SBS Resolution N° 2108-2011: Establishes Basic Savings Account Characteristics for Greater Financial Inclusion, Modifies Money Laundering and Terrorist Financing Norms and Regulations Approved by Resolutions S

1 Lima, February 16, 2011

S.B.S. Resolution N° 2108-2011

The Superintendent of Banking, Insurance and Private Pension Fund Administrators

CONSIDERING: That, through SBS Resolution Nº 838-2008 and its amendments, the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing are established; That, through SBS Resolution N° 1765-2005 and its amendments, the provisions of the Regulation on Information Transparency and Provisions Applicable to Contracting with Users of the Financial System are established; That, through SBS Resolution Nº 775-2008 and its amendments, the provisions of the Regulation on Opening, Conversion, Transfer or Closure of Office, Use of Shared Premises, ATMs and Correspondent ATMs are established; That, it is necessary to modify some articles of the aforementioned Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, in order to adapt them to international standards established by the South American Financial Action Group (GAFISUD) in relation to due diligence in the identification of clients according to their risk level and profile, among other aspects; That, to achieve greater financial inclusion, it is convenient to establish the characteristics of savings accounts with simplified procedures, called basic accounts, that promote the access of the population to basic financial services; That, it is necessary to modify the aforementioned norms and regulations so that basic accounts are subject to due diligence in matters of prevention of money laundering and terrorist financing and information transparency norms according to their risk level and complexity, as well as to allow their opening at correspondent ATMs; That, taking into account the nature of their activities, established in article 338° of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law N° 26702, it is necessary to incorporate

2 insurance brokers as obligated subjects to provide information to the Superintendency, through the UIF-Peru, in accordance with the provisions of article 3° of Law N° 29038; That, in order to collect the opinions of the general public regarding the proposed modification of the regulations applicable to supervised companies, the pre-publication of the draft norm that establishes the characteristics of basic savings accounts to achieve greater financial inclusion and modifies the complementarity norms for the prevention of money laundering and terrorist financing was ordered on the electronic portal of the Superintendency, under the provisions of Supreme Decree Nº 001-2009-JUS; Being the opinion of the Adjoint Superintendencies of Banking and Microfinance, Insurance, Private Pension Fund Administrators, Risks, Economic Studies, Legal Advisory and of the Financial Intelligence Unit of Peru; as well as by the Management of Products and Services to the User; and, In use of the powers conferred in numerals 7, 9 and 10 of article 349° and by the Fourteenth Final and Complementarity Provision of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law N° 26702, as well as in numeral 3.4 of article 3° of Law N° 29038;

RESOLVES:

Article One.- Incorporate insurance brokers as obligated subjects to provide the information referred to in article 3 of Law Nº 27693 and its amendments, in accordance with the provisions of article 3° of Law N° 29038, in the terms indicated in the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments.

Article Two.- Modify article 1° of the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments, according to the following text:

"Article 1°.- Scope The present norms comprise the companies indicated in articles 16° and 17° of the General Law, the Agricultural Bank, the Bank of the Nation, the Guarantee Fund for Small Industry – FOGAPI, the Private Pension Fund Administrators, the Development Financial Corporation S.A. - COFIDE, the Mivivienda Fund S.A., insurance brokers and the Savings and Credit Cooperatives not authorized to operate with public funds, insofar as applicable to them, hereinafter the companies. In the case of insurance brokers, the Superintendency, through an Annex to this norm, will establish those specific aspects relative to their Systems for the Prevention of Money Laundering and Terrorist Financing, taking into consideration their quality as intermediaries in the contracting of insurance."

Article Three.- Modify subsection m) of article 2° of the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments, according to the following text:

"m) Politically Exposed Persons (PEP): Those natural persons who fulfill or have fulfilled prominent public functions in the last two (2) years, whether in the national or foreign territory, and whose financial circumstances may be subject to public interest."

Article Four.- Modify the second paragraph of article 7° of the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments, according to the following text:

"Article 7°.- Clients (…) In the case of insurance companies, the policyholder, the insured and the beneficiary of the insurance shall be considered as clients, as appropriate, and these persons must be identified in accordance with articles 8° and 9° of this norm. However, the provisions on customer knowledge may be applied to the beneficiary of the insurance after the relationship with the policyholder of the insurance and/or insured has been established, but before making the payment of the corresponding indemnity or before the beneficiary can exercise the rights derived from the insurance contract. (…)"

Article Five.- Modify article 8° of the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments, according to the following text:

"Article 8°.- On customer knowledge and due diligence – General Regime Customer knowledge requires, among other activities, carrying out adequate identification, establishing activity profiles and determining the purpose and nature of the business relationship to facilitate the detection and/or prevention of unusual or suspicious operations. Furthermore, said knowledge will allow companies, among other aspects, to identify those clients who may represent a greater risk for the realization of money laundering and/or terrorist financing operations. Companies must develop policies and procedures intended to allow the verification of the information provided on the identity of their clients. For this purpose, the presentation of public or private documents must be requested, in accordance with the Law and its Regulation, including forms to be completed by them if applicable, with the purpose of obtaining the information indicated below, and have procedures for permanent verification of the information, adequate to the circumstances and to the risk for the realization of money laundering and/or terrorist financing operations, associated with the type of client, the type of products and channels to be used, as the case may be. The aforementioned information must be required even before initiating the business relationship and kept updated as long as it is in force. Companies are obligated to apply due diligence in customer knowledge when establishing business relationships regarding the same client or a set of linked clients,

4 even if said procedures have also been carried out by other members of their economic group or conglomerate. The company must establish specific restrictions to be applied at the beginning or during the business relationship, as long as the permanent verification procedures provided determine so. Minimum information requirement to clients The Minimum Information that companies must require from their natural person clients is the following: a) Full name. b) Type and number of identity document. c) Place and date of birth. d) Nationality and residence. e) Domicile, telephone number, and email, if applicable. f) Occupation, trade or profession. g) Name of the work center, position held and length of service, if applicable. h) Public position or function performed in the last two (2) years, as well as name of the institution, if applicable. i) Purpose of the relationship to be established with the company. j) Sworn statement on the origin of funds, at least in cases where the thresholds for the registration of operations established in article 12° of this norm are exceeded. k) According to the nature of the client and their risk profile for the realization of money laundering and/or terrorist financing operations, companies must strive to have information regarding the approximate average monthly income of their clients and the characteristics of the operations they will carry out through them, considering information on type of operations, amounts, currencies, accounts involved, places of realization, periodicity and other information they consider relevant, which will be recorded in the personal file of each client. l) Carry out reasonable inquiries to determine if the person is a PEP, in which case the name of their relatives up to the second degree of consanguinity and second of affinity and of the spouse or partner will be required, as well as, the list of legal persons where a PEP has 5% or more participation in the share capital, contribution or participation, if applicable, of a legal person. m) Carry out reasonable inquiries to determine if the client is an Obligated Subject to inform UIF-Peru, in accordance with article 3° of Law N° 29038, and in case they are an obligated subject, request a sworn statement in which they indicate that they have a Compliance Officer registered with the Superintendency. The Compliance Officer may be the obligated subject themselves when they are a natural person, for cases where the regulations allow it. Said information will be available to the Superintendency. The Minimum Information that companies must require from their legal person clients is the following: a) Name or corporate name. b) Single Taxpayer Registry (RUC), if applicable. c) Minimum financial information when it is required in accordance with current regulations. d) Corporate purpose and main economic activity (commercial, industrial, construction, transport, etc.)

5 e) Identification of administrators considering the information required for natural persons, insofar as applicable. f) Identification of shareholders, partners or associates who have directly or indirectly more than 5% of the share capital, contribution or participation of the legal person, considering the information required for natural persons, insofar as applicable, identifying those who are PEPs. g) Legal persons linked to the client, and/or to their economic group, if applicable. h) Location and telephones of the office or main premises, where they develop the activities proper to their business, that of their branches, agencies or others of a similar nature, if applicable. i) Identification of representatives, considering the information required in the case of natural persons; as well as the granting of the corresponding powers. j) Purpose of the relationship to be established with the company. k) Sworn statement on the origin of funds, at least in cases where the thresholds for the registration of operations established in article 12° of this norm are exceeded. l) According to the nature of the client and their risk profile for the realization of money laundering and/or terrorist financing operations, companies must strive to have information regarding the approximate average monthly income of their clients and the characteristics of the operations they will carry out through them, considering information on type of operations, amounts, currencies, accounts involved, places of realization, periodicity and other information they consider relevant, which will be recorded in the personal file of each client. m) Carry out reasonable inquiries to determine if the legal person is an Obligated Subject to inform UIF-Peru, in accordance with article 3° of Law N° 29038, and in case they are an obligated subject, request a sworn statement in which they indicate that they have a Compliance Officer registered with the Superintendency. Said information will be available to the Superintendency. Information Verification Companies must carry out, in all cases, unless otherwise provided in this norm, visits to the domiciles or offices of the clients, carry out personal interviews and carry out other procedures that allow them to ensure that their clients have been duly identified, leaving documentary evidence thereof, in which the place, date and time of the same are indicated, and their results, in the personal file of each client. Companies may use intermediaries or other third parties to comply with verification services, or to attract new business or to develop commercial activities proper to the company, to the extent that it is permitted, subjecting themselves to the general subcontracting norms defined in current regulations. Said intermediaries or third parties must comply with the due diligence regulations applicable to companies in the Law, its Regulation, or any other regulations issued in this regard, which are not exempt from the responsibility of their compliance by the fact that said obligation is carried out by an intermediary or third party. In these cases, companies must adopt adequate measures to obtain in a timely manner the information relative to the identification data and all pertinent documentation related to customer knowledge, as well as obtain evidence that the intermediary or third party has taken necessary measures to comply with customer due diligence.

6 Special Situations Verification of information through visits to the domiciles or offices of the clients or through personal interviews, is not mandatory in the contracting of the following products or in the realization of the operations detailed below: a) Operations that involve amounts that are below the thresholds required for the registration of operations. b) Mandatory insurance. c) Insurance contracted by natural or legal persons on behalf of and in favor of their employees, whose origin is an employment contract or labor relationship, regarding the information of the insured and the beneficiary. d) Insurance sold through bancassurance or other form of mass sale of insurance, provided that the payment of the premium is made via direct charge to the savings account, current account or credit card of the clients or via payment in any of their boxes or tellers. e) Collective or group insurance. f) Personal accident and medical assistance insurance. g) Funeral insurance. h) Pension insurance. i) Microinsurance. j) Remittance insurance. k) Mandatory contributions to the Private Pension System. l) Others determined by the Superintendency. For the cases described in the previous paragraph, the verification procedures applicable to the information associated with the referred clients may be determined according to the risk for the realization of money laundering and/or terrorist financing operations and to the characteristics of the expected relationship with the client. For this, the company will develop studies that determine the applicable criteria, compatible with the adequate verification of the minimum identification information of client required for said operations. For the case of the operations indicated above, the minimum information required for the identification of the client, is the following: In case the clients are natural persons: a) Full name. b) Type and number of identity document. c) Domicile, and if applicable, telephone number. In case the clients are legal persons: a) Name or corporate name. b) Single Taxpayer Registry (RUC), if applicable. c) Identification of administrators and representatives. The full name and the type and number of the identity document will be requested. d) Domicile of the office or main premises, and if applicable, telephones."

7 Article Six.- Modify article 9° of the Complementarity Norms for the Prevention of Money Laundering and Terrorist Financing, approved by SBS Resolution Nº 838-2008 and its amendments, according to the following text:

"Article 9°.- On customer knowledge and due diligence – Special Regimes 9.1. Simplified Regime: Under the simplified regime of due diligence in customer knowledge, some minimum information requirements of due diligence applicable to clients may be reduced, relative to the risk they face for the realization of money laundering and/or terrorist financing operations, when the design of the products, services and distribution channels with which they interact, mitigate said risk through limits on the amounts transacted, and the type of transactions available, among other special measures. To apply the simplified regime to a determined product, the company must request authorization in advance from the Superintendency, for which it will present: a) Information about the characteristics of the product. b) Study where the commercial and operational design of the product is defined, including the distribution channels. c) Risk management program applicable to the product, which will be formalized and approved by the Risk Committee or equivalent, which will contain at least periodic monitoring of the behavior of the product, analysis of the operational process and identification of the risk areas associated with the realization of money laundering and/or terrorist financing operations. Additionally, it must be considered that the design of the product is subject to the current provisions for the management of operational risk associated with new products. Updates to the indicated documentation, once authorization is obtained, will be available to the Superintendency. The minimum information to be obtained and verified under this regime will be the full name, type and number of identity document and domicile. For its corresponding verification, the National Identity Document (DNI) or Foreigner Card is required. The Superintendency may regulate products that will be considered under the Simplified Regime, as well as the specific requirements for determined products, which according to their nature, warrant special treatment. In these cases authorization from the Superintendency is not required. However, what is indicated in subsections a), b) and c) indicated above applies, and said information must be kept available to the Superintendency. 9.2. Enhanced procedures regime: Companies must identify and register clients who in the course of the business relationship, show a transactional pattern that does not correspond to their profile or business activity. Likewise, they must, under their good judgment, identify and register those clients who could be highly exposed to the risk for the realization of money laundering and/or terrorist financing operations, in order to include them in this regime. This regime must be applied, at least, to the following clients:"

8 a) National or foreign clients, non-residents; b) Trusts; c) Non-domiciled companies; d) Politically Exposed Persons (PEP) or those who manage public resources. Companies must also reinforce their customer knowledge procedures when one of their clients becomes a PEP or an official who manages public resources, as the case may be, after having initiated commercial relations with the company; e) Correspondency or agency services with foreign companies; especially those constituted in tax havens or that do not have banking regulation or supervision. f) Clients who receive transfers from countries considered non-cooperative by the FATF, with risk related to money laundering and/or terrorist financing, with scarce banking supervision, or countries subject to OFAC sanctions; g) Legal persons in which a PEP owns 5% or more of the share capital, contribution or participation and which, according to the good criterion of the company, possess a high risk of ML/TF; h) The partners, shareholders or associates and administrators of legal persons where a PEP owns 5% or more of the share capital, contribution or participation; i) Clients regarding whom it is known that they are being investigated for money laundering, predicate offenses and/or terrorist financing by the competent authorities; j) Clients linked to natural or legal persons subject to investigation or judicial processes related to money laundering, predicate offenses and/or terrorist financing; k) Clients with deposit accounts in foreign currency for amounts equal to or greater than the thresholds for the registration of operations established in article 12° of this norm. l) Legal persons whose shareholders, partners or associates who have directly or indirectly more than 5% of their share capital, contribution or participation, as the case may be, are natural or legal foreign persons. m) Those other assumptions that according to their good criterion the companies identify; In all these cases, intensified monitoring and due diligence procedures must be implemented according to the risk criterion for the realization of money laundering and/or terrorist financing operations. Likewise, the company, according to the risk for the realization of money laundering or terrorist financing operations associated with the clients included and registered in this regime, must apply the following enhanced due diligence measures: a) Register the client's declaration regarding the origin of the funds and if possible identify the origin of the funds. b) Increase the frequency in the review of the client's transactional activity. c) Increase the frequency in the update of the client's information, including when dealing with legal persons, an annual update of their shareholders, partners or associates who have directly or indirectly more than 5% of their share capital, contribution or participation, as the case may be. d) Conduct inquiries and apply additional measures for identification and knowledge of the client. Among these could be considered: obtaining information on main suppliers and clients, collecting information from public or open sources, among others.

9 e) The decision of acceptance and/or maintenance of the relationship with the client will be in charge of the highest management level of the company, who in turn may delegate this function to another management position within the organization, or to a committee established for the effect, retaining the responsibility for the acceptance and/or maintenance or not of the client. f) Carry out at least one (1) time per year a visit to the client's domicile, when it is domiciled in Peru. For companies that carry out fund transfer operations or money transport, reasonable measures must be applied that allow fully identifying the orderer (originator), and determining if this or the beneficiary of said operation is a PEP." Article Seven.- A "basic account" is considered to be that deposit account that companies of the financial system authorized to capture deposits from the public, hereinafter companies, make available to natural persons, and that complies with all the following conditions: a) It is opened by national or foreign resident natural persons. b) The holder does not maintain more than one basic account in the same company. c) It is expressed in national currency, and its balance cannot be greater than S/. 2000 at any time. d) Daily deposits cannot exceed S/. 1000. e) Accumulated monthly deposits and withdrawals cannot exceed S/. 4000. f) It is freely available in the national territory, subject to the limitations that the company establishes. g) It is not used for transactions outside the country. The company must define procedures and measures that appropriately treat cases where exceptionally, the conditions provided above are not complied with, with the objective of restoring its normal operation and/or avoiding the use of basic accounts outside the conditions established. For the adequate application of the measures referred to above, in the contractual forms it must be indicated that contract resolution or suspension measures may be applied by blocking the basic account, unilaterally and without prior notice, when it is a matter of the application of prudential norms issued by this Superintendency, according to article 85° of the Consumer Protection and Defense Code. In this case, the communication regarding the resolution of the contract or blocking of the account will be carried out within a maximum period of seven (07) calendar days of adopting the corresponding measure. Additionally to the conditions mentioned above, whose control corresponds to the companies that offer basic accounts, the same holder may not maintain more than four (04) basic accounts in the financial system, restriction that must be communicated to the client by the company at the time of the opening of the basic account. For the follow-up of this restriction by the Superintendency, the companies will remit to it the list of basic accounts, as well as any other information about them that is requested, through the electronic means that the Superintendency establishes. Article Eight.- Basic accounts are found included in the simplified regime referred to in article 9° of the Complementary Norms for the

10 Prevention of Money Laundering and Terrorist Financing, approved by Resolution SBS No. 838-2008 and its amendments. The minimum identification and verification requirements applicable to the opening of basic accounts will be the following: a) The information for identification will include the full name of the client, contained in the National Identity Document (DNI) or Foreigner Card, as corresponds, and updated domicile according to client declaration. b) The company must verify the name and DNI against the information of the National Registry of Identification and Civil Status (RENIEC) or the name and Foreigner Card against the Central Registry of Foreigners of the General Directorate of Migrations and Naturalization, when that is possible, which may be carried out subsequently to the opening of the basic account if there are technological limitations. For the closure of basic accounts, the client must be identified with the same document used for the opening and leave record of the express will of closure of the client. To apply these simplified identification and verification requirements, each of the conditions that define the basic accounts indicated in literals a) to g) of article seven of this Resolution must be complied with. Companies must develop monitoring, risk evaluation and control procedures in order to prevent the abuse of this account modality, guarantee its operativity within the established conditions and take the additional measures that are appropriate to maintain the product within the levels proper to a low risk account in matters of money laundering and terrorist financing. The Risk Management Program applicable to the product referred to in article 9.1 of the Complementary Norms for the Prevention of Money Laundering and Terrorist Financing, must also include due consideration to the behavior of the product through the correspondent tellers authorized to open basic accounts. Likewise, said authorized correspondent tellers must have adequate training for the purpose of this product, as well as in the conditions required for adequate customer service and criteria required in said openings. Article Nine.- Include as Ninth Provision Complementary and Final of the Regulation of Transparency of Information and Provisions Applicable to Contracting with Users of the Financial System, approved by Resolution SBS No. 1765-2005 and amendments, hereinafter Transparency Regulation, the following text: "Ninth. Simplified Regime The Superintendency may regulate in a general manner, the exemption of one or more of the criteria indicated in the Regulation in case the design of the operations, products or services so justifies and/or there are alternative means to comply with the objectives of this Regulation."

11 Article Ten^1 .- Basic accounts are found under the simplified regime established in the Regulation of Transparency of Information and Contracting with Users of the Financial System, hereinafter Transparency Regulation, being applicable its norms, with the particularities that are indicated below: a) Contracts celebrated in writing: companies may design simplified contracts and information booklets that include in a highlighted and prominent manner at least what indicated in literals a) to h) of article 19° of the Transparency Regulation and the main characteristics associated with the operations, limits, restrictions and conditions applicable to the basic account. The information corresponding to the information booklet can be added directly in the contract, in a single document. b) Contracts celebrated by means other than those provided in the preceding numeral: companies must apply what is provided in article 41° of the Transparency Regulation, considering the information and minimum conditions established in the preceding literal. Article Eleven.- Amend Numeral I.3 of Annex C of the Regulation of Opening, Conversion, Transfer or Closure of Office, Use of premises Shared, Automatic Tellers and Correspondent Tellers, approved by Resolution SBS No. 775- 2008 and its amendments, according to the following text: "I.3. Through correspondent tellers the following operations may be carried out: a) Collection of credits. b) Withdrawal of money. c) Transfer of funds. d) Cash deposits in own or third party accounts. e) Opening and closure of basic accounts, at client request. f) Payment of services and collections in general. g) Other services to which the company is authorized to satisfaction of this Superintendency. It will not be permitted to open other deposit accounts different from basic accounts, nor agree new credit operations under any modality. Likewise, advertising may be carried out and deliver information that facilitates the opening of other deposit accounts and/or concession of credits subsequently in the offices of the company. The operations that are carried out through correspondent tellers must be those that imply credits and/or automatic charges in accounts and/or credit lines, according corresponds, without requiring reconciliations or verifications other than those that are carried out in electronic terminals that are interconnected with the company. In the case of basic accounts, companies may establish complementary mechanisms according is required in order to make possible the opening in a timely manner. The Superintendency may authorize operations that follow another operational scheme or use other modalities of service provision, if it considers that the controls to be applied allow to adequately manage the risks associated; in which case detailed information will be provided about the proposed modality, and the reports prepared by the Operational Risk Unit or equivalent will be attached."

1 Article amended by SBS Resolution No. 8181-2012 of 10/25/2012

12 Article Twelve.- Incorporate the procedure No. 152 "Authorization for inclusion of products under the simplified regime of due diligence in the knowledge of the client" in the Single Text of Administrative Procedures – TUPA of the Superintendency of Banking, Insurance and AFP, whose text is annexed to this Resolution and is published according to what is provided in Supreme Decree No. 004-2008-PCM, Regulation of Law No. 29091 (Institutional portal: www.sbs.gob.pe). Article Thirteen.- This Resolution enters into force from the day after its publication in the Official Gazette El Peruano. FINAL AND TRANSITORY PROVISIONS First.- Application for insurance brokers. For insurance brokers, Circular CS-23-2010 and its amendments, as well as the provisions of the Complementary Norms for the Prevention of Money Laundering and of the Terrorist Financing, approved by Resolution SBS No. 838-2008 and its amendments that are applicable to them in quality of obligated subjects, will remain in suspense while the Annex of the cited Complementary Norms is issued where the specific aspects applicable to insurance brokers referred to in article 1° of said norm are established. Second.- Adaptation period to determine if the person is Obligated Subject. For purposes of compliance with what is provided in incises m) of the section "Requirement of minimum information to clients" of article 8° of the Complementary Norms for the Prevention of Money Laundering and Terrorist Financing, on minimum information to be required to natural persons and legal persons when they are obligated subjects to inform the FIU-Peru of according to article 3° of Law No. 29038, the companies referred to in article 1° of the referred Complementary Norms will have an adaptation period of one hundred eighty (180) days calendar counted from the entry into force of this norm, to establish the corresponding procedures. Record, communicate and publish. FELIPE TAM FOX Superintendent of Banking, Insurance and Private Pension Funds Administrators