SBS Resolution No. 11699-2008: Internal Audit Regulation

Lima, November 28, 2008

SBS Resolution No. 11699 -2008

The Superintendent of Banking, Insurance and Private Pension Fund Administrators:

WHEREAS:

In accordance with Article 180 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amendments, hereinafter the General Law, it is the responsibility of this Superintendency to establish the requirements and standards for internal audit for companies in the financial and insurance systems, in order to provide adequate protection to savers and policyholders;

WHEREAS, by SBS Resolution No. 1041-99 dated November 26, 1999, and its amendments, the Internal Audit Regulation was approved;

WHEREAS, in accordance with subsection e) of Article 57 of the Consolidated Text of the Law of the Private Pension Fund Administration System, approved by Supreme Decree No. 054-97-EF, it is the attribution and obligation of the Superintendency to supervise AFPs in compliance with the legal provisions and administrative directives that govern them, which is why it is convenient to include them within the scope of application of the Internal Audit Regulation;

WHEREAS, the work carried out by the internal audit of supervised companies constitutes a fundamental support mechanism for the supervision and control carried out by this Superintendency, making it necessary to update the minimum criteria required for its exercise in accordance with international standards and best practices;

WHEREAS, an effective and efficient internal audit constitutes a vital element for prudent administration in companies of the financial system, insurance, and private pension fund administrators;

WHEREAS, in accordance with the Law for the Creation of the Financial Intelligence Unit of Peru (UIF-Peru), approved by Law No. 27693 and its amendments, this Superintendency, to exercise its function of supervising the system for the prevention of money laundering and terrorist financing, will rely, among other agents, on internal audit areas, which will prepare a special annual report on the evaluation of the system for the prevention of money laundering and terrorist financing;

WHEREAS, on July 25, 2006, Regulation of Law No. 27693, approved by Supreme Decree No. 018-2006-JUS, was published, which regulates various aspects related to the work of the internal audit area of entities obliged to report to the UIF-Peru supervised by this Superintendency;

WHEREAS, by SBS Resolution No. 37-2008 of January 10, 2008, the Comprehensive Risk Management Regulation was approved, stating in Article 22 of said Regulation that internal audit plays an independent role in Comprehensive Risk Management;

WHEREAS, consequently, it is necessary to issue a new Internal Audit Regulation;

Having heard the opinions of the Deputy Superintendencies of Banking and Microfinance, of Risks, of Insurance, of Private Pension Fund Administrators, of Legal Advisory, of the Financial Intelligence Unit of Peru -UIF, as well as the Economic Studies Management; and,

In use of the powers conferred in numeral 7 of Article 349 and numeral 7 of Article 367 of the General Law;

RESOLVES:

Article First.- To approve the Internal Audit Regulation, which forms an integral part of this Resolution.

Article Second.- To grant a period until December 31, 2008, for companies to adapt to the provisions of the Regulation approved in Article First.

Article Third.- Once the adaptation period indicated in the previous article has expired, the Internal Audit Regulation approved by SBS Resolution No. 1041-99 of November 26, 1999, the last paragraph of Article 79 of Resolution No. 053-98-EF/SAFP, as well as all those provisions that totally or partially oppose it, shall be without effect.

Article Fourth.- The preparation, presentation, and implementation of the Annual Work Plan and its respective reports, corresponding to the 2009 exercise, shall be subject to the provisions of the Regulation approved by Article First.

Article Fifth.- Incorporate procedures Nos. 116 and 117 “Special authorizations for significant subcontracting of Internal Audit functions” and “Authorization to submit the Risk-based Audit Work Plan”, respectively, into the Consolidated Text of Administrative Procedures – TUPA of the Superintendency of Banking, Insurance and AFPs approved by SBS Resolution No. 131-2002, in accordance with the text attached to this Resolution and published as provided in Supreme Decree No. 004-2008-PCM, Regulation of Law No. 29091. (Institutional portal: www.sbs.gob.pe).

Register, communicate and publish,

FELIPE TAM FOX Superintendent of Banking, Insurance and Private Pension Fund Administrators

INTERNAL AUDIT REGULATION

CHAPTER I GENERAL PROVISIONS

Article 1.- Scope This Regulation shall apply to the companies indicated in Articles 16 and 17 of the General Law, as well as to Private Pension Fund Administrators (AFPs), hereinafter referred to as companies. In the case of Municipal Savings and Credit Banks (CMAC), the Municipal Popular Credit Bank of Lima, the Guarantee Fund for Loans to Small Industry (FOGAPI), the Banco de la Nación, the Banco Agropecuario, the Financial Development Corporation (COFIDE), Fondo MIVIVIENDA S.A., Derramas, Benefit Funds under the control of the Superintendency, and the Fund of Municipal Savings and Credit Banks (FOCMAC), this Regulation shall apply insofar as it does not conflict with the specific regulations governing the actions of these companies.1

Article 2.- Definitions For the application of this Regulation, the following definitions shall be considered: a) Programmed activities.- These are activities included in the Annual Audit Work Plan, some of which are mandatory due to regulatory requirements. b) Head Office.- Refers to the main company or the one exercising control in a financial or mixed conglomerate. c) Audit Committee.- Any reference to the Audit Committee, in cases where companies are not obliged to constitute such Committee in application of Article 11 of the Comprehensive Risk Management Regulation, shall be understood as referring to the Board of Directors. d) Days.- Calendar days. e) Board of Directors.- Any reference to the board of directors, or any equivalent body. f) Comprehensive risk management.- It is a process, carried out by the Board of Directors, Management, and personnel applied throughout the company and in the definition of its strategy, designed to identify potential events that may affect it, manage them according to its risk appetite, and provide reasonable assurance in achieving its objectives. g) Significant events.- Those events that may have a significant impact on the financial situation of the company, or on the achievement of its objectives. h) Head of internal audit.- The Manager or managerial level official, whatever their title, responsible for the internal audit unit or service. i) Policy and procedure manuals.- Documents containing functions, responsibilities, policies, methodologies, and procedures established by the company for carrying out the activities of each of its units, including those corresponding to risk management. j) Plan.- Refers to the Annual Audit Work Plan. k) Assurance services.- Objective examinations of evidence for the purpose of providing an independent assessment of an organization's risk management, control, and governance processes. These services include financial, performance, compliance, system security evaluations, among others. l) Consulting services.- Advisory, counseling, and related services provided to users, whose nature and scope are agreed upon with them and are aimed at adding value and improving the organization's governance, risk management, and control processes, without the internal auditor assuming management responsibilities. Examples of these activities include advice, counseling, facilitation, and training. m) Superintendency.- Superintendency of Banking, Insurance and Private Pension Fund Administrators.

Article 3.- Responsibility of the Board of Directors and the Audit Committee The board of directors is responsible for taking the necessary actions to ensure that the internal audit unit can perform its functions in accordance with the provisions of this Regulation and with the nature and complexity of the company's operations. The Audit Committee's main purpose is to ensure that accounting and financial reporting processes are appropriate, as well as to evaluate the activities carried out by internal and external auditors. The reports prepared by the internal auditor presented to the Audit Committee and required by this Regulation shall be understood as presented to the Board of Directors. The responsibilities indicated in this Regulation to the Audit Committee shall be understood as assigned to the Board of Directors when the Audit Committee has not been constituted. The Audit Committee Regulation, which must be approved by the Board of Directors, shall establish the relationships and reporting format between the Audit Committee, the Board of Directors, and the Internal Audit Unit, insofar as it does not conflict with this Regulation.

CHAPTER II ON INTERNAL AUDIT

Article 4.- Internal Audit Internal Audit is an independent and objective assurance and consulting activity, conceived to add value and improve the operations of companies, by helping them achieve their objectives by providing a systematic and disciplined approach to evaluating and improving the effectiveness of risk management and corporate governance.

Article 5.- Independence of the Internal Audit Unit Companies must have an internal audit unit, hereinafter UAI, which shall report to the Audit Committee, when it exists, and to whom it shall present the reports it prepares, unless, in the auditor's opinion, they should also be reported to the Board of Directors. The UAI must have sufficient independence to fulfill its functions effectively, efficiently, and timely, having all the powers and mechanisms to achieve its objectives. The UAI must have access to the information it requires for the fulfillment of its functions and the development of its examinations, without limitation that may affect its conclusions, including that derived from minutes of the board of directors and its Committees, and of any other governing body, management, or administrative level. In the case of CMACs and FOCMAC, the UAI must have internal regulations that establish the difference in its functions compared to those applicable to the Institutional Control Body (OCI), which are subject to the rules of the National Control System.2

Article 6.- Functions of the Internal Audit Unit The functions that the UAI must perform include, among others, the following: a) Evaluate the design, scope, and operation of internal control. b) Design the Plan and submit it for consideration by the board of directors for approval, as well as comply with the programmed activities and prepare the reports derived therefrom; c) Evaluate compliance with the legal provisions governing companies, in the course of its examinations, particularly the General Law and the provisions issued by the Superintendency; d) Continuously evaluate the quality and adequacy of information systems and the mechanisms established by the company to ensure information security; e) Continuously evaluate compliance with the company's policy and procedure manuals and other internal regulations, as well as propose modifications to them; f) Evaluate the timely and adequate implementation of recommendations and measures to overcome observations made by the Superintendency, external auditors, as well as those made by the UAI itself.3 g) Verify compliance with the system for the prevention of money laundering and terrorist financing. h) Evaluate compliance with those aspects determined by this Superintendency; and, i) Other assurance or consulting activities that the company itself indicates.

Article 7.- Competence of internal audit and significant subcontracting The UAI, when considered as a whole, must gather or obtain the knowledge, technical skills, and other competencies required to fulfill its responsibilities, according to the complexity and size of the company.

Competence of internal audit The UAI and the internal auditors that comprise it must possess the knowledge, technical skills, experience, and other competencies required for the fulfillment of their responsibilities. Every UAI must have an information systems audit service, which collaborates in achieving its functions and objectives. This service must have competent personnel with specific experience in systems auditing, appropriate in competencies to the complexity and size of the operations carried out by the company, which may also be subcontracted. The experience and specialization required for the professional practice of internal audit may be accredited, among others, by current international professional certifications such as the Certified Internal Auditor (CIA), issued by The Institute of Internal Auditors (IIA), and the Certified Information Systems Auditor (CISA), issued by ISACA.4

Significant subcontracting Significant subcontracting is defined as subcontracting whose purpose is to replace most of the functions assigned to the UAI, on a non-occasional basis and with the aim of accessing technical, resource, methodological, among other advantages. This type of subcontracting requires prior authorization from the Superintendency, as indicated in the First Final Provision.

Whatever the level of subcontracting, the head of audit remains responsible for ensuring that internal audit functions properly and effectively, and in accordance with current regulations and the service level agreement or equivalent. The contracting of specific services from professional service providers for the better development of the UAI's functions, which does not imply significant subcontracting, does not require prior authorization from this Superintendency, but must be reported to this supervisory body. The Head of Internal Audit is responsible for supervising compliance with the service contract, ensuring the overall quality of activities, reporting to the Audit Committee, as well as monitoring the results of the contracted work.

Article 8.- Infrastructure and other resources The UAI must have appropriate infrastructure and adequate human, technical, and logistical resources, commensurate with the magnitude and complexity of the company's operations, as well as the risks it faces. The Board of Directors is responsible for ensuring appropriate conditions for the development of the internal audit function. The head of internal audit and other internal auditors must receive permanent training in matters related to their functions, for which the head of internal audit is responsible for presenting training needs for UAI members, indicating the main training areas and the number of hours required annually.

Article 9.- Standards and guidelines for the practice of internal audit 5 Insofar as they do not conflict with the provisions of the Superintendency's regulations, the standards issued by The Institute of Internal Auditors (IIA) shall apply. In the case of systems auditors, the audit guidelines provided by ISACA shall be taken into consideration.

Article 10.- Risk-Based Audit (RBA) Risk-Based Audit consists of a set of processes through which audit provides independent assurance to the Board of Directors regarding:

• Whether the implemented risk management processes and measures are functioning as expected;
• Whether the risk management processes are appropriate and well-designed; and,
• Whether the risk control measures implemented by Management are adequate and effective, and reduce risk to the tolerance level accepted by the Board of Directors. RBA depends on the level of development that the company itself has achieved in risk management in the area under examination, and the extent to which appropriate objectives have been defined by Management against which associated risks can be measured. When the company has an adequate risk management system in the area(s) under examination, without prejudice to the need for additional verifications inherent in professional due care, RBA can rely to a greater extent on the risk assessment carried out by the company itself, and develop a Risk-Based Plan (RBP) that complements the actions carried out by the company and increases the value of Internal Audit activities. When the company has a less developed risk management system, RBA requires greater reliance on the risk assessment performed by the Audit itself.

CHAPTER III ON THE HEAD OF INTERNAL AUDIT

Article 11.- Appointment The UAI shall be headed by the Head of Internal Audit, who shall be a full-time, exclusive dedication managerial level official, who may not have management functions, whose appointment is the responsibility and attribution of the Audit Committee.

Article 12.- Requirements and impediments of the internal auditor The head of internal audit must have moral solvency, appropriate knowledge, and experience for the function performed by said unit, and must meet the following minimum requirements: a) Hold a professional title or Master's academic degree, as well as specialization in matters related to the functions of the UAI; b) Have at least three (3) years of experience in audit activities, as appropriate, in financial system companies, insurance companies, pension funds, complementary or related services, benefit funds, pension funds, and/or have held similar positions for said companies, for a period of not less than five (5) years, as appropriate; c) Have no criminal record; d) For obliged companies, not be subject to any of the impediments indicated in Article 81 of the General Law, with the exception of numeral 5 of said article; e) Not have been sanctioned by this Superintendency for committing serious or very serious infractions; f) Not have been sanctioned by any public body for committing infractions considered serious or very serious by the sanctioning entity; g) Not have ownership or management links with the company or with the legal entities that are part of the conglomerate to which it belongs. Likewise, not have a family relationship with its shareholders or partners, directors, managers, legal representatives, or principal officers, in accordance with the regulations issued by this Superintendency; h) Not be in situations that limit the necessary independence for the exercise of their functions; With the exception of literals a) and b) indicated in this article, the other members of the UAI must comply with the requirements indicated in the previous paragraph. Likewise, said members must not have management functions. The minimum requirements indicated must be duly verified by the human resources area or equivalent, and such verification must be recorded in the personnel files.

Article 13.- Responsibility of the Head of Internal Audit The Head of Internal Audit is responsible for complying with the obligations assigned to them in this Regulation, as well as for immediately informing this Superintendency, within two (2) business days, of any event that significantly affects the operation of the UAI and/or its independence.

1 Paragraph modified by SBS Resolution No. 1325-2018 published on 06.04.2018. 2 Paragraph modified by SBS Resolution No. 1325-2018 published on 06.04.2018. 3 Literal modified by SBS Resolution No. 1325-2018 published on 06.04.2018. 4 Paragraph modified by SBS Resolution No. 1132-2025 published on 26.03.2025. 5 Article modified by SBS Resolution No. 1132-2025 published on 26.03.2025.

9 The Head of Internal Audit is also responsible for immediately and directly informing the Superintendency and the audit committee, simultaneously, of the occurrence of significant events. Such communication must be made within two (2) business days of the conclusion of the corresponding evaluations and the issuance of the report. Depending on the circumstances and their importance, the Head of Internal Audit may provide preliminary information on significant events under examination and send preliminary reports if deemed convenient; and likewise, the Superintendency may request them, pending the final report. It is the responsibility of internal auditors to apply the general standards defined by Article 9 in the exercise of their functions. Article 14.- Removal of the Head of Internal Audit The removal of the Head of Internal Audit may only be carried out for duly justified cause, which must be agreed upon by the board of directors. In the case of companies that are part of the National Control System, they must take into account the specific applicable regulations. The adoption of such an agreement must be communicated to this Superintendency, indicating the reasons for this decision. This Superintendency may summon the Head of Internal Audit and take the measures it deems necessary. The vacancy situation due to removal or resignation may not last more than thirty (30) days, except for reasons of force majeure which must be reported to the Board of Directors and this Superintendency. Article 15.- Interim Head of Internal Audit Prior authorization from this Superintendency, the IAU may be in charge of an interim Head of Internal Audit for a period of up to six (6) months, who must comply with the requirements referred to in Article 12 of this Regulation, with the exception of the provisions of subparagraph b) of the aforementioned article. Alternatively to what is indicated in the aforementioned subparagraph, the experience will be at least two (2) years in audit activities of the indicated companies or in the performance of related managerial positions in said companies. The registration process will follow through the information system of the Registry of Directors, Managers and Principal Officers (REDIR), in the manner provided for the Head of Internal Audit. CHAPTER IV ON THE WORK PLAN Article 16.- Minimum Content of the Plan The annual internal audit work plan must include all tasks to be carried out. Said Plan must be approved by the board of directors, and a copy thereof must be sent to this Superintendency no later than December 31 of the previous year. Said Plan must consider, at least, the following aspects: a) Objectives and scope of the plan b) Activities, examinations and reports and their schedule; c) Human resources available for the fulfillment of the Plan, indicating, if applicable, the need to contract specialized services; and, d) Follow-up on observations made by this Superintendency. The activities mentioned in subparagraph b) must include at least what is indicated in the annex attached to this Regulation, unless authorization from the Superintendency is obtained, as indicated in the Third Final Provision. In addition, the Superintendency may request additional activities and require complementary information about the content of the Plan. Likewise, the Superintendency, by means of a Multiple Official Letter, may define the minimum structure that the Plan must contain, as well as its presentation by electronic means. In the case of CMACs, the annual internal audit work plan must be formulated in such a way that there is no duplication with respect to the functions corresponding to the OCI, which is subject to the rules of the National Control System.6 Article 17.- Modifications to the Plan Significant modifications made to the Plan must be approved by the Audit Committee and reported to the Superintendency as part of the plan progress report referred to in the following article. CHAPTER V ON REPORTS SUBMITTED TO THE SUPERINTENDENCY Article 18.- Report on the Progress of the Plan The IAU will submit to this Superintendency a quadrimester report on the progress of the Plan, indicating the degree of fulfillment of the objectives and activities carried out and other relevant aspects, among others, within twenty (20) days after the close of each quadrimester. The last quadrimester report will account for the activities planned and carried out during the year. Said report will include a list of the reports prepared by the IAU during the respective period, a brief summary of the content and the observations found and their importance. Likewise, said report will contain an evaluation of the status of the observations and recommendations made by this Superintendency, indicating those overcome, pending, in process and their age. The report must be brought to the timely attention of the board of directors or the audit committee, when the latter has been constituted, for the taking of pertinent actions. Regarding the report on the progress of the Plan, ETFs must submit the reports semi-annually, within twenty (20) days after the close of each semester. This Superintendency, by means of a Multiple Official Letter, may define the minimum structure that the report must contain, as well as its presentation by electronic means. Article 19.- Special Reports In addition to what is indicated in the previous article, the IAU must submit annual special reports to this Superintendency, which may be included as part of the report corresponding to the last quadrimester, on the following:

1. For the companies indicated in sections I, II, III, IV and VI of the attached annex, the evaluation of the anti-money laundering and terrorism financing system, emphasizing: a) Establishment of policies that ensure adequate customer knowledge, market knowledge and correspondent banking knowledge, when applicable. b) Existence of the Manual for the Prevention of Money Laundering and Terrorism Financing, permanently updated and in accordance with current legislation. c) Level of compliance with the Manual for the Prevention of Money Laundering and Terrorism Financing. d) Existence of periodic training programs that cover all levels of the company. e) Compliance with regulations on the prevention of money laundering and terrorism financing. f) Evaluation of the criteria applied by the Compliance Officer for not considering certain operations suspicious. In case there is a Committee for the Prevention of Money Laundering and Terrorism Financing, the assistance provided by said Committee must also be evaluated. g) Timeliness of communication of suspicious operations to the FIU-Peru based on the Registry of Suspicious Operations. Said review does not imply access to information protected by the duty of confidentiality, provided for in Article 12 of Law No. 27693. h) Implementation of the Operations Registry in accordance with the guidelines established by current regulations. The conclusions of said evaluation must be presented to the Superintendency through an annual special report. Said report will be presented within the period established for the Annual Report of the Compliance Officer corresponding to the second semester.
2. For the companies indicated in sections I and IV of the attached annex, except Investment Banks, the evaluation of the functioning of the system for handling requirements and complaints, as well as compliance with the provisions on the management of market conduct of the financial system, emphasizing: a) Implementation of policies and procedures defined by the company, in accordance with the Market Conduct Principles on its business practices, information transparency and complaint management. b) Criteria established by the company to ensure full transparency in the dissemination of interest rates, commissions, expenses and other fees for active and passive operations it carries out, as well as their modifications. c) Timely compliance in communicating modifications to interest rates, commissions, expenses and other fees. d) Compliance with all aspects referred to in the provisions on market conduct management of the financial system, regarding the information attached to contracts whose purpose is the performance of active and passive operations. The conclusions of said evaluation must be presented to the Superintendency through an annual special report. Said report will be presented within the period established for the Annual Report of the Market Conduct Officer.7 12 CHAPTER VI ON REPORTS SUBMITTED TO THE BOARD OF DIRECTORS Article 20.- Submission to the Board of Directors The IAU must submit to the audit committee or board of directors all reports it prepares in fulfillment of its functions. Said body will evaluate the respective reports no later than the immediate session following their submission. The timeliness with which said body becomes aware of the reports, the decisions adopted in this regard, and the follow-up of corrective measures must be recorded in the respective Minute Book. Article 21.- Files The IAU must maintain a file containing the reports prepared, work papers and communications informing the result of its examinations to the different units of the company, as well as the supporting documentation thereof. Said information must be available to the Superintendency, external auditors and, if applicable, risk rating companies, when so required. Article 22.- Minimum Content of the Reports The IAU reports must contain, at least, the following information: a) Objective and scope of the evaluation; b) Evaluation of the situation of the activity or operation as of the date of the report, identifying the detected risks and their impact on the company; c) Observations and recommendations made, regardless of whether they have been remedied or not at the close of the report, indicating their status; d) Name of the official responsible for the evaluation; and, e) Start and end date of the evaluation. FINAL PROVISIONS First.- Special authorizations for significant subcontracting of internal audit functions With the exception of the Fishermen's Benefits and Social Security Fund, the Military and Police Pension Fund and the Benefit Funds, the functions of the IAU may be subject to significant subcontracting with the parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation, or with specialized audit firms, provided that said subcontracting equals or exceeds the criteria provided in this Regulation and represents a significant advantage in scope, specialization and professional competence. Companies, prior to subcontracting, must request authorization from the Superintendency, with the approval of the Board of Directors, for which they will present the following information:
3. Request presented by the Audit Committee,
4. Organization of the audit service of the parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation, as relevant to the requested authorization.
5. Justification for the reason for subcontracting.
6. Methodology to be applied.
7. Description of available resources.
8. Detailed explanation of how the provisions established in this regulation will be applied, as relevant. 13
9. Report describing how compliance with the International Standards for the Professional Practice of Internal Auditing, as published by The Institute of Internal Auditors, is given, insofar as it does not conflict with this regulation.
10. Draft Service Level Agreement or equivalent, indicating the measures the company will take to ensure its proper fulfillment.
11. When contracting a specialized firm, additional information will be presented about the planned audit teams, responsible partner, seniority and experience of the firm in Peru in relevant audit tasks.
12. Others at the request of the Superintendency. Additionally, the following must be considered: a) In cases where the activities of the conglomerate to which the company belongs are carried out mainly outside the country, the functions of the Internal Audit Unit may be assumed by its parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation. This subcontracting modality, when provided from outside the country, will be mainly aimed at covering the audit needs of companies whose volume of operation does not require the presence of permanently established teams in Peru. The company must designate a local person responsible for monitoring the proper functioning of the services received, through the service level agreement or equivalent, who will be responsible for compliance with this Regulation before the Superintendency, as well as with the rules related to the internal auditor. b) Specialized firms with which the internal audit function is subcontracted cannot provide consulting services, external audit services or other services to the same company that limit their independence in the exercise of the internal audit function. Likewise, the specialized firm may not have carried out the evaluation of the anti-money laundering and terrorism financing system, nor the examination of the financial statements during the two (2) previous consecutive years, a restriction that is also applicable to the members of the teams. Likewise, the same partner rotation requirements, applicable to external auditors, must be observed, according to the External Audit Regulation. Specialized firms must operate and be legally authorized for this purpose in Peru. Given the specialized nature of their services, these firms must have external methodological support and periodic quality reviews, as well as relevant experience in the country. Second.- Cancellation of authorizations This Superintendency may cancel at any time the special authorizations granted to which this norm refers, when in the exercise of its supervisory function it observes that, among other reasons, the volume of operation, the company's activities or the services of the parent company changed significantly and did not adequately cover the associated risks, that the company has failed to comply with the obligations provided, or that the authorization granted has not contributed to an improvement in the audit work. Third.- Risk-Based Audit Plan (RBAP) and programmed activities Companies must include in their plan the aspects contemplated in the special reports corresponding to the evaluation of the anti-money laundering and terrorism financing system and the evaluation of the functioning of the user attention system, as well as the activities related to compliance with the provisions on information transparency and contracting with users of the financial system, indicated in Article 19 of this Regulation, which are required by legal mandate. Likewise, those companies that have solid internal audit practices and adequate compliance with the criteria provided in this regulation, may request authorization from the Superintendency so that in the formulation of their annual plan, only the activities provided in the annex “programmed activities” that are relevant according to the company's own risk-based audit methodology implemented, should be considered, having to include for each “programmed activity” that had not been considered in its plan, except for activities 17A8, 23 and 24 of section I which cannot be excluded from the plan, the reasons that support not having considered it in the audit plan for that year.9 14 Requests for authorization to the Superintendency must be submitted at least sixty (60) calendar days before the submission of their annual plan, for which they must present the following documentation: a) Request made by the Internal Auditor or Audit Committee, b) Description of the risk-based audit approach and associated methodology. c) List of existing human and technical resources, as well as related contracting policies, such as specialized system audit services, among others. d) Self-assessment carried out by the Internal Auditor on the degree of compliance with the “International Standards for the Professional Practice of Internal Auditing” according to the Institute of Internal Auditors (IIA), and the measures it will take in relation to cases where there is a significant deviation. The Superintendency will determine the term of the authorization, indefinitely or only for a specific fiscal year, as well as with the exceptions it deems necessary, based on the evaluation of the information submitted by the applicant company. Likewise, if as a result of its supervisory work it deems necessary to carry out certain examinations excluded by the company, it may require them for inclusion as an unplanned activity. The Superintendency's authorization does not exempt the company from complying with the examinations required by current laws, it being understood that this is limited only to those activities required by regulation issued by the Superintendency. Fourth.- Agreements Supervised companies may establish collaboration and mutual support agreements, technology transfer or others, for the proper application of this Regulation. Fifth.- Complementary and Related Services Companies For the purposes of what is indicated in Article 11 of this norm, in the case of Complementary and Related Services Companies, said companies will be subject to the provisions of the aforementioned article, in accordance with the magnitude of the operations they carry out. Fund Transfer Companies (ETFs) whose monthly average of funds transferred in the last twelve (12) months is equal to or exceeds four thousand (4,000) Tax Units (UITs), must have a full-time Internal Auditor. The Internal Auditor of ETFs whose aforementioned monthly average is less than the referred 4,000 UITs, may be contracted part-time and under any modality, having to comply with the requirements and functions indicated in this Regulation. 15 TRANSITORY PROVISION FIRST:10 Exceptionally, in the case of the annual internal audit work plan corresponding to the year 2009, the request for authorization referred to in the Third Final Provision must be submitted at least thirty (30) calendar days before the submission of the Plan. SECOND:11 The requirements contemplated in the Regulation will be applicable to the Peruvian Federation of Municipal Savings and Credit Banks (FEPCMAC) as long as it is under the supervision of the Superintendency, in accordance with the provisions of Article 21 of Supreme Decree No. 157-90-EF and its modifying norms. THIRD:12 In the case of the annual audit work plan referred to in the Third Final Provision, companies with authorization must incorporate activities 23 and 24 of numeral I of the Annex “Programmed activities” into their plan.

16 ANNEX PROGRAMMED ACTIVITIES As part of the annual plan, companies must consider at least carrying out examinations aimed at evaluating and verifying the proper functioning of the following topics: I. COMPANIES MENTIONED IN SUBPARAGRAPHS A, B AND C OF ARTICLE 16 OF THE GENERAL LAW (EXCEPT SURETY AND GUARANTEE COMPANIES), BANCO DE LA NACIÓN, BANCO AGROPECUARIO, FONDO MIVIVIENDA AND CORPORACIÓN FINANCIERA DE DESARROLLO (COFIDE)13:

1. Evaluation of compliance with the companies' operational limits, both individual and global;
2. Evaluation of the allocation criteria and compliance with capital requirements for each risk, the calculation of leverage, and total effective equity;
3. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity14;
4. Evaluation of market risk management, which must include a review of compliance with management and operational requirements for operations that generate market risk. Likewise, the evaluation of market risk management must include: a) Review of compliance with policies and procedures. b) Review of compliance with regulatory and internal limits. c) Review of the assumptions and results of market risk measurement models, as well as models for stress tests and backtesting, if applicable. d) Review of the quality of information in the applicable regulatory annexes, verifying compliance with the respective methodological notes, as well as the reasonableness of the assumptions, and the timely submission of information to the Superintendency.15 4A) Evaluation of liquidity risk management;16
5. Evaluation of credit risk management; which must include the review of the classification of a representative sample of non-retail credit portfolio debtors, at least quarterly, with the composition of the sample being able to vary in each review. The methodology for determining the representative sample and its modifications must be duly documented and remain at all times available to the Superintendency. This control body may require modifications to said methodology. 13 Title modified by SBS Resolution No. 8934-2012 published on 01.12.2012. Subsequently modified by SBS Resolution No. 3544-2015 published on 26.06.2015. 14 Paragraph replaced by SBS Resolution No. 504-2021 published on 23.02.2021, effective from the audit corresponding to fiscal year 2022. 15 Paragraph replaced by SBS Resolution No. 4906-2017 published on 26.12.2017. 16 Paragraph incorporated by SBS Resolution No. 9075-2012 published on 07.12.2012.

17 The methodology for determining the representative sample must consider, among other criteria: the largest individual exposures, debtors who have been subject to alerts, debtors who have repeatedly had occasional arrears, and debtors who have improved their classification during the last year. It must also include debtors of refinanced and restructured credits, credits granted to persons related to the financial system company itself, and debtors reclassified by the company or by the Superintendency. For the review of the classification of retail credit debtors, permanent automated controls must be implemented. Likewise, companies must use data integrity analysis and perform representative sample analysis, as review procedures, at least once a year. In the case of economic groups or the presumption of single risk referred to in Article 203 of the General Law, the review will be carried out by treating them as a single client. 5A) Evaluation of the process of managing, classifying, and registering commitments, including ensuring that the areas responsible for defining the amount of commitments are competent according to the company's internal policies;17 6) Evaluation of credit exchange rate risk management; 6A) Evaluation of country risk management;18 7) Evaluation of compliance with the provisions indicated in the special rules on linkage and economic group; 8) Analysis of the mechanisms for the comprehensive risk management of the financial group, taking into account risk exposure from operations carried out with natural persons, legal persons or legal entities, and companies of the conglomerate. Evaluation of the significant accounting policies used in the consolidation of the financial statements of the financial group and of the consolidable groups, as well as the evaluation of compliance with capital requirements, global and concentration limits, and other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates;19 9) Evaluation of compliance with the standard on Requirements for the Ethical Conduct and Professional Capacity of Persons Participating in the Investment Process of Banking and Insurance Companies and Portfolios Managed by AFPs; 10) Evaluation of the nature and frequency of complaints submitted to companies as well as the treatment given to them; 11) Evaluation of compliance with the recommendations made by the Internal Audit Unit (UAI), external auditors, and the Superintendency; 12) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.20 17 Paragraph incorporated by SBS Resolution No. 4345-2023 published on 04.01.2024, effective from July 2025 information. 18 Paragraph incorporated by SBS Resolution No. 7932-2015 published on 04.01.2016. 19 Paragraph modified, effective from 01-01-2011, by SBS Resolution No. 11823-2010 of 29-09-2010 and by SBS Resolution No. 779-2021 effective from 01.04.2021. 20 Paragraph modified by SBS Resolution No. 8754-2011 published on 05.08.2011.

18 13) Evaluation of credit portfolio transfer and acquisition operations.21 14) Evaluation of trust operations.22 15) Evaluation of compliance with the provisions indicated in the Regulation for the Management of Social and Environmental Risk, if said regulation is applicable.23 16) Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment method criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan compliance, annual productivity bonuses, among others24.

17. Evaluation of compliance with the Regulation on Classification and Valuation of Investments of Financial System Companies, the Rules for Investment in Instruments Traded Through Non-Centralized Trading Mechanisms, and the Regulation for the Trading and Accounting of Derivative Financial Products in Financial System Companies.25 17A) Annual evaluation of the procedures that the company has established and uses in the calculation of deposit amounts subject to coverage and the premium paid to the Deposit Insurance Fund. The auditor must evaluate at least two of the quarters comprised in the last twelve months, counted from the date on which the review begins.26
18. For CMACs, verification of compliance with Supreme Decree No. 157-90-EF and its modifying regulations and the regulations issued by the Superintendency, which includes at least the provisions of articles: 8 (not considering 8-A and 8-B), 11 and 12 of the aforementioned Supreme Decree No. 157-90-EF, as well as the first final complementary provision of Law No. 30607.27
19. For Municipal Savings and Credit Banks:28 a) The evaluation of compliance with the standards indicated in the special rules for the implementation of Law No. 30607 regarding the capitalization of profits. b) The evaluation of compliance with the provisions of the Regulation on the Participation of Municipal Savings and Credit Banks in the Law that promotes regional and local public investment with private sector participation, if applicable.
20. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.29
21. For companies included in subparagraphs A and B of Article 16 of the General Law, the Banco de la Nación and the Banco Agropecuario; in accordance with the provisions of Article 1 of 21 Paragraph modified by SBS Resolution No. 1308-2013 published on 20.02.2013. 22 Paragraph incorporated by SBS Resolution No. 1882-2014 published on 29.03.2014. 23 Paragraph incorporated by SBS Resolution No. 1928-2015 published on 28.03.2015. 24 Paragraph incorporated by SBS Resolution No. 272-2017 published on 23.01.2017. 25 Paragraph incorporated by SBS Resolution No. 4906-2017 published on 26.12.2017. Subsequently renumbered by SBS Resolution No. 681-2018 published on 24.02.2018. 26 Paragraph incorporated by SBS Resolution No. 2448-2020 published on 09.10.2020. 27 Paragraph incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018. 28 Paragraph incorporated by SBS Resolution No. 1706-2018 published on 04.05.2018. 29 Paragraph incorporated by SBS Resolution No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to fiscal year 2022.

19 the Provisions for the application of maximum interest rates, approved by SBS Resolution No. 02192-202230: Evaluation of the procedures established by the company for the proper application of maximum interest rates in its consumer credit operations, and for small and micro-enterprises, which must include, at least, the following: a) Establishment and implementation of procedures in accordance with the provisions associated with the application of maximum interest rates. b) Designation of a person responsible for monitoring and reporting on the application of maximum interest rates, as well as the level of compliance with their functions. c) Timeliness and quality of information submitted to the Superintendency. 22) Evaluation of compliance with the provisions indicated in the Model Risk Management Regulation, if said regulation is applicable.31 23) Evaluation of the balances and movements of in-process operations, as well as their age. It must be verified that the balances do not exceed the maximum periods allowed by accounting provisions, as well as analyzing cases that have exceeded said periods and the reasons for this, and evaluating the accounting dynamics in such cases. In addition, a significant sample of the registered items must be identified, which includes at least the most significant movements of in-process operation items, those that are not carried out regularly, those carried out with related parties, in order to identify the nature of said movements, independently of the closing balances.32 24) Evaluation of the balances and movements of operations between the main office, branches, and agencies. It must be verified that the active and passive accounts corresponding to the main office, branches, and agencies of the company are used in accordance with accounting provisions and that their balances are duly offset, as well as analyzing cases where this is not complied with. In addition, a significant sample of the registered items must be identified, which includes at least the most significant movements and those that are not carried out regularly, those that correspond to operations with other companies, such as their related parties, in order to identify the nature of said movements and the reclassifications that must be made.33 25) For companies included in subparagraphs A and B of Article 16 of the General Law, as well as for the Banco de la Nación and the Banco Agropecuario, evaluation of compliance with the requirements for the use of transactional information for the estimation of sales, income, and expenses of the family-business unit of debtors with small business or micro-enterprise credits, if applicable.34 Other evaluations and reports that companies must periodically carry out in accordance with the current provisions of this Superintendency.35 30 Paragraph incorporated by SBS Resolution No. 2192-2022 published on 14.07.2022. 31 Paragraph incorporated by SBS Resolution No. 00053-2023 published on 11.01.2023. 32 Paragraph incorporated by SBS Resolution No. 467-2023 published on 13.02.2023, effective from the audit plan corresponding to fiscal year 2024. 33 Paragraph incorporated by SBS Resolution No. 467-2023 published on 13.02.2023, effective from the audit plan corresponding to fiscal year 2024. 34 Paragraph incorporated by SBS Resolution No. 2368-2023 published on 19.07.2023, effective from the audit plan corresponding to fiscal year 2025 to be submitted to the SBS no later than 31.12.2024. 35 Paragraph incorporated by SBS Resolution No. 8754-2011 published on 05.08.2011.

20 II. INSURANCE AND/OR REINSURANCE COMPANIES:

1. Evaluation of the management of risks other than technical insurance risks, which include operational, market, credit, liquidity risks, among others; as well as, evaluation of compliance with the procedures used for the identification, measurement, control, and reporting of said risks;36
2. Evaluation of policy underwriting management and premium collection;
3. Evaluation of compliance with the procedures carried out by the person(s) in charge of the actuarial function and the technical risk management function;37
4. Evaluation of co-insurance and reinsurance management, as well as the determination of the quality of reinsurers;38
5. 39
6. Evaluation of compliance with the procedures carried out to guarantee the quality of the data used in pricing, in the calculation of technical reserves, and the solvency margin;40
7. Evaluation of investment management and its valuation. As part of this evaluation, it must include:41 a) Verify that a record of the personal investments of those who make decisions in the investment process is kept, including personnel from the risk and investment committees and the board of directors. b) Verify that there is independent control to ensure that personnel who have access to information regarding the analysis, strategies, positions, among other reserved information regarding the company's investments, sign sworn declarations of compliance with the Policies for appropriate use of reserved information; and that these are available to the Superintendency. c) Regarding assets that are subject to notification and authorization processes, within the framework of Articles 26, 27, and 28 of the Regulation on Investments of Insurance Companies, reasonable compliance with the minimum requirements established for the investment and risk units indicated in Articles 13 and 15 of said Regulation must be verified, which contribute to ensuring the adequate investment process linked to the instrument under analysis.42
8. Evaluation of management in the marketing of policies and the transparency of information to potential insureds;
9. Evaluation of compliance with the Superintendency's provisions regarding the justification for rejecting claims;
10. Evaluation of the nature and frequency of complaints submitted to companies, as well as the treatment given to them; 36 Paragraph modified by SBS Resolution No. 2507-2010 published on 19.03.2010. Subsequently, modified by SBS Resolution No. 00053-2023 published on 11.01.2023. Subsequently, modified by SBS Resolution No. 397-2024 published on 05.02.2024, effective from 01.04.2024. Subsequently, modified by SBS Resolution No. 1660-2025 published on 09.05.2025, effective from 01.01.2026. 37 Paragraph modified by SBS Resolution No. 3863-2016 published on 16.07.2016. 38 Paragraph modified by SBS Resolution No. 4706-2017 published on 13.12.2017. 39 Paragraph deleted by SBS Resolution No. 3863-2016 published on 16.07.2016. 40 Paragraph modified by SBS Resolution No. 3863-2016 published on 16.07.2016. 41 Paragraph replaced by SBS Resolution No. 1041-2016 published on 27.02.2016. 42 Subparagraph incorporated by SBS Resolution No. 556-2025 published on 18.02.2025.

21 11) Evaluation of compliance with the provisions indicated in the special rules on linkage and economic group; 12) Analysis of the mechanisms for the comprehensive risk management of the financial group, taking into account risk exposure from operations carried out with natural persons, legal persons or legal entities, and companies of the conglomerate. Evaluation of the significant accounting policies used in the consolidation of the financial statements of the financial group and of the consolidable groups, as well as the evaluation of compliance with capital requirements, global and concentration limits, and other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates 43 13) Evaluation of compliance with the standard on Requirements for the Ethical Conduct and Professional Capacity of Persons Participating in the Investment Process of Banking and Insurance Companies and Portfolios Managed by AFPs; 14) Evaluation of compliance with the recommendations made by the Internal Audit Unit (UAI), external auditors, and this Superintendency; 15) Evaluation of the custody and intermediation of the company's investments and, if applicable, the implementation and exercise of investment mandates, in accordance with the provisions of the Regulation on Classification and Valuation of Investments of Insurance Companies;44 16) Evaluation of compliance with the regulatory limits established by the Superintendency.45 17) Evaluation of the quality of the information submitted to the Superintendency regarding financial statements and accounting information (forms, annexes, reports, and statements) required by the regulations issued by the Superintendency.46 18) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function.47 19) Evaluation of trust operations.48 20) Evaluation of the remuneration system for employees and board members, which must include at least:

• Measurement, evaluation, periodicity, and payment method criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.
• Policies related to variable remuneration, including bonuses for strategic plan compliance, annual productivity bonuses, among others49.

21. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for 43 Paragraph modified by SBS Resolution No. 11823-2010 of 29-09-2010 published on 01.10.2010 effective from 01.01.2011. Subsequently modified by SBS Resolution No. 779-2021 published on 19.03.2021 effective from 01.04.2021. 44 Paragraph modified by SBS Resolution No. 5027-2017 published on 30.12.2017 effective from the audit corresponding to fiscal year 2018. 45 Paragraph modified by SBS Resolution No. 2507-2010 published on 19.03.2010. 46 Paragraph incorporated by SBS Resolution No. 2507-2010 published on 19.03.2010. 47 Paragraph modified by SBS Resolution No. 8754-2011 published on 05.08.2011. 48 Paragraph incorporated by SBS Resolution No. 1882-2014 published on 29.03.2014. 49 Paragraph incorporated by SBS Resolution No. 272-2017 published on 23.01.2017.

22 controversies.50 22) Review of the consistency of the information contained in the database of insured assets to calculate the Loss at Risk (LaR) in the calculation of the catastrophic reserve, which is sent to the Superintendency via Annex No. SG-4, as well as the information contained in Annex No. SG2, Annex No. SG-3, Annex No. SG-4A, and Annex No. SG-7. 51 23) Evaluation of asset and liability management. As part of this evaluation, the following must be included: 52 a) Review of compliance with policies and procedures. b) Review of compliance with regulatory and internal limits. c) Evaluation of the procedures carried out to guarantee the quality of the information sent to the Superintendency regarding Homogeneous Groups of Regulatory Obligations, the Analysis of Asset Sufficiency, interest rate risk indicators, liquidity indicators, stress tests, and liquidity contingency plan. The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency. 53 III. COMPANIES OF COMPLEMENTARY AND RELATED SERVICES:

1. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and cybersecurity;54
2. Evaluation of the nature and frequency of claims presented to the companies as well as the treatment given to them;
3. Evaluation of compliance with the operational limits established by the Superintendency:
4. Evaluation of compliance with the recommendations formulated by the internal audit unit, external auditors, and by this Superintendency;
5. In the case of general warehouses: a) Evaluation of the client portfolio for storage services, and b) Evaluation of the control, valuation, and custody responsibility policies for stored goods, in the case of general warehouses.
6. Additionally, Money Transfer Enterprises (ETF) must include the following activities in the Work Plan: a) Evaluation of the commissions charged to companies abroad for the delivery of funds to beneficiaries in Peru, as well as their accounting record, the periodicity of execution of the activity being semi-annual. b) Evaluation of the adequate identification and control of own and third-party funds available, objects of the service, the periodicity of execution of the activity being semi-annual. c) Evaluation of compliance with deadlines for the delivery of funds to third parties in accordance with the policies and internal norms established by the company, the commitments assumed with users, as well as adequate publicity and information to clients, the periodicity of execution of the activity being semi-annual. d) Evaluation of compliance with the company's operational limit regarding available funds, the periodicity of execution of the activity being quarterly. e) Evaluation of compliance with Board Agreements, the periodicity of execution of the activity being semi-annual. f) Evaluation on the adequate supervision and centralization of operations of Agents, in case they have them, the periodicity of execution of the activity being semi-annual.
7. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function. 55
8. Additionally, Electronic Money Issuing Companies (EEDE) must include the following activities in the Work Plan:56

• Evaluation of compliance with the operational limits and conditions established by the Law regulating the basic characteristics of electronic money as an instrument for financial inclusion, Law No. 29985; the Regulation of Law No. 29985 regulating the basic characteristics of electronic money as an instrument for financial inclusion, approved by Supreme Decree No. 090-2013-EF; and the Regulation of Operations with Electronic Money, approved by Resolution SBS No. 6283-2013.
• Evaluation of the commissions charged for operations, as well as their accounting record.
• Evaluation of compliance with commitments assumed with clients, as well as adequate information and publicity provided to them.
• Evaluation of compliance with Board Agreements.
• Evaluation of compliance with provisions regarding guarantees: constitution, functioning, balances, and effective coverage, etc.
• Evaluation of the adequate supervision and centralization of operations of correspondent cash machines, in case they have them.

9. Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity, and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others57.

10. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.58 55 Numeral modified by Resolution SBS No. 8754-2011 published on 05.08.2011. 56 Numeral incorporated by Resolution SBS No. 6284-2013 of 18-10-2013. Subsequently replaced by Resolution SBS No. 03932-2022 published on 22.12.2022 effective from January 1, 2023. 57 Numeral incorporated by Resolution SBS No. 272-2017 published on 23.01.2017. 58 Numeral incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to the

23 and third parties, objects of the service, the periodicity of execution of the activity must be semi-annual. c) Evaluation of compliance with deadlines for the delivery of funds to third parties in accordance with the policies and internal norms established by the company, the commitments assumed with users, as well as adequate publicity and information to clients, the periodicity of execution of the activity must be semi-annual. d) Evaluation of compliance with the company's operational limit regarding available funds, the periodicity of execution of the activity must be quarterly. e) Evaluation of compliance with Board Agreements, the periodicity of execution of the activity must be semi-annual. f) Evaluation on the adequate supervision and centralization of operations of Agents, in case they have them, the periodicity of execution of the activity must be semi-annual. 7) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function. 55 8) Additionally, Electronic Money Issuing Companies (EEDE) must include in the Work Plan the following activities:56

• Evaluation of compliance with the operational limits and conditions established by the Law regulating the basic characteristics of electronic money as an instrument for financial inclusion, Law No. 29985; the Regulation of Law No. 29985 regulating the basic characteristics of electronic money as an instrument for financial inclusion, approved by Supreme Decree No. 090-2013-EF; and the Regulation of Operations with Electronic Money, approved by Resolution SBS No. 6283-2013.
• Evaluation of the commissions charged for operations, as well as their accounting record.
• Evaluation of compliance with commitments assumed with clients, as well as adequate information and publicity provided to them.
• Evaluation of compliance with Board Agreements.
• Evaluation of compliance with provisions regarding guarantees: constitution, functioning, balances, and effective coverage, etc.
• Evaluation of the adequate supervision and centralization of operations of correspondent cash machines, in case they have them.

9. Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity, and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others57.

10. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.58 55 Numeral modified by Resolution SBS No. 8754-2011 published on 05.08.2011. 56 Numeral incorporated by Resolution SBS No. 6284-2013 of 18-10-2013. Subsequently replaced by Resolution SBS No. 03932-2022 published on 22.12.2022 effective from January 1, 2023. 57 Numeral incorporated by Resolution SBS No. 272-2017 published on 23.01.2017. 58 Numeral incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to the

24 The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency.59 IV. GUARANTOR AND GUARANTEE COMPANIES:

1. Evaluation of guarantees granted;
2. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on information security and Cybersecurity60.
3. Evaluation of the nature and frequency of claims presented to the companies as well as the treatment given to them;
4. Evaluation of compliance with the operational limits established by the Superintendency:
5. Evaluation of compliance with the recommendations formulated by the Internal Audit Unit (UAI), external auditors, and by this Superintendency;
6. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function. 10
7. Evaluation of the criteria for allocation and compliance with capital requirements for each risk, the calculation of leverage, and total effective equity.61
8. Evaluation of credit portfolio transfer and acquisition operations. 62
9. Evaluation of trust operations. 63
10. Evaluation of compliance with the provisions indicated in the Regulation for the Management of Social and Environmental Risk, in case the cited regulation is applicable.64
11. Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity, and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others65.

12. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.66
13. Evaluation of compliance with the requirements for the use of transactional information exercise 2022. 59 Paragraph incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011. 60 Numeral replaced by Resolution SBS No. 504-2021 published on 23.02.2021, effective from the audit corresponding to the exercise 2022. 61 Numeral incorporated by Resolution SBS No. 8934-2012 published on 01.12.2012. 62 Numeral modified by Resolution SBS No. 1308-2013 published on 20.02.2013. 63 Numeral incorporated by Resolution SBS No. 1882-2014 published on 29.03.2014. 64 Numeral incorporated by Resolution SBS No. 1928-2015 published on 28.03.2015. 65 Numeral incorporated by Resolution SBS No. 272-2017 published on 23.01.2017. 66 Numeral incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to the exercise 2022.

25 for the estimation of sales, income, and expenses of the family-business unit of debtors with small or micro-enterprise credits, if applicable. 67 The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency.68 V. DERRAMAS AND PENSION FUNDS:

1. Evaluation of deliveries to be accounted for and their regularization;
2. Evaluation of the company's investment management, its valuation, the constitution of provisions, and adequate backing of obligations with its associates;
3. Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as, the provisions of current regulations on business continuity management and information security and Cybersecurity69;
4. Evaluation of the constitution of technical reserves and liabilities for obligations with its associates.
5. Evaluation of the nature and frequency of claims presented to the companies as well as the treatment given to them;
6. Evaluation of compliance with policies and procedures implemented for the granting and classification of debtors in its credit portfolio; as well as on the adequate constitution of provisions.
7. Evaluation of compliance with the recommendations formulated by the Internal Audit Unit (UAI), external auditors, and by this Superintendency; and,
8. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function. 10
9. Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity, and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others70.

10. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.71
11. Additionally for the case of Derramas, the evaluation of information by type of activity and business unit. 72 67 Numeral incorporated by Resolution SBS No. 2368-2023 published on 19.07.2023, effective from the audit plan corresponding to the exercise 2025 to be sent to the SBS by December 31, 2024 at the latest. 68 Paragraph incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011. 69 Numeral replaced by Resolution SBS No. 504-2021 published on 23.02.2021, effective from the audit corresponding to the exercise 2022. 70 Numeral incorporated by Resolution SBS No. 272-2017 published on 23.01.2017. 71 Numeral incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to the exercise 2022. 72 Numeral incorporated by Resolution SBS No. 02738-2023 published on 22/08/2023, effective from the Annual Work Plan of 2025 to

26 The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency.73 VI. PRIVATE PENSION FUND ADMINISTRATORS (AFP):

1. Evaluation of operational risk management and the provisions of current regulations on business continuity management and information security74;
2. Evaluate the investment risk management system, within which the following must be included, at a minimum75: a) The development of investment risk management in accordance with what is established in the provisions indicated in Chapter XI of Title VI and in the manual of policies and procedures established by the AFP. b) The organization of the investment risk unit, which includes the assignment of responsibilities within the investment risk unit; and its independence from other functional areas. c) The sufficiency, integrity, consistency, and degree of integration of information processing systems and for investment risk analysis. d) The consistency, precision, integrity, timeliness, and validity of the information sources used in measurement models. e) Modifications in the risk measurement models and their corresponding approval by the investment risk committee. f) The approval process for the risk measurement models used by personnel in various areas and operational control.
3. Evaluation of the nature and frequency of claims presented to the companies as well as the treatment given to them;
4. Evaluation of compliance with the standard on Requirements for Ethical Conduct and Professional Capacity of Persons who participate in the Investment Process of Banking, Insurance Companies, and Portfolios Managed by AFPs;
5. Evaluation of measures taken to implement the recommendations formulated by the Internal Audit Unit (UAI), external auditors, and by this Superintendency; and,
6. Evaluate at least annually compliance with Title VI of the Compendium of Regulatory Superintendence Norms of the Private System for the Administration of Pension Funds referred to Investments, informing the AFP board and the Superintendency once the evaluation is completed, including preventive and corrective measures adopted. 76
7. Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons carrying out said function. 77 be sent by December 31, 2024 at the latest. 73 Paragraph incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011. 74 Numeral replaced by Resolution SBS No. 504-2021 published on 23.02.2021, effective from the audit corresponding to the exercise 2022. 75 Numeral modified by Resolution SBS No. 6253-2014 published on 22.09.2014. 76 Modified by Resolution SBS No. 2111-2010 published on 08.03.2010. Subsequently modified by Resolution SBS No. 1293-2014 published on 03.03.2014. Subsequently modified by Resolution SBS No. 6253-2014 published on 22.09.2014. 77 Numeral incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011.

27 8) Evaluate at least semi-annually the process linked to the direct investment of Pension Funds in local and foreign derivative instruments, including compliance with the applicable regulations of the investment units, investment risk units, and back office.78 9) Evaluate compliance with the requirements associated with the general authorization process established by Circular No. AFP-140-2014. The conclusions of the evaluation must contain any change and/or modification that has been made and may affect compliance with any of the requirements indicated in Circular No. AFP-140-2014. 79 10) Evaluation of the remuneration system for workers and board members, which must include at least:

• Criteria for measurement, evaluation, periodicity, and form of payment, as well as the correspondence between the indicators used to measure performance with the risk appetite defined by the company.
• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others80.

11. Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting, and constitution of provisions for controversies.81 The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency. 82 78 Numeral incorporated by Resolution SBS No. 6412-2014 published on 29.09.2014. 79 Numeral incorporated by Resolution SBS No. 6412-2014 published on 29.09.2014. 80 Numeral incorporated by Resolution SBS No. 272-2017 published on 23.01.2017. 81 Numeral incorporated by Resolution SBS No. 2451-2021 published on 24.08.2021 effective from the audit corresponding to the exercise 2022. 82 Incorporated by Resolution SBS No. 2111-2010 published on 08.03.2010.