SBS Resolution No. 0838-2008: Complementary Regulations for the Prevention of Money Laundering and Terrorism Financing

Lima, March 28, 2008
S.B.S. Resolution
No. 838-2008
The Superintendent of Banking, Insurance and
Private Pension Fund Administrators

WHEREAS:
Law No. 29038 ordered the incorporation of the Financial Intelligence Unit of Peru, hereinafter UIF-Peru, into the Superintendency of Banking, Insurance and Private Pension Fund Administrators, hereinafter Superintendency, as a specialized unit, whereby the latter, in addition to its own functions, has assumed the competencies, attributions and functions that corresponded to the UIF-Peru;

In this regard, following the incorporation of the UIF-Peru into the Superintendency, it is necessary to modify SBS Resolution No. 479-2007, the regulation by which the Complementary Regulations for the Prevention of Money Laundering and Terrorism Financing were approved;

Likewise, in accordance with Law No. 27693 and its amendments, the entities obliged to provide information to the UIF-Peru include, among others, the companies indicated in Articles 16 and 17 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, hereinafter General Law, approved by Law No. 26702 and its amendments, as well as Private Pension Fund Administrators, Fondo Mivivienda S.A., Banco de la Nación, the Guarantee Fund for Small Industry – FOGAPI, the Financial Development Corporation S.A. - COFIDE, and Savings and Credit Cooperatives not authorized to operate with public funds;

Supreme Decree No. 018-2006-JUS approved the Regulations of the Law that creates the UIF-Peru;

In accordance with paragraph 6 of the Twenty-Fourth Final and Complementary Provision of the General Law, the Superintendency regulates the operations of Savings and Credit Cooperatives not authorized to operate with public funds and is empowered to order the adoption of necessary measures to correct any patrimonial or administrative deficiencies detected;

In this regard, it is necessary to issue regulatory norms related to the systems for the prevention of money laundering and terrorism financing that such cooperatives must have, and therefore they must be incorporated into the new Complementary Regulations for the Prevention of Money Laundering and Terrorism Financing issued by this Superintendency as a result of the incorporation of the UIF-Peru, where applicable;

In accordance with paragraph 3 of the Twenty-Fourth Final and Complementary Provision of the General Law, the supervision of the aforementioned cooperatives is carried out by the National Federation of Savings and Credit Cooperatives of Peru, hereinafter FENACREP, or by other second-tier federations recognized by the Superintendency, and to which they voluntarily affiliate;

However, by Resolution dated October 15, 2002, of the Constitutional and Social Law Chamber of the Supreme Court of Justice of the Republic, certain articles of the Regulations for Savings and Credit Cooperatives not authorized to operate with public funds, approved by SBS Resolution No. 540-99 dated June 15, 1999, were declared inapplicable with general effects, among which was subsection l) of its Article 39, which stipulated that in the performance of its supervisory functions, FENACREP or another federation recognized by the Superintendency, as the case may be, had the power to impose sanctions on the aforementioned cooperatives;

In this regard, the Superintendency's Sanctions Regulations, approved by SBS Resolution No. 816-2005, must be modified to incorporate Savings and Credit Cooperatives not authorized to operate with public funds;

Based on the opinion of the Deputy Superintendencies of Banking and Microfinance, Risks, Insurance, Private Pension Fund Administrators and Legal Advisory, and the UIF-Peru; and,

In use of the powers conferred in paragraphs 7 and 10 of Article 349 and by the Fourteenth Final and Complementary Provision of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance;

RESOLVES:
Article First.- To approve the Complementary Regulations for the Prevention of Money Laundering and Terrorism Financing, which form an integral part of this Resolution.

Article Second.- This Resolution repeals SBS Resolution No. 479-2007 published on April 22, 2007.

Article Third.- This Resolution shall enter into force on the day following its publication in the Official Gazette El Peruano.

Register, communicate and publish.

FELIPE TAM FOX
Superintendent of Banking, Insurance and
Private Pension Fund Administrators

COMPLEMENTARY REGULATIONS FOR
THE PREVENTION OF MONEY LAUNDERING
AND TERRORISM FINANCING

TITLE I
GENERAL PROVISIONS

Article 1.- Scope
These regulations cover the companies indicated in Articles 16 and 17 of the General Law, Banco Agropecuario, Banco de la Nación, the Guarantee Fund for Small Industry – FOGAPI, Private Pension Fund Administrators, Financial Development Corporation S.A. - COFIDE, Fondo Mivivienda S.A., insurance brokers and Savings and Credit Cooperatives not authorized to operate with public funds, where applicable, hereinafter the companies.

For the case of insurance brokers, the Superintendency, by means of an Annex to this regulation, will establish those specific aspects related to their Systems for the Prevention of Money Laundering and Terrorism Financing, taking into account their role as intermediaries in the contracting of insurance.

Article modified by SBS Resolution No. 2108-2011 of 02/16/2011

Article 2.- Definitions
The companies must consider the following definitions:

a) Shell Bank: A bank constituted and authorized in a country where it has no physical presence, and which is not a subsidiary of a group that provides financial services subject to effective consolidated supervision. Likewise, for the purposes of this regulation, physical presence shall be understood as management and administrative functions located within a country. The existence of a local representative or mid-level personnel does not constitute physical presence. b) Ultimate Beneficiary: Any natural person who, without necessarily being a client, is the owner or recipient of the resources or assets subject to the contract or is authorized or empowered to dispose of them. c) Good judgment of the company: The judgment formed, at least, from the knowledge of the client and the market, experience, training and institutional commitment of the company's employees for the prevention of money laundering and terrorism financing. d) Client: Any natural or legal person with whom companies establish or maintain commercial relations for the provision of a service or the supply of any product typical of their activity. e) FATF: Financial Action Task Force. f) General Law: General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amendments. g) Law: Law that creates the Financial Intelligence Unit of Peru – UIF-Peru, Law No. 27693 and its amendments. h) OFAC List: List issued by the Office of Foreign Assets Control of the U.S. Department of the Treasury (OFAC), which includes countries, persons, entities that, in the opinion of the U.S., collaborate with terrorism and drug trafficking. i) Manual: Manual for the Prevention of Money Laundering and Terrorism Financing.

Article modified by SBS Resolution No. 11695-2008 of 11/27/2008
Subsection modified by SBS Resolution No. 6561-2009 of 06/22/2009

j) Complementary Regulations: Complementary Regulations for the Prevention of Money Laundering and Terrorism Financing. k) Unusual operations: Those operations carried out or intended to be carried out whose amount, particular characteristics and periodicity do not bear relation to the client's economic activity, fall outside the parameters of normality in force in the market or do not have an evident legal basis. l) Suspicious operations: Those unusual operations carried out or intended to be carried out of a civil, commercial or financial nature that have an unusual magnitude or speed of rotation, or unusually complex or unjustified conditions, which, based on the information collected in accordance with the rules on “client knowledge,” are presumed to originate from some illicit activity, or which, for any reason, do not have an apparent economic or lawful basis; and which could be linked to money laundering and/or terrorism financing. m) Politically exposed persons (PEP): Those natural persons who hold or have held prominent public functions in the last two (2) years, either in national or foreign territory, and whose financial circumstances may be subject to public interest. n) Regulations: Regulations of the Law that creates the UIF-Peru, approved by Supreme Decree No. 018-2006-JUS. o) External Audit Regulations: External Audit Regulations approved by the Superintendency. p) Internal Audit Regulations: Internal Audit Regulations approved by the Superintendency. q) Superintendency: Superintendency of Banking, Insurance and Private Pension Fund Administrators. r) UIF-Peru: Financial Intelligence Unit of Peru, a specialized unit of the Superintendency. s) Related parties and economic group: The concepts defined in the Special Regulations on Related Parties and Economic Group issued by the Superintendency.

Subsection m) modified by SBS Resolution No. 2108-2011 of 02/16/2011

Article 3.-System for the prevention of money laundering and terrorism financing
Companies must have a system for the prevention of money laundering and terrorism financing to prevent and avoid that the products and/or services they offer to the public are used for illicit purposes related to money laundering and/or terrorism financing.
It will be the responsibility of the General Manager and the Board of Directors or equivalent bodies of the companies to implement said system in the companies they represent. The prevention system is made up of the policies and procedures established by the companies in accordance with the Law, the Regulations, the General Law where applicable, the Complementary Regulations and other provisions on the matter. All areas, units or departments of the companies are obliged to apply the system for the prevention of money laundering and terrorism financing in accordance with the functions they perform within them, taking into account the Code of Conduct and the Manual that they establish for this purpose in accordance with this regulation and other provisions on the matter. Companies must ensure that their directors, managers and employees have a high level of integrity, collecting information on their personal, professional, patrimonial backgrounds and credit history, requiring them to submit a sworn patrimonial declaration. This information must be included in the file of each director, manager and employee of the company, and must be kept permanently updated.

Article modified by SBS Resolution No. 11695-2008 of 11/27/2008

The General Manager and the Board of Directors or equivalent bodies of the companies are responsible for compliance with this regulation and other provisions on the prevention of money laundering and terrorism financing, as well as for providing the necessary and sufficient facilities to the Compliance Officer for the execution of their responsibilities. The necessary and sufficient facilities include the benefits inherent to the managerial level that corresponds to them.

Likewise, companies must verify that their branches and subsidiaries abroad comply with money laundering and terrorism financing prevention measures compatible with those required in Peru and the FATF recommendations. Companies must inform the Superintendency when one of their branches or subsidiaries abroad cannot appropriately comply with said measures because the laws, regulations or other internal measures of the host country prohibit it.

Article 4.- Purpose of the system for the prevention of money laundering and terrorism financing
The system for the prevention of money laundering and terrorism financing must allow companies to detect unusual operations and the timely prevention or detection of suspicious operations carried out or attempted to be carried out, in order to communicate them to the UIF-Peru within the legal term. Likewise, companies must be able to attend, within the required term, requests for information or additional information from the Superintendency or other competent authority in accordance with current regulations. In the event that due to the magnitude and/or complexity of the requested information an additional term is required, companies will communicate to the respective authority the shortest term in which they can make this information available. For this purpose, companies will obtain from their files or records, whether manual or computerized, as the case may be, the information related to client knowledge and their operations to provide it to the competent authorities as support for the suspicious operations communicated, as well as at their request in accordance with the Law or for investigations and/or processes that are being carried out in relation to money laundering or terrorism financing.

Article modified by SBS Resolution No. 6561-2009 of 06/22/2009

Article 5.- Training programs
Companies must develop training programs in order to instruct their employees on current regulations regarding the prevention of money laundering and terrorism financing, as well as regarding the policies, regulations and procedures established by the companies themselves. The obligation to carry out training programs requires that every employee undergoes at least one training session per year, with the purpose of instructing them on current regulations, modifications that may have been incorporated into the prevention system, typologies of money laundering and terrorism financing detected in the company or in other companies, alert signals to detect unusual and suspicious operations and other aspects that the Compliance Officer considers relevant. Employees who have direct contact with clients, as well as those who work directly under the orders of the Compliance Officer, require more demanding training, so they must have at least one additional annual training session to the one indicated above. However, the Superintendency, in exceptional cases and due to the inherent nature of certain company operations, may exempt certain employees who have direct contact with clients from the obligation of having an additional annual training session.

The aforementioned training sessions may be carried out by any physical or electronic means that the company deems appropriate, provided that a record of it is kept in the personal file of each employee of the company who participated in the respective training.

Notwithstanding the foregoing, new directors, managers and employees who join the companies must be informed about the scope of the system for the prevention of money laundering and terrorism financing, in accordance with their respective functions, no later than thirty (30) days following the date of entry; this must be done in coordination with the Compliance Officer and with the support of the Human Resources area or equivalent body of the companies.

Training programs must be reviewed and updated by the Compliance Officer, with the support of the Human Resources area or equivalent body of the companies, in order to evaluate their effectiveness and adopt any improvements deemed pertinent. Likewise, the Compliance Officer is responsible for communicating to all directors, managers and employees of the company about changes in the regulations of the system for the prevention of money laundering and/or terrorism financing.

Finally, the Compliance Officer must have at least two specialized training sessions per year, different from those given to the company's employees and which may be carried out by any means that the General Manager and Board of Directors or equivalent body of the company deems appropriate, in order to be instructed in detail on current regulations, their modifications, typologies of money laundering and terrorism financing, alert signals to detect unusual and suspicious operations and other aspects related to money laundering and/or terrorism financing.

Article 6.- Code of conduct
All directors, managers, employees and any authorized representative of the companies must commit to implementing a code of conduct, approved by the Board of Directors or equivalent body of the companies, aimed at ensuring the proper functioning of the system for the prevention of money laundering and terrorism financing, which must contain, among other aspects, the guiding principles, values, policies, processes and controls that must be applied to manage the risk of exposure to money laundering and/or terrorism financing. For this purpose, the companies' code of conduct must highlight the mandatory nature of the procedures that integrate the system for the prevention of money laundering and terrorism financing, in accordance with current regulations on the matter. Said code must indicate that any non-compliance with the system for the prevention of money laundering and terrorism financing will be considered a very serious, serious or minor offense, which will be determined beforehand by the companies according to the type of offense in question, applying the corresponding sanctions in accordance with the provisions and procedures determined by the companies.

In the respective personnel files of the companies, a record must be kept of their knowledge of the code of conduct and their commitment to comply with it in the exercise of their functions within the companies. Likewise, if applicable, any sanctions imposed must be recorded in the corresponding personal files. Said personnel files will be available to the Superintendency.

TITLE II
SYSTEM FOR THE PREVENTION OF MONEY LAUNDERING
AND TERRORISM FINANCING

CHAPTER I
CLIENT AND MARKET KNOWLEDGE

Article 7.- Clients
Clients are all natural and legal persons with whom commercial relations are established or maintained for the provision of a service or the supply of any product typical of the financial, insurance, private pension fund administration system, complementary and related services companies or any other that corresponds to the operations authorized to companies in accordance with the General Law, the provisions issued by the Superintendency and other pertinent regulations, as well as any other company that falls within the scope of this Resolution. The Law, the Regulations, the General Law, the Consolidated Text of the Law of the Private Pension Fund Administration System, and other pertinent regulations, where applicable, and this regulation are applicable to all clients of the companies, whether habitual or occasional, national or foreign.

In the case of insurance companies, the contractor, the insured and the beneficiary of the insurance will be considered clients, as appropriate, and these persons must be identified in accordance with Articles 8 and 9 of this regulation. However, the provisions on client knowledge may be applied to the insurance beneficiary after the relationship with the insurance contractor and/or insured has been established, but before making the corresponding indemnity payment or before the beneficiary can exercise the rights derived from the insurance contract.

In the case of private pension fund administrators, clients are the affiliates to the Private Pension Fund Administration System. Likewise, for the case of Savings and Credit Cooperatives not authorized to operate with public funds, clients are understood to be all members who have met the required conditions, according to the internal regulations of each cooperative to which they associate, and with whom, by virtue of this condition, they maintain or establish relations for the provision of services or supply of products typical of the cooperatives, in accordance with their applicable regulations and their authorized operations.

The mandatary as well as the mandator, the representative as well as the represented, as well as the originator and/or beneficiary of the operations or services requested from the companies, will be considered clients, if applicable.

Companies, in order to decide on the acceptance of a natural or legal person as a client and in consideration of the products and/or services requested, or to decide on the provision of a service or supply of a product to a member in the case of Savings and Credit Cooperatives not authorized to operate with public funds, must take into account, among other aspects, the

Article modified by SBS Resolution No. 11695-2008 of 11/27/2008 and SBS Resolution No. 6561-2009 of 06/22/2009.
Paragraph modified by SBS Resolution No. 2108-2011 of 02/16/2011

volume of funds involved, country of origin thereof, applicant profile, and whether relationships will be conducted through electronic or similar means, as applicable.

It is a permanent duty of companies to identify the ultimate beneficiaries of all services or products they supply and to take reasonable measures to verify their identity, to the extent due diligence permits.

Article 8.- Customer Knowledge and Due Diligence – General Regime

Customer knowledge requires, among other activities, adequate identification, establishment of activity profiles, and determination of the purpose and nature of the commercial relationship to facilitate the detection and/or prevention of unusual or suspicious transactions. Furthermore, such knowledge will allow companies, among other aspects, to identify those clients who may represent greater risk for carrying out money laundering and/or terrorist financing operations.

Companies must develop policies and procedures aimed at allowing verification of information provided regarding the identity of their clients. To this end, public or private documents must be requested, in accordance with the Law and its Regulations, including forms to be completed by them if necessary, with the aim of obtaining the information indicated below, and having permanent verification procedures for the information, appropriate to the circumstances and to the risk associated with carrying out money laundering and/or terrorist financing operations, linked to the type of client, type of products, and channels to be used, as applicable.

The aforementioned information must be requested even before initiating the commercial relationship and kept updated while it remains in effect.

Companies are obliged to apply due diligence in customer knowledge when establishing business relationships regarding the same client or a group of related clients, even if such procedures have also been carried out by other members of their economic group or conglomerate.

The company must establish specific restrictions to be applied at the start or during the commercial relationship, as determined by the permanent verification procedures envisaged.

Minimum Information Requirement to Clients

The minimum information that companies must request from natural person clients is as follows:
a) Full name. b) Type and number of identity document. c) Place and date of birth. d) Nationality and residence. e) Address, telephone number, and email address, if applicable. f) Occupation, trade, or profession. g) Name of workplace, position held, and length of service, if applicable.

Article modified by SBS Resolution No. 11695-2008 of 27/11/2008, by SBS Resolution No. 6561-2009 of 22/06/2009, and by SBS Resolution No. 2108-2011 of 16/02/2011

h) Public office or function performed in the last two (2) years, as well as name of the institution, if applicable. i) Purpose of the relationship to be established with the company. j) Sworn declaration regarding the origin of funds, at least in cases where the thresholds for transaction registration established in Article 12 of these standards are exceeded. k) According to the nature of the client and their risk profile for carrying out money laundering and/or terrorist financing operations, companies must endeavor to have information regarding approximate average monthly income of their clients and the characteristics of the transactions they will carry out through them, considering information on type of transactions, amounts, currencies, accounts involved, places of execution, frequency, and other relevant information, which shall be recorded in the personal file of each client. l) Conduct reasonable inquiries to determine if the person is a PEP (Politically Exposed Person), in which case the names of relatives up to the second degree of consanguinity and second degree of affinity, and of the spouse or concubine, are required, as well as the list of legal entities where a PEP holds 5% or more of the share capital, contribution, or participation, if applicable. m) Conduct reasonable inquiries to determine if the client is an Obligated Subject to report to UIF-Peru, pursuant to Article 3 of Law No. 29038, and if so, request a sworn declaration stating that they have a Compliance Officer registered with the Superintendency. The Compliance Officer may be the obligated subject itself when it is a natural person, for cases permitted by regulations. This information will be available to the Superintendency.

The minimum information that companies must request from legal person clients is as follows:
a) Trade name or corporate name. b) Unique Taxpayer Registry (RUC), if applicable. c) Minimum financial information when required according to current regulation. d) Corporate object and main economic activity (commercial, industrial, construction, transport, etc.) e) Identification of administrators considering the information required for natural persons, insofar as applicable. f) Identification of shareholders, partners, or associates who directly or indirectly hold more than 5% of the share capital, contribution, or participation of the legal entity, considering the information required for natural persons, insofar as applicable, identifying those who are PEPs. g) Legal entities linked to the client, and/or their economic group, if applicable. h) Location and phone numbers of the main office or premises where business activities are developed, as well as those of their branches, agencies, or others of a similar nature, if applicable. i) Identification of representatives, considering the information required in the case of natural persons; as well as the granting of corresponding powers. j) Purpose of the relationship to be established with the company. k) Sworn declaration regarding the origin of funds, at least in cases where the thresholds for transaction registration established in Article 12 of these standards are exceeded. l) According to the nature of the client and their risk profile for carrying out money laundering and/or terrorist financing operations, companies must endeavor to have information regarding approximate average monthly income of their clients and the characteristics of the transactions they will carry out through them, considering information on type of transactions, amounts, currencies, accounts involved, places of execution,

frequency, and other relevant information, which shall be recorded in the personal file of each client. m) Conduct reasonable inquiries to determine if the legal entity is an Obligated Subject to report to UIF-Peru, pursuant to Article 3 of Law No. 29038, and if so, request a sworn declaration stating that they have a Compliance Officer registered with the Superintendency. This information will be available to the Superintendency.

Verification of Information

Companies must carry out, in all cases, unless otherwise provided in these standards, visits to client domiciles or offices, conduct personal interviews, and perform other procedures that allow them to ensure that their clients have been duly identified, leaving documentary evidence thereof, indicating the place, date, and time of such actions, and their results, in the personal file of each client.

Companies may use intermediaries or other third parties to comply with verification services, or to attract new business or to develop commercial activities inherent to the company, insofar as permitted, subject to the general outsourcing rules defined in current regulation. Such intermediaries or third parties must comply with the applicable due diligence regulations for companies in the Law, its Regulations, or any other regulations issued on the matter, and the companies are not exempted from responsibility for compliance merely because this obligation is carried out by an intermediary or third party.

In these cases, companies must adopt adequate measures to obtain in a timely manner information regarding identification data and all pertinent documentation related to customer knowledge, as well as obtain confirmation that the intermediary or third party has taken necessary measures to fulfill customer due diligence.

Special Situations

Information verification through visits to client domiciles or offices or through personal interviews is not mandatory in the contracting of the following products or in carrying out the operations detailed below:
a) Transactions involving amounts below the thresholds required for transaction registration. b) Mandatory insurance. c) Insurance contracted by natural or legal persons on behalf of and for the benefit of their employees, whose origin is an employment contract or labor relationship, regarding information on the insured and the beneficiary. d) Insurance sold through bancassurance or other forms of mass insurance sales, provided that premium payment is made via direct charge to the client's savings account, checking account, or credit card, or via payment at one of their cashiers or tellers. e) Collective or group insurance. f) Personal accident and medical assistance insurance. g) Funeral insurance. h) Pension insurance. i) Microinsurance. j) Remittance insurance.

k) Mandatory contributions to the Private Pension System. l) Others determined by the Superintendency.

For the cases described in the preceding paragraph, the verification procedures applicable to the information associated with said clients may be determined based on the risk for carrying out money laundering and/or terrorist financing operations and the characteristics of the expected relationship with the client. To this end, the company will develop studies that determine the applicable criteria, compatible with the adequate verification of the minimum client identification information required for such operations.

For the cases of operations mentioned above, the minimum information required for client identification is as follows:

If clients are natural persons:
a) Full name. b) Type and number of identity document. c) Address, and if applicable, telephone number.

If clients are legal persons:
a) Trade name or corporate name. b) Unique Taxpayer Registry (RUC), if applicable. c) Identification of administrators and representatives. Full name and type and number of identity document will be requested. d) Address of the main office or premises, and if applicable, telephone numbers.

Article 9.- Customer Knowledge and Due Diligence – Special Regimes

9.1. Simplified Regime:

Under the simplified regime of due diligence in customer knowledge, some minimum due diligence information requirements applicable to clients can be reduced relative to the risk they face for carrying out money laundering and/or terrorist financing operations, when the design of the products, services, and distribution channels with which they interact mitigates said risk through limits on transacted amounts and the type of transactions available, among other special measures.

To apply the simplified regime to a specific product, the company must request prior authorization from the Superintendency, for which it will present:
a) Information regarding the characteristics of the product. b) Study defining the commercial and operational design of the product, including distribution channels. c) Risk management program applicable to the product, which will be formalized and approved by the Risk Committee or equivalent, which will contain at least periodic monitoring of product behavior, analysis of the operational process, and identification of risk areas associated with carrying out money laundering and/or terrorist financing operations. Additionally, it must be considered that the product design is subject to current provisions for operational risk management associated with new products.

10 Article modified by SBS Resolution No. 11695-2008 of 27/11/2008, by SBS Resolution No. 6561-2009 of 22/06/2009, and by SBS Resolution No. 2108-2011 of 16/02/2011

Updates to the indicated documentation, once authorization is obtained, will be available to the Superintendency.

The minimum information to be obtained and verified under this regime will be full name, type and number of identity document, and address. For its corresponding verification, the National Identity Document (DNI) or Foreigner ID Card is required.

The Superintendency may regulate products that will be considered under the Simplified Regime, as well as specific requirements for certain products that, according to their nature, require special treatment. In these cases, authorization from the Superintendency is not required. Nevertheless, what is indicated in items a), b), and c) mentioned above applies, and such information must be kept available to the Superintendency.

9.2. Enhanced Procedures Regime:

Companies must identify and register clients who, throughout the commercial relationship, show a transactional pattern that does not correspond to their profile or line of business.

Likewise, they must, at their good judgment, identify and register those clients who could be highly exposed to the risk for carrying out money laundering and/or terrorist financing operations, in order to include them in this regime.

This regime must be applied, at least, to the following clients:
a) National or foreign non-resident clients; b) Trusts; c) Non-domiciled societies; d) Politically Exposed Persons (PEPs) or those who administer public resources. Companies must also reinforce their customer knowledge procedures when one of their clients becomes a PEP or a public official administering resources, as applicable, after having initiated commercial relations with the company; e) Correspondency services or agency arrangements with foreign companies, especially those constituted in tax havens or lacking banking regulation or supervision. f) Clients receiving transfers from countries considered non-cooperative by the FATF, with risk related to money laundering and/or terrorist financing, with little banking supervision, or countries subject to OFAC sanctions; g) Legal entities in which a PEP owns 5% or more of the share capital, contribution, or participation and that, according to the company's good judgment, pose a high AML/CFT risk; h) Partners, shareholders, or associates and administrators of legal entities where a PEP owns 5% or more of the share capital, contribution, or participation; i) Clients regarding whom there is knowledge that they are being investigated for money laundering, predicate crimes, and/or terrorist financing by competent authorities; j) Clients linked to natural or legal persons subject to investigation or judicial processes related to money laundering, predicate crimes, and/or terrorist financing; k) Clients with foreign currency deposit accounts for amounts equal to or greater than the thresholds for transaction registration established in Article 12 of these standards.

l) Legal entities whose shareholders, partners, or associates who directly or indirectly hold more than 5% of their share capital, contribution, or participation, if applicable, are foreign natural or legal persons. m) Other situations identified by companies according to their good judgment;

In all these cases, intensified monitoring and due diligence procedures must be implemented in attention to the risk criterion for carrying out money laundering and/or terrorist financing operations.

Likewise, the company, according to the risk for carrying out money laundering or terrorist financing operations associated with clients included and registered in this regime, must apply the following enhanced due diligence measures:
a) Register the client's declaration regarding the origin of funds and, if possible, identify the origin of the funds. b) Increase the frequency of review of the client's transactional activity. c) Increase the frequency of updating client information, including, for legal entities, an annual update of their shareholders, partners, or associates who directly or indirectly hold more than 5% of their share capital, contribution, or participation, if applicable. d) Conduct inquiries and apply additional identification and customer knowledge measures. These could include: obtaining information on main suppliers and customers, collecting information from public or open sources, among others. e) The decision to accept and/or maintain the relationship with the client will be the responsibility of the highest managerial level of the company, who may delegate this function to another managerial position within the organization, or to a committee established for this purpose, retaining responsibility for the acceptance and/or maintenance or non-maintenance of the client. f) Conduct at least one (1) visit per year to the client's domicile, when domiciled in Peru.

For companies carrying out fund transfer or money transport operations, reasonable measures must be applied to fully identify the ordering party (originator), and determine if this party or the beneficiary of said operation is a PEP.

Article 10.- Market Knowledge

Market knowledge is a complement to customer knowledge, which allows companies to estimate the ranges within which usual transactions performed by their clients would be located, according to market characteristics. Thus, companies are able to detect unusual transactions that fall outside the activity profiles of clients or the market segments to which they correspond, by comparing transactions performed by clients with similar activity profiles.

Article 11.- Knowledge of Correspondent Banking

Pursuant to Article 14 of the Law, multiple operations companies and complementary and related services companies, as well as Savings and Credit Cooperatives not authorized to operate with public funds, as applicable, must have policies and procedures for the prevention and/or detection of unusual and suspicious transactions that might be carried out through correspondent services with national or foreign companies. To this effect, said companies must identify their exposure to money laundering and terrorist financing risk through correspondent services. In this sense, companies must know the nature and scope of the correspondent bank's and/or fund transfer correspondent's operations, evaluate the quality of their anti-money laundering and counter-terrorist financing prevention system, as well as their adherence to norms and control by the corresponding supervisor on this matter, and ensure that they are adequate and effective, placing particular emphasis, in the case of companies located in countries with strict regulations regarding bank secrecy or tax havens. Companies must clearly establish and fully comply with the respective obligations and responsibilities of each institution regarding the prevention of money laundering and terrorist financing, as well as have the respective documentation.

When a correspondent relationship includes the maintenance of payment transfer accounts in other jurisdictions, companies must have confirmation that: i) their client (the represented financial institution) has complied with all normal customer due diligence obligations regarding its clients who have direct access to the correspondent financial institution's accounts; and ii) upon request, the represented financial institution is in a position to provide relevant identification data of the clients.

The policies and procedures developed by the companies referred to in this article to know their correspondent bank and/or fund transfer correspondents must be incorporated into the Manual.

Companies must have policies and procedures on correspondent relationships with shell banks, as well as obtain confirmation that foreign companies represented in correspondentship do not allow the use of their accounts by shell banks.

CHAPTER II
REGISTRATION OF TRANSACTIONS

Article 12.- Transaction Registration

In addition to the operations referred to in numeral 9.2 of Article 9 of the Law, companies, as applicable, must register the following operations carried out for amounts equal to or greater than those described in this article:
a) Withdrawal of funds; b) Withdrawal of contributions or deposits, in the case of Savings and Credit Cooperatives not authorized to operate with public funds; c) Collection of checks; d) Purchase of certified checks or cashier's checks; e) Payment or refund of premiums established in insurance policies, regardless of payment method; f) Payment of benefits, claims, surrender, or any disbursement made by the insurance company to the insured or beneficiary as a consequence of the execution of the insurance contract; g) Payment of mandatory contributions to the Private Pension System; and, h) Payment of voluntary contributions with or without pension purposes to the Private Pension System.

Without prejudice to the foregoing, the Superintendency may:

12 Article modified by SBS Resolution No. 6561-2009 of 22/06/2009

a) Expand, reduce and/or modify the list of concepts that must be subject to Registration, as well as the content of the Registration in relation to each operation; b) Modify the deadline, manner and form in which the Registrations must be kept and preserved; and, c) Regulate any other matter related to the Operations Register. Companies must register the aforementioned operations carried out for amounts equal to or greater than ten thousand United States dollars (US$ 10,000.00), its equivalent in national currency or other currencies, if applicable. Regarding fund transfer companies, the obligation to register includes operations starting from two thousand five hundred United States dollars (US$ 2,500.00), its equivalent in national currency or other currencies, if applicable. For the case of Savings and Credit Cooperatives not authorized to capture public resources, the obligation to register will be for operations starting from five thousand United States dollars (US$ 5,000.00) or its equivalent in national currency or other currencies, if applicable. Likewise, they shall register multiple operations carried out in one or several offices, agencies, establishments or any type of physical or electronic device through which company operations can be effected during a calendar month, by or for the benefit of the same person, which together equal or exceed fifty thousand United States dollars (US$ 50,000.00), its equivalent in national currency or other currencies, if applicable; or ten thousand United States dollars (US$ 10,000.00), its equivalent in national currency or other currencies, if applicable, when it comes to fund transfer companies; or twenty thousand United States dollars (US$ 20,000.00), its equivalent in national currency or other currencies, if applicable, when it comes to Savings and Credit Cooperatives not authorized to capture public resources, in which cases they shall be considered as a single operation. The exchange rate applicable to determine the equivalent in national currency or other currencies, if applicable, shall be obtained by averaging the daily selling exchange rates corresponding to the month prior to the operation, published by the Superintendency. Companies must perform a risk analysis associated with their profile of operations or market segments, in order to determine if it is necessary to establish a threshold lower than that indicated for the registration of operations in the Operations Register. As a consequence of such study, companies may internally establish lower thresholds for the registration of operations than those previously indicated. Such lower thresholds may be established by economic sectors, types of more sensitive operations or any other criterion determined by the companies, as appropriate. The registration will be carried out through computer systems containing the minimum information indicated in Article 9°, numeral 9.3, of the Law and Article 7° of the Regulation. Regarding the natural
and/or legal persons intervening in the operation, the identification of the person who physically carries out the operation must be registered, as well as the person on whose behalf the operation is carried out and the beneficiary or recipient thereof, if any. To this effect, companies may use the form included by way of reference in Annex No. 2 or another that the Superintendency determines. Companies shall transmit the Operations Register to the Superintendency through the electronic means established by it. Operations carried out on own account between companies do not require registration. The Superintendency, based on the particular characteristics of the companies and exceptionally, may exclude them from the obligation to keep the Operations Register. To this effect, companies must submit to the Superintendency a duly substantiated application addressed to the Deputy Superintendent of UIF-Peru, who, based on the technical report issued by the competent areas of the Superintendency and his own evaluation carried out by virtue of the information contained in his database, will resolve the application submitted by the company. The authorization granted, if any, may be subject to revocation subsequently by the Superintendency when it considers that due to the particular characteristics of the company the aforementioned exclusion is no longer justified.
Article 12Aº.- Cash Operations Register - ROPE 13
Companies must keep available to the Superintendency a list of cash operations that they have registered in their Operations Register. A cash operation is considered to be all those that, in the course of the ordinary business of clients, involve delivery or receipt of money in banknotes or coins, national or foreign.
Article 13º.- Preservation and availability of the Register
Companies must keep the Operations Register accurate and complete from the day the operation was carried out and for a period of ten (10) years, which must be available to judicial bodies and competent authorities in accordance with the law. To this effect, computer media, microfilming, microfiche or similar means that allow easy recovery of information for consultation and internal or external reporting to competent authorities in accordance with the Law will be used. Companies must maintain a backup copy at the end of each quarter, which will be compiled in periods of five (5) years, procedure that must be in accordance with the Information Security Plan required by the Superintendency. The backup copy of the last five-year period must be available to the Superintendency and the Public Ministry within forty-eight (48) business hours of being requested. Information records that companies have about their clients and the operations they carry out may be used for the purposes of the Operations Register, provided that they are duly adapted to the requirements previously indicated for the system for the prevention of money laundering and terrorist financing.
Article 14°.- Exclusion from the Register
Companies, based on their good judgment and under their responsibility, may exclude certain clients from the operations register, taking into account their activity profiles, when sufficient, updated and duly justified knowledge they have of said clients allows them to consider that their activities are lawful, and always provided that they also meet the following conditions:
a) Have, at least, two (2) years as clients in the corresponding system or in companies of the same nature and one (1) year in the company before being excluded from the Operations Register. b) Carry out operations with some frequency that exceed the minimum amounts required for the Operations Register. c) Be residents in the country. d) Not have registered antecedents for suspicious operations. Compliance Officers will be responsible for approving or not the exclusion of clients from the Operations Register, for which they must previously carry out an evaluation and review of client activities as well as compliance with the requirements previously indicated. Likewise, the Compliance Officer must carry out periodic reviews of clients who have been excluded from the Operations Register, in accordance with what is provided in paragraph c) of Article 15° of this regulation. 13 Article incorporated by Resolution SBS No. 11695-2008 of 27/11/2008 and modified by Resolutions SBS Nos. 6561-2009 of 22/06/2009 and 1214-2014 of 24/02/2014.

When it is known that the client excluded from the operations register is allegedly linked to money laundering and/or terrorist financing activities, the Superintendency will proceed to evaluate the Compliance Officer's fulfillment of functions and the alleged commission of the crime of Omission of Reporting of Suspicious Operations in accordance with the law.
Article 15º.- Procedures for the exclusion of the Register
To control clients excluded from the Operations Register, the following procedures must be applied, in addition to those that companies consider necessary:
a) Design an appropriate form or computer record that allows documenting the approval process and periodic review of the criteria considered for the exclusion of each client, maintaining a centralized file thereof that will be available to the Superintendency. b) Evaluate in advance and individually the exposure and risk of clients to be excluded, taking into account the purposes described in this Regulation and leaving evidence thereof in the form or record previously indicated. The approval of the Compliance Officer must be substantiated by at least two (2) favorable and independent opinions, one of which must be from the personnel in charge of connecting directly with the client. c) At least once (1) every semester of the year, a formal review of the list of clients excluded from the register must be carried out to verify if they continue to satisfy the criteria applied for their exclusion, leaving evidence and comments thereof in the corresponding form or record. The procedures previously indicated, as well as the policies adopted by companies for the qualification of clients excluded from the Operations Register, must be incorporated into the Manual. The list of clients excluded by companies and their corresponding justifications must be available to the Superintendency, when so required.
Article 16º.- Provisions on fund transfers
The registration of fund transfers must be carried out including exact and complete information about the ordering party (full name, trade name or corporate name, address, telephone number, number of accounts involved, if applicable) in the transfers and in the messages related thereto. Companies must ensure that information about the ordering party and the beneficiary is maintained during the carrying out of the operation and once completed during the period established in the Law, as well as that such information is included in the messages related thereto. Companies must verify that the fund transfers sent to them contain the aforementioned information about the ordering party; those that do not comply with such conditions must be considered as alert signals. When the operation is carried out by a legal person, the data of the representative as well as the respective power of attorney must be requested.
CHAPTER III
ON THE COMMUNICATION OF SUSPICIOUS OPERATIONS
Article 17º.- Suspicious Operation Reports (ROS)
Companies are obliged to communicate to UIF-Peru the operations detected in the course of their activities, carried out or attempted to be carried out, which according to their good judgment are considered suspicious, regardless of the amounts involved, within a period not exceeding thirty (30) calendar days from having detected them. An operation is considered detected as suspicious when, having previously identified an operation as unusual, after the analysis and evaluation carried out by the Compliance Officer, he/she may presume that the funds used proceed from some illicit activity, or that, for any reason, they do not have an apparent economic or lawful basis. In cases where the company has constituted a Committee for the Prevention of Money Laundering and Terrorist Financing, it will have the function of assisting the Compliance Officer in the analysis and evaluation necessary to determine if an unusual operation is suspicious or not; however, the Compliance Officer is the only one who can qualify the operation as suspicious and proceed with its communication to UIF-Peru, in accordance with the Law. The Compliance Officer must leave documentary evidence of the analysis and evaluations carried out by him/her or with the collaboration of the Committee, if applicable, for the qualification of an operation as suspicious or not.
Annex No. 1 titled "Alert Signals" contains a list of this type of signals that companies must take into account in order to detect suspicious operations. The foregoing does not exempt companies from communicating other operations that they consider suspicious in accordance with their system for the prevention of money laundering and terrorist financing. Without prejudice to this, the Superintendency may provide additional information or criteria that contribute to the detection of unusual or suspicious operations.
The communication of suspicious operations and the Suspicious Operation Report (ROS) that companies carry out through their Compliance Officers have confidential and private character between the companies and the Superintendency, through UIF-Peru.
Companies shall transmit the ROS to UIF-Peru through the electronic means established by the Superintendency. 14
Article 18º.- Content of the ROS
The ROS must contain the following minimum information:
a) Identity of the client or clients intervening in the operation, indicating full name, date of birth, identity document number, nationality, profession or occupation, address and telephone, for natural persons; as well as trade name or corporate name, Unique Taxpayer Registry number (RUC), social object, address, telephone and legal representative, in the case of legal persons. Regarding the representative, the information required for natural persons must be included. b) When third parties intervene in the operation, the full names of said persons and other information available about them must be indicated. c) Indicate whether the client or clients have previously carried out a suspicious operation, indicating the documentation with which said operation was communicated to the competent authorities. d) List and description of operations carried out mentioning dates, amounts, currencies, accounts used, linked accounts, place of realization, supporting documents attached to the report, such as fund transfers, copies of checks, statements, etc. e) Irregularities and considerations that led to qualifying said operations as suspicious; and, f) Other information and documentation considered relevant.

14 Paragraph incorporated by Resolution SBS No. 6561-2009 of 22/06/2009

Annex No. 3 contains the form that companies must use for the preparation of the ROSs that must be communicated to UIF-Peru, without prejudice to the adaptations that companies may make, provided that they are duly justified and correspond to the specific characteristics of each company.
The ROS must not feature the identity of the Compliance Officer, nor any other element that could contribute to identifying him/her, for which said officer must use his/her assigned code or secret key. Likewise, in all other communications addressed to the Superintendency, the Compliance Officer must only use the assigned code or secret key.
CHAPTER IV
OF THE MANUAL FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING
Article 19º.- Manual
The system for the prevention of money laundering and terrorist financing must be embodied in the Manual elaborated by companies. The Manual will contain the policies, mechanisms and procedures established by companies for the prevention of money laundering and terrorist financing, in compliance with the Law, its Regulation, the General Law insofar as it corresponds, the Supplementary Standards and other provisions issued by the Superintendency on the matter. The Manual must contain as a minimum the information indicated in Annex No. 4. Without prejudice to the foregoing, companies must incorporate into the Manual, in addition to the "Alert Signals" of these standards, a list of those types of operations that due to the nature of the client's economic activity they consider unusual or susceptible to being communicated to UIF-Peru in case they are suspected, and must disseminate this list among the personnel in charge of the detection and/or prevention of said operations. The Manual must be approved by the Board of Directors or equivalent bodies of the companies, be permanently updated and be available to the Superintendency when requested.
CHAPTER V
ON THE SUPERVISION OF THE PREVENTION SYSTEM
Article 20º.- Collaborators of the prevention system
In the exercise of the control and supervision labor of the prevention system, the Superintendency will use not only its own supervision mechanisms but also, additionally, will rely on the Compliance Officer, internal auditors, external audit firms and risk rating companies.
The reports to be transmitted to the Superintendency by the Compliance Officer, internal auditors and external audit firms, must refer to the activities carried out by companies regarding the policies and procedures adopted to prevent money laundering and terrorist financing, in accordance with the minimum content of said reports established in the pertinent norms.

Article 21°.- Compliance Officer 15
The Board of Directors and the General Manager, or their equivalent bodies, must appoint a Compliance Officer who will be responsible together with them for monitoring compliance with the system for the prevention of money laundering and terrorist financing. The Compliance Officer must necessarily have a direct employment link with the company and managerial rank, depend organically, functionally and administratively on the Board of Directors or equivalent body, and report directly to it. He/She must count on the benefits inherent to his/her managerial level, which must be consistent with the benefits corresponding to the other managers of the company. The Compliance Officer must enjoy absolute autonomy and independence in the exercise of the responsibilities and functions assigned to him/her by law, and must be provided with the necessary resources and infrastructure for the adequate fulfillment of his/her responsibilities, functions and confidentiality. Regarding the situation and development of personnel assigned to the Compliance Officer, the evaluation reached by the Compliance Officer to the Board of Directors or equivalent body will be taken into account, mainly. In accordance with Articles 10°, paragraph b) of numeral 10.2.1 of the Law and 21°, numeral 21.1 of the Regulation, the following companies must have a Compliance Officer dedicated exclusively, except in those cases where, considering the nature, volume or specialization of their operations, it is justified that the Superintendency authorizes them a non-exclusive dedicated compliance officer, in accordance with the same procedure provided in the penultimate paragraph of this article:
a) Banking companies, with the exception of those indicated in paragraph d) of numeral 10.2.1 of Article 10° of the Law; b) Multiple operation companies, other than banking companies, whose effective assets as of December of the previous year, had been equivalent to the minimum capital required for banking companies; c) Insurance and/or reinsurance companies, whose effective assets as of December of the previous year, had been greater than one hundred million new soles (S/. 100,000,000.00); d) Credit and/or debit card issuing companies, fund transfer companies and transport, custody and administration of cash companies that have more than one hundred (100) workers. e) Fund transfer companies whose monthly average of transferred funds in the last twelve months is equal to or greater than 4000 UIT. The exclusive dedicated Compliance Officer of multiple operation companies and insurance and/or reinsurance companies referred to in the preceding paragraphs may also perform their functions in the subsidiaries of said companies, which comply with the rules established in Article 36° of the General Law and are under the supervision and control of the Superintendency, which must be communicated to the Superintendency in accordance with the procedure detailed in Article 22° of this regulation. Companies that do not fall within the parameters indicated in paragraphs a) to e) of this article, may have a non-exclusive dedicated Compliance Officer, who must necessarily be a managerial-level official with a direct employment link with the company, who will report directly to the Board of Directors or the equivalent body, as appropriate,

15 Article modified by Resolution SBS No. 11695-2008 of 27/11/2008 2008 and by Resolution SBS No. 6561-2009 of 22/06/2009.

regarding the system for the prevention of money laundering and terrorist financing. The designation of a Compliance Officer does not exempt the company, its directors, or employees from the obligation to apply the policies and procedures of the system for the prevention of money laundering and terrorist financing, in accordance with their respective functions. However, the Superintendence, given the characteristics of the particular operations of some of the aforementioned companies, may require that such official be dedicated exclusively. For this purpose, the Deputy Superintendent of UIF-Peru will request the company to present a technical report supporting the viability for its Compliance Officer to be non-exclusively dedicated, as well as the complementary information necessary for the management of operational, administrative, and legal risks, among other aspects. The Deputy Superintendent of UIF-Peru will resolve whether the company under analysis must have a Compliance Officer dedicated exclusively or not based on said information, the technical report issued by the competent areas of the Superintendence, which must take into consideration, among other aspects, the size of the organization, its complexity and volume of transactions and operations, and its own evaluation carried out based on the information in its database.

Pursuant to Article 10, numeral 10.2.1, item d) of the Law, branches of foreign banks in Peru may request the Superintendence that their Compliance Officer be non-exclusively dedicated. Such Officer must permanently reside in Peru and meet all requirements established in current regulations. For this purpose, said companies must present a request to the Superintendence addressed to the Deputy Superintendent of UIF-Peru, attaching a technical report supporting the viability of the Compliance Officer being non-exclusively dedicated. The Deputy Superintendent of UIF-Peru will resolve the request based on the technical report issued by the competent areas of the Superintendence, which must take into consideration, among other aspects, the size of the organization, its complexity and volume of transactions and operations, and its own evaluation carried out based on the information in its database. The Superintendence's authorization will have a validity of three (3) years, renewable upon request by the company, prior to compliance with the procedure described in this paragraph.

Companies may designate a Committee for the Prevention of Money Laundering and Terrorist Financing composed of first-level management officials and presided over by the Compliance Officer. This Committee will assist the Compliance Officer in the analysis and evaluation necessary to determine if an unusual operation is suspicious or not; however, the Compliance Officer is the only one who can qualify the operation as suspicious and proceed with its communication to UIF-Peru, in accordance with the Law. Likewise, this Committee may serve as support to the Compliance Officer in adopting policies and procedures necessary for the proper functioning of the prevention system. The members and functions of the Committee for the Prevention of Money Laundering and Terrorist Financing will be part of the Manual.

Article 22.- Requirements of the Compliance Officer
The Compliance Officer must meet, at a minimum, the following requirements:
a) Be designated by the Board of Directors and the General Manager, or their equivalent bodies, as Compliance Officer, a position that must have a managerial level. For the purposes of these regulations, the managerial level requirement does not include the position of deputy manager. b) Have experience in monitoring and controlling operations and/or regulatory compliance. c) Have experience in the main activity developed by the company. d) Not be or have been the internal auditor of the company during the six (6) months prior to their appointment. e) Not have been declared bankrupt, nor convicted of intentional crimes, nor be subject to the other impediments indicated in Article 365 of the General Law. For the purposes of numeral 1 of Article 365 of the General Law, the Compliance Officer cannot be a holder of shares in companies supervised by the Superintendence, whose ownership could cause a conflict of interest with the labor they perform. f) In the case of Savings and Credit Cooperatives not authorized to operate with public funds, not be subject to the impediments of Article 33 of the General Law of Cooperatives. g) Others established by the Superintendence.

With respect to item e), it must be taken into account that numeral 2 of Article 365 of the General Law applies to companies that require a Compliance Officer dedicated exclusively, in which case said official cannot simultaneously be a director or advisor of the company, nor perform tasks other than those indicated in Article 25 of this regulation.

Companies must inform the Superintendence of the appointment of their Compliance Officer within a period not exceeding one (1) business day from the occurrence, via communication addressed to the Deputy Superintendent of UIF-Peru, indicating at a minimum: full name, identification document number, nationality, domicile, contact data, and informing that the requirements indicated in the first paragraph of this article are being met. Such communications must observe the appropriate security measures to protect the identity of the Compliance Officer.

The procedure mentioned above must also be carried out in case of change of the person occupying the position of Compliance Officer or Corporate Compliance Officer. In the event of removal of the Compliance Officer or Corporate Compliance Officer, this must additionally be approved by the Board of Directors and General Manager, as well as communicated previously to the Superintendence via communication addressed to the Deputy Superintendent of UIF-Peru, indicating the reasons justifying such measure. The vacancy situation cannot last more than thirty (30) calendar days.

Article 23.- Corporate Compliance Officer
According to item c) of numeral 10.2.1 of Article 10 of the Law, companies that form part of the same economic group may appoint a single Corporate Compliance Officer, for which they must have the express approval of the Superintendence, and if applicable, of the holders of the supervisory bodies of the other companies forming part of the economic group not supervised by the Superintendence. The position of Corporate Compliance Officer must be dedicated exclusively, have a managerial level in one of the companies forming part of the economic group that is supervised by the Superintendence, and have the assistance of sufficient personnel. For this purpose, in addition to the personnel working directly with the Corporate Compliance Officer, each of the companies forming part of the economic group, whether supervised by the Superintendence or not, must have at least one official who coordinates directly with the Corporate Compliance Officer on all matters related to the prevention of money laundering and/or terrorist financing of said company, with the Compliance Officer being the only responsible for the prevention system of each of the companies that form part of the economic group.

For the approval of the position of Corporate Compliance Officer, companies must present an authorization request addressed to the Deputy Superintendent of UIF-Peru, attaching the following information:
a) The list of companies forming the economic group, whether supervised or not by the Superintendence; b) Technical report supporting the viability of the economic group to have a Corporate Compliance Officer, based on the money laundering and terrorist financing risks it faces, demonstrating that this position will not harm or endanger compliance with current regulations and the proper development of the prevention system of the companies forming part of the economic group it represents, whether supervised by this Superintendence or not, as well as exposing what measures will be implemented to prevent this from happening; c) Curriculum Vitae of the Corporate Compliance Officer; d) Sworn Declaration specifying that the Corporate Compliance Officer meets the requirements established in Article 22 of this Resolution and other applicable regulations; and that there is sufficient information in their personnel file regarding their personal, professional, credit, and asset history, as provided in Article 3 of this regulation; e) Sworn Declaration indicating that the appointment of the Corporate Compliance Officer has the approval of the Board of Directors and General Manager of each of the companies forming part of the economic group, whether supervised or not by the Superintendence; f) The list of personnel under the charge of the Corporate Compliance Officer and the persons responsible for coordinating directly with the Compliance Officer on matters related to the prevention system and working in each of the companies forming part of the economic group it represents, whether supervised or not by the Superintendence; and, g) In case there are companies in the economic group under the competence of other supervisory bodies different from the Superintendence, a copy of the authorizations issued by them for the companies under their competence to have the position of Corporate Compliance Officer or the receipt of such requests to prove that they are in process must also be attached to the aforementioned request. The Superintendence will not rule until the respective authorizations have been received.

The Deputy Superintendent of UIF-Peru will resolve the request based on the technical report issued by the competent areas of the Superintendence and its own evaluation carried out based on the information in its database.

In the case of replacement of the person occupying the position of Corporate Compliance Officer, and provided that the economic group has not changed substantially with respect to that maintained at the time of initial approval, said change must be brought to the knowledge of the Superintendence in accordance with the procedure detailed in the penultimate paragraph of Article 22 of this Resolution, attaching what is indicated in items c), d) and f) of this article.

Article 24.- Confidentiality of the Compliance Officer
The Superintendence, through UIF-Peru, will assign secret keys or codes to Compliance Officers, with which they will be identified, without exception, in all their communications addressed to the Superintendence, observing the pertinent security measures in them. UIF-Peru must notify the assignment of said keys or secret codes to the Compliance Officer.

Companies must take all necessary actions so that the identity of the Compliance Officer is not known by clients and other persons outside the company, so their identity must not appear in any information issued by the companies, such as annual reports, among others.

Article 25.- Responsibilities of the Compliance Officer
The responsibilities of the Compliance Officer are as follows:
a) Monitor compliance with the system to detect suspicious operations of money laundering and terrorist financing. b) Verify the application of policies and procedures implemented for customer knowledge, market knowledge, correspondent banking knowledge, as applicable; as well as the necessary procedures to ensure the integrity level of directors, managers, and employees, regarding which they will also verify that the necessary information is collected within the framework established in this regulation. c) Review the independent opinions referred to in item b) of Article 15 and other evaluations carried out on clients proposed to be excluded from the registry. d) Evaluate in advance the possibility of excluding a client from the operations registry and, if appropriate, approve their exclusion from said operations registry, as well as carry out periodic reviews of clients who have been excluded from the operations registry, in accordance with item c) of Article 15 of this regulation. e) Verify the adequate conservation and custody of documents required for the prevention of money laundering and terrorist financing. f) Promote the definition of company strategies to prevent money laundering and terrorist financing. g) Periodically review the United Nations website, the Lists on persons involved in terrorist activities (Resolution No. 1267), in order to detect if any of them is carrying out any operation with the company. h) Periodically review the FATF website, the List of Countries and Territories Non-Cooperative, as well as the OFAC List, which can serve as a consultation tool for customer knowledge. i) Take necessary actions, with the support of the Human Resources areas or equivalent body of the companies, to ensure that company personnel have the appropriate level of training that allows them to detect unusual or suspicious operations, and for the adequate dissemination of the Code of Conduct and the Manual. j) Propose alert signals to be incorporated into the Manual. k) Keep control of operations communicated by personnel as unusual. l) Analyze unusual operations detected, with the advice of the Committee for the Prevention of Money Laundering and Terrorist Financing if it exists, in order to determine which operations could be qualified as suspicious. m) Qualify unusual operations as suspicious, if applicable. n) Prepare and notify STRs to UIF-Peru, on behalf of the company. o) Be the company's interlocutor before the Superintendence. p) Issue quarterly reports on their management as Compliance Officer to the President of the Board of Directors or equivalent body of the companies. q) Issue semi-annual reports on the situation of the prevention system and its compliance within the company. r) Those others that are necessary to monitor compliance with the prevention system.

For the proper fulfillment of their responsibilities, the Compliance Officer must prepare an Annual Work Program that must be submitted for prior consideration to the Board of Directors or equivalent body of the companies, and approved before December 31 of each year. This program must indicate, among other aspects, the methodology used for reviews of the system's compliance level and the activities, deadlines, and dates for the execution of the responsibilities described above.

Article 26.- Quarterly Reports
Compliance Officers will present to the President of the Board of Directors or equivalent body of the companies, on a quarterly basis, a Report on their management. This Report will be available to the Superintendence and will contain at least the following information:
a) List of clients excluded from the Operations Registry in the quarter, as well as those who have been reincorporated. b) Monthly statistics of suspicious operations. c) Number of STRs sent to UIF-Peru in the quarter. d) Any important fact considered necessary to inform the President of the Board of Directors, or equivalent body of the companies. e) Personnel or resource requirements for their management, which are not part of the daily aspects of their work referred to logistical or similar matters that can be handled directly with the General Manager of the company, if applicable. f) Topics related to personnel training that the Compliance Officer considers convenient to inform the President of the Board of Directors or equivalent body of the companies. g) Any changes in regulations on money laundering and/or terrorist financing. h) Other important aspects related to their management, at the discretion of the Compliance Officer.

Quarterly reports must be brought to the knowledge of the President of the Board of Directors or equivalent body of the companies, within fifteen (15) days following the end of the quarter.

Corporate Compliance Officers must present a quarterly report for each of the companies supervised by the Superintendence that form part of the economic group they represent.

Article 27.- First Semi-Annual Report of the Compliance Officer
The Compliance Officer's report corresponding to the first semester of the year must contain, at least, information related to:
a) Detail of whether the Compliance Officer's functions are performed exclusively or not, as well as whether they have personnel under their charge, in accordance with current regulations. Indicate in case the Compliance Officer is Corporate or if they exercise their functions also in the subsidiaries of multiple operations companies and insurance and/or reinsurance companies, which comply with the rules established in Article 36 of the General Law and are under the supervision and control of the Superintendence, in accordance with Article 21 of this regulation. b) Description of new typologies of suspicious operations detected, in relation to the previous report, if any. c) Number of clients excluded from the operations registry during the semester, as well as those who were exempted and have been reincorporated, referencing how many periodic evaluations the Compliance Officer has carried out on clients excluded from the operations registry, in accordance with item c) of Article 15 of this regulation. d) Description of procedures implemented to detect, prevent, and control money laundering and terrorist financing, as well as, if applicable, new procedures implemented for the detection and/or prevention of unusual and/or suspicious operations, in relation to the previous report. e) Description regarding the observance of the Manual for the Prevention of Money Laundering and Terrorist Financing. f) Monthly statistics of suspicious operations. g) Number of STRs sent to UIF-Peru in the semester, as well as comparative information in relation to the previous report. h) Progress and degree of compliance with the Annual Work Program. i) Taking of corrective actions based on observations from the internal audit unit, external audit firm, parent company, and the Superintendence, if any. j) Sanctions applied to workers during the semester due to non-compliance with the system for the prevention of money laundering and terrorist financing, including information on the identity of the workers involved. k) Evidence of submission of the semi-annual report sent to the Board of Directors or equivalent body of the companies. l) Other important aspects at the discretion of the Compliance Officer.

The first semi-annual report presented to the Board of Directors or equivalent body of the companies may serve to comply with the obligation to present the quarterly report referred to in Article 26 of this regulation, corresponding to the second quarter, provided that it incorporates the aspects specific to the quarterly report that are not part of the topics reviewed in the first semi-annual report, and that this is communicated to both the Board of Directors or equivalent body of the companies, and the Superintendence.

Article 28.- Second Semi-Annual Report of the Compliance Officer
The Compliance Officer's report corresponding to the second semester of the year must include, in addition to what is indicated in the preceding article, an annual evaluation on the adequacy and compliance of the company's policies and procedures, referring to the following minimum aspects:
a) Customer, market, and correspondent banking knowledge, if applicable. b) Training of workers on topics related to the prevention of money laundering and terrorist financing, including a general description of the training provided and the number of workers who have been trained. Likewise, the number of workers who were trained more than once a year must be indicated, according to whether they had contact with the public or not or if they work directly with the Compliance Officer. c) Compliance with the Code of Conduct by directors, managers, and workers, and any authorized representative of the company, indicating those cases in which it has been breached and the corrective measures adopted. Indicate if the Code of Conduct has been approved by the Board of Directors or equivalent body of the company. d) If the company has complied with the knowledge policies of directors, managers, and workers, through the evaluation of their personal, professional, and asset backgrounds. e) Operations registry, analysis and control that said registry is being properly filled out by the responsible personnel. f) Maintenance of operations records for the legal period. g) Annual statistics of suspicious operations communicated to UIF-Peru. h) Changes and updates to the Manual for the Prevention of Money Laundering and Terrorist Financing. i) Compliance with the Annual Work Program. j) Information on personnel working directly under the orders of the Compliance Officer, as well as indicating the training received in matters of prevention of money laundering and terrorist financing.

k) Sanctions applied to employees during the year due to non-compliance with the anti-money laundering and terrorist financing prevention system, including information on the identity of the employees involved.

l) Observations made by the internal audit unit, external audit, headquarters, and the Superintendence, if any, as well as the actions taken and their timeliness.

m) Indicate whether the Compliance Officer has fulfilled the duty to review and, where applicable, update with the support of the Human Resources area or equivalent body of the companies, the training programs, as well as having fulfilled, where applicable, the communication to all directors, managers, and employees of the company of changes in the regulations of the prevention system.

n) Evidence of submission of the semiannual report sent to the Board of Directors or equivalent body.

o) Other important aspects at the discretion of the Compliance Officer.

In the event that significant changes occur in the following semester regarding the annual evaluation of the aforementioned aspects, they must be described in the next semiannual report of the Compliance Officer, together with the analysis of the impact these modifications have had on the company's prevention system.

The second semiannual report presented to the Board of Directors or equivalent body of the companies may serve to fulfill the obligation to present the quarterly report referred to in Article 26 of this standard corresponding to the fourth quarter, provided that it incorporates the aspects specific to the quarterly report that are not part of the topics reviewed in the Second Semiannual Report, and communicates this both to the Board of Directors or equivalent body of the companies and to the Superintendence.

Article 29.- Deadlines for the submission of reports by the Compliance Officer

Semiannual reports must be brought to the knowledge of the Board of Directors or equivalent body of the companies in the calendar month following the expiration of the semester and forwarded to the Superintendence within fifteen (15) calendar days following the date on which it was brought to the knowledge of the Board of Directors or equivalent body of the companies.

Corporate Compliance Officers must present a first and second semiannual report for each of the companies supervised by the Superintendence that form part of the economic group they represent.

Companies shall forward the semiannual reports to the Superintendence through the electronic means established by it.

Article 30.- Internal Audit

The design and application of the anti-money laundering and terrorist financing prevention system is the responsibility of each company and must be evaluated by its Internal Audit Unit based on generally accepted auditing procedures.

The evaluation of the prevention system within the framework of the Law, the Regulations, and other pertinent provisions must comprise, at minimum, the aspects on the matter indicated in the Internal Audit Regulations. The conclusions of said evaluation must be presented to the Superintendence through a special annual report, as an annex to the Compliance Officer's report corresponding to the second semester.

Article 31.- External Audit

Pursuant to the Law and Regulations, external audit firms must annually issue an Independent Compliance Report, on the evaluation of the companies' prevention system, in accordance with what is provided in the External Audit Regulations. Said report must contain, at minimum, an evaluation of the aspects indicated in Article 23 of the Regulations.

Article 32.- Risk Classification

Risk classification companies must evaluate the prevention system implemented by companies as part of the evaluation of their management quality, specifically pointing out those areas of risk and improvements implemented by the companies.

Article 33.- Annexes

The following annexes form an integral part of the Supplementary Standards:

Annex No. 1: "Alert Signals".

Annex No. 2: "Form for Operation Registration".

Annex No. 3: "Form for Suspicious Operations Report".

Annex No. 4: "Basic Content of the Manual for the Prevention of Money Laundering and Terrorist Financing".

FINAL AND TRANSITORY PROVISIONS

First.- Exemption from liability

Pursuant to Article 13 of the Law, companies and their directors, managers, employees, and other authorized representatives are exempt from criminal, civil, and administrative liability, as appropriate, derived from the due compliance with these standards.

Second.- Manual for the Prevention of Money Laundering and Terrorist Financing at the industry level

Companies may establish agreements in order to have a single manual at the industry level that has, at least, the basic content established in these standards.

Third.- Adaptation deadline for Savings and Credit Cooperatives not authorized to operate with public funds

Savings and Credit Cooperatives not authorized to operate with public funds must implement the Operation Register, the Code of Conduct, and the Manual for the Prevention of Money Laundering and Terrorist Financing referenced in this Resolution, within a period of one hundred twenty (120) calendar days counted from the entry into force of this standard.

Fourth.- Modifications to the Superintendence's Sanctions Regulation

Article 3, as well as the title and numerals 23 and 24 of the Serious Infractions of Annex 1, referred to Common Infractions, of Resolution SBS No. 816-2005, concerning Common Infractions, are modified with the following texts:

“Article 3. Scope
This Regulation is applicable to natural and legal persons carrying out activities that fall under the control and supervision of the Superintendence, as well as to all those that by express legal provision may be sanctioned by the Superintendence or find themselves, in some aspect, under its supervision, as well as to Savings and Credit Cooperatives not authorized to operate with public funds.”

“ANNEX 1
COMMON INFRACTIONS
(Annex corresponding to more than one of the natural or legal persons supervised by the Superintendence and to Savings and Credit Cooperatives not authorized to operate with public funds, as well as to shareholders, directors, managers, employees, representatives thereof, and supervision collaborators) (…)
II. SERIOUS INFRACTIONS
(…)
23) Failing to take timely and appropriate action regarding observations and recommendations made concerning the company's prevention system, by internal and/or external audits and/or those indicated by the Superintendence.
24) Denying or failing to deliver within the established timeframe the information requested by UIF-Peru, in accordance with current regulations on the prevention of money laundering and terrorist financing.
(…)”

Likewise, numerals 16 and 17 are incorporated into the Very Serious Infractions of Annex 1, referred to Common Infractions, of the aforementioned Sanctions Regulation, with the following texts:

“(…)
III. VERY SERIOUS INFRACTIONS
(…)
16) Violating the duty of confidentiality enshrined in Article 12 of Law No. 27693, bringing to the knowledge of any person, entity, or organism, by any means or modality, the fact that some information has been requested by UIF-Peru or provided to it.
17) Failing to communicate to UIF-Peru the suspicious operations carried out by clients from the moment it is known through public media or otherwise, according to the case, that such persons are being investigated or prosecuted for the crime of money laundering, predicate offenses, the crime of terrorist financing and/or related crimes.”

ANNEX NO. 1
ALERT SIGNALS
This guide contains a list of alert signals that companies must keep in mind in order to detect and/or prevent suspicious operations related to money laundering and/or terrorist financing. In the event that any of the operations or situations indicated below are identified, they must be analyzed and evaluated in order to determine if they constitute suspicious operations to be communicated to UIF-Peru. The operations or situations indicated in numerals I and II are applicable to all companies. However, it should be noted that this guide is not an exhaustive list, so companies must consider other situations that deviate from normality according to their good judgment.

I. Unusual operations or conduct relative to company customers

1. The customer refuses to provide the requested information, it is inconsistent or difficult to verify by the companies.
2. The customer presents inconsistent or unusual identifications, which cannot be verified.
3. An address is given that is also that of a business and/or does not seem to correspond with the declared occupation (for example, student, unemployed, self-employed worker, among others).
4. The customer's phone is disconnected or the phone number does not match the initially supplied information.
5. The customer requests to be excluded from the operation register without apparent or justified cause.
6. The customer refuses to fill out the forms required by the company or provide necessary information to complete them or carry out the operation once asked to fill out the forms.
7. Frequent use of intermediaries to carry out commercial or financial operations.
8. The operations do not correspond to the customer's profile or economic activity.
9. Regarding non-profit organizations, such as associations, foundations, committees, NGOs, among others, financial transactions do not appear to have a logical economic purpose or there does not seem to be a link between the activity declared by the organization and the other parties participating in the transaction.
10. The customer carries out frequent or significant operations and lacks past or present work experience.
11. Financial statements reveal a financial situation that differs from that corresponding to similar businesses.
12. The customer insists on meeting with company staff in a place different from the office, agency, or premises of the company to carry out a commercial or financial operation.
13. The customer tries to pressure an employee not to fill out the forms required by the company.
14. That it is known through public media or otherwise, as appropriate, that a customer is being investigated or prosecuted for the crime of money laundering, predicate offenses, the crime of terrorist financing and/or related crimes.

16 Numeral modified by Resolution SBS No. 6561-2009 of 06/22/2009

15. Funds generated by a business belonging to individuals of the same origin or linkage of several individuals of the same origin, coming from countries with strict regulations regarding bank secrecy or tax havens or countries where there is known terrorist activity or are considered non-cooperative by the FATF or subject to OFAC sanctions, acting on behalf of similar types of businesses.
16. The customer shows unusual indifference regarding the risks assumed and/or the commissions and costs involved in the operation.
17. The customer repeatedly carries out split operations.
18. The customer carries out complex operations without an apparent purpose.
19. The customer constantly carries out operations and unusually uses or intends to use cash as the only means of payment instead of others.
20. Existence of customers among whom there is no relationship of kinship, financial and/or commercial, depending on whether they are natural or legal persons, however they are represented by the same person, without apparent explanation. Special attention must be paid when such customers have fixed their domiciles in tax havens.

II. Unusual operations or conduct relative to company employees

1. The employee's lifestyle does not correspond to their income or there is a notable and unexpected change in their economic situation.
2. The employee constantly avoids or refuses to take vacations.
3. The employee presents frequent and unjustified absences.
4. The employee frequently remains in the office outside working hours, without justified cause.
5. The employee uses their own home to receive documentation from clients.
6. Any business conducted by the employee where the identity of the beneficiary is unknown, contrary to the normal procedure for the type of operation in question.
7. The employee has or insists on having meetings with company clients in a place different from the office, agency, or premises of the company or outside working hours, without any justification, to carry out a commercial or financial operation.
8. The employee is involved in non-profit organizations, such as foundations, associations, committees, NGOs, among others, whose objectives have been duly demonstrated to be related to the ideology, claims, or demands of a national and/or foreign terrorist organization, provided that this is duly demonstrated.
9. An unusual or sudden growth in the number of operations under the employee's charge is presented.
10. Notable or unexpected change in the commercial nature of businesses owned by the employee.
11. It is proven that the employee has not communicated or has concealed from the Compliance Officer information relative to the change in behavior of any client.

III. Operations or situations related to the financial system

1. The customer buys traveler's checks, drafts, or payment orders in cash above the amounts required for operation registration.

2. Cash deposit with immediate purchase of traveler's checks, payment orders, or other instruments for payment to third parties.

3. The customer who frequently carries out operations for large sums of money (deposits, withdrawals, or purchases of monetary instruments) and refuses or avoids giving information about the origin and/or destination of the money or these operations do not relate to their economic activity.

4. Withdrawal of a significant amount from an account that had little movement or from an account that received an unusual deposit.

5. Accounts that receive periodic deposits and remain inactive in other periods.

6. An account shows little or no activity for a long period or contains a minimum sum of money, but is used as a temporary destination for funds that are transferred abroad or transferred or deposited locally and withdrawn completely or almost entirely. For example, numerous cash deposits or transfers, followed by a transfer of all funds either abroad or locally.

7. The corporate customer frequently makes large cash deposits and maintains high balances, but does not use other banking services.

8. The retail business that routinely makes numerous check deposits but rarely makes withdrawals for daily operations.

9. Large cash deposits to the account of a person or company when the apparent commercial activity of the individual or entity would normally be conducted in checks or other payment instruments.

10. Multiple transactions carried out on the same day in the same financial institution in an apparent attempt to use different counters, without justification for doing so.

11. Structuring of deposits through multiple agencies of the company or through groups of individuals who enter the same office at the same time.

12. The customer intentionally withdraws in cash part of their deposits for an amount lower than the limit required for operation registration.

13. The deposit of multiple monetary instruments in quantities that systematically fall below the limit required for operation registration, and particularly if the instruments are numbered in sequence.

14. ATMs are used to make numerous cash deposits or withdrawals or operations below the established limit for operation registration.

15. Deposits in savings accounts whose funds are frequently withdrawn by ATMs located abroad.

16. Substantial deposits in numerous US$ 50 and US$ 100 bills.

17. Frequent changes from low denominations to high denominations of cash.

18. The representative or intermediary who makes substantial cash deposits in customer or trust accounts, whose profile does not match such operations.

19. Deposits of large amounts of money through electronic means or others that avoid direct contact with company personnel.

20. Large volume of drafts, payment orders, and/or electronic transfers are deposited in an account whose movement does not relate to the customer's profile.

21. Frequent use of safe deposit boxes.

22. A safe deposit box is opened in the name of a customer whose commercial or economic activity does not seem to justify the use of a safe deposit box.

23. Use of credit cards for amounts significantly higher than the authorized credit line.

24. Loans for high amounts that are not used or are suddenly canceled partially or totally without a rational explanation of the source of funds, and especially if the cancellation is in cash, foreign currency, or other instruments in which the issuer is unknown.

25. Use of the loan for a purpose inconsistent with the object for which it was requested.

26. Loans guaranteed by assets deposited in the financial entity whose value has no relation to the customer's profile or whose source is unknown or by third parties who do not appear to have any relation with the customer.

27. Loans in which it is requested to make the disbursement in another province or department of Peru or in another country, without apparent labor or commercial explanation.

28. Certificates of deposit or other investment vehicle used as collateral for loans.

29. Operations involving customers residing in countries with strict regulations regarding bank secrecy or tax havens or countries where there is known terrorist activity or are considered non-cooperative by the FATF or subject to OFAC sanctions.

30. An account for which several people have authorized signature, but among whom there does not seem to exist any relationship (whether family ties or commercial relationships).

31. An account opened by a legal person or an organization that has the same address as other legal persons or organizations, but for which the same person or persons have authorized signature, when there is no apparent economic or legal reason for such type of agreement (for example, people serving as directors for multiple companies whose headquarters are located in the same place, among other scenarios.)

32. An account opened in the name of a recently created legal person and in which deposits are made higher than expected compared to the income of its founding partners.

33. The opening of multiple accounts by the same person, in which numerous small deposits are made, which, collectively, do not correspond to the expected income of the customer.

34. An account opened in the name of a legal person that is involved in the activities of an association or foundation whose objectives are related to the ideology, claims, or demands of a national or foreign terrorist organization.

35. An account opened in the name of a legal person or non-profit organization, such as foundations, associations, NGOs, among others, that may or may not be linked to a terrorist organization and that shows fund movements above the expected income level.

36. A temporarily opened account in the name of a legal person or non-profit organization, such as foundations, associations, NGOs, among others, that shows constant fund movements inside and outside the country, carried out by people with no apparent labor link with them.

37. Contribution of goods to a trust without identifying the taxpayer or the source of its funds.

38. Trusts that possess assets consisting of companies constituted abroad, especially where shares are bearer shares and the source and amount of the company's assets are unknown.

39. Cases in which the trust deed does not grant the trustee substantial control over the trust assets, and where control lies elsewhere, such as the creator of the trust or its beneficiaries.

40. Deposits of large sums of money in accounts that are not coherent with the customer's activity, and subsequent transfers to extraterritorial accounts.

41. The use of letters of credit and other extraterritorial mechanisms to move money between countries where such activity has no relation to the customer's normal activity.

42. Frequent deposits of traveler's checks or drafts in foreign currency in an account, especially if they come from abroad without a clear purpose.

43. Cash deposits in an account from foreign banks, when the frequency and volume of deposits are considerable considering the size, nature, and location of the customer's foreign bank.

44. A financing request, when the source of the customer's financial contribution (for example, down payment) with respect to a business is unclear, especially if real estate is involved.

45. Requests for credit facilities from unfamiliar customers who offer cash guarantees, financial assets, foreign currency deposits, or guarantees from foreign banks, and whose activity has no relation to the object of the operation.

46. Failure to pay credits obtained to finance legal business activities, or transfers of such credits to another company, natural person, or entity, without any apparent justification, which causes the bank to honor the guarantee backing the credit.

47. The use of standby letters of credit to guarantee loans granted by foreign financial entities, without apparent economic justification.

48. Back-to-back operations in which the guaranteed debtor in the country does not demonstrate linkage with the originator of the guarantee abroad, or presents an unusual or unclarified contractual relationship.

49. Existence of individual or joint client accounts with family relationships, which transfer money between themselves, periodically or occasionally, with instructions to invest, cancel, or transfer abroad in the name of the one who does not have a regular source of funds resulting from a business or consistent labor income relative to said amounts.

50. Opening accounts or acquiring different financial system products with cash, transfers, or checks from abroad, with the apparent product of labor or businesses carried out outside the country whose origin is difficult to prove in whole or in part.

IV. Operations or situations related to electronic transfers

1. Transfers to or from countries with strict banking secrecy laws or tax havens, or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions, without an apparent economic reason or when inconsistent with the client's history or line of business.

2. Periodic electronic transfers from a personal account to countries with strict banking secrecy laws or tax havens, or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions.

3. Electronic transfers for significant amounts on behalf of a foreign client with little or no explicit reason.

4. Frequent or significant volume of electronic transfers to or from countries with strict banking secrecy laws or tax havens, or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions.

5. Funds transferred within and out of an account on the same day or during a relatively short period of time.

6. Payments or receipts with no apparent link to legitimate contracts, goods, or services.

7. Transfers sent through multiple national or foreign banks.

8. Instructions to a financial institution to electronically remit funds abroad, and to expect an electronic transfer of funds back for the same amount but from different sources.

9. Numerous electronic transfers for small amounts of funds or deposits made via checks and payment orders, almost immediately transferred electronically to another city or country, in a manner inconsistent with the client's history or line of business.

10. Electronic transfers for significant amounts to persons or businesses that do not maintain accounts in the company.

11. Transfer out of the country of an amount previously consolidated deposited through several accounts, usually below the amount required for transaction registration.

12. Frequent or high-amount unilateral transfers, especially by way of donation. When they are donations, special consideration must be given if these are carried out by or in favor of non-profit organizations, such as foundations, associations, committees, NGOs, among others.

13. Electronic transfers just below the limit required for transaction registration.

14. Electronic transfers to or by an individual where information about the originator or the person on whose behalf the operation is carried out is not supplied with the electronic transfer, when such information is expected to be included.

V. Operations or situations related to investments

1. Purchase of financial instruments to be held in custody by the supervised company that does not correspond to the client's line of business.

2. Deposits or back-to-back loan operations in areas within Peru related to illicit drug trafficking, money laundering, or terrorism, or that involve countries that have strict banking secrecy laws or are tax havens or countries known for terrorist activity or considered non-cooperative by the FATF or subject to OFAC sanctions.

3. Clients requesting investment management services where the source of funds is not clear or consistent with the type of business of the client.

4. Purchase and sale of unusual financial instruments and settled in cash.

5. Purchase or sale of different fixed assets within a short period, not consistent with the client's profile or activities.

VI. Operations or situations related to general deposit warehouses

1. Goods left in deposit that do not correspond to the commercial, business, or productive line of business of the client.

2. Goods left in deposit that total significant sums that do not correspond to the client's activity profile.

3. Value of the goods left in deposit does not correspond to their reasonable market value.

4. Purchase and sale of deposit certificates between natural or legal persons whose activity is unrelated to the goods represented in said instruments.

5. Warrants issued in favor of banks abroad located in tax havens or countries with strict banking secrecy laws or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions.

6. Request for the use of field warehouses without apparent justification given the type of good on which the deposit is to be made.

7. Imports carried out by natural or legal persons who do not have a background in the commercial or production activity of the imported product or input.

8. High-volume or high-value imports or exports carried out by residents abroad who have no direct relationship with the user's economic activity.

9. Frequent shipments of small packages or small consignments in the name of the same person or different people with the same address.

10. Imports or exports carried out by foreigners without permanent activity in the country.

11. Import or export of high-value goods that do not relate to the client's activity profile.

12. Over-invoicing or under-invoicing of imports or exports.

13. Use of presumably false documents or fictitious exports.

14. Merchandise that enters the country documentally, but not physically, without apparent or reasonable cause.

15. Imports or exports to or from tax havens or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions.

16. Clients whose merchandise presents constant legal abandonments or differences in quantity and value of the merchandise in sample extractions and other controls of the merchandise required by current regulation.

17. Import or storage of substances that are presumed to be used for the production and/or manufacture of narcotics.

VII. Operations or situations related to the insurance system

1. The same beneficiary of life or retirement insurance policies for significant amounts, contracted by different persons.

2. Insurance by the same person in several life insurance policies with significant amounts, contracted in one or different insurance companies.

3. Request for a policy by a potential client from a distant geographic location, when close to their home they could obtain a contract of similar characteristics.

4. The client requesting an insurance policy whose insured amount does not match their standard of living or activity profile.

5. The client who shows no interest in the cost of the insurance or its convenience for their needs, but does reveal interest regarding early cancellation conditions.

6. Early cancellation of policies with return of premium to the insured without a clear purpose or in unusual circumstances, especially when the payment is made in cash or the return is to the order of a third party without apparent relationship.

7. Policies whose policyholder or contractor are legal persons or entities that have the same address, and for which the same persons have authorized signature despite there apparently being no economic or legal reason for it.

8. Clients domiciled in tax havens or countries where terrorist activity is known or which are considered non-cooperative by the FATF or subject to OFAC sanctions.

9. The client shows no interest in the yield of the policy, but is interested in the possibilities of early cancellation of the insurance.

10. Proposals to contract insurance on goods related directly or indirectly to crimes related to money laundering and/or terrorist financing, according to current legislation.

11. Contracting by the same policyholder or insured of several policies for amounts below the limit required for transaction registration, followed by cancellation with return of premiums.

12. Insurance beneficiary with no apparent relationship to the insured.

13. The insured moves the insured property in the policy immediately before the occurrence of the claim.

14. Payment of high premiums via electronic transfer or in cash.

15. Payment of a higher premium with subsequent return of the difference.

16. Payment of the premium by check or payment order by third parties without apparent relationship to the policyholder and/or insured.

17. Payment of claims without supporting documentation of the occurrence.

18. Issuance of policies where the risk has already occurred.

19. Issuance of policies for coverage of non-existent goods or persons.

20. Issuance of policies for coverage of deceased persons.

21. Payment of indemnity unrelated to the coverage of the insurance contract.

22. Payment of indemnity to third parties not indicated as beneficiaries or recognized as legitimate heirs according to law or without apparent relationship to the insured.

23. Payment of indemnity for a value higher than the capital declared in the policy.

24. The applicant wishes to borrow the maximum real value of the single-premium policy shortly after having paid it.

VIII. Operations or situations related to cash transport, custody, and administration companies

1. The amount of money or securities being transported does not correspond to the magnitude of the client's business (commercial or productive).

2. Frequent transport of small packages or small consignments in the name of the same person or different people with the same address.

3. The assignment to transport money and securities on behalf of a company is received, but the respective officials do not deliver the documentation accrediting that the money attributed corresponds to said company.

4. Sporadic transport of money from clients who are not banks, whose place of pickup and delivery is not a bank office.

5. Transport operations with a difference greater than 10%, between the amount of money declared in the service receipt filled out by the client, and the actual amount of the remittance established in the recount process.

6. Amounts of money transported that exceed 10% or more of the average monthly amount of the three previous months, understanding that the client has a regular behavior regarding the amounts transported monthly.

IX. Operations or situations related to fund transfer companies

1. Constant money transfers that do not correspond to the magnitude of the client's income or business (commercial or productive).

2. Substantial increase in the funds transferred usually by the client, without an evident explanation of said change in the magnitude of the client's income or business (commercial or productive).

3. Constant transfers made by several people to be collected by the same person or persons linked to each other, or vice versa.

4. Transfers for significant amounts between persons with little or no explicit reason.

5. Frequent transfers where the originator and beneficiary are the same person, but in different locations.

6. Transfers from abroad to the country or vice versa, carried out between legal persons or from natural person to legal person or vice versa, without apparent commercial link.

7. Transfers to or from legal persons for amounts close to the limits established for mandatory registration, individually or accumulated monthly.

8. Frequent or large-quantity money shipments that cannot be clearly identified as good faith operations, or that are carried out to or from countries commonly associated with the production, processing, and sale of drugs, terrorist organizations, or tax havens.

9. Transfers carried out frequently in a month, not necessarily of high amounts, and which when consolidated represent significant sums of money even being below the limit established for mandatory accumulated monthly registration.

10. Transfers from one or several senders, in different countries, and in favor of the same local beneficiary.

11. Shipments made to a group of beneficiaries, from the same or several locations, without an apparent relationship.

12. Transfers made in favor of a group of people, without apparent relationship, with the same phone number and address in the same city, for the collection of the drafts.

13. Group of beneficiaries who provide the same phone number or address for the collection of transfers.

14. Transfers carried out by clients who collect or send drafts using different intermediaries in the same geographic area or who send or receive drafts in places different from their residence.

15. Drafts received by people who have collected reporting several economic activities that do not relate to the amounts received.

16. Transfers in which the beneficiary says they do not know the name of the sender, the origin, the amount, and the purpose of the money.

X. Operations or situations related to the private pension system

1. Voluntary contributions for pension purposes by the worker or employer for significant, unusual amounts, or, in the case of the contribution made by the worker, that do not relate to the client's activity profile.

2. Voluntary contributions or withdrawals without pension purpose for significant, unusual amounts, or that do not relate to the client's activity profile. In particular, if the money is withdrawn in its entirety or almost in its entirety shortly after the contribution.

3. Mandatory contributions to the pension fund of independent affiliates for significant, unusual amounts, or that do not relate to the client's activity profile.

4. Payments in excess of contributions to the pension fund and the administrator for significant amounts.

5. Substantial increase in the monthly value of mandatory contributions to the pension fund without apparent cause.

6. Withdrawals for pension surplus in those cases that do not relate to the affiliate's income trajectory.

7. Transfer of pension funds of affiliates abroad. In particular, if the money is transferred shortly after the contributions were made.

ANNEX No. 4
BASIC CONTENT OF THE MANUAL FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING

The Manual for the prevention of money laundering and terrorist financing has the purpose that all shareholders, directors, control or administration bodies, authorized representatives, and in general all personnel of the companies have access to the policies and procedures that must be observed, which must contain, at least, the following information:

1. Policies

The general guidelines established in the Companies' Code of Conduct with the objective of preventing money laundering and terrorist financing in the company, which must be signed by its directors, managers, workers, and any authorized representative, for their knowledge and due compliance.

2. Prevention mechanisms regarding the client and the company's workers

2.1 Criteria for establishing knowledge of the client, the market, and correspondent banking, as applicable, in accordance with these standards.

2.2 Description of the methodology and procedures for obtaining, verifying, and updating client information, indicating the levels or positions responsible for its execution.

2.3 System to evaluate the personal, labor, and asset background of personnel.

2.4 Alert signals to determine unusual conduct by personnel.

2.5 Alert signals for the detection of unusual or suspicious operations.

2.6 Internal controls implemented by the company to prevent or detect suspicious money laundering and terrorist financing operations, as well as the areas of greater risk in the company, in accordance with these standards.

2.7 Training programs and the mechanisms implemented to promote such training of personnel in the latest money laundering and/or terrorist financing techniques and the prevention of these.

2.8 Internal sanctions for non-compliance with the Code of Conduct, the Manual, the prevention system as a whole, or current legal provisions.

3. Registration and communication procedures for operations

3.1 Procedures for recording and conserving the required information and documentation, in accordance with current regulation.

3.2 Elements that determine the company's good judgment.

3.3 Forms for the registration of operations and reporting of suspicious operations.

3.4 Internal procedures for consultation and communication of unusual and/or suspicious operations.

3.5 Procedures for reporting suspicious operations to the UIF-Perú within the legal deadline.

3.6 Procedures to attend to information requests or additional information requested by competent authorities.

4. Review of the prevention system

4.1 Hierarchy, functions, and responsibilities of the Compliance Officer and personnel under their charge. In the case of the Compliance Officer, their hierarchy within the company will always be that of manager. Likewise, it must be specified whether the Officer is full-time or not, as well as indicating if they are Corporate or if they exercise their functions also in the subsidiaries of multiple operation companies and insurance and/or reinsurance companies, which comply with the rules established in Article 36 of the General Law and are under the supervision and control of the Superintendence, in accordance with Article 21 of this Resolution.

4.2 Communication channels between the main office, branches, and agencies with the different instances within the company for the purposes of the prevention system.

4.3 Consultation mechanisms between the Compliance Officer and all departments of the company, including branches and agencies. In case the Compliance Officer is Corporate, the consultation mechanisms between all companies in the economic group must be indicated.

5. Legislation on the prevention of money laundering and terrorist financing

5.1 Law No. 26702

5.2 Law No. 27693, Law creating the Financial Intelligence Unit – Peru, and its amendments.

5.3 Regulation of Law No. 27693, Supreme Decree No. 018-2006-JUS.

5.4 Sanctions Regulation of the Superintendence.

5.5 Law No. 27765, Criminal Law Against Money Laundering, and its amendments.

5.6 Law No. 25475, Law establishing the penalty for terrorism crimes and the procedures for investigation, instruction, and trial.

5.7 Internal Audit Regulation of the Superintendence.

5.8 External Audit Regulation of the Superintendence.

5.9 Other norms on the subject.