RESOLUCIÓN Nro. JPRFM-2026-048-T

THE BOARD OF FINANCIAL AND MONETARY POLICY AND REGULATION

WHEREAS:

That, the Constitution of the Republic of Ecuador, in its article 226, prescribes that public servants and persons acting by virtue of a state power shall exercise only the competencies and powers attributed to them in the Constitution and the Law;

That, article 227 ibidem states that the Public Administration constitutes a service to the community that is governed by the principles of effectiveness, quality, hierarchy, coordination, planning, among others;

That, numeral 1 of article 302 of the Magna Carta provides that monetary, credit, exchange and financial policies, among others, have as objectives, to supply the means of payment necessary for the economic system to operate efficiently;

That, the first paragraph of article 303 ut supra determines that the formulation of monetary, credit, exchange and financial policies is the exclusive power of the Executive Branch and shall be implemented through the Central Bank of Ecuador;

That, article 309 of the Constitution of the Republic establishes that the national financial system is composed of the public, private, and popular and solidarity sectors. Each of these sectors shall have specific and differentiated rules and control entities, which shall be responsible for preserving their security, stability, transparency and soundness;

That, article 13 of the Organic Monetary and Financial Code, reformed by the Organic Law Reforming the Organic Monetary and Financial Code, published in the Sixth Supplement of the Official Registry Nro. 142 of 13 October 2025, created the Board of Financial and Monetary Policy and Regulation, part of the Executive Branch, as a body with functional, technical, institutional autonomy, and in its decisions, responsible for the formulation of monetary, credit, financial, securities, insurance and prepaid comprehensive health care services policy and regulation. The Board of Financial and Monetary Policy and Regulation shall be the highest governing body of the Central Bank of Ecuador;

That, article 17 of the referred Code, in its pertinent part, determines that:

"(...) For the fulfillment of these functions, the Board shall issue the rules in the matters proper to its competence, without being able to alter the legal provisions. The Board of Financial and Monetary Policy and Regulation may issue regulations by segments, economic activities and other criteria. It may even reform or repeal regulations of the extinct Board of Monetary Policy and Regulation, Board of Financial Policy and Regulation, or of the Board of Monetary and Financial Policy and Regulation.

Página | 2

All the rules and policies that the Board of Financial and Monetary Policy and Regulation issues in the exercise of its functions, duties and powers shall be supported by duly substantiated technical and legal reports (...)";

That, numerals 2, 6, 10, 12, 13, 14, 15 and 17 of article 18 ibidem establish among the specific functions of the Board of Financial and Monetary Policy and Regulation, in the financial field, the following: issue the regulations necessary to preserve the integrity, soundness, sustainability and stability of the national financial system; regulate the creation, constitution, organization, activities, operation and liquidation of financial entities; issue the prudential regulatory framework to which financial entities shall be subject; issue the non-prudential regulatory framework for all financial entities, which shall include rules on transparency and disclosure of information, market integrity, consumer protection; promote financial inclusion processes and the full exercise of the rights of financial users; establish the system to define the charges for the services provided by financial entities; and, the expenses with third parties derived from active operations incurred by the users of these entities, promoting financial innovation and financial inclusion processes; establish the system to define the commissions that financial entities may charge commercial establishments for the use of the credit card, debit card and other means of similar nature collection service; and, authorize financial entities new activities or operations that, without being prohibited, are necessary for the fulfillment of the objectives of financial policy, respectively;

That, numeral 9 of article 19 of the same Code, establishes among the specific functions of the Board of Financial and Monetary Policy and Regulation, in the monetary field, the following: regulate the central payment system, as well as the regulation, permission, registration, monitoring and supervision of auxiliary payment systems;

That, article 24 of the same Code provides that the acts of the Board of Financial and Monetary Policy and Regulation enjoy the presumption of legality and shall be expressed through resolutions that shall have binding force, which shall govern from their publication in the Official Registry, or from the date of their issuance when the Board so determines, in accordance with the matter;

That, article 25.2 ibidem determines that the Technical Secretariat of the Board of Financial and Monetary Policy and Regulation is exercised by the Central Bank of Ecuador, and article 25.3 establishes as its functions the preparation of technical and legal reports that support the regulatory proposals, provide technical and administrative support to the Board of Financial and Monetary Policy and Regulation and the others that are assigned to it by said Board;

That, article 36 numeral 14 of the Organic Monetary and Financial Code establishes that the Central Bank of Ecuador, among its functions, has that of exercising control over means of payment; and, the oversight and supervision of auxiliary payment systems, promoting efficiency, interoperability and innovations;

Page | 3

That, article 99 of the aforementioned Code determines that means of payment are checks and electronic means of payment, which include transfers for payment or collection, credit, debit, prepaid, rechargeable or non-rechargeable cards, and other technology-centered means of payment, under the terms determined and regulated by the Board of Financial and Monetary Policy and Regulation. Electronic means of payment may be processed through electronic wallets or any other channel established by the Board of Financial and Monetary Policy and Regulation;

That, article 101 of the same Code states that: “Electronic means of payment shall be implemented and operated by the Central Bank of Ecuador; and, issued and operated by the entities of the national financial system and duly qualified participants of the auxiliary payment system, in accordance with the regulations issued by the Board of Financial and Monetary Policy and Regulation and with the authorization granted by the Central Bank of Ecuador, in accordance with international standards on the regulation of electronic means of payment. All transactions carried out with electronic means of payment shall be settled and, where applicable, cleared at the Central Bank of Ecuador, in accordance with the procedures established by the Board of Financial and Monetary Policy and Regulation. The use of electronic, telematic or similar means of payment implemented by the national financial system shall be encouraged, tending to reduce the costs for these and other services and promoting financial inclusion and the interoperability of means of payment”;

That, the first and second paragraphs of article 103 of the aforementioned norm state: “The national payment system comprises the set of policies, norms, instruments, procedures and services through which transfers of resources managed through means of payment and the settlement of values between its different participants are carried out, directly or indirectly. The national payment system is composed of the central payment system and the auxiliary payment systems. The Central Bank of Ecuador shall establish the requirements for authorization, operation, registration and disclosure of information of these systems. The corresponding tariff regime shall be regulated by the Board of Monetary Policy and Regulation (…)”

That, article 105 of the referred Code provides that auxiliary payment systems are the set of policies, norms, instruments, procedures and services articulated and coordinated, public or private, authorized by the Central Bank of Ecuador, which are established to carry out transfers of resources, money remittances or clearing between its different participants;

That, the first paragraph of article 108 ut supra indicates that the Central Bank of Ecuador is the entity that acts as clearer and settler of resources in the central payment system and settler of resources in the auxiliary payment systems. These auxiliary systems,

Page | 4

as well as the entities of the national financial system, shall submit, with the periodicity and in the form determined by the Board of Monetary Policy and Regulation, the detail and results of the clearing processes to be settled;

That, article 109 of the referred Organic Code determines that: “The Central Bank of Ecuador shall carry out the oversight and supervision of the auxiliary payment systems and their managing entities, as well as of any payment or monetary resource transfer infrastructure operating in the market, to ensure the correct functioning of the channels, instruments and means of payment processed through them.

The Board of Monetary Policy and Regulation shall adopt the regulations to determine the operation, governance, risk control and financial requirements that the auxiliary payment systems and their managing agencies must comply with.

The administrators of the auxiliary payment systems, including any payment or monetary resource transfer infrastructure, for their operation must have the authorization of the Central Bank of Ecuador, and shall be obliged to submit the information it requires and within the deadlines it determines (...)”;

That, article 194 of the referred Organic Code determines: “Financial entities may carry out the following operations, in accordance with the authorization granted by the respective control body:

1. Public and private financial sector: (...)

d. Services: (...)

2. Act as issuer or operator of credit cards, debit cards or payment cards; (...)

2. Popular and solidarity financial sector: (...)

d. Act as issuer or operator of debit cards or payment cards. Entities of segment 1 of the popular and solidarity financial sector may issue or operate credit cards; (...)”;

That, article 249 of the Organic Monetary and Financial Code indicates: “In case of loss, misappropriation, robbery or theft of debit, credit, ATM cards, checks or any other instrument having a similar purpose, the entities of the national financial system shall suspend any charge or payment on behalf of their clients, from the time such events are notified, whether in writing, by telephone or by any other means that constitutes evidence, in accordance with the provisions of the law.

The charges or payments made by the financial institution on behalf of its clients, which have not taken into account the notification of loss, misappropriation, robbery or theft, shall be assumed by the institution.

Page | 5

The institution shall additionally assume the responsibilities arising from computer fraud caused by weaknesses or defects in its systems.

The charges or payments made by financial institutions on behalf of their clients attributable to them shall be their own responsibility”;

That, General Provision Twenty-Ninth ibidem states: “In the current legislation where mention is made, indistinctly, of the Monetary and Financial Policy and Regulation Board, the Monetary Policy and Regulation Board; or, of the Financial Policy and Regulation Board, it shall be replaced and understood as "Financial and Monetary Policy and Regulation Board”;

That, the First Transitional Provision of the Organic Law Reforming the Monetary and Financial Organic Code determines that the members of the Financial and Monetary Policy and Regulation Board, sworn in on 16 September 2025 by the National Assembly, shall continue to exercise their functions for the terms for which they were designated and shall maintain their employment continuity and acquired rights;

That, by means of Official Letter No. T.233-SGJ-25-098, dated 5 September 2025, signed by the Constitutional President of the Republic, addressed to the President of the National Assembly, sent the list of candidates for the designation of the Members of the Financial and Monetary Regulation Policy Board; as well as, the duration of their permanence within the initial period;

Whereas, the Plenary of the National Assembly, on 16 September 2025, appointed and swore in the members of the Board of Financial and Monetary Policy and Regulation, namely: Gustavo Estuardo Camacho Dávila; Silvia Daniela Moya Arteta; Roberto Javier Basantes Romero; and, María Isabel Camacho Cárdenas;

Whereas, it is necessary to consolidate and harmonize the regulatory framework applicable to payment cards, in order to establish uniform provisions that respond to the evolution of the payment system and allow the participation of new actors, promoting competition, innovation, interoperability and efficiency in the provision of payment services, to the benefit of users and financial inclusion;

Whereas, the evolution of business models makes it necessary to establish requirements and conditions for the operation of payment aggregation services, with the purpose of fostering a safe environment for users and strengthening the management of risks associated with the activity, contributing to the modernization and development of the payment system;

Whereas, the Board of Financial and Monetary Policy and Regulation, through ordinary session No. 023-2026, held in person, on 06 November 2026, considered the proposal submitted by Memorandum No. BCE-BCE-2026-0515-M, dated 30 October 2026, from the General Manager of the Central Bank of Ecuador to the President of the Board of Monetary Policy and Regulation, as well as the Technical Report No. BCE-GSIMP-2026-047, dated 29 October 2026, and the Legal Report No. BCE-GJ-020-2026, dated 30 October 2026; and,

Page | 6

In exercise of its functions and in accordance with article 24 of the Organic Monetary and Financial Code, the Board of Financial and Monetary Policy and Regulation,

RESOLVES:

Article 1.- Repeal Chapter III "Rules governing credit, debit and payment card operations issued and/or operated by financial entities under the control of the Superintendency of Banks", Title II "National Financial System", Book I "Monetary and Financial System" of the "Codification of Monetary, Financial, Securities and Insurance Resolutions".

Article 2.- Repeal Section X "Rule governing the definition and actions comprising the issuance and operation of credit, debit, payment and prepaid cards for the Popular and Solidarity Financial Sector", Chapter XXXVI "Popular and Solidarity Financial Sector", Title II "National Financial System", Book I "Monetary and Financial System" of the "Codification of Monetary, Financial, Securities and Insurance Resolutions".

Article 3.- Incorporate following Title IV "Comprehensive Cancer Care", Book V "Rules of common application for regulated sectors" of the Codification of Monetary, Financial, Securities and Insurance Resolutions, the following Title text:

"TITLE V

"RULE GOVERNING THE OPERATION OF PAYMENT CARDS IN ECUADOR"

CHAPTER I

PURPOSE AND SCOPE

Article 1. Purpose.- The purpose of this rule is to regulate the issuance, financial and non-financial acquiring, operation, acceptance, processing, clearing, settlement and other operations linked to payment cards, which include credit, debit and reloadable and non-reloadable prepaid cards, in order to guarantee security, transparency, efficiency, interoperability and competition in the National Payment System.

Article 2. Scope of application.- The provisions of this rule are mandatory for all participants in the payment card ecosystem, including issuers, acquirers, affiliated establishments, cardholders, payment aggregators and other participants of the Auxiliary Payment System that intervene in card operations.

The Central Bank of Ecuador shall exercise the functions of control, registration, monitoring and supervision in the operational, technological, security, interoperability and functioning aspects of payment cards, as well as of its supervised entities, without prejudice to the powers of the competent bodies, in accordance with the provisions of current regulations.

Page | 7

Article 3. Operation of payment cards.- The operation of payment cards is understood as the set of technical, commercial, contractual and financial activities that enable the issuance, operation, processing, authorization, clearing and settlement of transactions carried out by means of payment cards. These operations comprise the interaction among the different participants in the system, including issuers, acquirers, affiliated establishments, cardholders, payment aggregators and other participants of the Auxiliary Payment System related to the operation of cards and payment card brands; and they are carried out in accordance with the technical specifications established by the Central Bank of Ecuador.

CHAPTER II

DEFINITIONS

Article 4. Definitions.- For the purposes of this regulation, the following definitions shall be considered:

1. Acquiring: is the service by means of which an authorized entity affiliates commercial establishments for the acceptance of payment cards and processes payments between the merchant and the card-issuing entities.

2. Financial acquirer: banks, savings and credit cooperatives, mutual savings and credit associations for housing, central bank and neobanks, which affiliate commercial establishments for the acceptance of payment cards, incorporated or domiciled in the country and duly authorized by the competent bodies.

3. Non-financial acquirer: non-financial legal person incorporated or domiciled in the country authorized by the Central Bank of Ecuador as a participant of the Auxiliary Payment System to provide the payment card acquiring service, through the affiliation of commercial establishments for the acceptance of such cards.

4. Authentication: process of verifying the identity of the cardholder by means of physical or electronic mechanisms, in order to validate the legitimacy of one of the parties to the transaction.

5. Adaptive multi-factor authentication: mechanism that evaluates, in real time, the risk level of a transaction or of access to a service, considering factors such as the device used, the geographic location, the user's behavior, the transaction amount, the IP address or other risk elements, in order to verify the user's identity and the validity of the use of a payment card.

Página | 8

6. Service charges: refer to the administrative and processing commissions, previously authorized by the Board of Financial and Monetary Policy and Regulation, that issuers apply for the use of payment cards.

7. Transaction receipt: document in physical or electronic format, issued as evidence of the debit or consumption transaction carried out with a debit, credit or prepaid card.

8. Current consumption: capital movements made with the credit card, including any additional card associated with the main card, during the current period, the total value of which must be paid by the maximum date established by the issuer.

9. Deferred consumption: consumption made with the credit card whose payment is agreed in periodic installments, which may include financing interest, which must be informed and accepted by the cardholder at the time of purchase, and must comply with the regulations applicable to the credit operation.

10. Chargeback: process by means of which the issuer of a payment card reverses a previously settled transaction, at the request of the cardholder or on the issuer's own initiative, when it is determined that the operation is improper, fraudulent, unauthorized or does not comply with the payment conditions.

11. Acquiring contract: contract entered into between the authorized financial or non-financial entity and the commercial or service establishment, so that the latter carries out its sales with the different types of cards, through the payment channels previously established with the acquirer.

12. Deferred credit: agreement between the credit card issuer and the affiliated commercial establishment, by means of which the establishment accepts payment under the conditions agreed for the acquisition of a good or service by the cardholder, which may include periodic installments; and that credit line is discounted with the issuer, who administers the credit until its total cancellation; or, an agreement for payment of periodic installments between the cardholder and the issuer who grants a payment facility to the cardholder.

13. Revolving credit: line of credit with predetermined conditions offered by the credit card issuing entity to the cardholder. Disbursements to affiliated commercial establishments are made against the presentation of debit notes and constitute utilization of the line of credit.

14. Credit limit: maximum amount of credit authorized by the credit card issuing entity up to which amount the cardholder may make their purchases,

RESOLUCIÓN Nro. JPRFM-2026-048-T
Página | 9

granted based on the cardholder's payment capacity, and may be adjusted over time based on the payment behavior and risk methodologies of the issuing entity.

15. Issuer: is the financial entity, whether banks, savings and credit cooperatives, mutual savings and credit associations for housing, central bank, Neobanks and digital credit concession entities; and, Specialized Companies for Electronic Deposits and Payments, duly authorized by the competent body, so that they may grant a payment card in favor of a cardholder.

16. Affiliated commercial establishments: natural or legal persons that provide goods or services, and accept payments through payment cards.

17. Cut-off date: date on which the billing period for purchases made with a credit card by the cardholder in a given period is closed.

18. Maximum payment date: deadline determined by the financial institution in the account statement, by which the total payment, the indicated minimum payment, or a partial payment greater than the minimum must be received, so that the cardholder's obligation does not fall into arrears.

19. Physical or virtual payment card formats: modalities of issuance and use of a payment card, whether through a physical medium (physical) or through a virtual representation, which allow the cardholder to carry out payment operations or other authorized transactions through the channels enabled by the issuer.

20. Financing interest: amount resulting from applying the current interest rate to a credit card purchase within the limits established by the Board of Financial and Monetary Policy and Regulation during the calculation period.

21. License: prior authorization granted by the owner of the card brand to the issuing entity, for the use of said brand in accordance with the terms established in the agreement or contract.

22. Card brands: international or national organizations and entities that establish the rules, standards, operating manuals, technical and security parameters governing the use of payment cards under their brand, and that grant licenses to issuers and acquirers to operate in their schemes.

23. Minimum payment: amount defined by the issuing entity and/or operator, to cover the percentage of amortization of current purchases, percentage of revolving balances, deferred installment, taxes, monthly charges and others.

Page | 10

24. Partial payment: voluntary amount paid by the cardholder that is less than the total payment.

25. Grace period: time elapsed between the date of purchase and the maximum payment date, during which purchases made do not generate financing interest nor incur charges and expenses.

26. Reward plans: packages of additional benefits offered by financial institutions or third parties linked to the different types of payment cards, to which the cardholder adheres through their acceptance or express consent, consisting of the accumulation of miles, points, money or another scheme generated as a result of card use for purchases; also involving the redemption or exchange of points, miles, money or others, for goods or services.

27. Bearer: natural person who possesses and uses a non-nominative prepaid card.

28. Overseas benefits: assistance services, insurance and other coverage abroad that are offered by card brands. They do not include cash advances, inquiries and purchases made abroad.

29. Outstanding balance: comprises the amounts of the deferred balance, revolving balance, current purchases, interest, taxes, charges and others.

30. Deferred balance: amounts corresponding to deferred purchases that are paid through periodic installments.

31. Revolving balance: amount pending payment; the same that is generated if the cardholder does not cancel the total payment of the obligations of their card.

32. Overdraft of authorized credit limit or overlimit: extension of credit that an issuing entity authorizes or allows a cardholder to access an amount higher than the available balance, up to the limit established by the entity, generating the obligation that must be notified and expressly accepted by the cardholder prior to its execution.

33. Supervision technologies: use of technological tools and solutions to strengthen, automate and/or improve the processes of supervision, monitoring, risk analysis and verification of regulatory compliance of supervised entities, through the processing and analysis of information.

34. Cardholder: natural or legal person authorized to use the card as a means of payment, whether or not they are the owner thereof, in accordance with the contract signed with the issuer.

Page | 11

35. Charge card: electronic payment method corresponding to the type of credit card in which the holder is obliged to pay the debt to the card issuer in full on the due date.

36. Payment card: electronic payment method, in physical or virtual format, that allows the cardholder to make payments or dispose of credit or funds, and incorporates a unique identifier and security mechanisms. Includes credit, debit and prepaid cards, rechargeable or non-rechargeable.

37. Flexible card: is a payment instrument backed by card brands that simultaneously integrates debit and credit modalities in a single physical or virtual payment card, allowing the user to select the applicable modality for each payment transaction.

38. Credit card: electronic payment method through which a revolving credit line granted by its issuer is available for the acquisition of goods, cash advances and payment of services.

39. Debit card: electronic payment method that allows the cardholder to make payments, withdraw cash, with direct charge to the available funds in the cardholder's demand deposit account or electronic payment account.

40. Prepaid card: electronic payment method, rechargeable or non-rechargeable, which may be nominative or non-nominative, that allows the cardholder or bearer to dispose of previously credited resources for the acquisition of goods, payment of services and cash withdrawal.

41. Nominative prepaid card: payment instrument attributed to a holder electronically associated with their identity from the moment of issuance, on which the cardholder's name may or may not be printed.

42. Non-nominative prepaid card: payment instrument that does not bear the holder's name, nor is it permanently linked to a specific account.

43. Holder: natural or legal person who maintains the contractual relationship with the issuer and in whose name the card is issued.

44. Payment card tokenization: process by which a payment card can be used without exposing the cardholder's real data, generating random identifiers or numerical values (token) that are used in transactions instead of the original data.

45. Card Verification Value (CVV): essential numerical security element designed to verify the physical or virtual possession

Page | 12

of payment cards in the generation of physical or electronic purchases. The CVV may be static or dynamic in nature. In the first case, it is a card verification value that remains unchanged throughout the entire useful life of the payment card. The dynamic CVV is a verification code that changes periodically or that is generated for a single transaction.

CHAPTER III

ON ACQUIRING

SECTION I: ON THE ACTIVITY AND AUTHORIZATION OF FINANCIAL AND NON-FINANCIAL ACQUIRERS

Article 5. Activities and responsibilities.- The acquirer shall be responsible to the participants in the payment card operation system for compliance with the activities listed herein:

1. Enroll commercial establishments for the acceptance of payment cards, following verification of their authorization and economic activity under due diligence and customer knowledge policies, using the acquirer's own tools.

2. Provide the commercial establishment with the infrastructure, devices and access technologies necessary for the use of payment cards, guaranteeing the correct acceptance of payment cards, as well as complying with international security standards and with the technical provisions for technological security in transactions.

3. Process, transmit and settle payment or fund transfer orders to affiliated commercial establishments, in accordance with current technical and security standards, in accordance with the type of payment card, within a term no greater than one (1) day.

4. Acquiring entities must settle the funds from transactions made with payment cards for current consumption within a maximum of five (5) days to affiliated merchants; in the case of deferred consumption, the funds shall be settled within a maximum of five (5) days from the date on which the payment obligation of the installment becomes enforceable for the cardholder.

5. Manage returns, claims, disputes and chargebacks in accordance with applicable regulations and the rules of the corresponding brand.

6. Maintain separate and identifiable accounts with respect to the economic activities they carry out.

Page | 13

7. Send periodic information to the control bodies and to the Central Bank of Ecuador, in accordance with their competencies, on affiliated commercial establishments, processed operations and others determined to be necessary.

Article 6. Registry of acquirers.- The control bodies and the Central Bank of Ecuador shall independently publish an updated registry of the entities authorized to provide the acquiring service, within the scope of their competencies. Prior to the registration of financial and non-financial acquiring, it must have a valid license granted by at least one payment card brand.

Article 7. On the authorization of financial acquirers.- Entities wishing to operate as financial acquirers must have prior authorization granted by the competent bodies, in accordance with the provisions of the Organic Monetary and Financial Code and the regulations defined by the Board of Financial and Monetary Policy and Regulation.

The following may operate as financial acquirers:

a. Public and private banks.

b. Neobanks.

c. Savings and credit cooperatives of Segment 1, mutual savings and credit associations for housing, and central banks for operations with debit, credit and prepaid cards.

d. Savings and credit cooperatives belonging to segments 2 and 3, for operations with debit and prepaid cards.

Article 8. Requirements for the authorization of non-financial acquirers.- Non-financial legal persons that request authorization to operate as acquirers must comply with the following:

1. Corporate purpose: the corporate purpose must be related to payments or transfers.

2. Economic activity: the economic activity registered by the Internal Revenue Service must be related to payments or transfers.

3. Incorporation and minimum capital: be incorporated as corporations or limited liability companies in Ecuador or duly domiciled in the country, with subscribed and paid-in capital equal to or greater than USD 500,000.00 (five hundred thousand United States dollars), which must be fully paid at the time of the authorization request.

4. From the end of the first year of operation, and each subsequent year, acquiring entities must demonstrate that they have subscribed capital

Page | 14

and paid-in capital of at least 5% of the average monthly value of the operations processed and settled in the last fiscal year. Except when the result of this calculation is less than USD 500,000.00, in which case the capital value must be this latter value.

5. Financial soundness: must maintain the funds destined for the settlement of operations to affiliated establishments in segregated accounts in authorized financial entities.

6. Corporate governance: have a board of directors and an organizational structure with functional independence in the areas of risk, audit and compliance, with directors and administrators who meet the suitability and honorability requirements determined by the Central Bank of Ecuador.

7. Technological infrastructure: prove the implementation of processing platforms certified under international security and quality standards, including the Payment Card Industry Data Security Standard (PCI DSS), among other cybersecurity standards and protocols defined by the Central Bank of Ecuador.

8. Operating manual: submit to the Central Bank of Ecuador an Acquiring Operating Manual that describes the policies, procedures and internal controls related to commercial establishments, transaction processing and settlement, chargeback administration and dispute resolution, in compliance with current regulations and the provisions issued by the regulatory body.

9. They must previously hold a valid license granted by at least one payment card brand.

The Central Bank of Ecuador shall verify compliance with the requirements established in this article prior to granting authorization to non-financial acquirers.

SECTION II: ON RELATIONSHIPS WITH COMMERCIAL ESTABLISHMENTS AND THE PROTECTION OF MERCHANTS AND CARDHOLDERS

Article 9. On acquiring contracts.- Contracts entered into between acquirers and merchants must observe the minimum requirements established by the control bodies and the Central Bank of Ecuador, in accordance with their competencies, expressly including: fund delivery periods, applicable commissions and charges, return and chargeback rules, information rights of affiliated commercial establishments and obligations to comply with security standards. Acquirers must provide commercial establishments with a standardized summary of contractual conditions, in clear and understandable language.

Página | 15

Contracts under the responsibility of the commercial establishment must include the obligation to maintain for card payments the same price applicable to cash transactions. Likewise, any offer, promotion, rebate or discount in force for cash payments shall be applicable to card payments.

Compliance with and supervision of the provisions stipulated in this subparagraph corresponds to the competent bodies and consumer protection bodies.

Acquirers are prohibited from including in the contract with the affiliated commercial establishment an exclusivity clause for the use of the payment card or cards offered by the acquirer and issuer.

Article 10. Protection of merchants and cardholders.- In addition to compliance with financial user protection rules, acquirers must guarantee:

a. The delivery of clear and timely receipts to affiliated commercial establishments and cardholders regarding the result of each transaction.

b. The resolution of claims and disputes by the affiliated merchant within the periods and in accordance with the procedures established by applicable regulations.

SECTION III: ON RISK MANAGEMENT AND SUPERVISION OF ACQUIRERS

Article 11. Comprehensive risk management in acquiring.- Acquirers must implement a comprehensive risk management framework, proportional to the nature and volume of their operations, aimed at guaranteeing the continuity and security of the service, which contemplates, at least, the types of risks and criteria indicated in this article, without prejudice to those additional ones determined by the control bodies and the Central Bank of Ecuador, within the scope of their respective competencies:

1. Operational risk:

a. Entities must implement controls to prevent and mitigate losses, errors and interruptions arising from deficiencies or failures in processes, people, systems and third-party services, as well as from external events. These controls must include transaction and fund reconciliation, traceability of operations and incident management.

b. Acquirers must maintain business continuity and disaster recovery plans, supported by a business impact analysis, that identify critical processes and services, their dependencies, those responsible and the recovery time and recovery point objectives.

2. Liquidity risk:

Página | 16

a. Maintenance of segregated accounts for funds destined for merchant settlement to guarantee payments within the established periods.

3. Legal risk:

a. Acquiring and service contracts drafted in accordance with the provisions of the control bodies and the Central Bank of Ecuador, in accordance with their competencies, that clearly delimit rights and obligations between acquirers, merchants and cardholders, that contemplate personal data protection and observance of applicable regulations.

4. Fraud risk:

a. Acquiring entities must manage fraud risk through the implementation of a comprehensive prevention, detection and response framework, in compliance with applicable regulations and the provisions issued by the competent authorities.

5. Information security and cybersecurity risk:

a. Acquiring entities must manage security and cybersecurity risk in line with international best practices, in compliance with the provisions established in the law and other applicable regulations issued by the competent authorities.

6. Systemic risk:

a. Acquiring entities must manage systemic risk through the application of controls that mitigate chain effects and may affect the financial system and the national payment system, in accordance with the provisions of the law and other current regulations.

Article 12. Third-party and critical supplier risk management.- Acquirers must identify, assess, monitor and manage the risks arising from contracting third parties that participate in the provision of services related to acquiring, including processing services, information storage, cloud computing, tokenization, cybersecurity, data centers, customer service or other critical technology services.

The contracting of third parties shall not exempt the acquirer from its responsibility to affiliated commercial establishments, cardholders, payment card brands and competent bodies.

Article 13. Anti-money laundering.- Acquiring entities must comply with the regulations in force regarding the prevention, detection and combating of money laundering and financing of other crimes.

Página | 17

Article 14. Compliance with international standards.- Acquirers must implement and maintain at all times internationally recognized technical and security standards that ensure the integrity, availability and confidentiality of transactions carried out with payment cards, in accordance with the guidelines issued by the competent bodies.

Article 15. Audits.- Compliance with technical and security standards shall be verified through independent external audits, which shall include vulnerability and penetration tests, as required by the control bodies, which may request additional audits and the submission of periodic reports.

Article 16. Incident notification.- Acquirers must immediately notify the control bodies and the Banco Central del Ecuador, as applicable, of any security incident, technological failure or operational event that may affect the integrity of transactions, the availability of services or trust in the payment system, in accordance with the procedures and timeframes established by said institutions.

Article 17. Acceptance of payment cards.- Acquirers must guarantee that the payment acceptance points provided to affiliated establishments, including point-of-sale terminals, applications, devices or electronic channels, allow the acceptance and processing of transactions with payment cards of different brands and issuers, in accordance with the technical standards determined by the control bodies and the Banco Central del Ecuador.

For this purpose, acquirers must ensure that said acceptance points allow the processing of transactions with payment cards or other electronic payment methods, in accordance with the technical and interoperability standards determined by the control bodies and the Banco Central del Ecuador.

Payment aggregators, payment gateways, payment processors and other participants in the auxiliary payment system that intervene in the acceptance, processing, routing or transmission of payment card transactions must, within the scope of the services they provide, ensure that their systems, platforms, applications, devices or technological solutions allow compliance with the obligations set forth in this article and do not generate unjustified technical restrictions for the acceptance of payment cards of different brands and issuers.

The intervention of the participants in the auxiliary payment system referred to in the preceding paragraph does not exempt the acquirer from compliance with the obligations applicable to it with respect to affiliated establishments and the acceptance of payment cards, in accordance with the applicable regulations.

CHAPTER IV

Página | 18

ON THE ISSUANCE OF PAYMENT CARDS

SECTION I: COMMON PROVISIONS FOR PAYMENT CARDS

Article 18. Issuance of payment cards.- It is the process by which an issuer duly authorized by the competent body grants an applicant a payment card, linked to an account or credit line, for the purpose of allowing the applicant to make payments, withdrawals or other financial transactions, in accordance with the terms and conditions established in the respective contract.

This process includes the evaluation and acceptance of the applicant, the assignment of a payment card with its respective conditions of use, as well as the activation, validity period and linkage to a corresponding account or credit line.

Article 19. On issuers.- The following may act as issuers of payment cards:

a. Public and private banking financial entities, with prior authorization from the Superintendencia de Bancos.

b. Financial entities of the popular and solidarity economy, with prior authorization from the Superintendencia de Economía Popular y Solidaria. Only those belonging to segment 1 may act as issuers of credit cards. Likewise, all segments may issue debit cards and prepaid cards.

c. Neobanks and entities for the digital granting of credits, with prior authorization from the Superintendencia de Bancos.

d. Specialized Electronic Deposit and Payment Companies, with prior authorization from the Banco Central del Ecuador. This type of entity may only be an issuer of debit and prepaid cards.

The control bodies and the Banco Central del Ecuador, within the scope of their competences, shall establish the necessary requirements to grant the corresponding authorization. Before granting said authorization, they must verify that the necessary internal processes for the operation of the cards have been implemented, as well as the mechanisms for managing the risks inherent to these products.

Article 20. Issuance format and security conditions.- Payment cards may be issued in physical or virtual format. In any of its modalities, card-issuing entities must comply with the applicable provisions regarding information security, cybersecurity, security in electronic channels, fraud prevention, due diligence and operational risk management.

Physical payment cards must be issued without sensitive data (card number, card expiration date and CVV). Printing with cardholder data

Page | 19

may be carried out only upon the customer's request, without any surcharge, in which case the request will be handled through the channels provided by the Financial Entity.

Issuance must align with recognized international standards, current best practices and their updates, including, as applicable, the Payment Card Industry Data Security Standard (PCI DSS), Adaptive Multifactor Authentication, tokenization, encryption, real-time anti-fraud monitoring and other equivalent mechanisms.

Additionally, based on their risk assessment, entities may implement complementary validation, authentication and fraud mitigation mechanisms for transactions with credit, debit or prepaid cards, including dynamic CVVs, multifactor authentication, biometrics, dynamic transaction limits, temporary credentials or other equivalent controls.

Security measures must be reviewed, evaluated and updated periodically in accordance with technological evolution, emerging threats, identified vulnerabilities and changes in applicable international standards.

Article 21. Special characteristics and modalities.- Issuing entities may offer payment cards whose use may be limited to certain affiliated commercial establishments, in which case they will be considered closed-loop, or allow their generalized use, in which case they will be classified as general circulation. Likewise, they may incorporate additional benefits and/or reward plans linked to agreements entered into between the issuing entity, the brand and third parties.

Additionally, entities must specify, at the time of issuance, whether the card corresponds to a revolving credit card, which allows minimum payment with the consequent generation of a revolving balance, or a charge card, which requires full payment of the current and deferred consumption on the agreed expiration date, in accordance with the definitions established in this regulation.

These characteristics must be duly informed to the cardholder prior to the issuance and signing of the contract or when they are modified.

Article 22. Issuance of flexible cards.- Financial entities that are previously authorized to issue credit and debit cards may grant flexible cards to their customers, subject to a prior risk analysis of the potential cardholder.

Article 23. Issuance of virtual cards.- For regulatory purposes, credit, debit and prepaid cards, as well as the corresponding contracts, issued in virtual format shall have the same legal nature, functionality and validity as those issued in physical format. Consequently, issuing entities may not establish distinctions regarding rights, obligations, security measures, responsibilities

Page | 20

or conditions of use based exclusively on the type of support, except for the specific cases determined in this regulation.

Article 24. Renewal term.- For credit, debit and prepaid cards, the renewal term may not be less than three (3) years nor more than ten (10) years, except with express authorization from the competent body based on the nature of the product, issuance format, risk profile, technological evolution and customer characteristics.

Article 25. Conditions in the promotion of payment cards.- The promotion of payment cards by issuing entities, as well as the corresponding subscription applications, must detail clearly and in a disaggregated manner all charges, fees and other items duly authorized by the Board of Financial and Monetary Policy and Regulation and the competent bodies, expressly identifying the scope of the services offered and any other consideration linked to the product.

In the case of credit cards, the cardholder must also be explicitly informed of the cut-off and payment dates, the accepted payment modalities (minimum, partial or total), as well as the methodology for calculating the interest applicable to financing and default and their rates.

Article 26. Prior acceptance by the customer for the issuance of payment cards.- Issuing entities may not issue payment cards without the prior and express acceptance of the member or customer. The prior acceptance of the member or customer may be through previously authorized physical or electronic mechanisms. If an entity issues and activates a payment card that has not been expressly accepted by the member or customer, it will be considered null and therefore may not generate any cost or charge for the same.

Article 27. Operations in foreign currency.- In consumptions or withdrawals made with debit, credit or prepaid cards in foreign currency, the transaction value will be converted to United States dollars and charged to the cardholder in said currency.

The amount will be converted to said currency using the official exchange rate corresponding to the date on which the consumption from abroad is recorded. This information must appear and be notified to the cardholder in the account statement and in the card's transaction record.

Article 28. Authentication of transactions made with payment cards.- Transactions made with debit, credit or prepaid cards must be subject to adaptive multifactor authentication mechanisms of the customer. The methodology for applying the authentication mechanisms shall be previously approved by the competent bodies.

The authentication process must include at least two different authentication factors that must be applied independently. One of them in the process of

RESOLUCIÓN Nro. JPRFM-2026-048-T
Página | 21

activation and another in the use of payment cards, without prejudice to the issuing entity being able to require additional authentication factors when the level of risk identified so warrants. During the use of the card, the issuing entity may require the concurrent application of two or more authentication factors, depending on the level of risk identified.

In the registration or linking of a payment card in applications, digital platforms or websites, it must be mandatorily authenticated regardless of the amount or type of service, in order to confirm the validity of the enrollment and mitigate the risks inherent to transactions in card-not-present environments. Additionally, all online purchases or payments made on websites that do not require linking the payment card must be authenticated by the issuing entity prior to their execution.

The implementation, enablement and use of the authentication and security mechanisms provided for in this article shall have no cost to the cardholder. The issuing entities are responsible for guaranteeing these security schemes as an integral part of the provision of the financial service, and therefore may not pass on charges for this concept to users.

Article 29. Notifications to the cardholder.- The issuer must notify the

cardholder, simultaneously and in real time, through at least two electronic means independent of each other, so that the unavailability of one of them does not prevent the delivery of the notification through the other, of all monetary and non-monetary transactions, relevant authentication events and critical interactions related to administration, carried out with their payment cards, as well as any change of password and personal data made. This obligation shall not apply to prepaid cards issued "to bearer".

The notifications must include the option for the cardholder to block the payment card immediately in case of not recognizing any of the notified transactions, clearly indicating the available channels to carry out said blocking.

All notifications must be generated and sent to the cardholder by electronic means that comply with information security and cybersecurity measures.

The notifications referred to in this article are an essential component of user security, and therefore must be provided by the issuer at no additional cost to the cardholder.

Article 30. Customer service.- Payment card issuing entities

must establish and make available to cardholders physical or electronic customer service channels. These must be operational permanently twenty-four (24) hours a day and seven (7) days a week and verifiable that allow

Página | 22

to make inquiries, complaints or notify the loss, theft or robbery of payment cards.

The entities must guarantee immediate, permanent, secure and verifiable mechanisms for the blocking, suspension or cancellation of cards, whether at the request of the cardholder or due to risk events detected by their monitoring systems.

It corresponds to the issuer of the payment card to resolve claims by the cardholder. Every request or action related to inquiries, claims, blocking, unblocking, suspension, cancellation, replacement or incident management must generate traceability, record and verifiable evidence, in accordance with information security, cybersecurity and operational risk management standards.

Article 31. Liability.- Payment card issuing entities shall be liable for charges or payments made on behalf of their cardholders in the following cases:

a. Any transaction carried out after the cardholder has notified the loss, misappropriation, robbery or theft of the payment card.

b. Those arising from computer fraud caused by weaknesses or defects in their systems or security.

c. Transactions in which the required adaptive multi-factor authentication or security mechanisms have not been applied and the cardholder has notified the issuer that they were not authorized by them, with the notification of blocking of the payment card.

d. Transactions in which the required adaptive multi-factor authentication or security mechanisms that have been previously approved by the competent bodies have not been applied.

e. Transactions carried out in non-compliance with the information security and cybersecurity provisions issued by the competent body.

In these cases, the issuing entity is obliged to refund the amounts to the cardholder in accordance with the law and the regulations issued by the competent bodies. It shall be the issuer's responsibility to carry out the necessary steps with the acquirers to obtain the information in the refund process. For this purpose, the issuing entity may take out fraud insurance without passing the cost on to the cardholder.

SECTION II: ON THE ISSUANCE AND OPERATION OF DEBIT CARDS

Página | 23

Article 32. Issuance conditions. - The debit card must be linked to a savings, checking, basic account or an electronic payments account, as applicable; and they shall only allow purchases up to the amount of the available balance in said accounts. In no case may this type of card generate overdrafts or grant any credit to the holder of the associated account.

Its issuance shall require the express consent of the account holder. The issuance contract must detail: rights and obligations of cardholders, applicable charges, conditions of use in physical and electronic channels, and complaint mechanisms.

In the case of basic accounts, the issuing entity may configure the account's payment card to serve as a debit card in the network administered by the brand it administers, provided it has the security measures established by the competent body.

The holder of a primary debit card may request the issuance of additional debit cards.

Additionally, they may observe the following:

1. Reward plans and additional benefits: they may be offered provided they do not involve hidden costs or abusive conditions for cardholders.

2. Transactions abroad: transactions in foreign currency must be converted to United States dollars at the official exchange rate in effect on the date of payment abroad, and therefore the surcharge of commissions and other costs not expressly regulated in the Law is prohibited. This must be notified both at the time of the transaction and in the account statement.

Article 33. Operations.- Debit cards shall allow payments and cash withdrawals, up to the amount of the funds available in the account, based on the limits established in current regulations and under the following obligations:

a. Payments and cash withdrawals, up to the amount of the funds available in the account, in accordance with risk models, customer transactional profiles, monitoring mechanisms and fraud prevention policies.

b. Transactions must be reflected in real time, with immediate debit to the account of the payment card holder.

c. The issuer must guarantee the cardholder access to the transaction detail or electronic or physical receipts for each operation, subject to the mechanism through which the transaction was executed.

Page | 24

d. In the case of transactions in foreign currency, the official exchange rate in effect on the date of payment abroad shall apply; the surcharge of commissions and other costs not expressly regulated in the Law is prohibited. This must be notified at the time of the transaction and in the account statement in accordance with current regulations.

Article 34. Risks and mitigation.- Issuers must implement, maintain and make available to the corresponding competent bodies policies, procedures, controls and risk management models proportional to the nature of their operations, at least, the types of risks and criteria indicated in this article, without prejudice to those additional ones determined by the control bodies and the Central Bank of Ecuador, within the scope of their respective competences:

1. Operational risk:

a. Manage operational and technological risk through the implementation, testing and maintenance of controls and mechanisms that guarantee the continuity, integrity and resilience of their operations.

b. Implement and maintain a Business Continuity Plan and a Disaster Recovery Plan, duly documented, approved by senior management or management and periodically updated.

2. Fraud risk:

a. Establish and implement formal procedures for the prevention, detection and management of fraud, including automated real-time monitoring of operations, supported by a risk assessment model that considers variables such as customer profile, amount, frequency, channel used, geographic location and transactional behavior.

3. Money laundering risk:

a. Adopt measures for the prevention of money laundering and terrorist financing and other crimes proportional to the risk of the product.

b. Report unusual transactions to the Financial and Economic Analysis Unit (UAFE).

4. Security and cybersecurity risk:

a. Entities must manage security and cybersecurity risk in line with international best practices, in compliance with the provisions established in the law and other applicable regulations issued by the competent authorities.

Page | 25

b. Guarantee the protection of personal data and the security of transactions through the application of recognized international standards, ensuring the implementation of adequate technical and organizational controls to prevent unauthorized access, alterations, losses or leaks of information.

5. Legal risk:

a. Contracts that avoid abusive clauses.

b. Agile dispute resolution and customer service mechanisms.

SECTION III: ON THE ISSUANCE AND OPERATION OF PREPAID CARDS

Article 35. Issuance conditions.- The issuance and operation of prepaid cards must be subject to the following conditions:

1. Issuance shall always be upon request of the applicant or at the initiative of the issuing entity. The issuing entity shall define the issuance of prepaid cards in closed commercial establishments and consumption in affiliated establishments.

2. The contract must clearly indicate: maximum charge amounts, validity, commissions, conditions of use and complaint mechanisms.

3. The balances of prepaid cards must be backed in segregated accounts in the name of the issuer, as applicable.

4. The holder or bearer shall have the right to request reimbursement in cash or credit to an account of the unused balance.

5. In non-reloadable cards, the issuer must inform the validity and without there being conditions for extinction of the balance.

6. In non-nominative cards, the issuing entity shall require the applicant to maintain a record of the cards and of the bearers to whom they have been initially delivered.

7. Rechargeable cards may only be registered cards. In no case may non-registered rechargeable prepaid cards be issued.

Article 36. Identification of the beneficiary.- Rechargeable prepaid cards must be registered; while non-rechargeable prepaid cards may be issued as registered or non-registered.

Non-rechargeable prepaid cards may be issued "to bearer", provided that the following conditions are met:

1. The applicant must be a member or customer of the entity that issues the prepaid card.

Page | 26

2. The amount loaded onto the prepaid card must be debited from the account or from the credit card limit of the member or applicant customer.

3. The issuing entity must maintain a detailed record of the identification numbers of each prepaid card requested by the applicant and the amounts loaded onto each of them.

Article 37. Limits and controls.- The maximum recharge values, balances and number of cards that may be kept active in the name of the same beneficiary per issuing entity shall be subject to the regulations issued by the corresponding competent body, applying due diligence criteria (KYC, by its acronym in English). Prepaid cards may not be used for purposes other than those provided for in this regulation.

Article 38. Conditions for the issuance and use of prepaid cards.- Cards may be issued without visible information printed on the physical cards.

Non-rechargeable prepaid cards, issued as instruments for use for a limited amount or for exclusive consumption at an issuing establishment or chain, may be issued "to bearer", provided that the maximum balance, conditions of use and validity are previously established and communicated to the customer. In no case may bearer prepaid cards that are rechargeable be issued.

The activation of the prepaid card shall be carried out upon prior request of the applicant.

Article 39. Risks in the operation of prepaid cards and mitigation mechanisms.- Entities issuing prepaid cards must implement and maintain a formal comprehensive risk management system, based on an approach proportional to the risk of the product, which considers its degree of anonymity, transactional limits, distribution channels and user profile. The system must include mechanisms for identification, evaluation, mitigation and permanent monitoring of operational, technological, fraud and money laundering and terrorist financing and other crimes risks. At least the types of risks and criteria indicated in this article must be considered, without prejudice to those additional ones determined by the control bodies and the Central Bank of Ecuador, within the scope of their respective competences:

1. Operational risk:

a. Maintain secure, resilient and duly certified technological platforms under recognized international standards regarding information security and technological services management, ensuring data protection and transaction integrity.

b. Implement and maintain documented business continuity and disaster recovery plans, which guarantee availability and recovery

RESOLUTION No. JPRFM-2026-048-T Page | 27 timely service in the event of interruptions, including periodic testing and the definition of maximum recovery times. c. Prepaid card issuers must guarantee payment to the order in favor of the holders. d. Issuers must guarantee cardholders clear information on recharge conditions, commissions, usage limits and validity of prepaid cards. e. They must enable accessible and effective complaint and dispute resolution channels. 2. Fraud risk: a. Establish customer authentication mechanisms in the issuance, activation and recharge processes depending on the type of prepaid card, especially when carried out through non-face-to-face channels, through the application of adaptive multi-factor authentication mechanisms, according to the risk level of the operation. b. Implement automated real-time transactional monitoring systems, based on risk assessment criteria, which allow identifying, generating alerts and, where appropriate, rejecting unusual, atypical or suspicious operations. c. Have documented procedures for the management, analysis and timely resolution of fraud alerts, including additional customer verification mechanisms. d. The bearer and/or applicant must report the theft or loss of the prepaid card and request the blocking of the available balance. 3. Legal risk: a. Agile dispute resolution and customer service mechanisms. 4. Money laundering and terrorist financing and other crimes risk (ML/TF): a. Apply "Know Your Customer" (KYC) policies in the issuance of registered prepaid cards. b. All operations must be recorded in electronic systems that allow the identification of the holder or cardholder, and of the commercial establishment receiving the funds.

Page | 28

c. Report unusual operations to the Financial and Economic Analysis Unit (UAFE).

Article 40. Record of operations and access to information.- The entity issuing prepaid cards must maintain records of all transactions carried out through said cards, whether rechargeable or non-rechargeable.

Likewise, it must make available to the cardholder the means, mechanisms and channels through which they may check the available balance of the card and carry out transactions. In the case of non-registered prepaid cards, in which the financial entity does not have the identification of the bearer, it must only enable said means, mechanisms and channels, without this implying making them available to a specific person.

Article 41. Availability of funds.- Monetary values loaded onto a prepaid card, whether reloadable or non-reloadable, shall not expire merely by the passage of time, except for express provision established in the terms and conditions of the contract governing the instrument. In this regard, the issuer must guarantee the availability of the balance as long as the contractual relationship remains in force. If the validity period of the prepaid card has expired, the balances shall remain available in favor of the beneficiary and may be claimed from the issuing entity. In the event of inactivity due to lack of use, unclaimed balances must be transferred to the Single Account of the National Treasury, in accordance with the provisions of the Organic Monetary and Financial Code.

SECTION IV: ON THE ISSUANCE AND OPERATION OF CREDIT CARDS

Article 42. Conditions for the issuance and use of credit cards.- Credit cards may only be issued by:

a. Public and private banking financial entities authorized by the Superintendency of Banks;

b. Savings and credit cooperatives of Segment 1, mutual savings and credit associations for housing, and central banks authorized by the Superintendency of Popular and Solidarity Economy;

c. Neobanks and digital credit concession entities, with prior authorization from the Superintendency of Banks.

The issuance of credit cards shall be subject to the following conditions:

1. Express request: the issuance must respond to a prior request and written acceptance by the client. The automatic issuance of unsolicited credit cards is prohibited.

Page | 29

2. Assignment of credit limit and overdraft: subject to prior credit evaluation of the applicant, considering payment capacity, credit history, and other internal methodologies approved by the competent body.

3. Types of credit: entities may offer revolving and deferred credit modalities, in accordance with the provisions of this regulation.

4. Contractual transparency: issuance contracts must clearly and comprehensibly include payment terms, interest rates, commissions, reward plans, overseas benefits, responsibilities of the user and the issuing entity.

5. User protection: the cardholder may terminate the contract at any time, provided there are no outstanding amounts pending payment.

6. Others as defined by the competent body.

Additionally, they must observe the following:

7. Reward plans and additional benefits: they may be offered provided they do not involve hidden costs or abusive conditions for cardholders.

8. Overseas consumption: Transactions in foreign currency must be converted to United States dollars at the official exchange rate in effect on the date of payment abroad; the surcharge of commissions and other costs not expressly regulated by law is prohibited. The exchange rate applied must be notified at the time of consumption and in the account statement.

Article 43. Services associated with credit card issuing entities.- The

credit card issuing entities, in addition to their own financial activities, shall provide services through the issuance, brand licensing, administration, financing, or marketing of credit cards, and shall carry out the following activities:

a. Issue and promote the credit card.

b. Approve credit limits for the use of the credit card by the cardholder.

c. Make collections from cardholders and payments to affiliated commercial establishments.

d. Receive payments from its cardholders for the purpose of settling consumptions made, interest, commissions, and other charges generated by the use thereof.

Page | 30

e. Record the consumptions and payments of cardholders and generate the corresponding account statements.

f. Carry out other activities directly related to its purpose, provided they have prior authorization and are reported to the competent body.

Article 44. Information required to authorize the operation of credit cards.-

Credit card issuing entities, in order to obtain authorization to operate, in addition to the requirements established by the corresponding competent body, shall present the following information:

a. Draft contract to be entered into with the credit card applicant.

b. Draft contract to be entered into with a financial or non-financial acquirer.

c. Format and channels for notifications of cardholder consumptions.

d. Format of the credit cards.

e. Formats of charge slips to be used by affiliated establishments.

f. Formats and channels for delivery of account statements.

Article 45. Requirements for the issuance of credit cards.- The issuing entity

shall receive the pertinent application from the applicant and, prior to entering into the contract, shall carry out the necessary analyses to determine the applicant's payment capacity and define the credit limit.

For this purpose, issuing entities must at least:

a. Have a specific methodology, with technical support to define or approve the credit limit and type of credit assigned to the cardholder, indicating the frequency and adjustment mechanism.

b. Have information from the credit data registry in order to have complementary information for the approval and monitoring process of its cardholders.

Article 46. Personal guarantee for the issuance of credit card.- In the event that the

credit card issuer requests the constitution of a personal guarantee for its issuance, said guarantee may be constituted for up to the term of validity of the card, after which it will be necessary for the guarantor and the entity to ratify it or, in the event that it is denied, the cardholder may constitute new guarantees. In no case shall the guarantee initially constituted be considered tacitly renewed.

Article 47. Interest on revolving and deferred credits.- Issuers of credit

cards may charge interest according to the type of credit granted.

Page | 31

In deferred credits, the collection of interest shall be made based on the conditions agreed with the cardholder at the time of billing with the affiliated commercial establishments. In the case of revolving credits, the interest shall be determined directly by the issuer based on the provisions of this regulation. The interest rate applicable to deferred credits shall be fixed throughout the entire term of the corresponding transaction.

The charging of interest on interest is expressly prohibited and no similar clause may appear in the contract for the issuance of credit cards.

Article 48. Conditions for the calculation, accrual and collection of interest in credit card transactions.- Credit card issuing entities may charge financing interest, including interest on deferred consumer transactions; and, default interest, in accordance with the nature of each transaction and the provisions of this article.

1. Financing interest:

When, by the maximum payment date, the cardholder does not pay the total capital balances corresponding to current purchases or revolving balances, the issuing entity may charge financing interest on:

a. The outstanding capital balance corresponding to current purchases reflected in the last account statement, calculated from the day following the maximum payment date indicated in said account statement.

b. The revolving balance maintained by the cardholder, calculated from the beginning of the billing period corresponding to the last account statement.

To determine the balances subject to financing interest, the payments or credits made by the cardholder shall be considered. When default interest is to be charged, the portion of overdue and unpaid capital subject to such interest shall be excluded from this base.

2. Default interest:

When, after the maximum payment date of the period has passed, the cardholder has not paid at least the amount corresponding to the minimum payment due, the issuing entity may charge default interest exclusively on the portion of overdue and unpaid capital that makes up said minimum payment, calculated from the day following the maximum payment date.

The same portion of capital may not simultaneously generate financing interest and default interest during the same period. In no case shall interest on interest be calculated or charged.

Page | 32

3. Deferred consumer transactions:

Deferred purchases with interest shall generate exclusively the interest expressly agreed with the cardholder at the time of contracting and may not generate additional financing interest.

The number of financial periods shall correspond to the whole number of agreed installments. For the financial structuring of deferred purchases, twelve complete monthly periods per year shall be considered, on an annual basis of three hundred sixty (360) days.

The issuing entity shall structure the payment schedule in accordance with the whole number of installments and the agreed financial periods, so that the financing term is not less than that contracted by the cardholder. No billing methodology, cut-off date or operational mechanism may reduce the effective term with respect to the term offered and contracted.

When the cardholder communicates their intention to make early payments or prepayments of deferred purchases, the issuing entity must apply them to the outstanding capital balance of the corresponding deferred transaction. If after the prepayment a capital balance remains and the transaction was agreed with interest, such interest must be recalculated exclusively on said balance, considering the days actually elapsed up to the date of early payment, on an annual basis of three hundred sixty (360) days.

The interest agreed in deferred consumer transactions shall accrue during each financial period, on the outstanding capital balance at the beginning of said period. Its accounting recognition shall be made in accordance with the accrual principle. Interest corresponding to future periods may not be recognized as income until the period to which it corresponds has elapsed.

4. General calculation rules:

For the determination of the interest provided for in this article, entities must consider the payments or credits made by the cardholder, applying them to the corresponding capital balance.

Financing interest, default interest and interest agreed in deferred consumer transactions shall be calculated on a basis of three hundred sixty (360) days. For such calculation, both the interest rate and the number of days considered for its settlement must be expressed on a basis of three hundred sixty (360) days. Consequently, the number of days used in the numerator and in the denominator of the calculation formula must correspond to a basis of three hundred sixty (360) days.

RESOLUTION No. JPRFM-2026-048-T
Page | 33

The annual basis, the frequency and the number of periods must correspond to the agreed financial conditions. In deferred purchases, each installment shall correspond to a complete financial period and the number of periods shall be equal to the whole number of contracted installments.

Calculation methodologies that use different day bases between the numerator and the denominator may not be used, nor mechanisms that produce results equivalent to a basis different from three hundred sixty (360) days.

In no case shall interest on interest be calculated or charged.

Article 49. Order of priority for the application of payments on credit cards.- The

payment order that credit card issuing entities must apply for credit card payment is as follows: taxes, credit life insurance premium, late payment interest, financing charges, instalments on deferred purchases, capital percentage of the revolving balance (percentage considered in the minimum payment methodology), expenses, current purchases corresponding to the billing month in order from the oldest, and; in the event that there is a payment surplus, it shall be applied to the revolving balance.

Entities authorized to issue and/or operate credit cards shall receive advance payments from their cardholders for the payment of future purchases or early allocation to their deferred purchases, provided that the cardholder indicates so.

Amounts received as advances for future purchases shall be held at the disposal of the credit card holders. In the event that the cardholder has paid an amount greater than the amount owed, they may request the immediate restitution of such amount.

Article 50. Content of the account statement.- The issuing entity shall deliver monthly

to the cardholder the account statement of their credit card through the channels established in the corresponding contract; these channels must have information technology and cybersecurity measures that protect their confidentiality, preventing them from being read by unauthorized third parties.

The account statement shall contain at least the following information:

a. Identification of the issuing entity.

b. Identification of the cardholder, specifying identity card, single taxpayer registry or passport.

c. Encoded credit card number.

d. Issue date or statement closing date.

e. Maximum date for cancellation of charges.

RESOLUCIÓN Nro. JPRFM-2026-048-T
Página | 34

f. Detailed breakdown of charges in national and foreign currency, specifying their date of occurrence, charge slip number, name of the affiliated establishment, and amount, exchange rate, as applicable.

g. Amount of cash advances made.

h. Reconciliation of revolving, deferred balances and charges for the period and definition of the amount to be paid.

i. Authorized, used, available, and over-limit credit line, as applicable.

j. Rewards accumulated based on rewards plans in favor of the cardholder.

k. Specification of any charge or value that the cardholder must pay, defining the frequency of its collection.

l. Determination of the amount of the financing interest and late payment interest, if applicable, indicating the calculation basis and the nominal and effective annual rate applied.

m. Balance owed for the period or previous periods.

n. Warning information to the cardholder indicating that, if the minimum payment is not made by the established maximum payment date, a late payment surcharge will be generated.

o. Warning information to the cardholder indicating that, if only the minimum payment is paid in each period, the term for total repayment of the debt will be extended and the total amount to be paid will increase, due to the application of financing interest on outstanding balances.

p. Contact information for the customer ombudsman.

Article 51. Rewards plans.- The issuing entity may offer its cardholders reward plans; and benefits abroad. The offer of the reward plan shall be communicated to the cardholder by any means. Acceptance by the cardholder must be voluntary and express and shall be conveyed to the entity through a signed communication or by means provided in applicable regulations, by the cardholder, in which the conditions shall be recorded clearly and in detail.

Reward plans may consider, for their operation, aspects related to the use of the credit card, such as purchases made or the payment of a monthly or annual fee, in accordance with the conditions previously informed and accepted by the cardholder.

Page | 35

Any modification to the reward plan must be notified to the cardholder through the means that the latter has provided for such purpose, at least thirty (30) days in advance of its application, in which case the customer may decide whether or not to continue with it.

The redemption or exchange of points, miles, money or others shall not be subject to additional conditions or charges. Any additional and special redemption mechanism shall be duly communicated to users and shall not represent any additional cost for it, except for costs established in the issuance of airline tickets.

In no case shall the acceptance of credit card opening contracts by users be conditioned on the acceptance or non-acceptance of a reward plan or benefits abroad.

Access to reward plans by the cardholder shall be immediate after acceptance of the plan has been made.

Article 52. Assignment of benefits of reward plans.- Holders of credit cards that have their own reward plans have the right to assign the benefits of said plans to another cardholder who has the same type of plan, at no additional cost for the transfer.

Article 53. Withdrawal from the rewards plan.- If a cardholder maintains active reward plans as an additional service of the credit card and decides not to continue with it, they may redeem or exchange their accumulated points, prizes, miles, money or others until they are exhausted or expire, whichever occurs first, with accumulation being suspended as of the date of the communication that the cardholder sends to the entity.

Article 54. Charges for reward and benefit plans abroad.- Charges for reward and benefit plans abroad shall be charged to the primary credit card, regardless of whether the cardholder has additional cards.

Article 55. On the credit life insurance.- The holder may contract a credit life insurance that covers the balances owed by the cardholders. The respective deductible, if applicable, shall be calculated and paid on the outstanding balance the cardholder maintains in their account statement.

The credit life insurance shall cover the entire outstanding balance of the debt up to the date of notification of the claim, and shall become effective when the following events occur:

1. Death of the holder, duly certified by the competent authority.

Página | 36

2. Due to a subsequent disability of fifty percent (50%) or more of the holder; or, due to the holder suffering from a subsequent catastrophic or high-complexity illness, determined by the competent national authority in accordance with the law.

If one of the described and notified events occurs, the issuing or administering entities of the credit cards shall suspend the collection of the outstanding balances and the generation of new expenses, interest and others related to the balances owed as of the date of occurrence of the claim; and shall file the claim for the collection of the credit life insurance with the insurance company, in order to recover said balance.

The coverages, conditions and exclusions of the credit life insurance must be clearly detailed in the respective contract and expressly accepted by the cardholder.

Financial entities may not, without authorization from the beneficiary, require or charge their cardholder, for credit life insurance, any other type of complementary insurance.

If, on the date of occurrence of the events indicated in this article, there are outstanding obligations payable to the insurance company, this shall not constitute grounds for denial of the credit life insurance coverage. The outstanding obligations payable shall be offset against the amount to be paid by the credit life insurance.

Article 56. Unrecognized transactions.- When the cardholder reports an unrecognized transaction, the issuing entity must initiate the corresponding investigation process and apply the claim and chargeback procedures established by current regulations.

Article 57. Risks in the credit card operation and mitigation mechanisms.- Credit card issuing entities must implement comprehensive risk management systems aimed at protecting the integrity of operations, the stability of the entity and the rights of cardholders. At least the types of risks and criteria indicated in this article must be considered, without prejudice to those additional ones determined by the control bodies and the Central Bank of Ecuador, within the scope of their respective competences:

1. Credit risk:

a. Prior evaluation of payment capacity and continuous monitoring of credit behavior.

b. Exposure limits defined and periodically reviewed.

2. Operational risk:

Página | 37

a. Entities must implement controls to prevent and mitigate losses, errors and interruptions arising from deficiencies or failures in processes, people, systems and third-party services, as well as from external events. These controls must include the reconciliation of transactions and funds, the traceability of operations and incident management.

b. Issuers must maintain business continuity and disaster recovery plans, supported by a business impact analysis, that identify critical processes and services, their dependencies, those responsible, and the recovery time and recovery point objectives.

3. Fraud risk:

a. Implement adaptive multi-factor authentication in electronic transactions.

b. Real-time monitoring of transactions and early detection of anomalous patterns.

c. Immediate blocking protocols upon reports of loss, theft or fraud.

4. Legal risk:

a. Contracts that avoid prohibited clauses or clauses that infringe rights.

b. Agile dispute resolution and customer service mechanisms.

5. Money laundering and terrorist financing and other crimes risk (ML/TF):

a. Apply strict due diligence and "know your customer" (KYC) policies.

b. Monitoring and reporting of unusual transactions to the UAFE.

6. Systemic risk:

a. Issuers must manage systemic risk through the application of controls that mitigate chain effects and may affect the financial system, in accordance with the provisions of the Law.

CHAPTER V

ON PAYMENT AGGREGATORS

Article 58. Operating requirements for the payment aggregation service.- Non-financial legal persons that request authorization to operate as payment aggregators must comply, in addition to the general requirements established in current regulations, with the following:

Página | 38

1. Incorporation and minimum capital: be incorporated as corporations or limited liability companies in Ecuador or duly domiciled in the country, with a subscribed and paid-in capital in cash equal to or greater than USD 250,000.00 (two hundred fifty thousand United States dollars), which must be fully paid at the time of the authorization request.

2. Financial soundness: maintain capital of no less than 2% with respect to the average monthly amount of operations processed and settled in the last fiscal year. Except when the result of this calculation is less than USD 250,000.00, in which case the capital value must be this latter value. Additionally, it must maintain the funds destined for the settlement of operations to affiliated establishments in segregated accounts in authorized financial entities.

Article 59. Operational risks of payment aggregators: Payment aggregators must implement a comprehensive risk management framework, proportional to the nature and volume of their operations, aimed at guaranteeing the continuity and security of the service, which contemplates, at least, the types of risks and criteria indicated in this article, without prejudice to those additional ones determined by the control bodies and the Central Bank of Ecuador, within the scope of their respective competencies:

1. Operational risk:

a. Entities must implement controls to prevent and mitigate losses, errors, and interruptions arising from deficiencies or failures in processes, people, systems, and third-party services, as well as from external events. These controls must include the reconciliation of transactions and funds, the traceability of operations, and incident management.

b. Payment aggregators must maintain business continuity and disaster recovery plans, supported by a business impact analysis, that identify critical processes and services, their dependencies, the responsible parties, and the recovery time and recovery point objectives.

2. Liquidity risk:

a. Maintenance of segregated accounts for funds destined for merchant settlement to guarantee payments within the established deadlines.

3. Legal risk:

a. Payment aggregation contracts shall be drafted in accordance with the provisions of the Central Bank of Ecuador, which clearly delimit rights and obligations

Page | 39

among the participants, which contemplate personal data protection and observance of applicable regulations.

4. Fraud risk:

a. Payment aggregators must manage fraud risk through the implementation of a comprehensive prevention, detection, and response framework, in compliance with applicable regulations and the provisions issued by competent authorities.

5. Cybersecurity risk:

a. Payment aggregators must manage cybersecurity risk in compliance with the provisions established in the Law and other applicable regulations issued by competent authorities.

6. Systemic risk:

a. Payment aggregators must manage systemic risk through the application of controls that mitigate chain effects and may affect the financial system, in accordance with the provisions of the Law.

CHAPTER VI

SUPERVISION AND CONTROL

Article 60.- Supervision.- The Central Bank of Ecuador shall exercise oversight of the payment card system and supervision of its participants within the scope of its competencies, and may request information from the superintendencies or participants of the payment card system; issue technical provisions; implement supervision technologies; and coordinate actions with the Superintendencies.

The Superintendencies and the Central Bank of Ecuador, within the scope of their respective competencies, shall exercise supervision and control of the financial products and services related to payment cards offered by the entities subject to their control, in accordance with the regulations in force.

Article 61.- Reports.- Participants in the payment card ecosystem shall submit the information determined by the control bodies and the Central Bank of Ecuador within the scope of their competencies, in the form and at the frequency established by the latter.

GENERAL PROVISIONS

FIRST.- Payment card issuing entities shall send to the control bodies and the Central Bank of Ecuador, within the scope of their competencies, the information requested by them in the frequency and formats established for that purpose.

Page | 40

SECOND.- The use of mechanisms aimed at forcing the individual or mass migration of cards is prohibited, with the exception of technological update processes aimed at improving the security and functionality of the card and prior authorization from the control body and the Central Bank of Ecuador, within the scope of their competencies.

THIRD.- Issuers and acquirers shall have the authorization of the corresponding competent body: Superintendency of Banks, Superintendency of Popular and Solidarity Economy, and/or Central Bank of Ecuador.

FOURTH.- The tariffs currently applicable to services associated with the issuance, administration, use, and acceptance of payment cards shall continue to be applied and shall remain in force until the Financial and Monetary Policy and Regulation Board decides what is appropriate, as the case may be.

FIFTH.- All issuers of debit or prepaid cards shall have sufficient coverage mechanisms to cover their obligations in the Specialized Clearing House of the Central Bank of Ecuador, including bilateral credit lines (BCL).

TRANSITIONAL PROVISIONS

FIRST.- The Superintendency of Banks, the Superintendency of Popular and Solidarity Economy, and the Central Bank of Ecuador shall, within a period of six (6) months, adjust their regulations in order to implement the provisions issued in this regulation.

SECOND.- Participants in the auxiliary payment system authorized by the Central Bank of Ecuador in the payment aggregation service shall have one (1) year from the publication of this regulation to constitute a subscribed and paid-in capital equal to or greater than USD 250,000.00 (two hundred fifty thousand United States dollars)."

Article 4.- The text of item 4 of Article 90 of Chapter II "Of the National Payment System", Title I "Monetary System" of the "Codification of Monetary Policy Resolutions and Operations of the Central Bank of Ecuador issued by the Monetary Policy and Regulation Board" 4, is replaced by the following:

"4. Payment Aggregation.- A service that links merchants in the name of an acquiring entity, through its service and technological infrastructure to accept payment means, collecting in the name of such merchants the proceeds of the settlement of authorized payments, to transfer or credit them to the merchant. The payment aggregator shall enter into the corresponding agreements or contracts, both with the establishments and with the acquiring entities;"

Article 5. - The following item is incorporated after item 7 of Article 166 of Section 13 "Auxiliary Payment System", Chapter II "Of the National Payment System", Title I "Monetary System" of the "Codification of Monetary Policy Resolutions and Operations of the Central Bank of Ecuador issued by the Monetary Policy and Regulation Board":

Page | 41

"8.- Non-financial acquiring;"

SOLE GENERAL PROVISION.- The Superintendency of Banks, the Superintendency of Popular and Solidarity Economy, and the Central Bank of Ecuador, within the scope of their respective competencies, shall bring the content of this resolution to the attention of the entities under their control and supervision.

FINAL PROVISION.- This resolution shall enter into force from its issuance, without prejudice to its publication in the Official Register.

The General Secretariat of the Central Bank of Ecuador is entrusted with its publication on the institutional website, the updating of the "Codification of Monetary, Financial, Securities and Insurance Resolutions" and of the "Codification of Monetary Policy Resolutions and Operations of the Central Bank of Ecuador issued by the Monetary Policy and Regulation Board".

COMMUNICATE AND PUBLISH.- Given in the city of Quito D.M., on 06 November 2026.

THE PRESIDENT

Mgs. Gustavo Estuardo Camacho Dávila

The resolution above was provided and signed by Magíster Gustavo Estuardo Camacho Dávila - President of the Financial and Monetary Policy and Regulation Board, in the city of Quito D.M., on 06 November 2026.- I CERTIFY.

TECHNICAL SECRETARIAT

Abg. Ninoska Geovanna Ceballos Pin