implement the structure, responsibilities and controls necessary for liquidity risk management - including all subsidiaries and branches in the jurisdictions in which the entity operates -. The degree of centralization or decentralization of this must take into account any legal, regulatory or operational restriction regarding the transfer of funds;
3.2.2.2. Evaluate the incidence of the existing interactions between funding liquidity risk and market liquidity risk, as well as perform the analysis of the incidence of the remaining risks - including credit, interest rate, market, operational and reputation risk - in compliance with the entity's global liquidity strategy;
3.2.2.3. Continuously review the information referred to the entity's developments in liquidity matters and regularly inform the Board of Directors;
3.2.2.4. Effectively communicate to all areas of the entity directly or indirectly involved the liquidity strategy, the key policies to implement that strategy and the structure for liquidity risk management.
The persons responsible for the business units that develop activities that may affect the entity's liquidity must have full knowledge of the liquidity strategy and operate in accordance with the policies, processes, limits and controls, and those responsible for management must maintain a fluid relationship with those who monitor market conditions or who have access to critical information for liquidity risk management;
3.2.2.5. Ensure the existence of adequate internal controls to protect the integrity of the liquidity risk management process. To that end, internal audit must regularly review the implementation and effectiveness of the framework used to manage this risk;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 4

3.2.2.6. Frequently follow market trends that may present significant or unprecedented challenges for liquidity risk management, so that necessary changes in the liquidity strategy can be made in a timely manner;
3.2.2.7. Define the procedures and the corresponding approval level for exceptions to limits as established in the policy approved by the Board of Directors;
3.2.2.8. Ensure that stress tests, contingency plans and liquidity backstop are effective and appropriate for the entity;
3.2.2.9. Ensure that the costs, income and risks of liquidity are appropriately incorporated into the internal pricing system, into performance measures and into the process for approving new products for significant activities -on- or off-balance sheet-, aligning the incentives for risk-taking of each line of business with the overall liquidity risk exposure that those activities generate for the entity.
Those costs, income and risks must be attributed to the relevant activities, assigning a liquidity charge to the corresponding positions, portfolios or individual transactions.
3.3. Liquidity risk management process.
3.3.1. General guidelines.
Entities must have an adequate process to identify, assess, monitor, control and mitigate liquidity risk, which must include an effective, viable and consistent framework that allows for a comprehensive projection of cash flows from assets, liabilities and off-balance sheet operations, for an appropriate set of time horizons. Liquidity measurement involves evaluating the entity's cash inflows against outflows and the net value of assets to identify potential future liquidity shortfalls. Financial institutions must:
3.3.1.1. Define and identify the liquidity risk to which all their branches and subsidiaries in the country and abroad are exposed;
3.3.1.2. Consider the existing interactions between funding liquidity risk exposures and market liquidity risk;
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 5

3.3.1.3. Ensure that assets are prudently valued in accordance with applicable standards, taking into account that their valuation may deteriorate in stress situations and, in particular, when evaluating the feasibility and the impact that asset sales in such situations may have on their liquidity position;
3.3.1.4. Recognize and consider the existing interactions between liquidity risk and the other risks to which they are exposed -credit, interest rate, market, operational and reputation risk-, which may influence their liquidity risk profile;
3.3.1.5. Assess the sufficiency of their capital based on their own liquidity profiles and the liquidity of the markets in which they operate, given that entities' capital positions can influence their ability to obtain liquidity, especially in stress situations.
3.3.1.6. Project cash flows for their assets, liabilities, equity items -such as dividends- and off-balance sheet operations -such as derivatives- for different time horizons, under normal conditions and for a range of stress scenarios;
3.3.1.7. Ensure that their management practices consider, in relation to time horizons, vulnerabilities to:
i) Changes in intraday liquidity needs and funding capacity; ii) Daily liquidity and funding needs for horizons of up to 90 days; iii) Liquidity needs beyond 90 days and up to one year -at least on a monthly basis-; iv) Liquidity needs beyond one year, with the frequency determined by the entity's operations; v) Events, activities and strategies that may significantly pressure the internal capacity to generate liquid income;
3.3.1.8. Identify, assess, monitor, control and mitigate the liquidity risk of their positions arising from:
i) Future cash flows from assets and liabilities.
Financial institutions must:

establish an effective, viable and consistent process that allows them to obtain a dynamic projected cash flow that includes assumptions about the possible behaviors and responses of the main counterparties to changes in conditions and that is carried out with a sufficient level of detail;
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 6
make feasible assumptions about their future liquidity needs in both the short and long term that reflect the complexity of their businesses, products and the markets in which they operate;
analyze the quality of assets that can be used as collateral, in order to assess their potential to provide funds in stress situations;
verify that the assumptions used are reasonable and appropriate to their situation, in addition to being documented and periodically reviewed and approved;
manage the temporal distribution of their income flows in relation to expected outflows to obtain an appropriate maturity distribution for those sources and uses of funds;
assess the stability of cash flows derived from liabilities when estimating them;
assess, in particular for wholesale funding providers, the probability of funding renewal under normal and stress situations.
In the case of short-term funds, entities must not assume that such funding will be automatically renewed;
consider the factors that may influence the stability of retail deposits, such as their amount, sensitivity to interest rates, geographic location, as well as the collection channel -for example, direct or through the Internet-;
ii) Contingent sources of liquidity requirements and triggers associated with off-balance sheet positions.
Entities must:
identify, assess, monitor, control and mitigate potential cash flows related to off-balance sheet commitments and other contingencies -including so-called "special purpose vehicles", financial derivatives, guarantees and other commitments- for which they must have an adequate process that allows projecting the probability of their materialization.
For these purposes, the nature of the commitments and the credit quality of the counterparty must be considered, as well as the fact that exposures in certain activities or economic or geographic sectors may be simultaneously affected by stress situations;
monitor the potential risks arising from the existence of clauses that imply liability in the sale of assets and the provision of liquidity lines to securitizations, as well as the liquidity risk derived from the impossibility of completing the securitization cycle.
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 7

The process to identify and measure contingent funding risks must consider the nature and magnitude of the entity's potential non-contractual obligations, since those obligations may cause, in stress situations, the entity to provide assistance to "special purpose vehicles" -such as trusts- or off-balance sheet instruments; and

monitor liquidity management in contingent items given the difficulties in assessing liquidity needs related to them in times of crisis;
iii) Currencies in which the entity operates significantly.
Entities must assess their foreign currency liquidity needs and establish prudent limits to mismatches -taking into account the limits established in current regulations-, with a strategy for each of the main currencies with which they work. These strategies must consider the restrictions that may arise in periods of stress. The size of the foreign currency mismatch assumed by the entity must take into consideration:
the entity's ability to obtain funds in foreign currency markets;
the availability of foreign currency funding in the local market;
the possibility of transferring liquidity from some currencies to others, through different jurisdictions and entities; and
the possibility of converting currencies into the one in which the entity operates, including the potential impediment or closure of the currency "swaps" market.
Entities must manage the liquidity risk exposures arising from the application of their foreign currency deposits and short-term lines that fund local currency assets, taking into consideration the risk derived from unforeseen changes in foreign currency quotations and market liquidity, as well as the probability of loss of access to exchange markets; iv) Correspondent, custody and settlement activities. Entities must assess how correspondent, custody and settlement activities can affect their cash flows.
3.3.2. Measurement tools.
Entities must:
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 8

3.3.2.1. Use a set of tools and/or ratios appropriate to their profile;
3.3.2.2. Use measures that allow evaluating the balance sheet structure and projecting cash flows and future liquidity positions -taking into consideration the risks of off-balance sheet operations-, in order to obtain a prospective view of liquidity risk exposure;
3.3.2.3. Design the tools and perform liquidity risk analysis based on the type of business, complexity and their risk profile;
The analysis must be comprehensive and prospective with the objective of identifying future funding gaps that allow entities to assess their exposure and identify the appropriate actions or instruments to mitigate that potential risk.
The tools must include those vulnerabilities that arise in normal and stress situations, in various time horizons. Prospective tools must:
i) In normal situations, identify needs derived from projected cash outflows in relation to normal funding sources; ii) In stress situations, be capable of identifying funding mismatches in different time horizons and serve as a basis for limits to liquidity risk exposure and early warning indicators. In the normal course of measurement, monitoring and analysis of sources and uses of funds, entities must project their cash flows over time and under a number of alternative scenarios. This tool -fundamental for adequate liquidity risk management- allows producing an analysis of liquidity mismatches. The aforementioned analysis can be based on assumptions regarding the future behavior of assets, liabilities and off-balance sheet items and be used to calculate the net accumulated excess or deficit in each time period. Entities must take the necessary precautions to ensure that these assumptions are appropriate, documented and periodically reviewed.
3.3.3. Limits for liquidity risk control.
Entities must establish limits to control their liquidity risk exposure and vulnerability, regularly reviewing these limits as well as the corresponding authorization procedure.
The limits must be relevant to the business -based on location, complexity of the activity, nature of the product, currencies or markets, etc.- and be used in daily liquidity management within and across business lines and/or between subsidiaries, under normal conditions. LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS B.C.R.A. EN LAS ENTIDADES FINANCIERAS Sección 3. Gestión del riesgo de liquidez. Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 9

The limit structure must also include measures aimed at ensuring that the entity will continue operating in periods of market stress, individual stress or a combination of both, in order to ensure that in those situations there is sufficient liquidity.
3.3.4. Early warnings.
Entities must design a set of indicators that allow them to identify potential risks in their liquidity position, indicating negative trends that give rise to an evaluation and a potential management response to mitigate the entity's exposure to that emerging risk. These indicators can be qualitative or quantitative and can include, among others:
3.3.4.1. The rapid increase in assets, especially when funded with potentially volatile liabilities;
3.3.4.2. The increase in concentrations in assets or liabilities;
3.3.4.3. Increases in currency mismatches;
3.3.4.4. The decrease in the weighted average term of liabilities relative to assets;
3.3.4.5. Positions that approach, or breach, internal or regulatory limits repeatedly;
3.3.4.6. Negative trends in the risk associated with a particular product line -for example, increases in delinquency-;
3.3.4.7. Significant deteriorations in the entity's earnings, asset quality or overall financial condition;
3.3.4.8. Circumstances that cause damage to the entity's reputation;
3.3.4.9. The deterioration of the entity's credit rating;
3.3.4.10. Decreases in asset prices;
3.3.4.11. Sustained increases in funding costs at the system level; and
3.3.4.12. Significant increases in funding costs above the market trend.
3.3.5. Monitoring systems.
Financial institutions must have reliable information management systems to monitor liquidity risk. These information systems must:
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 10

3.3.5.1. Provide Directors, Senior Management and persons responsible for areas directly or indirectly involved with timely and prospective information on the entity's liquidity position;
3.3.5.2. Allow calculating liquidity positions in the main currencies with which the entity operates, individually and aggregated;
3.3.5.3. Allow evaluating the aggregate trend of the entity's degree of exposure to liquidity risk;
3.3.5.4. Capture all sources of risk, including contingent risks and those that could arise from new activities;
3.3.5.5. Enable the calculation of liquidity positions on an intraday, daily basis, for short periods of time (for example, weekly, biweekly and monthly) and, from there, for a series of longer-term periods;
3.3.5.6. Be used in daily liquidity management to verify compliance with established policies, limits and procedures;
3.3.5.7. Provide in a timely manner a set of reports that must be approved by Senior Management, establishing objectives, modality and frequency for different recipients and for the parties responsible for their preparation, so that personnel involved in risk management have sufficient information to fulfill their functions.
3.3.6. Liquidity monitoring and control.
Entities must:
3.3.6.1. Actively monitor and control liquidity risk exposure and financing needs within and between the different subsidiaries that make up the group, business lines and currencies, taking into consideration legal, regulatory and operational limitations for transferring liquidity;
3.3.6.2. Monitor and control liquidity risk on an individual basis and of their branches and subsidiaries in the country and abroad, as well as at the group level, in order to obtain a comprehensive view of liquidity risk exposure and identify restrictions on the transfer of liquidity within the group;
3.3.6.3. Take into account that a localized liquidity stress event can have consequences throughout the group, due to its effect on the group's reputation. Therefore, both the group and the entity must have resilience to such events at a level consistent with the risk tolerance level defined by the Board of Directors.
In order to mitigate potential contagion from reputation risk, it is important that entities maintain effective communication with counterparties, rating agencies and other interested third parties; LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS B.C.R.A. EN LAS ENTIDADES FINANCIERAS Sección 3. Gestión del riesgo de liquidez. Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 11

3.3.6.4. Take into account particularly in those cases where there is no developed foreign exchange market, the specific characteristics of the market and the liquidity risk of foreign currency positions.
3.3.7. Diversification.
3.3.7.1. General aspects.
Financial institutions must:
i) Establish a funding strategy that ensures effective diversification of funding sources and characteristics, for which they must adopt the necessary precautions to establish and maintain good access to the funding market and a solid relationship with their funding providers; ii) Regularly assess their ability to obtain funds quickly from each source and identify and monitor the factors that may affect that ability; iii) Diversify their available financing sources in the short, medium and long term. For this, diversification objectives must be part of medium- and long-term financing plans and be aligned with the entities' budget and business plan. Financing plans must take into consideration the correlations between financing sources and market conditions. To promote diversification, entities must apply limits to counterparties, types of instruments, securitizations and by currency and geographic market; iv) Limit concentration in a specific source of financing. In particular, entities with greater dependence on wholesale financing must take into account that these funds are more volatile than retail deposits. For this reason, these entities must promote greater diversification of their funding sources and maintain a greater amount of high-quality liquid assets not affected by other operations compared to those entities with greater dependence on retail funding.
3.3.7.2. Market access management.
Management of access to funding markets can include the development of markets for the sale of assets or the strengthening of agreements through which entities can request funds.
Entities must:
i) Maintain an active presence in the markets considered relevant to their financing strategy; LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS B.C.R.A. EN LAS ENTIDADES FINANCIERAS Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 12

ii) Consider the impact that the interruption of financing markets in stress situations -whether derived from individual or systemic crises- may have on their short- and long-term cash flows, since such a situation could cause their assets to not be sold or financed at reasonable prices; and iii) Identify and build effective relationships with current or potential investors, even in those sources of funds accessible through stockbrokers or other intermediaries. This is essential to have sufficient backup in case liquidity problems arise in times of crisis, and must also evaluate how those relationships may be affected in such situations.
3.3.8. Intraday liquidity.
Entities must actively manage their intraday liquidity positions and the risks associated with their payment and settlement obligations in normal and stress situations.
The entities' strategy to achieve their intraday liquidity management objectives must include at least the following aspects:
3.3.8.1. Measure expected increases in daily cash inflow and outflow, anticipating, if possible, when those flows will occur and forecasting the range of possible funding deficits that may occur at different times of the day;
3.3.8.2. Monitor intraday liquidity positions, taking into account expected activities and available resources (such as balances and remaining intraday credit capacity and assets susceptible to being pledged as collateral);
3.3.8.3. Permanently carry the position of assets pledged as collateral;
3.3.8.4. Make agreements to obtain sufficient intraday liquidity funds in order to meet the objectives;
3.3.8.5. Actively manage assets pledged as collateral;
3.3.8.6. Manage, in line with their intraday liquidity objectives, the times of day when their cash outflows occur; and
3.3.8.7. Be prepared to face severe and unexpected alterations in the intraday liquidity cash flow.
Entities must have policies, procedures and systems to support these objectives in all financial markets and currencies in which they have fund movements.
3.3.9. Collateral.
Entities must:
LINEAMIENTOS PARA LA GESTIÓN DE RIESGOS
B.C.R.A. EN LAS ENTIDADES FINANCIERAS
Sección 3. Gestión del riesgo de liquidez.
Versión: 2a. COMUNICACIÓN “A” 5398 Vigencia:
13/02/2013 Página 13

3.3.9.1. Actively manage assets pledged as collateral, bringing their positions to current values and differentiating them from those available to obtain funding;
3.3.9.2. Know the physical location where collateral is held and how it can be made available in a timely manner;
3.3.9.3. Take into account the possibilities of pledging assets as collateral given existing regulatory or legal restrictions, in order to determine whether they have freely available (or unencumbered) assets that can be pledged in cases of stress situations;
3.3.9.4. Evaluate the eligibility of assets to be pledged as collateral in operations with the Central Bank of the Argentine Republic and the capacity of such assets to be accepted by counterparties and funding providers in fund markets;
3.3.9.5. Diversify their sources of collateral, taking into consideration concentrations, price sensitivity, haircuts and specific requirements and availability of private funds in markets under stress conditions; and
3.3.9.6. Be in a position to have a range of collateral in line with their structural intraday, short- and long-term needs.
3.3.10. Stress tests.
Entities must regularly conduct tests for different stress scenarios related to specific variables of the entities or the market - individually and in combination -, both short- and long-term. Stress tests must allow them to identify sources of potential liquidity shortfalls and ensure that current exposure remains within the established tolerance level. Entities must use the results of these scenarios to adjust their liquidity management strategies and policies, generate actions that limit their exposure, build a liquidity buffer and develop effective contingency plans.
3.3.10.1. Stress testing process.
Stress tests must allow entities to analyze the impact of stress scenarios both on the group's consolidated liquidity position and on the individual position of the entities and their business lines.
The extent and frequency of the tests must be proportional to the size of the entities, the nature and complexity of their operations and their exposure to liquidity risk, as well as the systemic importance of the entities in the markets in which they operate. GUIDELINES FOR RISK MANAGEMENT B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 14

Senior Management, whose active participation is important for the stress testing process, must require that, even in periods of abundant liquidity, rigorous scenarios in which liquidity availability is scarce be taken into account.
Senior Management must also review in detail and discuss the results of stress tests in order to, on that basis, make decisions to mitigate or correct the entities' exposure, create liquidity buffers and adjust the liquidity profile to the entity's risk tolerance.
3.3.10.2. Scenarios and assumptions.
Entities must take into consideration, when designing stress scenarios, the nature of their businesses, their products and other activities (including complex financial instruments and off-balance sheet items), their funding sources and vulnerabilities. The defined scenarios must allow entities to evaluate the potential adverse effects that such factors could generate on their liquidity position, with the judgment of analysts being important in the design of stress tests, although historical events may also be taken into account as a guide. Entities must consider short- and long-term stress scenarios, as well as entity-specific and market-specific ones, simultaneously including a disruption of liquidity in the market, severe restrictions on access to funds, restrictions in the foreign exchange market and severe disruptions in payment and settlement systems. Entities must have a conservative approach when establishing stress test assumptions, based on the type and severity of the scenario, to consider whether the assumptions remain appropriate. As an illustrative and non-limiting list of other stress test assumptions, the following may be mentioned:
i) Illiquidity in the asset market and deterioration in its value; ii) Runs on retail funds; iii) Unavailability of wholesale funding sources; iv) Margin requirements and other additional collateral; v) Contingent exposures, specifically extension of committed lines to third parties; vi) Availability of contingent lines for the entity; vii) Outflows of funds linked to complex products or transactions; GUIDELINES FOR RISK MANAGEMENT B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 15

viii) Impact of changes in credit ratings; ix) Access to financial assistance from the Central Bank of the Argentine Republic; and x) Estimates of future growth of balance sheet items.
In stress tests, entities must consider the possible response of other participants to market stress events, the way in which that common response could amplify market fluctuations and exacerbate pressures, as well as the effects on the time distribution of expected cash flows. Likewise, entities must take into account the results of stress tests carried out for other risks and their impact on the liquidity position. Also, they must consider possible interactions with those other risks and that, in many cases, liquidity needs increase simultaneously both due to the entities' own activities and those of their clients. Scenarios must be reviewed periodically to ensure that their nature and severity are adequate and relevant for the entities. Reviews must take into consideration changes in market conditions, in the nature, magnitude or complexity of the entity's businesses or activities and real experiences in stress situations. In order to identify and analyze factors that could have a significant impact on the liquidity profile, entities must perform a sensitivity analysis of the stress test results under certain key assumptions. Such sensitivity analysis can provide additional information on the degree of vulnerability of entities to certain factors.
3.3.10.3. Use of results.
Senior Management must review the scenarios, assumptions and results of stress tests. The choice of scenarios and related assumptions must be documented and reviewed together with the test results.
The results of stress tests - which must be incorporated into contingency plans -, the vulnerabilities detected as well as the resulting actions must be reported and discussed with the Board of Directors.
3.3.11. Contingency planning.
Financial institutions must have a contingency funding plan that clearly establishes the strategy to overcome cash flow shortfalls during emergency situations.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 16

The contingency funding plan must contain policies to manage a range of possible stress situations and establish clear lines of responsibility along with appropriate procedures for each level of situation. This plan must be regularly tested and updated, to ensure its effectiveness, viability and that it is operationally adequate. The contingency funding plan is the compilation of policies, procedures and actions to respond to severe difficulties in the entities' ability to fund some or all of their activities, in a timely manner and at a reasonable cost. The contingency funding plan must:
3.3.11.1. Be proportional to the size of the entity, the nature and complexity of its operations, its risk profile and its economic importance in the financial system;
3.3.11.2. Have a design and procedures integrated with the daily analysis of liquidity risk and the results of the scenarios and assumptions used in stress tests;
3.3.11.3. Contemplate different time horizons, including intraday;
3.3.11.4. Prepare the entity to handle a range of severe stress scenarios that considers a diversified menu of options, so that those responsible for the areas involved have a vision of the potentially available contingent measures;
3.3.11.5. Have procedures to cover cash deficits in adverse situations;
3.3.11.6. Take into account:
i) The effect that market stress situations will have on its ability to sell or securitize assets; ii) The existing links between the asset market and liquidity fund markets; iii) The reputational effects related to the execution of the measures provided for in the plan; iv) The financial assistance programs provided by the Central Bank of the Argentine Republic and its collateral requirements. These elements will reflect the entity's prior experience, expert judgment and the results from stress tests.
3.3.11.7. Contain clear policies and procedures that allow Senior Management to make timely and well-informed decisions and communicate their implementation effectively and efficiently. Said plan must contemplate, among other aspects, the following:
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 17

i) The establishment of an allocation of responsibilities, including the designation of the authority with powers to activate the plan. The formal establishment of a “crisis team” can facilitate internal coordination and decision-making during the liquidity crisis; ii) The identification of the personnel responsible for the implementation of the planned contingency plan and their functions during a critical situation; iii) The establishment of guidelines for the decision-making process to be adopted - definition of who should make them and the issues that must be escalated to hierarchical levels in the entity - in order to ensure effective coordination and communication across the different business lines; iv) The establishment of guidelines aimed at influencing the behavior of assets and liabilities in the face of alteration of cash flows due to an adverse situation - for example by modifying the level of rates for attracting deposits -; and v) The design of a communication plan that guarantees fluid contact with debtors, creditors and other counterparties, taking into account that good management of these relationships becomes key to facing adverse situations.
3.3.12. Liquidity buffer.
Entities must maintain - at all times - a sufficient amount of high-quality liquid assets, unencumbered and not pledged as collateral for other operations, to ensure obtaining funds in stress scenarios - including those that involve losses of typical funding sources -. There must be no legal, regulatory or operational impediments to selling or pledging the assets for such purpose. In order for entities to face liquidity stress events, the amount of the liquidity buffer must be related to the effects that liquidity stress events may cause and to the estimate of the need for funds in those periods. The amount of the liquidity buffer must align with the level of risk tolerance established by the entities, being important to consider the magnitude of cash flow mismatches and the estimated duration and severity of stress events, among other factors.
3.4. Transparency.
Financial institutions must make known to the public - on a regular basis - through their Internet pages or reports:
3.4.1. Information that allows market participants to evaluate the soundness of the liquidity risk management framework and its exposure to liquidity risk;
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 18

3.4.2. A description of the framework implemented to manage liquidity risk, its structure, the roles and responsibilities of the relevant committees on the subject, as well as the different functions and business units;
3.4.3. Qualitative information that enables market participants to know how liquidity risk is managed.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 3. Liquidity risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 19

4.1. Concepts.
4.1.1. Market risk.
Market risk is defined as the possibility of suffering losses in on- and off-balance sheet positions as a result of adverse fluctuations in the market prices of various assets.
The risks that compose it are:
4.1.1.1. Risks inherent to shares, to financial instruments whose value depends on interest rates and other financial instruments, recorded in the trading portfolio;
4.1.1.2. Currency risk through on- and off-balance sheet positions.
4.1.2. Market risk management.
Market risk management is understood as the process of identification, evaluation, monitoring, control and mitigation of this risk, which involves a series of processes, among them:
4.1.2.1. Development of models for risk estimation;
4.1.2.2. Establishment of limits;
4.1.2.3. Prudent valuation of financial instruments;
4.1.2.4. Use of stress tests; and
4.1.2.5. Contingency planning.
As part of this process, entities must have methodologies that allow them to evaluate and actively manage significant market risks, regardless of their origin, both at the position, trader, business line and entity-wide level.
The market risk management system must include the use of VaR methodologies and the performance of stress tests that are consistent with the type and level of activity, in order to effectively calculate the significant risks of the instruments with which they trade and the strategies they pursue. Both techniques must evolve as the instruments and trading strategies used change. Financial institutions must demonstrate how they combine their risk measurement methods to calculate the economic capital necessary for market risk. Furthermore, in the case of more sophisticated entities, the assessment of the sufficiency of economic capital for market risk must include the evaluation of concentration and illiquidity risk in market stress scenarios. GUIDELINES FOR RISK MANAGEMENT B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 1

4.1.3. Market risk management framework.
The framework for market risk management includes the strategies, policies, practices, procedures and organizational structures that financial institutions must have for the identification, evaluation, monitoring, control and mitigation of this risk. This framework must be proportional to the size and economic importance of the financial institutions and to the nature and complexity of their operations and:
i) Cover all relevant market risks faced by the entities; ii) Contemplate a strategy that comprises the general approach of the financial institutions to market risk, including quantitative and qualitative objectives; and iii) Be supported by documentation that describes its basic principles and explains the empirical techniques used to quantify market risk.
4.1.3.1. Strategy.
The market risk management strategy must establish the general guidelines that financial institutions will apply to manage this risk, for which they must adopt adequate policies and practices, contemplating the objective of protecting liquidity and solvency, the established level of risk tolerance and the capacity to face stress situations in the market. Entities must take into account, when formulating the strategy, their corporate structure - for example, whether they have subsidiaries or branches abroad -, key business lines, the diversity of markets and products with which they operate and, if applicable, the requirements of the regulators of their subsidiaries and branches abroad.
4.1.3.2. Policies.
Policies and procedures must establish clearly defined criteria to determine the positions to include and exclude from the trading portfolio, as well as establish when a position should be valued daily at market prices taking as reference an active and liquid market. When positions are valued through a model, entities must determine to what extent they can:
i) Identify the significant risks of the position; ii) Cover these significant risks and to what extent the hedging instruments would have an active and liquid market; iii) Obtain reliable estimates of the main assumptions and parameters used in the model. GUIDELINES FOR RISK MANAGEMENT B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 2

Likewise, a study must be provided for regarding legal restrictions or other operational requirements that could prevent the immediate liquidation of positions.
4.1.3.3. Organizational structure.
The organizational structure must have the necessary characteristics so that the defined strategy can be effectively implemented and contemplate the assignment of the responsibility of managing market risk to a specific unit or person of the financial institution. That unit, depending on the size and economic importance of the entity, and the magnitude and nature of its operations, may be made up of a single person, a specific area or take the form of a risk committee, and must be independent from the business units, report to Senior Management and fulfill an independent market risk control function. Its members cannot be employees responsible for exposing the entity to market risks or who perform tasks that imply other conflicts of interest.
4.2. Responsibilities.
4.2.1. Board of Directors.
The Board of Directors is responsible for ensuring that the entity has an adequate framework - effective, viable and consistent - for market risk management, for the market risk assumed by the entity and for the way in which it is managed. In this regard, it must:
4.2.1.1. Approve the strategy for market risk management, which must clearly define the administrative structure related to the management of this risk and be duly documented.
The strategy must include the performance of stress tests and the establishment of limits that reflect the entity's level of tolerance to market risk, which must be appropriate for its business strategy and its role in the financial system;
4.2.1.2. Approve significant policies and practices, reviewing them periodically - at least annually - and each time in its judgment relevant events or situations related to this risk occur, and must ensure that Senior Management takes the appropriate corrective actions to address those aspects;
4.2.1.3. Approve exceptions to policies and limits that imply a significant deviation;

4.2.1.4. Ensure that Senior Management communicates the market risk management strategy through clear and operational guidelines and manages risk effectively;
4.2.1.5. Receive information periodically to become aware of the entity's trading portfolio, and immediately in the event that adverse situations arise, and must ensure that Senior Management takes the appropriate corrective actions to address those aspects. It is essential that it also receives information on the stress tests performed and the contingency plans established;
4.2.1.6. Ensure that Senior Management and the personnel of the areas involved have the necessary experience for market risk management and that the entity has processes and systems to identify, assess, monitor, control and mitigate the sources of market risk;
4.2.1.7. Understand the existing interactions between market risk and the other risks of the financial institution;
4.2.1.8. Ensure that there is a periodic independent review of the market risk management framework carried out by internal audit;
4.2.1.9. Guarantee that the policy of economic incentives for personnel is not in conflict with the entity's market risk strategy.
4.2.2. Senior Management.
Senior Management is responsible for implementing the market risk management strategy in accordance with the entity's level of risk tolerance and the policies and practices approved by the Board, as well as for developing written procedures to identify, assess, monitor, control and mitigate this risk. Senior Management, among other aspects, must:
4.2.2.1. Approve and develop the specific procedures for active management of positions in the trading portfolio;
4.2.2.2. Implement the structure, responsibilities and controls necessary for market risk management by areas and products;
4.2.2.3. Define the procedures and the corresponding level of approval for exceptions to limits in accordance with the policy approved by the Board;
4.2.2.4. Design and regularly review the results of stress tests, which must be reflected in the established policies and limits;
4.2.2.5. Implement contingency plans, which must be linked to the results of stress tests;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 4

4.2.2.6. Continuously review market information that affects the entity's positions and report regularly to the Board;
4.2.2.7. Carry out an assessment of the capacity to actively manage the risk of exposures in its trading activities;
4.2.2.8. Perform an analysis of the capacity to transfer risks between the trading portfolio and the investment portfolio;
4.2.2.9. Communicate to all areas directly or indirectly involved the market risk strategy, the key policies to implement that strategy and the structure for market risk management;
4.2.2.10. Frequently monitor market trends that may present significant or unprecedented challenges for market risk management;
4.2.2.11. Ensure the existence of adequate internal controls to protect the integrity of the market risk management process.
4.3. Market risk management process.
Entities must have an adequate process to identify, assess, monitor, control and mitigate market risk, which guarantees compliance with a documented set of internal policies, controls and procedures relating to the operation of the risk management system, which will be carried out by an independent unit. Entities must define and identify the market risk to which all their branches and subsidiaries in the jurisdictions in which they operate are exposed. Also - in the context of their internal audit processes - they must regularly subject their risk management framework to an independent review, which evaluates the activities of the business units and those of the market risk management unit. In the case of new products, the approval processes must include all internal areas related to the measurement and control of risks and the valuation of instruments and their verification. Regardless of whether the new products are assigned to the trading or investment portfolio, the approval and review of valuation methodologies must comply with pre-established minimum requirements. In addition, the approval and valuation processes for new products must be supported by well-documented valuation methodologies that are specific to those products and businesses.
4.3.1. Specification of market risk factors.
The risk factors specified in the market risk measurement system - among them, interest rates, market prices and exchange rates - must be sufficient to capture the risks inherent in the entities' trading portfolio, on and off balance sheet. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 5

Factors considered relevant in price determination must be included as risk factors in the models, and the entity must justify cases of omission. Counterparty risk for each of the financial instruments and factors related to the issuers of the instruments must also be taken into account. As regards interest rates, risk factors must be identified in each currency in which the entities maintain positions - on or off balance sheet - whose value depends on interest rates. The risk measurement system must also model the yield curve, for example, using forward rates from the yields of zero-coupon securities. In relation to exchange rates - where gold may be included - the risk measurement system must incorporate the risk factors corresponding to the currencies in which the entity's positions are denominated. Any position denominated in foreign currency will introduce exchange rate risk, since the risks calculated by the measurement system will be expressed in the local currency. For this reason, there must be risk factors corresponding to the exchange rate between the national currency and each of the currencies in which the entity maintains a significant position. In the case of share prices, risk factors corresponding to each of the markets in which the entity maintains important positions must be included, and must, at a minimum, include a risk factor that reflects movements in share prices across the entire market.
4.3.2. Market risk measurement models.
Entities must develop risk models that must be fully integrated into daily market risk management, whose degree of development will depend on the importance and sophistication of the entities' positions as well as their associated market risks, and must be validated continuously. These models must allow risk to be measured at a minimum confidence level of 99% with a 10-day horizon, and financial institutions must estimate the model parameters and keep in mind their main assumptions. Entities must carry out a periodic programme that compares actual results with the predictions of their models, and must check whether the number of days with losses greater than those predicted is in line with what is expected based on the established confidence level, for which it will be necessary to have a record of historical data.
4.3.3. Limits.
Market risk control includes the establishment of limits - at the corporate level, by line of business and at the trading desk level - that allow the entities' exposure to such risk to be controlled.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 6

Limits must take into account the key risk factors, be adequate to the volume and complexity of the entities' operations and be constituted in such a way that their application is transparent and consistent over time, and may be applied to:
4.3.3.1. Net or gross positions;
4.3.3.2. Market risk concentrations;
4.3.3.3. The maximum admissible loss;
4.3.3.4. Potential risks based on the information obtained through stress tests and scenario analysis;
4.3.3.5. The Value at Risk (VaR) of positions.
VaR is an important tool that contributes to monitoring aggregate exposure, while offering a standard measure to compare the risk incurred by different traders and lines of business. The VaR model must allow the risks arising from all trading activities to be adequately identified and measured, must be incorporated into the internal capital adequacy assessment process and must, moreover, be subject to rigorous and continuous validation. Estimates with VaR models must be sensitive to changes in the risk profile of the trading portfolio.
4.3.3.6. Mismatches.
Financial institutions must maintain a set of intermediate thresholds that alert Senior Management when limits are about to be reached, in order to allow the necessary actions and/or reviews. Processes will be established to address situations in which certain market risk positions exceed pre-established limits and criteria, and must contemplate significant excesses in contingency plans. Limits must be reviewed periodically to confirm that the maximum market risk exposure admissible by the entity has not been exceeded.
4.3.4. Stress tests.
Entities that have significant positions in their trading portfolio must have a rigorous and comprehensive programme for conducting tests for different stress scenarios. This programme must help identify adverse events that could significantly affect the entities' capital position. In the internal capital adequacy assessment, it must be demonstrated that the entity has sufficient capital not only to meet minimum requirements, but also to withstand a series of stress scenarios. Stress scenarios must:
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 7

4.3.4.1. Include a range of risk factors that could entail extraordinary losses in the entities' portfolios or hinder the control of risks in those portfolios;
4.3.4.2. Be qualitative and quantitative in nature;
4.3.4.3. Incorporate the potential market and liquidity risks that could arise in the event of high volatility.
Quantitative criteria must allow the identification of scenarios to which the entities could be exposed, while qualitative criteria must emphasize that the two main goals of stress tests are to assess the entities' capacity to absorb potentially large losses and to identify the actions they can take to reduce their risk and preserve their capital;
4.3.4.4. Allow assessment of the response of trading portfolio positions to fluctuations similar to those occurring in past crises, incorporating the sharp drops in prices and liquidity observed during those events;
4.3.4.5. Contemplate particularly adverse situations based on the characteristics of their portfolio - such as concentrated positions relative to the volume traded in the market, illiquidity situations, financial products with optionalities, positions with deep out-of-the-money value, significant changes in correlations and other risks, such as uncertainty about recovery rates, which may not be correctly reflected in VaR.
The stress tests applied by the entity - and especially their calibration, which covers the magnitude of the alterations and the types of events considered - must observe clear premises, since the internal capital adequacy assessment is carried out on the basis of their results. This assessment must consider the sufficiency of capital to address a series of situations, such as managing traded portfolios within established limits and during a prolonged period of stress and illiquidity in the markets or guaranteeing that, with a given time horizon and confidence level, all positions can be liquidated or losses can be faced in an orderly manner. The alterations or scenarios used in the tests must reflect the nature of the portfolios and the time it would take to hedge or manage the risks under severe market conditions. The results of stress tests must be routinely communicated to Senior Management for review and periodically to the Board, as well as being reflected in the established policies and limits.
4.3.5. Contingency planning.
Financial institutions must have a contingency plan that clearly establishes the strategy for dealing with emergency situations.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 8

The contingency plan must:
4.3.5.1. Be proportional to the size of the entity, its risk profile and its relative importance in the financial system, and to the nature and complexity of its operations;
4.3.5.2. Contemplate different time horizons, including intraday;
4.3.5.3. Prepare the entity to handle a range of severe stress scenarios, considering a diversified menu of options so that Senior Management has a view of the potentially available contingency measures;
4.3.5.4. Contain clear policies and procedures that allow Senior Management to make timely and well-informed decisions and to communicate their implementation effectively and efficiently. Said plan must contemplate, among other aspects, the following:
i) The establishment of an allocation of responsibilities, including the designation of the authority with powers to activate the plan. The formal establishment of a “crisis team” can facilitate internal coordination and decision-making during the crisis; ii) The identification of the personnel responsible for implementing the planned contingency plan and their functions during a critical situation; iii) The establishment of guidelines for the decision-making process to be adopted - defining who should make them and the matters that must be escalated to hierarchical levels of the entity - in order to ensure effective coordination and communication across the different lines of business. The plan must be reviewed and tested regularly to ensure its effectiveness and viability and be designed to address the scenarios raised by the entity in the stress tests.
4.3.6. Valuation of positions in the trading portfolio.
It is important that a prudent valuation be carried out of financial instruments whose accounting reflects a fair market value, paying special attention to less liquid positions. For these purposes, the entity must have clear and sound governance structures and control processes that allow the fair value of exposures to be estimated both for risk management purposes and for financial reporting. The governance structures and control processes must be embedded in the entity's overall governance structure and must explicitly contemplate the role of the Board and Senior Management. In addition, the Board must receive reports from Senior Management on the issues it has had to resolve when overseeing valuations and the performance of valuation models, and on all significant changes in valuation policies. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 9

A framework with prudent valuation practices must include, without thereby modifying the current accounting valuation criteria, the elements described below:
4.3.6.1. Systems and controls.
Entities must establish and maintain adequate systems and sufficient controls that guarantee that valuations are prudent and reliable.
These systems must be integrated with the entity's other risk management systems - such as credit, interest rate, liquidity and operational risk - and include:
i) Documented policies and procedures for the valuation process that must contain, among other aspects, clearly defined responsibilities, market information sources, the frequency of valuation, which techniques are accepted for valuation - at market prices or according to a model - and the periodic and independent review of valuations; ii) Unambiguous and independent channels for transmitting information to Senior Management. Valuation control processes must be applied consistently throughout the entity - including at the line of business and instrument level - and be integrated with the risk measurement and management processes. These controls must be subject to internal audit. The approval processes for new products must involve all instances of the financial institution involved in the measurement and control of risks and in the assignment and verification of the valuations of financial instruments.
4.3.6.2. Valuation methodologies.
Valuation at market prices consists of calculating, at least daily, the value of positions at closing prices in current transactions reported by independent sources.
Entities must prioritize the use of market information and minimize the use of discretionary parameters in their valuation techniques. However, observed data may not be relevant - for example a transaction that reflects a forced liquidation or where no transactions have been recorded. In these cases, the information arising from the market must be taken into account but must not be decisive for the valuation of the position. Entities must ensure that the sources of information are reliable and relevant, for which they must consider, among others, the following aspects:
i) the quality and reliability of the reported data; RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 10

ii) the frequency and availability of prices and quotations for market participants; iii) whether the prices represent regular transactions carried out between independent parties; iv) whether the information is received in a timely manner in relation to the frequency of valuations; v) the number of independent sources that generate the quotations and prices; vi) the degree of development and the depth of the market; and

vii) the similarity between the financial instruments traded in the reference transaction and the instruments in the entity's portfolio.
In cases where it is not possible to value positions at market prices, entities may value them through a model and demonstrate that such valuation is prudent.
Model-based valuation is defined as that which can be obtained from references, extrapolations or other calculations from market data, requiring a greater degree of prudence for this purpose.
Independent price verification is the process by which models are regularly reviewed to verify their accuracy. Entities must have the capacity to produce and verify valuations of instruments and transactions, including during periods of stress. This capacity must be adequate to the importance, risk and size of the exposures, in the context of the respective entity's business profile. In addition, for exposures that represent a significant risk, entities must be able to generate valuations through alternative methods in the event that the input data and the approaches normally used become unreliable, unavailable or irrelevant due to discontinuities or illiquidity in the markets. Entities must test and review the performance of their models under stress conditions, in order to understand the limitations of said models under these conditions. While daily valuation at market prices may be carried out by the personnel in charge of trading, verification of market prices or of the data input into the models must be carried out by an independent area, at least monthly or more frequently if the nature of the entity's trading activity so requires. When dealing with new products, and regardless of which line of business they correspond to, the review and approval of valuation methodologies must be guided by a minimum set of common considerations. In particular, the approval and valuation processes for new products must be supported by well-documented valuation methodologies specific to the products and businesses. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 1st. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 11

4.3.6.3. Valuation adjustments.
Financial institutions must establish and maintain procedures to consider valuation adjustments, taking into account at a minimum: credit rating differentials not yet recognized, liquidation costs, operational and early termination risks, investment, financing and future administrative costs and, where applicable, the risk associated with the use of a model.
4.4. Transparency.
Financial institutions must make known to the public - on a regular basis - through their Internet pages or reports:
4.4.1. Timely, relevant, reliable and useful information for decision-making, which allows market participants to evaluate the soundness of their market risk management framework and their exposure to market risk;
4.4.2. A description of the framework implemented to manage market risk, its structure, the roles and responsibilities of the unit in charge of that management, as well as the different functions and lines of business;
4.4.3. Qualitative information that enables market participants to know the way in which they manage market risk;
4.4.4. Clear information on the uncertainty in valuations, such as descriptions of the instruments valued according to model and the techniques employed, the sensitivity of the valuations to the assumptions and data employed and the effect of stress scenarios on the valuations.
In addition, transparency policies must be regularly reviewed to ensure that the information provided continues to be relevant based on the business model, products and current market conditions.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 4. Market risk management.
Version: 1st. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 12

5.1. Concepts.
5.1.1. Interest rate risk.
Interest rate risk is understood as the possibility of changes occurring in the financial condition of an entity as a consequence of fluctuations in interest rates, which may have adverse effects on the entity's net financial income and its economic value. A process for the effective management of this risk that keeps it bounded within prudent levels is essential for the safety and solvency of the entity. The main sources of interest rate risk result from:
5.1.1.1. The different maturity terms and rate adjustment dates for the entity's assets, liabilities and off-balance sheet holdings;
5.1.1.2. Fluctuations in yield curves;
5.1.1.3. The basis risk that arises as a consequence of an imperfect correlation in the adjustment of asset and liability rates for instruments that have similar revaluation characteristics;
5.1.1.4. The implicit options in certain assets, liabilities and off-balance sheet items of the financial institution, such as loans with early cancellation clauses.
The main approaches to assess interest rate risk are:
i) Net financial income approach:
It is based on the analysis of the incidence of a change in interest rates on accrued or forecast income. ii) Economic value approach:
It recognizes that changes in interest rates affect the economic value of assets, liabilities and off-balance sheet positions. Thus, the economic value of the financial institution will be given by the present value of the entity's expected cash flows, that is, the expected cash flows of assets net of liabilities plus net off-balance sheet positions. This approach provides a more comprehensive view of the potential long-term effects arising from rate variations.
5.1.2. Interest rate risk management.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 1

Interest rate risk management is the process of identification, evaluation, monitoring, control and mitigation of this risk, which must focus its attention on all balance sheet items that are affected by adverse variations in rates - reflected at market values or accounted for otherwise -. The management of this risk involves a series of processes, among them the administration of interest rate mismatches, the analysis of uncertainty regarding the rate to be applied to future cash flows and rate repricings - including the use of “stress scenarios” - as well as the consideration of the rate risk resulting from certain implicit options in some banking products, the use of dynamic models that reflect potential future business, business decisions and contingency planning. Interest rate risk is a potentially significant risk, which must be covered with capital. Given the considerable heterogeneity that exists in the nature of the risk and in the monitoring and management processes of said risk, the rules on “Minimum capital of financial institutions” do not provide for a capital requirement to address interest rate risk. Notwithstanding this, entities must evaluate the sufficiency of capital with respect to this risk. The internal systems of the entities are the main instrument to measure said risk and to evaluate the sufficiency of capital. Financial institutions must provide the Superintendency of Financial and Exchange Institutions with the results of their internal measurement systems, expressed in terms of economic capital and using a standard disturbance for the relevant interest rates. In cases where the Superintendency of Financial and Exchange Institutions concludes that the entity does not maintain capital in accordance with its level of interest rate risk, it may require it to reduce its risk, to maintain a specific amount of additional capital or a combination of both alternatives. For this, special attention will be paid to the sufficiency of capital in entities in which the economic value falls more than 20% of the computable net worth due to a standard disturbance of the relevant interest rates of 200 basis points or the 1st and 99th percentiles of the distribution of changes in interest rates produced in one year (240 business days) taking a minimum observation period of five years.
5.1.3. Framework for interest rate risk management.
The framework for interest rate risk management includes the policies, practices, procedures and organizational structures that financial institutions must have for adequate management of that risk, and must be proportional to the dimension and economic importance of the financial institutions and to the nature and complexity of their operations. This framework must include basic elements in the administration of assets, liabilities and off-balance sheet instruments:

an interest rate strategy, which comprises the financial institution's general approach to that risk, including quantitative and qualitative objectives;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 2
adequate monitoring by the Board of Directors and Senior Management;
adequate policies and procedures for risk management;
appropriate functions for risk measurement, monitoring and control;
comprehensive internal controls and independent audits.
5.1.3.1. Strategy.
The interest rate risk management strategy must:
i) Establish the general guidelines that financial institutions will apply to manage this risk; ii) Contemplate the objective of protecting liquidity and solvency, the level of risk tolerance as well as the capacity to face stress situations in the market; iii) State the specific policies on particular aspects of the administration of this risk, such as:
the establishment of limits that reflect the entity's risk tolerance - defined as the level of risk it is willing to assume, which must be appropriate for its business strategy and its role in the financial system -;
the review of rate risk prior to the acquisition or launch of new products;
the linkage of this risk with liquidity risk, among others.
For the formulation of the strategy, entities must take into account their corporate structure - for example, if it has subsidiaries or branches abroad -, the key lines of business, the diversity of markets and products with which they operate and, if applicable, the requirements of the regulators of their subsidiaries and branches abroad.
5.1.3.2. Organizational structure.
The organizational structure must have the necessary characteristics so that the interest rate strategy can be effectively implemented and contemplate the assignment of the responsibility of managing the overall interest rate risk to a specific unit or person of the financial institution. That unit, depending on the dimension and economic importance of the entity and the magnitude, complexity and nature of its operations, may take the form of an asset and/or liability management committee or a risk committee, in which members of Senior Management and the Board of Directors must participate. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 3

5.2. Responsibilities.
5.2.1. Board of Directors.
The Board of Directors is responsible for ensuring that the entity has an adequate framework - effective, viable and consistent - for interest rate risk management, for the interest rate risk assumed by the entity and for the way in which it is managed. In this regard, the Board of Directors must:
5.2.1.1. Approve the strategy for interest rate risk management, which must be duly documented;
5.2.1.2. Approve and review, at least annually, the interest rate risk policies and practices and the business strategies that affect the entity's exposure to this risk.
These reviews must be carried out more frequently in cases where the entity maintains significant positions in complex instruments and each time relevant events or situations occur;
5.2.1.3. Establish the entity's level of risk tolerance, defined as the maximum level of risk it is willing to assume, which must be appropriate for its business strategy and importance in the financial system and reflect its financial condition. For this, it will approve aggregate limits related to the amount of risk acceptable for the entity;
5.2.1.4. Define the lines of authority and levels of responsibility in interest rate risk management, clearly establishing the persons and/or committees responsible for administering the key elements of the risk management system;
5.2.1.5. Ensure that the entity has personnel with the necessary technical skills to identify, evaluate, monitor, control and mitigate interest rate risk;
5.2.1.6. Promote among its members and the members of the management, fluid communication regarding the exposures and the interest rate risk management framework;
5.2.1.7. Ensure that Senior Management communicates the interest rate strategy through clear and operational guidelines and manages risk effectively;
5.2.1.8. Receive periodic reports to become aware of the interest rate risk exposure, which must be analyzed immediately if problems arise in terms of interest rate risk;
5.2.1.9. Understand the way in which the remaining risks affect the entity's overall interest rate strategy;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 4

5.2.1.10. Receive periodic reports regarding the results of stress tests;
5.2.1.11. Ensure that Senior Management takes the appropriate corrective actions to face stress situations and that the associated contingency plans are effective;
5.2.1.12. Evaluate whether the risk assumed is in line with the assigned capital; and
5.2.1.13. Ensure that the policy of economic incentives for personnel is not in opposition to the entity's interest rate risk strategy.
5.2.1.14. Ensure that the measurement system used is adequate and exhaustive, regardless of its type and level of complexity. Since the quality and reliability of the measurement system depend especially on the quality of the data and assumptions used in the model, the Board of Directors must pay special attention to these aspects.
5.2.2. Senior Management.
Senior Management is responsible for implementing the strategy and policies for interest rate risk management and developing written procedures to identify, evaluate, monitor, control and mitigate this risk.
Senior Management must:
5.2.2.1. Implement the strategy, policies and practices approved by the Board of Directors;
5.2.2.2. Approve and develop the specific procedures for active interest rate risk management;
5.2.2.3. Ensure the existence of effective internal controls that include adequate risk limits, as well as appropriate systems and standards for interest rate risk measurement;
5.2.2.4. Define the procedures and the corresponding approval level for exceptions to limits, in accordance with the policy approved by the Board of Directors;
5.2.2.5. Periodically review the entity's interest rate risk management framework in order to ensure that it continues to be appropriate and is in line with sound practices;
5.2.2.6. Design and regularly review the results of stress tests, which must be reflected in the established policies and limits;
5.2.2.7. Implement contingency plans, which must be linked to the results of stress tests;
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 5

5.2.2.8. Understand, together with the areas directly or indirectly involved with this risk, the assumptions of the interest rate risk measurement system, which will be reviewed at least annually;
5.2.2.9. Ensure that before the introduction of a new product, hedge or position-taking strategy, there are adequate operational procedures and risk control systems;
5.2.2.10. Receive reports on interest rate risk that contain both aggregate and detailed information, which allows it to determine the entity's vulnerability to changes in market conditions and other risk factors and periodically inform the Board of Directors;
5.2.2.11. Ensure that there are sufficient provisions to minimize the eventual influences that risk takers could have on the control functions of the risk management system, the development and application of policies and processes, the risk reports elevated to Senior Management and other administrative functions;
5.2.2.12. Guarantee that the reviews and evaluations that are part of the internal control system are carried out periodically by persons who are not related to the functions assigned to them for review;
5.2.2.13. Understand the incidence of the existing interactions between the different risks;
5.2.2.14. Effectively communicate to all areas of the entity directly or indirectly involved the interest rate strategy, the key policies to implement that strategy and the structure for the management of this risk;
5.2.2.15. Appropriately incorporate the costs, benefits and interest rate risk in the internal pricing system, in performance measures and in the approval process for new products for the significant activities carried out by the entity, aligning the incentives for risk-taking of individual business lines with the interest rate risk exposure that those activities generate for the entity as a whole.
5.3. Interest rate risk management process.
Interest rate risk management comprises the stages of identification, evaluation, monitoring, control and mitigation of this risk.
The identification of interest rate risk is mainly associated with the incorporation of new products or activities, while monitoring is linked to the setting of limits, the performance of stress tests and the preparation of periodic publication reports.
5.3.1. New products.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 6

Prior to the acquisition or launch of new products or activities, entities must subject them to a careful review that allows ensuring that they understand the characteristics of the risk and incorporate them into their management system.
Entities must pay attention to changes in terms, rate adjustments and cancellation terms, which can affect the risk characteristics of the products.
Proposals for the incorporation of new products or activities must contain the following characteristics:
5.3.1.1. The description of the product or activity;
5.3.1.2. Identification of the resources required to establish adequate and effective risk management practices for the product or activity in question;
5.3.1.3. An evaluation of the reasonableness of the proposed activities or products in relation to the entity's financial situation and its level of capital;
5.3.1.4. Procedures to identify, evaluate, monitor, control and mitigate the risks of the proposed activity or product.
5.3.2. Interest rate risk measurement.
Depending on the complexity and type of activities carried out, financial institutions must have interest rate risk measurement systems that allow determining the incidence of rate changes on their net income and/or their economic value.
These systems must:
5.3.2.1. Measure the entity's current levels of risk exposure and identify excessive exposures that may arise;
5.3.2.2. Evaluate all significant interest rate risks associated with the entity's assets, liabilities and off-balance sheet positions;
5.3.2.3. Use generally accepted financial concepts and risk measurement techniques;
5.3.2.4. Be duly documented, detailing the assumptions and parameters used, being particularly rigorous in determining the interest rate sensitivity of complex instruments and instruments with uncertain maturities;
5.3.2.5. Incorporate in a timely manner all relevant positions and cash flows, on and off balance sheet.
RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 7

For this, it is important that in the process of measuring this risk the information on current positions is communicated comprehensively and in a timely manner;
5.3.2.6. Incorporate the risk exposures from all activities of the entities, including both the trading portfolio and the investment portfolio. This does not exclude the existence of different measurement systems used for different activities. However, the person or unit in charge of risk management must have a comprehensive vision that covers all products and lines of business;
5.3.2.7. Consider all significant sources of risk, including rate adjustments, fluctuations in the yield curve, basis risk and implicit options in certain products;
5.3.2.8. Evaluate with particular rigor the concentrations of rate risk in the entity's large positions, given that their characteristics can dominate its aggregate risk profile, as well as those instruments that can significantly affect the entity's aggregate position, even in the case that they do not represent a large concentration;
5.3.2.9. Consider the use of various techniques for measuring interest rate risk exposure, such as from simple calculations or static simulations - where the interest rate sensitive items are distributed according to their maturity or their next rate adjustment - to dynamic models that reflect potential future business and business decisions. Forecasts on the potential evolution of interest rates can also be used;
5.3.2.10. Consider the use of multiple scenarios, including potential effects of relative changes between interest rates - that is, due to basis risk and fluctuations in the yield curve - as well as variations in the general level of rates;
5.3.2.11. Pay special attention in the treatment of those positions whose normal maturities differ from contractual maturities - for example mortgage loans with early cancellation clauses -, since this makes their measurement difficult, because not only the amounts but also the timing of cash flows will depend significantly on the evolution of rates;
5.3.2.12. Incorporate risk exposures and the treatment of positions denominated in different currencies.
5.3.3. Limits.
Entities must have a system of limits and clear guidelines for risk-taking, in order to maintain interest rate risk exposure within the parameters established by the entity, in the face of a range of possible changes in rates - objective of interest rate risk management -. RISK MANAGEMENT GUIDELINES B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION “A” 5398 Effective:
02/13/2013 Page 8

That system must:
5.3.3.1. Allow determining risk level limits for the entire entity and, where applicable, assigning limits for individual portfolios, activities and business units.
Interest rate risk limits may:

be set based on specific scenarios of market rate variations;
be defined as increases or decreases of a predetermined magnitude;
be based on measures derived from statistical distributions of interest rates, such as Value at Risk (VaR) techniques.
The variations used in setting these limits must represent significant stress situations, taking into account historical volatilities and the time required to manage exposures;
5.3.3.2. Ensure that positions exceeding certain levels receive adequate attention from the corresponding unit or person responsible for the analysis of this risk.
To this end, there must be a clear policy establishing:
whether limits may be exceeded under certain circumstances -clearly specified and authorized-, during a brief period of time;
how to inform Senior Management at the moment such excesses occur; and
the actions to be taken by the responsible unit or person in these cases;
5.3.3.3. Allow monitoring of the risk assumed and comparison with the established risk tolerance level.
5.3.4. Monitoring and reporting of interest rate risk.
An information system must be developed that allows communicating the interest rate risk profile to management levels and that ensures compliance with the policies approved by the Board of Directors.
Reports with risk measurements must be made periodically and allow comparing the current degree of interest rate risk exposure with the limits established in the financial entity's policies. Additionally, forecasts made in the past must be compared with observed results to identify defects in prediction models. GUIDELINES FOR RISK MANAGEMENT B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 9

Likewise, the Board of Directors must receive reports on interest rate risk exposure that include, at minimum:
5.3.4.1. Summaries of the entity's aggregate exposures;
5.3.4.2. Information demonstrating compliance with the entity's policies and limits;
5.3.4.3. Main assumptions;
5.3.4.4. Summaries of the results of reviews of risk policies, procedures and the adequacy of risk measurement systems, including the results of internal auditors.
5.3.5. Control of interest rate risk.
Financial institutions must have adequate internal controls to ensure the integrity of their interest rate risk management processes. This, as part of the entity's internal control system.
These internal controls must promote effective and efficient operations, periodic and reliable financial reports and be adequate to the legal framework, current regulations and institutional policies.
Likewise, they must identify any significant change that may affect the effectiveness of controls and ensure that the relevant area or person performs adequate monitoring of any excesses that may arise.
An effective internal control system includes:
5.3.5.1. Effective control of the context;
5.3.5.2. An adequate process to identify and evaluate risk;
5.3.5.3. Control policies, procedures and methodologies -for example, approval processes, exposure limits and reviews-;
5.3.5.4. Adequate information systems;
5.3.5.5. Periodic evaluations and reviews that ensure established procedures and policies are followed;
5.3.5.6. Reviews of the interest rate risk measurement system that include the evaluation of assumptions, parameters and methodologies used.
Such reviews must allow understanding, testing and documenting current measurement processes, as well as evaluating the reasonableness of the system and recommending solutions for identified weaknesses.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 10

In cases where measurement systems include the systems or processes of one or more subsidiaries, the review must prove that their systems are integrated and consistent with each other in their critical aspects.
The results of this review, as well as improvement proposals, must be reported to Senior Management and/or the Board of Directors so that they can act in a timely and appropriate manner.
Entities, particularly those with complex risk exposures, must be subject to an independent review process -for example, through an internal auditor- for their risk assessment, monitoring, control and mitigation functions and written reports must be available to the Superintendency of Financial and Exchange Institutions.
5.3.6. Stress tests.
Entities must regularly perform tests for different stress scenarios related to specific variables of the entity or the market -individually and in combination-, both short and long term.
Stress tests must allow entities to analyze the effect of stress scenarios, both on the consolidated position of the group and on the individual position of the entity and its business lines.
The extent and frequency of the tests must be proportional to the size of the entity and its exposure to interest rate risk, as well as its systemic importance in the market in which it operates and the nature and complexity of its operations. Entities must incorporate the results of stress tests into their contingency plans and use them to adjust their interest rate management strategies and policies, develop actions that limit exposure and prepare effective contingency plans. Possible stress scenarios may include:
5.3.6.1. Abrupt changes in:
i) The general level of interest rates; ii) The relationships between the main market rates; iii) The slope and shape of the yield curve; iv) Liquidity in the main financial markets; and v) The volatility of market rates.
5.3.6.2. Conditions under which the main business assumptions and parameters are altered.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 11

Entities, when performing stress tests, must especially consider:

instruments or markets with high concentration, since such positions may be more difficult to liquidate in such situations;
illiquid instruments or those with uncertain contractual maturities, in order to achieve a better understanding of the risk profile.
Entities must consider scenarios involving the most adverse cases, in addition to the most probable ones.
5.3.7. Contingency planning.
Entities must have a contingency plan that clearly establishes the strategy to face emergency situations.
The contingency plan must:
5.3.7.1. Contain policies to manage a range of possible stress situations and establish clear lines of responsibility along with adequate procedures for each level of situation. The plan must be periodically verified and updated to ensure it is operationally effective and consistent;
5.3.7.2. Be proportional to the size of the entity, its risk profile and its importance in the financial system and the nature and complexity of its operations;
5.3.7.3. Contemplate different time horizons;
5.3.7.4. Prepare the entity to handle a range of severe stress scenarios, considering the diversified menu of options so that Senior Management has a view of potentially available contingent measures;
5.3.7.5. Contain clear policies and procedures that allow Senior Management to make timely and well-informed decisions and communicate their implementation effectively and efficiently.
5.4. Transparency.
Entities must periodically disclose, through their Internet pages or reports:
5.4.1. Information that allows market participants to evaluate the soundness of the interest rate risk management framework and its exposure to interest rate risk;
5.4.2. A description of the system implemented to manage interest rate risk, its structure, the roles and responsibilities of the relevant committees on the subject, as well as the different functions, units and businesses;
5.4.3. Qualitative information that enables market participants to understand how they manage interest rate risk.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 5. Interest rate risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 12

Financial institutions must implement a framework to manage operational risk as an integral discipline separate from other risks, which must be proportional to the dimensions of the entity and the complexity of its operations and adequate to its risk profile.
6.1. Concepts.
6.1.1. Operational risk.
Operational risk is understood -a concept that includes legal risk and excludes strategic and reputational risk- as the risk of losses resulting from lack of adequacy or failures in internal processes, from the actions of personnel or systems, or those that are the product of external events. Legal risk, which may occur endogenously or exogenously to the financial entity, includes, among other aspects, exposure to sanctions, penalties or other economic and other consequences for non-compliance with regulations and contractual obligations. Strategic risk is understood as that arising from an inadequate business strategy or an adverse change in the forecasts, parameters, objectives and other functions that support that strategy. Each entity may adopt, at its discretion, a broader definition of operational risk, adapting it to its reality and needs, provided that, at minimum, the concepts contemplated above are included.
6.1.2. Operational risk management.
Operational risk management is understood as the identification, evaluation, monitoring, control and mitigation of this risk.
Financial institutions must evaluate their vulnerability to events, in order to better understand their operational risk profile and, where applicable, adopt the pertinent corrective policy measures.
The operational risk management framework comprises the policies, practices, procedures and structures that the financial entity has for its adequate management, and must also allow it to evaluate capital adequacy. The framework must cover the entity's operational risk appetite and tolerance -which must be established in the management policies for this risk-, including the degree and manner in which this risk is transferred outside the entity.
6.1.3. Loss events.
The exhaustive list of categories is indicated below -for the purposes of these provisions- for the classification of loss events derived from operational risk, including some examples of the concepts that would make up each of them:
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 1

6.1.3.1. Internal fraud: false information on positions -own or clients'-, theft by employees, use of confidential information of the financial entity for the employee's benefit, etc.
6.1.3.2. External fraud: theft, forgery, damage from intrusion into computer systems, etc.
6.1.3.3. Employment relations and workplace safety: employee claims for compensation, violations of labor safety and hygiene regulations, discrimination, general liabilities, etc.
6.1.3.4. Practices with clients, products and businesses: abuse of confidential information about the client, fraudulent trading in the financial entity's accounts, money laundering, sale of unauthorized products, etc.
6.1.3.5. Damage to physical assets derived from: acts of terrorism and vandalism, earthquakes, fires, floods, etc.
6.1.3.6. Alterations in activity and technological failures: "hardware" or "software" failures, telecommunications problems, interruption in the provision of public services, etc.
6.1.3.7. Execution, management and compliance with process deadlines: errors in data entry, failures in collateral administration, incomplete legal documentation, granting unauthorized access to client accounts, litigation with suppliers, etc.
The same loss event may not be recorded in more than one of the categories mentioned above.
6.2. Responsibilities.
It will correspond to each entity to implement efficient operational risk administration, considering the guidelines set forth below and taking into account the dimensions of the entity and the complexity of its operations.
The Board of Directors, Senior Management and the unit in charge of operational risk management or responsible person, must demonstrate a high degree of commitment tending to maintain a solid operational risk management culture in which activities related to that risk form part of the daily processes of the financial entity.
6.2.1. Board of Directors.
The Board of Directors will be responsible for ensuring that the entity has an adequate strategy for operational risk management, for the operational risk assumed by the entity and for the manner in which it is managed. To this end, it must:
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 2

6.2.1.1. Approve the framework to be used for operational risk management, whose minimum review frequency will be annual or whenever, in the entity's judgment, relevant facts or situations related to this risk occur, which must be brought to the attention of the Superintendency of Financial and Exchange Institutions;
6.2.1.2. Have clear knowledge of the procedures developed to manage operational risk and their degree of compliance. To this end, it must receive, at minimum semi-annually, sufficient information that allows analyzing the general operational risk profile of the financial entity and verifying the strategic and substantial implications for its activity;
6.2.1.3. Ensure that the operational risk management framework is subject to an internal audit process -an area that will not be responsible for its management- that contemplates adequate coverage and depth of reviews and the timely adoption of corrective measures by the audited areas;
6.2.1.4. Approve policies for the dissemination of the operational risk management framework and training, aimed at all areas and officials of the financial entity;
6.2.1.5. Establish policies for the management of operational risks derived from outsourced activities and services provided by suppliers;
6.2.1.6. Approve a policy for the dissemination to third parties of the corresponding information on the operational risk management framework. The content of said information and its characteristics will be proportional to the volume, complexity and risk profile of the financial entity's operations;
6.2.1.7. Guarantee that the entity has technically qualified personnel, as well as the necessary resources for operational risk management; and
6.2.1.8. Verify that those in charge of that management -Operational Risk Unit or responsible person, in accordance with point 6.2.4.- do not perform other tasks in areas that may generate conflicts of interest with their function.
6.2.2. Senior Management.
6.2.2.1. It will be responsible for the implementation, reporting and control of the processes and procedures for the implementation and operation of the management framework approved by the entity's Board of Directors. That framework will be applied consistently throughout the financial entity, and all levels of the organization must understand their responsibilities with respect to the administration of this risk.
6.2.2.2. It will be responsible for ensuring that there are processes and procedures applicable to each business unit, aimed at the operational risk management of the financial entity's products, activities, processes and systems.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 3

6.2.2.3. It must establish clear lines of authority, responsibility and communication with the different managements to foster and maintain the assumption of responsibilities.
6.2.2.4. It will ensure the existence of sufficient resources for the performance of effective operational risk management.
6.2.2.5. It must evaluate whether the management oversight process adapts to the risks inherent in the policies of each business unit.
6.2.2.6. It will receive reports from the Operational Risk Unit or responsible person and, where applicable, from the functional level with decision-making capacity in risk management matters on which that unit or person depends, related to the results of the execution of processes and procedures, the detection of possible deficiencies that occur in the operational risk management policies, processes and procedures and the pertinent proposals for their correction.
The financial entity will establish the frequency of said reports in accordance with its size, the nature and complexity of its products and processes and the magnitude of its operations.
6.2.2.7. It will inform the Board of Directors, at minimum semi-annually, on the main aspects related to operational risk management.
6.2.3. Managements.
The managements will be responsible for applying, in the different business units -according to their scope of competence- the specific processes and procedures in accordance with the framework defined for operational risk management, and must ensure that both procedures and controls are adequate and effective in the scope in which they are applied. Likewise, they will inform the Operational Risk Unit or responsible person about the results of the execution of processes and procedures, with the frequency that the financial entity establishes in accordance with its size, the nature and complexity of its products and processes and the magnitude of its operations.
6.2.4. Operational Risk Unit or responsible person.
The structure of the unit in charge of operational risk management will contemplate the following characteristics:
6.2.4.1. It will be adapted to the size of the entity, the nature and complexity of its products and processes and the magnitude of its operations;
6.2.4.2. It must functionally depend on the General Management -or equivalent authority- or on a functional level with decision-making capacity in risk management matters that reports to that Management;
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 4

6.2.4.3. It may not be in charge of internal audit, an area that nevertheless may contribute its knowledge for the development of the operational risk management framework and for the constant improvement of its administration;
6.2.4.4. It may involve personnel from other areas provided that the assigned responsibilities do not imply conflicts of interest based on the respective incumbencies;
6.2.4.5. There will be independence between the unit or person responsible for operational risk management and the business units involved, as well as a clear delimitation of functions, responsibilities and job profiles at all levels;
6.2.4.6. It must articulate the main processes that the financial entity needs to manage operational risk, adopting the mechanisms that allow effective communication, interaction and coordination with those responsible for the other risks -that the entity has according to its definitions and the requirements of the Central Bank of the Argentine Republic- and those responsible for contracting external services;
6.2.4.7. It will receive from the Managements reports with the results of the execution of processes and procedures, with the frequency that the financial entity establishes in accordance with its size, the nature and complexity of its products and processes and the magnitude of its operations;
6.2.4.8. It will inform the General Management or, where applicable, the functional level with decision-making capacity in risk management matters on which it depends, of the detection of possible deficiencies that occur in the application of operational risk management policies, processes and procedures and the pertinent proposals for their correction, with the frequency that the financial entity establishes in accordance with its size, the nature and complexity of its products and processes and the magnitude of its operations.
6.3. Operational risk management process.
Effective management of this risk will contribute to preventing future losses derived from operational events. Consequently, financial institutions must manage the operational risk inherent in their relevant products, activities, processes and systems; additionally, prior to a launch or presentation of new products, start of activities, implementation of processes or systems, they must also verify that their inherent operational risk is adequately evaluated. The operational risk management process will comprise the stages described below.
6.3.1. Identification and evaluation.
GUIDELINES FOR RISK MANAGEMENT
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 5

For the identification of operational risk, internal factors - such as the structure of the financial institution and the nature of its activities - and external factors - such as changes in the sector and technological advances - that could affect the development of processes and negatively influence the projections made in accordance with the business strategies defined by the financial institution shall be taken into account.

Financial institutions shall use internal data, and must establish a process to systematically record and document the frequency, severity, categories and other relevant aspects of operational risk loss events.

The recording of these events will contribute to reducing incidents, losses and improving the quality of service and products.

The data collection process must be accompanied by an incentive policy that encourages their registration, thereby promoting an organizational culture for reporting such data and controls that contribute to verifying their consistency and integrity.

Among the tools that institutions must use to identify and evaluate their operational risks, the following may be highlighted:

6.3.1.1. Operational risk self-assessment: internal process that involves the use of checklists or working groups to identify strengths and weaknesses of the operational risk environment;

6.3.1.2. Risk assignment - or "risk mapping" -: allows grouping by type of risk the different business units, organizational functions or processes; and

6.3.1.3. Risk indicators: parameters - such as the number of failed operations, staff turnover rates and the frequency and/or severity of errors - defined and measured periodically by financial institutions. These indicators must reflect the potential sources of operational risk, such as accelerated expansion, the launch of new products, staff turnover, interruptions in operations or systems, etc.

6.3.2. Monitoring.

Financial institutions must have an effective monitoring process in order to facilitate the rapid detection and correction of possible deficiencies that occur in their operational risk management policies, processes and procedures. This process must be inserted into the usual activities of the financial institution.

In addition to monitoring operational loss events, financial institutions must verify the evolution of indicators in order to reformulate them based on the nature of the loss events that occurred.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 6

The unit or person responsible for operational risk management must send to the General Manager - or equivalent authority - or, where appropriate, to the functional level with decision-making capacity in risk management matters on which it depends, with the frequency that the financial institution establishes according to its size, the nature and complexity of its products and processes and the magnitude of its operations, reports linked to the results of the monitoring carried out and the pertinent proposals for correction in the processes and procedures.

The aforementioned reports, once analyzed by the General Management and the pertinent corrections approved, shall be distributed among the corresponding management levels and the areas of the financial institution that could be affected, so that they adopt these corrective measures to ensure effective operational risk management.

6.3.3. Control and mitigation.

Institutions must establish control processes and procedures and have a framework that ensures compliance with internal policies, reexamining with a minimum annual frequency the strategies for control and reduction of operational risks, and must make the adjustments that may be appropriate.

In order to reduce exposure to significant operational risks, risk coverage tools or programs such as insurance policies may be used, which must be used as a complement to the internal control measures adopted for those risks, but will not be considered substitutes for operational risk management.

The Board of Directors, the General Manager and, where appropriate, the functional level with decision-making capacity in risk management matters on which the Operational Risk Unit or responsible person depends, must demonstrate a high degree of commitment tending to maintain a solid internal control culture, in which activities related to operational risk control form part of the daily processes of the financial institution.

Financial institutions must have contingency and business continuity plans, in accordance with the size and complexity of their operations, that ensure the continuation of their operational capacity and the reduction of losses in the event of interruption of activity. To this end, they must identify their most critical processes - including those dependent on third parties - and alternative mechanisms, in order to resume service in the event of interruption.

Institutions must periodically verify the effectiveness of their recovery and business continuity plans through testing, verifying that they are in accordance with operations and business strategies.

In relation to aspects linked to information technology, the rules on "Minimum requirements for management, implementation and control of risks related to information technology, information systems and associated resources for financial institutions" shall apply.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 6. Operational risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 7

7.1 General considerations.

7.1.1. Securitizations constitute an alternative source of financing and a mechanism for transferring risks to investors. However, securitization activities and the rapid innovation of the techniques and instruments used also generate new risks that include:

i) Credit, market, liquidity, concentration, legal and reputational risks from retained or invested securitization positions, including - among others - liquidity facilities and credit enhancements granted; and

ii) The credit risk of the exposures underlying the securitization.

Therefore, in risk management, all securitization positions must be taken into consideration - including those not recorded in the balance sheet, whether or not they are recorded in memorandum accounts - for the purposes of approving new products, monitoring limits to avoid concentrations and estimating market, credit and operational risks.

7.1.2. Due to the risks arising from securitization activities and the rapid innovation of the techniques and instruments used, regulatory capital may be insufficient. Therefore - without prejudice to observing the minimum capital requirement - financial institutions must evaluate the economic fundamentals of their securitization positions and consider, for the calculation of economic capital, among others, the following aspects:

i) Maturity mismatches between the underlying exposures and the retained securitization positions, avoiding structuring operations with the objective of reducing capital needs in an artificial manner; and

ii) The correlation existing between the assets of the securitized portfolio and its effect on the calculation of economic capital.

If deemed necessary, the Superintendency of Financial and Exchange Institutions may deny or reduce the reduction of the capital requirement - in the case of assets originated by the institution - or, in the case of acquired securitization positions, require an increase in the capital requirement.

7.1.3. Securitization operations may be used for purposes other than the transfer of credit risk, such as a source of funding. In such cases, if the Superintendency of Financial and Exchange Institutions considers that the risk transfer is insufficient or non-existent, it may require more capital than that arising from the rules on "Minimum capital of financial institutions" or deny the reduction of the capital requirement obtained from securitizations.

The retention or repurchase of securitization positions may - depending on the proportion of risk retained by the originating financial institution - limit the transfer of credit risk commonly pursued by a securitization. Therefore, at least a significant part of the credit risk and the nominal value of the set of exposures must be transferred to an independent third party. For their part, positions purchased to create market must be resold within an adequate period of time, so as to respect the initial objective of transferring risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitization risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 1

7.2. Securitization risk management process.

In order to adequately manage this risk, financial institutions must:

7.2.1. Include securitization positions in the institution's MIS, so that Senior Management understands their consequences on liquidity, results, risk concentration and economic capital. Specifically, the institution must establish the necessary processes to capture in a timely manner updated information on securitization transactions, including market data, if available, and updated data on the performance of securitization operations provided by the trustee.

7.2.2. Permanently analyze - not only at the time of acquisition - the underlying risks when investing in structured products. To do this, they must have quantitative tools, valuation models and stress tests adequate to evaluate the relevant risks in a reliable manner.

7.2.3. Ensure, when evaluating securitization positions, that they know the credit quality and risk characteristics of the underlying exposures, including risk concentrations. Additionally, they must analyze the term of the underlying exposures and their relationship with the liabilities issued in order to evaluate potential maturity mismatches.

7.2.4. Analyze the credit risk represented by securitizations at the level of each transaction and line of business, as well as comprehensively, in order to generate reliable risk measures at the aggregate level. Also, analyze the significant concentrations that could originate in securitizations related to individual debtors, products and economic sectors and consider that information in the risk aggregation system at the institution level - for example, allowing the exposure with an individual debtor to be aggregated across all products and activities of the institution -.

7.2.5. Base the evaluation of risks on a thorough understanding of the securitization structure, identifying the different types of trigger clauses, credit events and other clauses that may affect the securitization positions, integrating that information into the institution's risk management processes.

7.2.6. Consider the market value of retained securitization positions and those being structured, regardless of the probability that they will actually be securitized. Likewise, as part of their stress tests, the institution must consider scenarios that prevent securitizing said assets - such as a general market disruption - and identify the potential effects on its liquidity, earnings and solvency.

7.2.7. Develop contingency plans, specifying how they would respond to pressures, particularly on funding and capital, that could arise from reduced access to securitization markets. Contingency plans must also consider how to address difficulties in valuing potentially illiquid positions held in the trading portfolio.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitization risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 2

7.2.8. Incorporate risk measures, stress test results and contingency plans into risk management processes and the internal capital adequacy assessment process.

7.2.9. Determine which risks to mitigate, whether the hedging techniques used are effective and their potential effects, so that risk is not underestimated when evaluating capital adequacy. In particular, they must consider whether in a stress scenario they would be willing to provide support to securitization structures due to their dependence on these structures as a source of funding.

7.2.10. Consider changes in the characteristics of securitizations, their impact on the calculation of regulatory/economic capital and how they can affect the degree of credit risk transfer.

7.3. Operations related to securitizations.

7.3.1. Support to a securitization

Support to a securitization, whether contractual or non-contractual in nature - implicit credit support -, may take various forms.

Contractual support may include, among others, an underlying asset that exceeds the amount of the issue ("overcollateralization"), spread accounts, contractual recourse obligations, retention of the most subordinated tranche, the provision of credit risk hedges - such as credit derivatives -, the subordination of commission or interest income or the deferral of financial margin, as well as clean-up call options that exceed 10% of the original value of the underlying portfolio or of the securities issued.

Implicit credit support may consist of the purchase of exposures belonging to the underlying portfolio whose credit risk is deteriorating, the sale to said portfolio of exposures at a price below market, the purchase of underlying exposures at a price above market or the increase in the first loss position in proportion to the deterioration of the underlying exposures.

7.3.1.1. Implicit credit support.

Institutions must give special importance to the implicit support provided to traditional securitization structures, since it implies not observing the operational requirements for the recognition of risk transfer that allow excluding the exposures subject to securitization from the computation of risk-weighted assets for the purposes of minimum capital requirement calculations.

By providing implicit support, institutions provide signals to the market that the risk has not been transferred in practice.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitization risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 3

The Superintendency of Financial and Exchange Institutions will verify whether the financial institution has provided implicit credit support, in which case it will take timely measures so that the minimum capital requirement that the financial institution must integrate does not underestimate the real risk to which it is exposed.

Until it reaches a conclusion on the facts investigated, the Superintendency of Financial and Exchange Institutions may resolve that the institution not apply the treatment provided for securitizations in the "Minimum capital of financial institutions" rule and thus not obtain a reduction in capital requirements with respect to future securitization operations. This, with the objective of modifying the institution's conduct with respect to the implicit support it provides and correcting existing market perceptions about the institution's willingness to provide support in the future beyond its contractual obligations.

If it is detected that the institution has provided implicit credit support on more than one occasion, the financial institution must publicly disclose it and the Superintendency of Financial and Exchange Institutions will adopt the pertinent measures, among which are:

i) Prevent it from obtaining favorable capital treatment with respect to securitized assets for a period of time to be determined;

ii) Require it to maintain capital with respect to all assets that have been securitized - as if it had generated a commitment to them - applying a conversion factor to the risk weighting of the underlying assets;

iii) Require, for the purposes of calculating the capital requirement, that it treat all securitized assets as if they remained on the institution's balance sheet;

iv) Require it to maintain regulatory capital higher than the minimum capital ratios based on risk.

Furthermore, when it is detected that an institution has granted implicit credit support to a securitization, the institution must observe the provisions of point 3.6.5.2. of Section 3. of the rules on "Minimum capital of financial institutions".

7.3.2. Exercise of options.

7.3.2.1. In order to obtain the reduction in the requirement provided for in the rules on "Minimum capital of financial institutions", institutions must refrain from exercising the clauses that allow them to prematurely repurchase a securitization operation or waive credit protection, if doing so increases their exposure to losses or deteriorates the credit quality of the underlying positions.

Furthermore, institutions must only exercise a clean-up call option for economic reasons related to the administration of these lines of business, such as that the cost of administering the underlying credit exposures is greater than the benefits obtained from managing them.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitization risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 4

7.3.2.2. Early repurchase options cannot be exercised during the term of the duration or weighted average life of the exposures underlying the securitization. Consequently, when financial institutions set the date of the first possible exercise of the option, they must contemplate a prudent period of time taking into account, in addition, that the initial costs of a securitization in the capital market are unrecoverable.

7.3.3. Early amortization.

Financial institutions must:

7.3.3.1. Calculate, monitor and internally manage the risks associated with securitizations of revolving exposures, evaluating for this purpose the risk that these securitization positions must be amortized early.

7.3.3.2. Ensure that - at a minimum - reasonable methods have been established to allocate economic capital to address the credit risk from securitizations whose underlying exposures are of a revolving nature.

7.3.3.3. Have capital and liquidity plans that contemplate the probability that amortization will be early and how to address the implications derived from amortizations, both scheduled and early.

7.3.3.4. Contemplate, in the contingency plan for capital, the possibility of having to face higher capital requirements by virtue of the requirement established by the rules on "Minimum capital of financial institutions" for securitizations with early amortization clauses.

7.3.3.5. Understand, monitor and manage the levels of excess spread, given that most early amortization clauses enter into force from a certain level of said spread. Among the factors that affect the aforementioned excess spread and that the originating financial institution must consider include:

i) The payment of interest by debtors for the underlying credits;

ii) Other concepts that debtors of the underlying portfolio must pay - such as penalties for late payment and fees for cash advances -;

iii) The amortization of the asset underlying the securitization;

iv) Gross amounts of credits written off;

v) Recoveries of loans written off;

vi) Macroeconomic factors - such as interest rates and the unemployment rate -.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitization risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 5

7.3.3.6. Consider the impact that changes in portfolio management or business strategies may have on the levels of excess spread and on the probability of early amortisation occurring -for example, changes in marketing strategies or in underwriting procedures, which result in lower financial income or higher loans written off, can also reduce excess spread levels and increase the probability of early amortisation occurring-.

7.3.3.7. Use techniques -such as static cash collection analysis and stress tests- to better understand how the underlying portfolio operates and to identify potentially adverse trends and effects. They must also have policies that respond promptly to adverse or unforeseen changes.
If the Superintendency of Financial and Exchange Institutions considers that these policies are not adequate, it may adopt measures such as requiring the entity to obtain an exclusive liquidity line or raising the credit conversion factor for early amortisation (CCF) provided for in the rules on "Minimum Capital of Financial Institutions". Although excess spread constitutes a loss-absorption mechanism in a securitisation, it is not -by itself- a guarantee of the proper functioning of the underlying pool of exposures. Under certain circumstances this level may be reduced rapidly, not allowing timely warning of the deterioration of the underlying credit, and therefore it does not necessarily constitute a timely and reliable indicator of the deterioration of the credit quality of the underlying exposures. In other cases excess spread may be well above the trigger level of the amortisation clause but, at the same time, show a high degree of volatility. Moreover, that level may fluctuate for reasons unrelated to the underlying credit risk, such as mismatches in the frequency with which financial income is repriced relative to the cost of funding. Therefore, entities must pay special attention to the management and control of the risk of securitisations with early amortisation clauses. The sophistication of the system used by a financial institution to estimate the probability of occurrence and the risks of early amortisation must be commensurate with the size and complexity of the entity's securitisation activities that involve early amortisation clauses. In the case of controlled amortisations, the entity must be able to demonstrate how it determines the minimum amortisation period to repay 90% of the outstanding balance at the beginning of that period. When the Superintendency of Financial and Exchange Institutions considers that this process is not adequate, it may adopt measures such as increasing the CCF, either for a particular transaction or for a type of transaction.

7.4. Residual risks.
Entities must assess whether the credit protection they recognise in respect of exposure to a securitisation is adequate, especially in the case of protection in respect of first-loss securitisation positions, in which the protection buyer retains the expected loss through the price. If the Superintendency of Financial and Exchange Institutions determines that it is inadequate to recognise the aforementioned protection, it may raise the capital requirement both for a particular transaction and for a type of transaction.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitisation risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 6

7.5. Transparency.
Financial institutions must make known to the public -on a regular basis- through their web pages or reports:
7.5.1. Information that allows market participants to assess the soundness of the securitisation risk management process and their exposure to securitisation risk;
7.5.2. A description of the process implemented to manage securitisation risk, its structure, and the roles and responsibilities of the units related to the matter;
7.5.3. Qualitative information that enables market participants to know how they manage securitisation risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 7. Securitisation risk management.
Version: 2nd. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 7

8.1. Concepts.
8.1.1. For the purposes of these guidelines, risk concentration is understood as exposures or groups of exposures with similar characteristics -such as corresponding to the same debtor, counterparty or guarantor, geographic area, economic sector or being covered by the same type of asset as collateral-, with the possibility of generating:
8.1.1.1. Losses significant enough -with respect to results, regulatory capital, assets or the overall level of risk- to affect the soundness of the financial institution or its ability to maintain its main operations; or
8.1.1.2. A significant change in the entity's risk profile.
8.1.2. Risk concentrations may occur in assets, liabilities and off-balance-sheet items;
8.1.3. Credit risk concentrations are generally the most significant in financial institutions and are due to common or correlated risk factors that, in periods of stress, may produce an adverse effect on the solvency of debtors, counterparties and/or guarantors. For this reason, concentration risk is present both in direct exposures to debtors and counterparties and in exposures to credit protection providers.

8.2. Situations that may give rise to risk concentrations.
Among them are:
8.2.1. Exposures with the same debtor or counterparty or with a group of related debtors and counterparties;
8.2.2. Exposures in the same geographic region, industry or economic sector;
8.2.3. Indirect credit exposures arising from the same credit risk coverage, such as guarantees and credit derivatives obtained from the same credit protection provider.
Entities must establish systematic procedures to identify situations in which -due to common factors other than systematic risk- there is a high correlation between the solvency of the protection provider and that of the obligors in the underlying exposures;
8.2.4. Exposures in the trading book;
8.2.5. Sources of funding;
8.2.6. Off-balance-sheet exposures -such as liquidity lines, guarantees granted and other commitments- agreed with the same counterparty.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 8. Concentration risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 1

8.3. Framework for concentration risk management.
8.3.1. The framework for concentration risk management includes the strategy, policies, practices, procedures and organisational structure that financial institutions must have for the adequate administration of that risk.
That framework used by the entity to manage risk concentrations must be clearly documented and include a definition of the risk concentrations relevant to the entity, as well as the method of calculating those concentrations and their corresponding limits, which must be established in relation to capital, total assets or, where adequate measurements exist, the overall risk level of the financial institution.
8.3.2. Entities must:
8.3.2.1 Implement policies, systems and internal controls capable of identifying, assessing, monitoring, controlling and mitigating their risk concentrations in a timely manner. Those policies must cover the different forms that risk concentrations to which the entity may be exposed present.
8.3.2.2. Consider -within the framework of their ICAAP- explicitly the level reached by their concentrations and, where necessary, establish an appropriate level of capital for those concentrations.
8.3.2.3. Establish procedures that allow communicating to the Board and Senior Management in which area of the organisation the risk concentrations are located.
8.3.2.4. Establish effective concentration risk mitigation strategies that have the approval of Senior Management. This may include changes in business strategies, reduction of limits or increases in capital backing.

8.4. Concentration risk management process.
Financial institutions must:
8.4.1. Proactively manage and assess concentration risk.
8.4.2. Periodically bring exposures to concentration risk to the attention of the Board and Senior Management.
8.4.3. Analyse risk concentrations at an individual and consolidated level, since a risk concentration in a branch or subsidiary that is inadequately managed may affect the viability of that subsidiary, even if the concentration is insignificant at a consolidated level.
8.4.4. Consider concentrations, measured in respect of a single risk factor or a set of highly correlated risk factors, comprehensively in the assessment of overall risk exposure.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 8. Concentration risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 2

8.4.5. Consider traditional concentrations as well as those arising from correlations between the different risk factors.
8.4.6. Identify and aggregate exposures to similar risks throughout the organisation, including subsidiaries, the different types of assets -such as loans and structured products-, risk areas -such as the trading book- and geographic regions, through their risk management processes and the information system ("MIS").
8.4.7. Identify and understand the risk concentrations present across different business lines and types of exposure, such as those produced by debtors with a high level of credit risk, trusts and transactions in the process of being securitised, and activities linked to the trading book.
8.4.8. Assess concentration risk through various techniques, which must include, where appropriate, the performance of stress tests at the level of the whole organisation and of the business lines and the use of capital measurement models.
8.4.9. Measure concentrations in order to identify and respond to changes that may occur in market conditions and that could adversely affect the entity's results and its level of capitalisation, such as the potential accumulation of concentrations under stressed market conditions.
8.4.10. Assess scenarios that consider possible concentrations arising from computable items not recorded in the balance sheet ("off-balance-sheet items"). The scenarios must also combine a potential accumulation of exposures being processed together with the loss of market liquidity and a significant decline in asset values.
8.4.11. Measure the concentrations identified in various ways, such as the consideration of gross versus net exposures, the use of notional amounts, and the analysis of exposures with and without counterparty hedges.
8.4.12. Establish internal limits on the concentration positions to which it is exposed.
8.4.13. Consider the possible concentrations that could arise as a result of the use of risk mitigation techniques.

8.5. Stress tests. Responsibilities.
The Board is responsible for:
8.5.1. Ensuring that stress tests are performed periodically and that they contemplate concentration risk.
8.5.2. Analysing the results of the stress tests and taking the necessary corrective measures when the results of those tests show potential levels of concentration that put the entity's liquidity or solvency at risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 8. Concentration risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 3

8.6. Transparency.
Financial institutions must make known to the public -on a regular basis- through their web pages or reports:
8.6.1. Information that allows market participants to assess the soundness of the concentration risk management process and their exposure to concentration risk;
8.6.2. A description of the framework implemented to manage concentration risk, its structure, and the roles and responsibilities of the units related to the matter;
8.6.3. Qualitative information that enables market participants to know how they manage concentration risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 8. Concentration risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 4

9.1. Concepts.
9.1.1. For the purposes of these guidelines, reputational risk is defined as that which is associated with a negative perception of the financial institution on the part of clients, counterparties, shareholders, investors, debt holders, market analysts and other relevant market participants that adversely affects the financial institution's ability to maintain existing business relationships or establish new ones and to continue accessing sources of funding -such as in the interbank or securitisation market-.
9.1.2. Reputational risk may also affect the entity's liabilities, because public confidence and the entity's ability to raise funds are strongly linked to its reputation.
In order to avoid damage to its reputation, a financial institution may redeem certain liabilities, even though this may deteriorate its liquidity profile, particularly in the case of liabilities that make up regulatory capital -such as instruments included in additional tier 1 capital (CAn1) or in complementary net equity (PNc), in accordance with the rules on "Minimum Capital of Financial Institutions"-.
9.1.3. Reputational risk may lead a financial institution to grant implicit support, incurring credit, liquidity, market and legal risks, with possible negative effects on its results, liquidity and regulatory capital.
This support may occur:
i) In the case of securitisations of which the financial institution is the originator, whether because it promoted them or because it originated the credit exposures underlying the trust. ii) When the entity is involved in the management of assets or funds, particularly when it controls or promotes the issuer of the financial instruments that it then places among its clients. In the event that the price of those instruments has not been determined correctly or that the main risks have not been adequately disclosed, the promoting entity may later consider it necessary to respond to its clients, even covering their losses. iii) When the entity promotes mutual investment funds or other types of funds, backing the value of the units even though it is not contractually obliged to do so. Unlike what occurs with a contractual credit exposure, such as in the case of guarantees, implicit support -that is, any direct or indirect credit support that it provides and that does not result from its contractual obligations- is a more uncertain form of exposure because it is not documented. Nevertheless, it may also expose the entity to losses -such as those arising from the deterioration in the credit quality of the underlying assets of a securitisation-.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 9. Reputational risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 1

9.2. Reputational risk management process.
In order to carry out adequate management of this risk, the financial institution must:
9.2.1. Identify potential sources of reputational risk to which the entity is exposed, including its business lines, liabilities, transactions with subsidiaries, securitisations it has originated -in particular, for the implicit support it may have provided- and the markets in which it operates.
9.2.2. Take reputational risk into account in its ICAAP and in its liquidity contingency plans.
9.2.3. Implement policies that allow identifying sources of reputational risk in the event that the entity enters new markets or develops new products or activities.
9.2.4. Incorporate reputational risk into stress testing procedures, so that Senior Management fully understands the direct consequences and feedback effects that may be generated by that risk.
9.2.5. Pay particular attention to the effects of reputational risk on its overall liquidity position, taking into account possible increases in its assets and restrictions on its funding. This is because the deterioration of the financial institution's reputation may lead to the loss of confidence of its counterparties.
9.2.6. Measure, once the potential exposures that may arise from reputational events have been identified, the amount of support that the entity should provide or the losses it could experience under stress.
9.2.7. Incorporate the remaining risks identified into the entity's risk management processes.
9.2.8. Develop methodologies to measure as precisely as possible the effects of reputational risk in terms of other types of risk to which the entity could be exposed, including reputational risk scenarios in its regular stress tests in order to avoid adverse reputational effects and maintain market confidence.
9.2.9. Assess whether the minimum capital requirement for securitisation positions and off-balance-sheet items not associated with such programmes is sufficient and whether it contemplates the potential negative effect of implicit support.

9.3. Transparency.
Financial institutions must make known to the public -on a regular basis- through their web pages or reports:

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 9. Reputational risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 2

9.3.1. Information that allows market participants to assess the soundness of the reputational risk management process;
9.3.2. A description of the process implemented to manage reputational risk, its structure, and the roles and responsibilities of the units related to the matter;
9.3.3. Qualitative information that enables market participants to know how they manage reputational risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 9. Reputational risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 3

10.1 Concept.
For the purposes of these guidelines, strategic risk is understood as the risk arising from an inadequate business strategy or from an adverse change in the forecasts, parameters, objectives and other functions that support that strategy. Despite the complexity of its estimation, entities must develop new management techniques that cover all related aspects.

10.2. Strategic risk management process.
In order to carry out adequate management of this risk, the financial institution must:
10.2.1. Consider the strategic approach, the business plan and future capital requirements when assessing the risk-based capital adequacy objective.
10.2.2. Clearly include in the strategic plan what the desired level and capital needs are, and what the available external sources of capital are, given that the analysis of current and future capital requirements in relation to the entity's strategic objectives is an essential element of the planning process.

10.3. Responsibilities.
The Board and Senior Management must:
10.3.1. Consider capital planning as a fundamental element for achieving the financial institution's strategic objectives.
10.3.2. Become involved -given its strategic importance- in the stress testing programmes, in the definition of both the objectives of the tests and the scenarios, in the discussion of the results and in the definition of corrective actions.
The results of the stress tests must contribute to adopting strategic decisions and to fostering internal debate about fundamental issues of the entity, such as the form and speed with which new capital can be obtained, its cost and the associated risks, as well as how to sell or hedge risk positions.

10.4. Transparency.
Financial institutions must make known to the public -on a regular basis- through their web pages or reports:
10.4.1. Information that allows market participants to assess the soundness of the strategic risk management process;

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 10. Strategic risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 1

10.4.2. A description of the process implemented to manage strategic risk, its structure, and the roles and responsibilities of the units related to the matter;
10.4.3. Qualitative information that enables market participants to know how they manage strategic risk.

RISK MANAGEMENT GUIDELINES
B.C.R.A. IN FINANCIAL INSTITUTIONS
Section 10. Strategic risk management.
Version: 1st. COMMUNICATION "A" 5398 Effective date:
13/02/2013 Page 2

11.1. Concepts.
A stress test is generally defined as the assessment of the financial position of an entity under a severely adverse but possible scenario. For the purposes of these guidelines, this term will be used to refer not only to the mechanisms by which individual tests are applied but also to the environment in which those tests are developed, evaluated and used in the decision-making process of the entities. Stress tests complement other management tools and have a particularly important role in order to:
11.1.1. Provide a forward-looking assessment of risk;
11.1.2. Overcome the limitations of models and historical data;
11.1.3. Support external and internal communication;
11.1.4. Establish capital and liquidity planning procedures;
11.1.5. Assist in setting risk tolerance levels;
11.1.6. Facilitate the development of contingency and risk mitigation plans across a range of possible stress situations.
Stress tests, as part of a comprehensive approach, play a very important role in strengthening both the corporate governance of entities and their resilience and that of the financial system as a whole.
The guidelines provided in these provisions are intended to help and reinforce the entities' own efforts and do not constitute merely a list of requirements to be met. They must be applied with a criterion of proportionality, taking into account the size of the entities, the nature and complexity of their operations, and their risk exposure and systemic importance.
11.2. Guidelines.
11.2.1. Use and integration in risk management.
11.2.1.1. Stress tests must be an integral part of the corporate governance and risk management culture of the entities. Their results must influence the decision-making of the corresponding management level, including the strategic business decisions of the Board of Directors and Senior Management, since they may reveal vulnerabilities that are costly to resolve, for which both instances must be involved in the programs of those tests.
The Board of Directors is responsible for the stress testing program, while Senior Management is responsible for its implementation, administration and supervision.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 1

The grounds justifying the particular choices as well as their main implications must be explained and documented, so that the Board of Directors and Senior Management are aware of the limitations entailed by the stress tests performed. Senior Management must understand the effect of stress events on the entity's risk profile and participate both in the identification of potential stress scenarios and in the formulation of risk mitigation strategies. For these purposes, it must consider an adequate number of scenarios relevant to the entity, documented and sufficiently severe. Among other aspects, the scenarios must consider the possibility that solvent entities find it difficult to raise funds at reasonable costs. Stress tests must be used in making a series of decisions, in particular, to establish the risk tolerance of the entities, set limits and define the long-term business plan. Likewise, they must be considered in planning capital and liquidity levels.
11.2.1.2. Stress testing programs must promote the identification and control of risks, provide a risk perspective complementary to that of other tools, improve capital and liquidity management and internal and external communication.
A stress testing program is an integrated strategy to achieve various purposes that requires the use of a series of techniques, there being no particular one to achieve all objectives.
Stress tests, in order to promote the identification and control of risks, must:
i) Be considered in risk administration at different levels of the organization. This includes their use for the management of debtors and individual and group operations; for portfolio management, to adjust the business strategy of the entities and in particular, to evaluate present or potential concentrations at the entity level; ii) Provide a risk perspective complementary to and independent of other management tools -such as, for example, Value at Risk or VaR- and be able to provide information on the validity of statistical models; iii) Be used to evaluate the soundness of models against possible changes in the economic and financial situation and the risk characteristics of new products -which have not been subject to stress periods and/or for which limited historical information is available-; RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 2

iv) Be an integral part of the ICAAP. This requires the entity to perform rigorous and forward-looking stress tests that identify severely adverse events or changes in market conditions that may negatively affect the entity, analyzing the evolution of the capital requirement and the availability of funding sources in those scenarios. In addition, capital adequacy under stress conditions must be evaluated against a series of capital objectives, such as the minimum capital requirement and alternative capital ratios defined by the entity. v) Be a central tool in the identification, evaluation and control of funding liquidity risks, in particular to evaluate the liquidity profile of the entities and the adequacy of liquidity buffers in the case of stress events, both individual and systemic; vi) Play an important role in risk communication within the entity. Unlike a purely statistical model, feasible forward-looking scenarios are more easily accepted, which is why they help in the evaluation of vulnerabilities and the effectiveness of corrective actions; vii) Have an important role in external communication with the Superintendencia de Entidades Financieras y Cambiarias to provide the necessary information in capital adequacy assessments. Entities may also voluntarily disclose their stress test results so that the market can better understand the administration and its risk profile, as well as relevant related information -underlying assumptions and methodologies used- so that interested third parties can form a well-founded opinion on the results of those tests.
11.2.1.3. Stress testing programs must contemplate the vision of different areas of the organization and encompass a set of techniques and perspectives.
The implementation of the stress testing program requires the collaboration of qualified personnel within the entities, whose opinions must be considered, in particular when such tests have scope over the entire entity.
The unit or person responsible for implementing the program must organize the discussion among these experts, question their opinions, verify their consistency and decide on their design and implementation, ensuring an adequate balance between usefulness and precision. Entities must consider multiple perspectives and a series of quantitative and qualitative techniques to support and complement the models, so that the aforementioned programs have a broad scope. RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 3

Likewise, the tests must range from simple sensitivity analyses -from the variation of a particular risk factor-, to more complex exercises that revalue the portfolios considering the interaction of risk factors conditional on the stress event and must be performed regularly but there must also be the possibility of performing them sporadically in response to specific needs. Sensitivity analyses generally seek to evaluate the results when certain parameters or input data are stressed without relating these changes to an underlying event or to results observed in the real world. In some cases it may be convenient to perform a scenario analysis considering several factors simultaneously -historical extreme data and hypothetical extreme values- so that their potential interactions can be verified and it can be evaluated whether the model is working as planned. Entities must carefully evaluate the risks emerging from commitments with securitizations and the possibility that it may be necessary to replenish credits in replacement of underlying exposures in default for reputational reasons. Therefore, in their stress testing program, entities must include scenarios that evaluate the size and soundness of said securitizations in relation to their own financial situation, liquidity and minimum capital position. This analysis must include structural, solvency, liquidity and other risks of those structures, including the effects of contractual provisions such as trigger clauses. Sensitivity and scenario analyses must be developed regularly, given that models can deteriorate and the relationship between variables can change over time.
11.2.1.4. Entities must have written policies and procedures on which the stress testing program is based.
The stress testing program must be appropriately documented, in particular, it must detail:
i) The type of stress test and the main purpose of each element of the program; ii) The frequency of the tests, which will vary according to the type and its purpose; iii) The possibility of also performing them sporadically in response to specific needs -for example, a stress situation-; iv) The methodological details of each element that compose them, including the methodologies used in the definition of the relevant scenarios and the degree of influence of expert opinion; and RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 4

v) The series of planned corrective actions, based on the objective, type and result of the test, including an evaluation of the feasibility of the corrective actions under stress situations.
For each stress exercise, entities must document the assumptions and base data used, including the reasoning and opinions underlying the chosen scenarios and the sensitivity of the results to the variety of scenarios as well as the evaluation of the most important assumptions and their results -regularly or in the face of changes in external conditions-.
11.2.1.5. Entities must have an infrastructure that applies flexible criteria and data of appropriate quality and disaggregation to adapt to different stress tests.
Said infrastructure must allow:
i) Aggregating their exposures to a given risk factor, product or counterparty and modifying the methodologies when necessary to implement new scenarios; and ii) Performing stress tests in response to specific needs, at the level of business lines or the entire entity, to evaluate specific risks in periods of stress.
11.2.1.6. The stress testing system must be updated periodically while the effectiveness of the program and the soundness of its main components must be evaluated regularly and independently.
The evaluation of the soundness of stress tests must include two aspects:
i) Qualitative evaluation, regarding:

the effectiveness of the program in achieving the intended objectives;
documentation;
development tasks;
implementation of the system;
management supervision;
data quality; and
assumptions used.
ii) Quantitative evaluation, which must include comparison with other stress tests, performed inside and outside the entity.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 5

Independent control functions, such as risk management and internal audit, must play an important role in the process since the development and maintenance of stress tests generally involve expert opinions and decisions.
11.2.2. Methodologies and scenario selection.
11.2.2.1. Stress tests must cover a range of risks and business areas, including tests at the level of the entire entity. Entities must effectively integrate stress tests for the various risks -taking into account for this the interrelations between their respective risk factors- to have an estimate of the overall risk profile of the entity.
Stress testing programs must cover risks coherently and comprehensively, taking into account the particularities of the products, business lines and the entity, and examine the effects of eventual alterations considering all relevant risk factors and their interactions. Entities must also use stress tests to identify, evaluate, monitor, control and mitigate risk concentrations in different dimensions as well as to capture potential variations in market conditions that may adversely affect the entities' exposure to those concentrations. For this, the scenario must cover the entire financial entity and be detailed, covering on- and off-balance-sheet risks, regardless of their contractual nature. The effects of stress tests are generally evaluated on one or more measures -among others, the value of assets, results, regulatory or economic capital, risk-weighted assets, the capital requirement and liquidity and funding mismatches-. Their choice will depend on the specific use of the tests, the risks and the portfolios analyzed. Entities must have available at the request of the Superintendencia de Entidades Financieras y Cambiarias a description of the methodology they use to identify and develop the scenarios, as well as the results derived from the simulations performed.
11.2.2.2. Stress testing programs must contain scenarios that consider a spectrum of events and levels of adversity -including forward-looking ones-, considering systemic interactions and feedback effects.
These programs must be administered with flexibility to better identify hidden vulnerabilities, seeking to avoid underestimating the probability and adversity of extreme events.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 6

Stress testing programs must include forward-looking scenarios to incorporate changes in portfolio composition, new information and possible emerging risks not covered when using historical information. The design of those scenarios requires combining the knowledge and judgment of different experts and the opinion of Senior Management. Stress tests must include several time horizons, depending on the risk characteristics of the exposures analyzed and their use. Thus, stress tests for risk management purposes must cover substantially longer time periods than the relevant horizon of management of the target portfolio and the liquidity of the underlying exposures, given that liquidity conditions change rapidly under stress situations. Entities must consider scenarios that imply a recession and evaluate their capacity to react in the medium to long term. They must also incorporate in the stress tests the feedback effects, systemic interactions and specific reactions of the entity itself and of the market.
11.2.2.3. Stress tests must include:

a series of adverse events, including those that may be more significant for financial entities, whether due to the amount of losses or the effects on their reputation;
the most important business areas and the events that may be particularly more adverse for the entities, in terms of significance of losses and damage to their reputation.
Stress testing programs must:
contemplate reverse stress tests, which allow identifying those scenarios that can put the viability of the entity at risk, identify hidden risks and the interactions between risks.
These tests start from a known stress result -non-compliance with the capital requirement, illiquidity or insolvency, among others- and then identify events that could have originated such a fact.
The use of reverse stress tests particularly benefits new products and new markets that have not experienced tensions as well as business lines in which traditional risk management models indicate an exceptionally good risk-return relationship;
include extreme scenarios that could make the entity insolvent.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 7

This type of test can reveal hidden vulnerabilities and inconsistencies in hedging strategies or in other actions.
11.2.2.4 Entities must take into account the pressures that may arise simultaneously in funding sources and asset markets.
Asset and funding markets can be strongly related during periods of stress.
Entities must refine their stress tests considering the important interrelations between various factors, including:

abrupt falls in prices and liquidity in certain asset classes;
possibility of significant losses that deteriorate their solvency;
growth in liquidity needs as a result of commitments assumed;
assets affected as collateral; and
reduced access to funding markets.
11.2.3. Specific areas of interest.
11.2.3.1. The effectiveness of risk mitigation techniques must be systematically evaluated.
Stress tests must facilitate the development of contingency or risk mitigation plans under different stress situations.
The performance of risk mitigation techniques -such as hedges, netting and use of collateral- must be systematically evaluated under stress situations in which markets may not be fully functioning and several entities may be simultaneously applying similar risk mitigation strategies.
11.2.3.2. Stress testing programs must explicitly include complex and tailor-made products, such as securitized exposures.
Stress tests comprising securitized exposures must consider the underlying assets, their exposure to systemic risk factors, contractual arrangements, trigger clauses and the effect of leverage, particularly regarding the degree of subordination in the issuance structure. Stress tests must include all relevant information related to the underlying assets, their dependence on market conditions, complex contractual agreements and effects related to the level of subordination of specific tranches. RISK MANAGEMENT GUIDELINES B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 8

11.2.3.3. Stress testing programs must cover the risks inherent in the structuring of a securitization, such as when the fall in market liquidity forces the assets to be kept on the entity's balance sheet.
Stress tests must include exposures in the process of being securitized, given that many of the associated risks arise when an entity cannot access the securitization market under its own or market stress conditions.
11.2.3.4. Stress testing programs must include the effect of reputation risk and the risks of off-balance-sheet instruments and other related structures.
Stress tests must include non-contractual off-balance-sheet exposures to determine the effect on their credit, liquidity and market risk profile, as part of a process of developing methodologies to quantify the effect of reputation risk on other risks. This, in order to mitigate the effects of a loss of reputation and maintain market confidence. Stress testing programs must include scenarios that evaluate the significance and effects of off-balance-sheet instruments in relation to the financial position of the entities, their liquidity and their capital, seeking to thoroughly evaluate the risks associated with these instruments.
11.2.3.5. Entities must refine their stress tests for highly leveraged counterparties, considering their vulnerability to certain types of assets or to market fluctuations and evaluate the possible correlation between their risk and that of the assets covered by them.
In the case of important alterations in the markets, gross exposures to highly leveraged counterparties could increase significantly.
Particularly, the risk that arises when the credit exposure to a counterparty is negatively correlated with its credit quality must be evaluated.
RISK MANAGEMENT GUIDELINES
B.C.R.A. FOR FINANCIAL INSTITUTIONS
Section 11. Conducting stress tests.
Version: 1st. COMMUNICATION “A” 5398 Effective:
13/02/2013 Page 9

B.C.R.A.

ORIGIN OF THE PROVISIONS INCLUDED IN THE ORDERED TEXT OF THE RULES ON "RISK MANAGEMENT GUIDELINES FOR FINANCIAL INSTITUTIONS"

RISK MANAGEMENT GUIDELINES FOR FINANCIAL INSTITUTIONS

ORDERED TEXT - ORIGIN RULE

Section	Point	Com.	Observations
1.1.		"A" 5203	According to Com. "A" 5398.
1.2.		"A" 5203
1.3.		"A" 5398
1.4.		"A" 5203	According to Com. "A" 5398.
1.
1.5.		"A" 5203	According to Com. "A" 5398.
2.1.		"A" 5203	According to Com. "A" 5398.
2.2.		"A" 5203	According to Com. "A" 5398.
2.3		"A" 5203	According to Com. "A" 5398.
2.4.		"A" 5398
2.5.		"A" 5398
2.6.		"A" 5398
2.
2.7.		"A" 5203	According to Com. "A" 5398.
3.1.		"A" 5203
3.2.		"A" 5203	According to Com. "A" 5398.
3.3.		"A" 5203	According to Com. "A" 5398.
3.
3.4.		"A" 5203
4.1.		"A" 5203	According to Com. "A" 5398.
4.2.		"A" 5203
4.3.		"A" 5203	According to Com. "A" 5398.
4.
4.4.		"A" 5203	According to Com. "A" 5398.
5.1.		"A" 5203	According to Com. "A" 5398.
5.2.		"A" 5203	According to Com. "A" 5398.
5.3.		"A" 5203	According to Com. "A" 5398.
5.
5.4.		"A" 5203
	1°	"A" 4793	According to Com. "A" 5203 and 5398.
6.1.1.		"A" 4793	According to Com. "A" 5203 and 5398.
6.1.2.		"A" 4793	According to Com. "A" 5203 and 5398.
6.1.3.		"A" 4793
6.2.	1°	"A" 4793
	2°	"A" 4793	According to Com. "A" 4854, 5203 and 5398.
6.2.1		"A" 4793	According to Com. "A" 5203 and 5398.
6.2.2		"A" 4793	According to Com. "A" 4854 and 5203.
6.2.3.		"A" 4793	According to Com. "A" 5203 and 5398.
6.2.4.		"A" 4793	According to Com. "A" 4854 and 5203.
6.3.	1°	"A" 4793	According to Com. "A" 5203 and 5398.
6.3.1.		"A" 4793	According to Com. "A" 5398.
6.3.2.		"A" 4793	According to Com. "A" 4854, 5203 and 5398.
6.
6.3.3.		"A" 4793	According to Com. "A" 4854, 5203 and 5398.
7.1.		"A" 5398
7.2.		"A" 5398
7.3.		"A" 5398
7.4.		"A" 5398
7.
7.5.		"A" 5398
8.1.		"A" 5398
8.
8.2.		"A" 5398
8.3.		"A" 5398
8.4.		"A" 5398
8.5.		"A" 5398
8.
8.6.		"A" 5398
9.1.		"A" 5398
9.
9.2.		"A" 5398
9.3.		"A" 5398
10.1.		"A" 5398
10.2.		"A" 5398
10.3.		"A" 5398
10.
10.4.		"A" 5398
11.1.		"A" 5203
11.
11.2.		"A" 5203	According to Com. "A" 5398.

6.1. Basic information.
The review of the commercial portfolio will be carried out on the basis of updated financial information - financial statements and supplementary information, investment projects, etc. - that clients must provide upon request of the entities, applying valid parameters for each sector and considering other circumstances of the economic activity.

6.2. Classification criteria.
The basic evaluation criterion is the debtor's repayment capacity based on the estimated financial flow and, only secondarily, on the basis of the liquidation of the client's assets, since the granting of financing must respond to their true credit needs and be made under amortization conditions consistent with the real repayment possibilities that their activity and generation of funds allow. In this analysis, emphasis will be placed on measuring the degree of exposure recorded in foreign currency based on their indebtedness and generation of income in that currency, as well as with respect to those income and expenses that are linked to the evolution of the Reference Stabilization Coefficient. Regarding clients for financing in foreign currency, whatever the source of funds applied, emphasis should be placed on analyzing whether the client has sufficient payment capacity to cover maturities even in the face of significant variations in the exchange rate. To this end, at least two scenarios must be considered that contemplate significant variations in the exchange rate of different magnitudes within a term of up to one year. In the cases of clients residing abroad, the criteria defined in Section 2 of the rules on "Risk management guidelines for financial institutions" related to "country risk" must also be taken into account. Among other aspects, the following must be considered regarding the country of residence - of the debtor and its guarantor: i) the economic situation; ii) the size and structure of external debt in relation to the economy; iii) the implicit weaknesses in the country's current account and iv) the evaluation of the country's financial history. In the cases of financial institutions, the analysis must take into account the liquidity of the debtor intermediary and the quality of its portfolio.

6.3. Minimum classification periodicity.
The review must be carried out at least with the periodicity indicated below, leaving a record of it in the file of the analyzed client:
6.3.1. In the course of each calendar quarter, with respect to individually considered clients whose financing included at some point are equivalent to 5% or more of the computable equity or the assets of the financial trust of the month prior to the end of said period, depending on whether they are entities or financial trusts, respectively. For these purposes, the group or economic set will be treated as a single client.

DEBTOR CLASSIFICATION B.C.R.A. Section 6. Classification of debtors of the commercial portfolio.

Version: 8th. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 1

DEBTOR CLASSIFICATION

ORDERED TEXT - ORIGIN RULE

Sect.	Point	Com.	Annex	Point	Para.	OBSERVATIONS
5.1.1.1.		"A" 2216	I	I.	1°
		"A" 2216	I	I.	2°
		"A" 2216	I	II.	4°	According to Com. "A" 2410, 4310 (point 1.), 4975 and 5311.
5.1.1.2.	1°	"A" 2216	I	6.	last	According to Com. "A" 2358, 4310 (point 1.), 4975 and 5311.
5.1.1.2.	2°	"A" 2216	I	I.	1°	According to Com. "A" 2410.
5.1.1.2.	last	"A" 2216	I	6.	last	According to Com. "A" 2358.
5.1.2.1.		"A" 2216	I	6.	1°
5.1.2.2.		"A" 2216	I	6.	1°
5.1.2.3.		"A" 4891		6.		According to Com. "A" 4975.
5.
5.1.2.4.		"A" 2216	I	II.	3°	According to Com. "A" 2358, 4310 (point 1.), 4975 and 5311.
6.1.		"A" 2216	I	I.	last
6.2.	1°	"A" 2216	I	I.a.	1°
6.2.	2°	"A" 3918				According to Com. "A" 3987.
6.2.	3°	"A" 4453				According to Com. "A" 4577 and 5398.
6.2.	4°	"A" 5398
6.2.	5°					Incorporates criterion not previously disclosed generally.
6.3.		"A" 2216	I	I.a.	2°
6.3.1.		"A" 2216	I	I.a.	2°, i)	According to Com. "A" 2223 (point 1.) and 3339.
6.3.2.		"A" 2216	I	I.a.	2°, ii)	According to Com. "A" 2223 (point 1.), 3339, 4972 (point 10.) and 5311.
6.3.3.		"A" 2216	I	I.a.	2°, iii)
6.4.	1°	"A" 2216	I	I.b.	1°	According to Com. "A" 3339.
6.4.1.		"A" 2216	I	I.b.	1°, i)	According to Com. "A" 3339.
6.4.2.		"A" 2216	I	I.b.	1°, ii)	According to Com. "A" 3339.
6.4.3.		"A" 2216	I	I.b.	1°, iii)
6.4.4.		"A" 2893		4.
6.4.5.		"A" 3339		unique
6.4.	last	"A" 2216	I	I.b.	last	According to Com. "A" 2223 (point 1.), 3339, 4972 (point 10.) and 5311.
6.5.	1°	"A" 2216	I	I.d.	1°	According to Com. "A" 2440.
6.5.	2°	"A" 4060		10.
6.5.	3°	"A" 2216	I	I.d.	last	According to Com. "A" 3339 and 4972 (point 10.).
6.5.	last	"A" 2216	I	I.d.	last	Includes interpretive clarification.
6.5.1.		"A" 2216	I	I.d.1.		According to Com. "A" 2932 (point 16.) and 3339.
6.5.1.1.		"A" 2216	I	I.d.1.a)		According to Com. "A" 3955.
6.5.1.2.		"A" 2216	I	I.d.1.b)		According to Com. "A" 3339.
6.5.1.3.		"A" 2216	I	I.d.1.c)
6.5.1.4.		"A" 2216	I	I.d.1.d)		According to Com. "A" 2932 (point 5.).
6.5.1.5.		"A" 2216	I	I.d.1.e)
6.5.1.6.		"A" 2216	I	I.d.1.f)		According to Com. "A" 3339.
6.5.1.	last	"A" 2216	I	I.d.1.	last	According to Com. "A" 3339.
6.5.2.		"A" 2216	I	I.d.2.		According to Com. "A" 3339.
		"A" 2216	I	I.d.2.	1°, 2° and 3°	According to Com. "A" 3339.
	i)	"A" 2216	I	I.d.2.a)		According to Com. "A" 3339 and 3955.
	ii)	"A" 2216		I.d.2.b)		According to Com. "A" 3339.
6.
6.5.2.1.
	iii)	"A" 2216	I	I.d.2.c)		According to Com. "A" 3339.

2.2.6. Acquisition of liabilities from clients of the non-financial private sector.
Financial institutions that acquire liabilities from clients of the non-financial private sector at a cost value lower than the contractual value must allocate the difference to a regularization account enabled for such purposes.
In cases where the acquisition value is higher than the contractual value net of the provisions for bad debt risk that would correspond if the general regulations were applied, a provision must be constituted for the resulting difference.
In subsequent months, the aforementioned procedure of calculating minimum provisions on the contractual value - according to the category assigned to the client - and comparing the resulting amount with the net book value (including the regularization account and accounting provisions) will continue to be applied, constituting additional provisions or releasing them as appropriate or, if applicable, decreasing the balance of the aforementioned regularization account. In the case of eventual refinancings that include write-offs, these will be allocated first against the balance of the regularization account and then against the provisions constituted, applying the treatment provided in point 5.3. of Section 5.

2.2.7. Refinancing of debts with capital write-offs.
The minimum provision for bad debt risk to be constituted will be equivalent to the amount resulting from deducting from the provisions required on the debt - without considering the provision corresponding to accrued interest, in accordance with the provisions of point 2.2.2.2. - before its refinancing, the amount corresponding to the write-off made. The resulting provisioning percentage on the refinanced amount will determine the classification level that must be assigned to the debtor based on the ranges of the table contained in point 2.1.1. of Section 2.

2.2.8. Treatment of clients or guarantors residing abroad - "country risk".
In the cases of clients or guarantors residing abroad, financial institutions must evaluate the appropriateness of constituting a specific provision for "country risk" based on the provisions of point 6.2. of Section 6. of the rules on "Debtor classification" and taking into account the criteria defined in Section 2. of the rules on "Risk management guidelines for financial institutions" related to that risk.

2.3. Provisions higher than the minimum.
Entities may make provisions for amounts higher than the minimum established, if they deem it reasonable.
In such cases, it must be kept in mind that the application of percentages corresponding to other subsequent levels will determine the automatic reclassification of the client by assimilation to the quality grade associated with the minimum provision, except in the cases referred to in point 2.2.2. or when dealing with debtors included in the consumer or housing portfolio and commercial assimilable to the latter, in accordance with the provisions of point 7.1. of the rules on "Debtor classification".

MINIMUM PROVISIONS FOR BAD DEBT RISK B.C.R.A. Section 2. Minimum guidelines.

Version: 9th. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 7

2.4. Nature of the provisions.
The provision on the normal portfolio will be of a global nature, while those corresponding to the other categories will have individual imputation, including in both cases those constituted in excess of the minimum requirements established by this Institution.

2.5. Fully provisioned debts of debtors in the "irrecoverable" category.
The debts of clients classified in the "irrecoverable" category and fully provisioned for bad debt risk must be eliminated from assets starting from the seventh month after that in which those circumstances occur and recorded in order accounts as long as the entity continues the collection efforts of its claim. This will also be applicable to the debts of clients classified in the "irrecoverable by technical disposition" category, in case their situation corresponds to placing them in the "irrecoverable" category and they are fully provisioned.

2.6. Requirements of the Superintendency of Financial and Exchange Entities.
Upon requirement made by the Superintendency of Financial and Exchange Entities, financial institutions must constitute provisions for bad debt risk in the percentages established when:
2.6.1. from the analyses of the credit portfolio to verify the correct application of the provisions on debtor classification it arises, in the judgment of that Superintendency, that the provisions constituted are insufficient, according to the procedure provided in point 2.7. of this Section, or
2.6.2. from the elements made available to the acting inspectors it arises that the accounting records made by the entities do not accurately reflect the economic and legal reality of the operations or that actions or artifices have been carried out to distort or disguise the true character or scope of the operations, effective as of the date indicated in each case.

2.7. Procedure for accounting recording of provisions at the requirement of the Superintendency of Financial and Exchange Entities.
For the purposes provided in point 2.6.1. of this Section, the Superintendency of Financial and Exchange Entities will communicate to the entity the amount of the adjustments to be recorded, which will have a period of 30 consecutive days, counted from the day following the date of the pertinent notification, to formulate the considerations that, in its judgment, justify maintaining the criteria applied by it to constitute the observed provisions. Once said period has expired without the entity making a presentation in that sense, the regularization of the insufficient provisions must be reflected accounting-wise in the month in which this circumstance occurs. In case the entity makes that presentation, the Superintendency of Financial and Exchange Entities will rule within the following 20 consecutive days from the date of its receipt. The accounting recording of the provisions resulting from that final determination must be made in the month of the pertinent notification.

MINIMUM PROVISIONS FOR BAD DEBT RISK B.C.R.A. Section 2. Minimum guidelines.

Version: 6th. COMMUNICATION "A" 5398 Effective:
02/13/2013 Page 8

B.C.R.A.

ORIGIN OF THE PROVISIONS INCLUDED IN THE ORDERED TEXT OF THE RULES ON "MINIMUM PROVISIONS FOR BAD DEBT RISK"

ORDERED TEXT	ORIGIN RULE	Observations
Section	Point	Para.	Com.	Annex	Point	Para.
1.1.			"A" 2216		2.	1º
1.2.1.			"A" 2216		2.	1º
1.2.2.			"A" 2216		II	2º	Includes interpretive clarification.
1.2.3.			"A" 2216		II	2º
1.2.4.			"A" 2216		II	3º	According to Com. "A" 3040 (point 3.) and "B" 9074.
1.2.5.			"A" 3040
1.
1.2.6.			"A"3064
2.1.1.	1° and table		"A" 2216		II	1°	Modified by Com. "A" 2440, "A" 3339 and "B" 9074.
2.1.2.1.			"B" 6331			6.
2.1.2.2.			"A" 2826			2°
2.1.2.3.
2.1.2.4.			"A" 2932			7°	Includes interpretive clarification.
2.1.2.5.			"A" 3314
2.2.1.			"A" 2216		II	6º	According to Com. "A" 2932 (point 15.).
2.2.2.			"A" 2216		II	9º and last	According to Com. "A" 3040 (point 5.), includes interpretive clarification. According to Com. "A" 3339, "A" 3955 and "B" 9074.
2.2.3.1.			"A" 2216		II	8°	According to Com. "A" 2442, "A" 3091 and "B" 9074.
2.2.3.2.			"A" 3091
2.2.3.3.			"A" 3091
2.2.3.4.			"A" 2216		II	8°	According to Com. "A" 2442 and "A" 3091.
2.2.4.			"A" 2440		2.	1º	Modified by Com. "A" 2890 (point 2.), 3157 (point 1.) and 3339.
2.2.5.			"A" 3157		2.		According to Com. "A" 3918 and 4055.
2.2.6.			"A" 4060		6.
2.2.7.			"A" 4467
2.2.8.			"A" 5398
2.3.			"A" 2216		II	7º	According to Com. "A" 4683 (point 5.).
2.4.			"A" 2216		II	4º	According to Com. "A" 4738.
2.5.	1º		"A" 2357		1.
2.5.	last						Incorporates criterion not previously disclosed generally.
2.6.			"A" 2287		4.		Modified by Com. "A" 2893 (point 2.).
2.6.1.			"A" 2287		4.		Same as above.
2.6.2.			"A" 2287		4.		Same as above.
			"A" 2607		1.
2.7.			"A" 2893		3.
2.
2.8.			"A" 2893		3.
3.1.	1º		"A" 2373		8. and 3.		Includes interpretive clarification.
3.1.	2º		"A" 2373		8.
3.
3.1.	last		"B" 5902		3.		Includes interpretive clarification.