Lima, 28 November 2008

S.B.S. Resolution No. 11699 -2008

The Superintendent of Banking, Insurance and
Private Administrators of Pension Funds:

WHEREAS:

That, in accordance with the provisions of article 180 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amendments, hereinafter General Law, it corresponds to this Superintendency to establish the requirements and internal audit standards for the companies of the financial and insurance system, with the purpose of providing the depositor and the insured with adequate protection;

That, by SBS Resolution No. 1041-99 dated 26 November 1999 and its amendments, the Internal Audit Regulation was approved;

That, in accordance with subsection e) of article 57 of the Single Ordered Text of the Law of the Private System of Pension Fund Administration, approved by Supreme Decree No. 054-97-EF, it is the attribution and obligation of the Superintendency to supervise the AFP in compliance with the legal provisions and administrative directives that govern them, which is why it is convenient to include them within the scope of application of the Internal Audit Regulation;

That, the work carried out by the internal audit of the supervised companies constitutes a fundamental mechanism of support for the supervision and control carried out by this Superintendency, so it is necessary to update the minimum criteria required for its exercise in accordance with international standards and best practices;

That, an effective and efficient internal audit constitutes a vital element for prudent administration in the companies of the financial system, insurance and private administrators of pension funds;

That, in accordance with the Law of Creation of the Financial Intelligence Unit of Peru (UIF-Peru), approved by Law No. 27693 and its amendments, this Superintendency, in order to exercise its function of supervising the system for the prevention of money laundering and terrorist financing, will rely, among other agents, on the internal audit areas, which will formulate a special annual report on the evaluation of the system for the prevention of money laundering and terrorist financing;

That, on 25 July 2006, the Regulation of Law No. 27693 was published, approved by Supreme Decree No. 018-2006-JUS, which regulates various aspects related to the work of the internal audit area of the subjects obliged to report to the UIF-Peru supervised by this Superintendency;

That, by SBS Resolution No. 37-2008 of 10 January 2008, the Regulation of Comprehensive Risk Management was approved, stating in article 22 of said Regulation that internal audit plays an independent role in Comprehensive Risk Management;

That, consequently, it is necessary to issue a new Internal Audit Regulation;

Having regard to the opinion of the Deputy Superintendencies of Banking and Microfinance, of Risks, of Insurance, of Private Administrators of Pension Funds, of Legal Advice, of the Financial Intelligence Unit of Peru -UIF, as well as the Economic Studies Management; and,

In use of the powers conferred in numeral 7 of article 349 and numeral 7 of article 367 of the General Law;

RESOLVES:

Article One.- To approve the Internal Audit Regulation, which forms an integral part of this Resolution.

Article Two.- To grant a period until 31 December 2008, for the companies to adapt to the provisions of the Regulation approved in article One.

Article Three.- Once the adaptation period indicated in the previous article has expired, the Internal Audit Regulation approved by SBS Resolution No. 1041-99 of 26 November 1999, the last paragraph of article 79 of Resolution No. 053-98-EF/SAFP, as well as all those provisions that oppose it totally or partially, shall be without effect.

Article Four.- The preparation, presentation and implementation of the Annual Work Plan and its respective reports, corresponding to fiscal year 2009, shall be subject to the provisions of the Regulation approved by article One.

Article Five.- Incorporate procedures Nos. 116 and 117 "Special authorizations for the significant outsourcing of Internal Audit functions" and "Authorization to present the Risk-based Audit Work Plan", respectively, in the Single Text of Administrative Procedures – TUPA of the Superintendency of Banking, Insurance and AFP approved by SBS Resolution No. 131-2002, in accordance with the text attached to this Resolution and published in accordance with the provisions of Supreme Decree No. 004-2008-PCM, Regulation of Law No. 29091. (Institutional portal: www.sbs.gob.pe).

Register, communicate and publish,

FELIPE TAM FOX
Superintendent of Banking, Insurance and
Private Administrators of Pension Funds

INTERNAL AUDIT REGULATION

CHAPTER I GENERAL PROVISIONS

Article 1.- Scope

This Regulation shall apply to the companies indicated in articles 16 and 17 of the General Law, as well as to the Private Administrators of Pension Funds (AFP), hereinafter companies.

In the case of the Municipal Savings and Credit Banks (CMAC), the Municipal Popular Credit Bank of Lima, the Guarantee Fund for Loans to Small Industry (FOGAPI), the Bank of the Nation, the Agricultural Bank, the Financial Corporation of Development (COFIDE), the MIVIVIENDA S.A. Fund, the Derramas, the Benefit Banks under the control of the Superintendency and the Fund of Municipal Savings and Credit Banks (FOCMAC), this Regulation shall apply insofar as it does not conflict with the specific regulations that regulate the actions of these companies.1

Article 2.- Definitions

For the application of this Regulation, the following definitions shall be considered:

a) Programmed activities.- These are those included in the Annual Audit Work Plan, some of which are mandatory due to regulatory requirements.

b) Head Office.- Refers to the main company or the one that exercises control in a financial or mixed conglomerate.

c) Audit Committee.- Any reference to the Audit Committee, in cases where companies are not required to establish said Committee pursuant to article 11 of the Regulation for Comprehensive Risk Management, shall be understood as referring to the Board of Directors

d) Days.- Calendar days.

e) Board of Directors.- Any reference to the board of directors, or any equivalent body.

f) Comprehensive risk management.- It is a process, carried out by the Board of Directors, Management and staff applied throughout the company and in the definition of its strategy, designed to identify potential events that may affect it, manage them according to its risk appetite and provide reasonable assurance in achieving its objectives.

g) Significant events.- Those events that may have a significant impact on the financial situation of the company, or on the achievement of its objectives

h) Head of internal audit.- The Manager or managerial-level officer, whatever their title, responsible for the internal audit unit or service.

i) Policy and procedure manuals.- Documents containing functions, responsibilities, policies, methodologies and procedures established by the company for carrying out the activities of each of its units, including those corresponding to risk management.

j) Plan.- Refers to the Annual Audit Work Plan.

k) Assurance services.- Objective examinations of evidence for the purpose of providing an independent assessment of an organization's risk management, control and governance processes. These services include financial, performance, compliance, systems security assessments, among others.

l) Consulting services.- Advisory, counseling and related services provided to users, whose nature and scope are agreed with them and are aimed at adding value and improving the organization's governance, risk management and control processes,

[1] Paragraph amended by SBS Resolution No. 1325-2018 published on 06.04.2018.

without the internal auditor assuming management responsibilities. Some examples of these activities are counseling, advising, facilitation and training.

m) Superintendency.- Superintendency of Banking, Insurance and Private Pension Fund Administrators.

Article 3.- Responsibility of the Board of Directors and the Audit Committee

The board of directors is responsible for adopting the necessary actions so that the internal audit unit can perform its functions in accordance with the provisions of this Regulation and with the nature and complexity of the company's operations.

The Audit Committee's main purpose is to oversee that accounting and financial reporting processes are appropriate, as well as to evaluate the activities carried out by internal and external auditors.

The reports made by the internal auditor presented to the Audit Committee and required by this Regulation shall be understood as presented to the Board of Directors. The responsibilities indicated in this Regulation to the Audit Committee shall be understood as assigned to the Board of Directors, when the Audit Committee has not been established.

The Audit Committee Regulation, which must be approved by the Board of Directors, shall establish the relationships and reporting format between the Audit Committee, the Board of Directors and the Internal Audit Unit, insofar as it does not conflict with this Regulation.

CHAPTER II INTERNAL AUDIT

Article 4.- Internal Audit

Internal Audit is an independent and objective assurance and consulting activity, conceived to add value and improve the operations of companies, by helping them achieve their objectives by providing a systematic and disciplined approach in the evaluation and improvement of the effectiveness of risk management and corporate governance.

Article 5.- Independence of the Internal Audit Unit

Companies must have an internal audit unit, hereinafter UAI, which will report to the Audit Committee, when it exists, and to which it will present the reports it prepares, unless in the auditor's judgment they must also be reported to the Board of Directors

The UAI must have sufficient independence to fulfill its functions effectively, efficiently and timely, having for this purpose all the powers and mechanisms to achieve its objectives.

The UAI must have access to the information it requires for the fulfillment of its functions and the development of its examinations, without limitation that could affect its conclusions, including that derived from minutes of the board of directors and its Committees, and any other governing, management or administrative level body. In the case of CMAC and FOCMAC, the UAI must have internal regulations that establish the difference of the functions corresponding to it with respect to those applicable to the Institutional Control Body (OCI), which are subject to the rules of the National Control System.2

[2] Paragraph amended by SBS Resolution No. 1325-2018 published on 06.04.2018.

Article 6.- Functions of the Internal Audit Unit

The functions that the UAI must perform include, among others, the following:

a) Evaluate the design, scope and operation of internal control.

b) Design the Plan and submit it for consideration of the board of directors for approval, as well as comply with the programmed activities and prepare the reports derived from them;

c) Evaluate compliance with the legal provisions governing the companies, in the course of its examinations, in particular the General Law and the provisions issued by the Superintendency;

d) Continuously evaluate the quality and adequacy of the computer systems and the mechanisms established by the company to guarantee information security;

e) Continuously evaluate compliance with the policy and procedure manuals and other internal company rules, as well as propose modifications to them;

f) Evaluate the timely and adequate implementation of the recommendations and measures to overcome the observations made by the Superintendency, the external auditors, as well as those made by the UAI itself.3

g) Verify compliance with the anti-money laundering and terrorist financing prevention system.

h) Evaluate compliance with those aspects determined by this Superintendency; and,

i) Other assurance or consulting activities that the company itself indicates.

Article 7.- Competence of internal audit and significant outsourcing

The UAI, when considered as a whole, must gather or obtain the knowledge, technical skills and other competencies required to fulfill its responsibilities, according to the complexity and size of the company.

Competence of internal audit

The UAI and the internal auditors that comprise it must gather the knowledge, technical skills, experience and other competencies required to fulfill their responsibilities.

Every UAI must have an information systems audit service, which collaborates in achieving its functions and objectives. This service must have competent personnel and specific experience in systems auditing, appropriate in competencies to the complexity and size of the operations carried out by the company, which may also be outsourced.

The experience and specialization required for the professional practice of internal auditing may be accredited, among others, through current professional certifications of international prestige such as the Certified Internal Auditor (CIA), issued by The Institute of Internal Auditors (IIA) and the Certified Information Systems Auditor (CISA), issued by ISACA. 4

Significant outsourcing

Significant outsourcing is defined as outsourcing whose purpose is to replace most of the functions assigned to the UAI, on a non-occasional basis and with the purpose of accessing advantages of a technical, resource, methodology nature, among others. This type of outsourcing requires prior authorization from the Superintendency, as indicated in the First Final Provision.

[3] Subparagraph modified by Resolution SBS No. 1325-2018 published on 06.04.2018.

[4] Paragraph modified by Resolution SBS No. 1132-2025 published on 26.03.2025.

Whatever the level of outsourcing, the head of audit continues to be responsible for ensuring that internal audit functions adequately and effectively, and in accordance with the provisions of current regulations and according to the service level agreement or equivalent.

The contracting of specific services from professional service providers for the better development of the UAI's functions, which does not imply significant outsourcing, does not require prior authorization by this Superintendency, and must be reported to this supervisory body.

The Head of Internal Audit is responsible for supervising compliance with the service contract, ensuring the overall quality of the activities, informing the Audit Committee, as well as monitoring the results of the contracted work.

Article 8.- Infrastructure and other resources

The UAI must have an appropriate infrastructure and the human, technical and logistical resources, adequate to the magnitude and complexity of the company's operations, as well as to the risks it faces.

The Board of Directors is responsible for ensuring the appropriate conditions for the development of the internal audit function.

The head of internal audit and other internal auditors must receive ongoing training in matters related to their functions, for which the head of internal audit must present the training needs in relation to the members of the UAI, indicating the main training areas and the number of hours required annually.

Article 9.- Rules and standards for the practice of internal auditing 5

Insofar as it does not conflict with the provisions of the Superintendency's regulations, the standards issued by The Institute of Internal Auditors (IIA) shall apply. In the case of systems auditors, the audit guidelines provided by ISACA shall be taken into consideration.

Article 10.- Risk-Based Auditing (RBA)

Risk-Based Auditing consists of a set of processes through which auditing provides independent assurance to the Board of Directors about:

• Whether the risk management processes and measures that are implemented are working as expected;

• Whether the risk management processes are appropriate and well designed; and,

• Whether the risk control measures that Management has implemented are adequate and effective, and reduce risk to the level of tolerance accepted by the Board of Directors.

The RBA depends on the level of development that the company itself has achieved in risk management in the area under examination, and the degree to which appropriate objectives have been defined by Management against which the associated risks can be measured.

When the company has an adequate risk management system in the area(s) under examination, without prejudice to the need for additional verifications inherent to due professional care, the RBA may rely to a greater degree on the risk assessment that the company itself has performed, and develop a Risk-Based Plan (RBP) that complements the actions

[5] Article modified by Resolution SBS No. 1132-2025 published on 26.03.2025.

carried out by the company and increase the value of the activities of the Internal Audit. When the company has a less developed risk management system, the RBA requires relying more on the risk assessment made by the Audit itself.

CHAPTER III OF THE HEAD OF INTERNAL AUDIT

Article 11.- Appointment

The IAU shall be headed by the Head of Internal Audit, who shall be a full-time, exclusively dedicated officer at the managerial level, who may not have management functions, whose appointment is the responsibility and attribution of the Audit Committee.

Article 12.- Requirements and impediments of the internal auditor

The head of internal audit must have moral solvency, knowledge and experience appropriate to the function performed by said unit, and must meet the following minimum requirements:

a) Have a professional degree or academic degree of Master, as well as specialization in matters related to the functions of the IAU;

b) Have no less than three (3) years of experience in audit activities, as applicable, in companies of the financial system, insurance, pension funds, complementary or related services, derramas, pension funds, and/or have held similar positions for said companies, for a period of no less than five (5) years, as applicable;

c) Have no criminal record;

d) For obligated companies, not be subject to any of the impediments indicated in article 81 of the General Law, with the exception of numeral 5 of the aforementioned article;

e) Not have been sanctioned by this Superintendency for the commission of infractions considered serious or very serious;

f) Not have been sanctioned by any public body for the commission of infractions considered serious or very serious by the sanctioning entity;

g) Not have ownership or management ties with the company or with the legal entities that are part of the conglomerate to which it belongs. Likewise, not have a kinship relationship with its shareholders or partners, directors, managers, legal representatives or principal officers, in accordance with the regulations issued by this Superintendency;

h) Not be subject to situations that limit the necessary independence for the exercise of its functions;

With the exception of literals a) and b) indicated in this article, the other members of the IAU must comply with the requirements indicated in the preceding paragraph. Likewise, said members must not have management functions.

The minimum requirements indicated must be duly verified by the human resources area or equivalent, and said verification must be recorded in the personnel files.

Article 13.- Responsibility of the Head of Internal Audit

The Head of Internal Audit is responsible for complying with the obligations assigned to him/her in this Regulation, as well as for immediately informing, within two (2) business days, this Superintendency of any fact that significantly affects the operation of the IAU and/or its independence.

The Head of Internal Audit is also responsible for immediately and directly informing the Superintendency and the audit committee, simultaneously, of the occurrence of significant facts. Said communication must be made within two (2) business days after the corresponding evaluations are completed and the report is issued. Taking into account the circumstances and their importance, the Head of Internal Audit may preliminarily report the significant facts under examination and send preliminary reports if deemed convenient; and likewise the Superintendency may request them, as long as the final report is available.

It is the responsibility of the internal auditors to apply in the exercise of their functions the general standards defined by Article 9.

Article 14.- Removal of the head of internal audit

The removal of the Head of Internal Audit may only be carried out for duly justified cause, which must be agreed upon by the board of directors. In the case of companies that are part of the National Control System, they must take into account the specific applicable regulations.

The adoption of said agreement must be communicated to this Superintendency indicating the reasons for which this decision is made. This Superintendency may summon the head of internal audit and take the measures it deems necessary.

The vacancy situation due to removal or resignation may not last more than thirty (30) days, except for reasons of force majeure that must be reported to the Board of Directors and to this Superintendency.

Article 15.- Interim head of internal audit

With prior authorization from this Superintendency, the IAU may be headed by an interim Head of Internal Audit for a period of up to six (6) months, who must meet the requirements referred to in article 12 of this Regulation, with the exception of the provisions of literal b) of said article. As an alternative to the provisions of the aforementioned literal, the experience shall be at least two (2) years in audit activities of the indicated companies or in the performance of related managerial positions in said companies. The registration process shall be followed through the information system of the Registry of Directors, Managers and Principal Officers (REDIR), in the manner provided for the Head of Internal Audit.

CHAPTER IV OF THE WORK PLAN

Article 16.- Minimum content of the Plan

The annual internal audit work plan must include all the tasks to be developed. Said Plan must be approved by the board of directors, and a copy of it must be sent to this Superintendency no later than 31 December of the previous year. Said Plan must consider, at least, the following aspects:

a) Objectives and scope of the plan

b) Activities, examinations and reports and their schedule;

c) Human resources available for the fulfillment of the Plan, indicating where applicable the need to contract specialized services; and,

d) Follow-up on the observations made by this Superintendency.

The activities mentioned in literal b) must include at a minimum what is stated in the annex attached to this Regulation, unless authorization is obtained from the Superintendency, as indicated in the Third Final Provision. In addition, the Superintendency may request additional activities and require complementary information regarding the content of the Plan. Likewise, the Superintendency through a Multiple Official Letter may define the minimum structure that the Plan must contain, as well as its submission by electronic means.

In the case of the CMAC, the annual internal audit work plan must be formulated in such a way that there is no duplication with respect to the functions corresponding to the OCI, which is subject to the rules of the National Control System.6

Article 17.- Modifications of the Plan

Significant modifications made to the Plan must be approved by the Audit Committee and reported to the Superintendency as part of the plan progress report referred to in the following article.

CHAPTER V OF THE REPORTS SUBMITTED TO THE SUPERINTENDENCY

Article 18.- Report on the progress of the Plan

The UAI shall present to this Superintendency a four-monthly report on the progress of the Plan, indicating the degree of fulfillment of the objectives and activities carried out and other aspects considered relevant, among others, within twenty (20) days following the close of each four-month period. The last four-monthly report shall account for the activities planned and carried out in the year.

Said report shall include a list of the reports prepared by the UAI during the respective period, a brief summary of the content and the observations found and their importance. Likewise, said report shall contain an evaluation of the status of the observations and recommendations made by this Superintendency, indicating those resolved, pending, in process and their age.

The report must be brought to the timely attention of the board of directors or the audit committee, when the latter has been constituted, for the taking of pertinent actions.

Regarding the report on the progress of the Plan, the ETF must present the reports on a semi-annual basis, within twenty (20) days following the close of each semester.

This Superintendency, by means of a Multiple Office, may define the minimum structure that the report must contain, as well as its submission by electronic means.

Article 19º.- Special Reports

In addition to what is stated in the preceding article, the UAI must submit to this Superintendency special annual reports, which may be included as part of the report corresponding to the last four-month period, on the following:

1) For the companies indicated in headings I, II, III, IV and VI of the attached annex, the evaluation of the money laundering and terrorism financing prevention system, with emphasis on:

[6] Paragraph incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018.

a) Establishment of policies that ensure adequate customer knowledge, market knowledge and correspondent banking knowledge, where applicable.

b) Existence of the Manual for the Prevention of Money Laundering and Terrorism Financing, permanently updated and in accordance with current legislation.

c) Level of compliance with the Manual for the Prevention of Money Laundering and Terrorism Financing.

d) Existence of periodic training programs covering all levels of the company.

e) Compliance with regulations on the prevention of money laundering and terrorism financing.

f) Evaluation of the criteria applied by the Compliance Officer to not consider certain operations as suspicious. In the event that a Money Laundering and Terrorism Financing Prevention Committee exists, the assistance provided by said Committee must also be evaluated.

g) Timeliness of the communication of suspicious operations to the UIF-Peru based on the Suspicious Operations Registry. Such review does not imply access to information protected by the duty of confidentiality, provided for in Article 12° of Law No. 27693.

h) Implementation of the Operations Registry in accordance with the guidelines established by current regulations.

The conclusions of said evaluation must be submitted to the Superintendency through a special annual report. Said report shall be submitted within the period established for the Annual Report of the Compliance Officer corresponding to the second semester.

2) For the companies indicated in headings I and IV of the attached annex, except Investment Banks, the evaluation of the functioning of the requests and complaints handling system, as well as compliance with the provisions on market conduct management of the financial system, with emphasis on:

a) Implementation of policies and procedures defined by the company, in accordance with the Market Conduct Principles regarding its business practices, Information transparency and the management of its complaints.

b) Criteria established by the company to ensure full transparency in the dissemination of interest rates, commissions, expenses and other fees of the active and passive operations it carries out, as well as their modifications.

c) Timely compliance in communicating modifications to interest rates, commissions, expenses and other fees.

d) Compliance with all aspects referred to in the market conduct management provisions of the financial system, regarding the information attached to contracts whose object is the carrying out of active and passive operations.

The conclusions of said evaluation must be submitted to the Superintendency through a special annual report. Said report shall be submitted within the period established for the Annual Report of the Market Conduct Officer.7

[7] Numeral modified by SBS Resolution No. 3966-2018 of 11/10/2018, effective from the audit corresponding to the 2019 fiscal year

CHAPTER VI OF THE REPORTS SUBMITTED TO THE BOARD OF DIRECTORS

Article 20°.- Submission to the Board of Directors

The UAI shall submit to the audit committee or board of directors all reports it prepares in the performance of its functions. Said body shall evaluate the respective reports no later than the immediately following session after their submission. The time at which said body becomes aware of the reports, the decisions adopted in this regard and the follow-up of corrective measures shall be recorded in the respective Minutes Book.

Article 21°.- Files

The UAI shall maintain a file containing the reports prepared, working papers and communications informing the results of its examinations to the different units of the company, as well as the supporting documentation thereof. Said information shall be made available to the Superintendency, external auditors and, where applicable, risk rating companies, when so required.

Article 22º.- Minimum content of reports

The UAI reports shall contain, at a minimum, the following information:

a) Objective and scope of the evaluation;

b) Evaluation of the situation of the activity or operation as of the date of the report, identifying the risks detected and their impact on the company;

c) Observations and recommendations formulated, regardless of whether they have been remedied or not at the close of the report, indicating the status in which they are;

d) Name of the official responsible for the evaluation; and,

e) Start and end date of the evaluation.

FINAL PROVISIONS

First.- Special authorizations for the significant subcontracting of internal audit functions

Except for the Fisherman's Social Security and Benefits Fund, the Military Police Pension Fund and the Derramas, the functions of the UAI may be subject to significant subcontracting with the parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation, or with firms specialized in auditing, provided that such subcontracting meets or exceeds the criteria set forth in this Regulation and represents a significant advantage in scope, specialization and professional competence.

Companies, prior to subcontracting, shall request authorization from the Superintendency, with the approval of the Board of Directors, for which they shall submit the following information:

1) Application submitted by the Audit Committee,

2) Organization of the audit service of the parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation, to the extent relevant to the requested authorization.

3) Justification of the reason for the subcontracting.

4) Methodology to be applied.

5) Description of available resources.

6) Detailed explanation of the manner in which the provisions established in this regulation will be applied, to the extent relevant.

7) Report describing how compliance with the International Standards for the Internal Audit Profession, as published by The Institute of Internal Auditors, is achieved, to the extent that it does not conflict with this regulation.

8) Draft Service Level Agreement or equivalent, indicating the measures the company will take to ensure its proper compliance.

9) When a specialized firm is contracted, additional information shall be submitted regarding the planned audit teams, the responsible partner, and the firm's seniority and experience in Peru in relevant auditing work.

10) Others as requested by the Superintendency.

Additionally, the following shall be considered:

a) In the event that the activities of the conglomerate to which the company belongs are carried out mainly outside the country, the functions of the Internal Audit Unit may be assumed by its parent company, the company that exercises direct or indirect control, or the one that has direct responsibility for the operation.

This form of subcontracting, when provided from outside the country, shall be aimed primarily at covering the audit needs of companies whose volume of operations does not require the presence of teams permanently established in Peru.

The company must designate a local person responsible for overseeing the proper functioning of the services received, through the service level agreement or equivalent, who shall be responsible for compliance with this Regulation before the Superintendency, as well as with the rules related to the internal auditor.

b) The specialized firms with which the internal audit function is subcontracted may not provide consulting, external audit or other services to the same company that limit their independence in the exercise of the internal audit function. Likewise, the specialized firm may not have carried out the evaluation of the anti-money laundering and terrorist financing prevention system, nor the examination of the financial statements during the two (2) preceding consecutive years, a restriction that is also applicable to the members of the teams. Likewise, the same partner rotation requirements applicable to external auditors must be observed, according to the External Audit Regulations.

The specialized firms must operate and be legally authorized for this purpose in Peru. Given the specialized nature of their services, these firms must have external methodological support and periodic quality reviews, as well as have relevant experience in the country.

Second.- Cancellation of authorizations

This Superintendency may cancel at any time the special authorizations granted to which this rule refers, when in the exercise of its supervisory function it observes that, among other reasons, the volume of operations, the company's activities or the parent company's services have changed significantly and do not adequately cover the associated risks, that the company has failed to comply with the obligations provided for, or that the authorization granted has not contributed to an improvement in the audit work.

Third.- Risk-based audit plan (PBR) and programmed activities

Companies shall include in their plan the aspects contemplated in the special reports corresponding to the evaluation of the money laundering and terrorism financing prevention system and the evaluation of the operation of the user service system, as well as the activities related to compliance with the provisions on information transparency standards and contracting with users of the financial system, indicated in Article 19º of this Regulation, which are required by legal mandate.

Likewise, those companies that have solid internal audit practices and adequate compliance with the criteria provided for in these regulations may request authorization from the Superintendency so that, in the formulation of their annual plan, only the activities provided for in the annex "scheduled activities" that are relevant according to the company's own risk-based audit methodology are considered, and for each "scheduled activity" that has not been considered in its plan, except for activities 17A8, 23 and 24 of section I, which cannot be excluded from the plan, the reasons supporting its non-consideration in the audit plan for that year must be included.9

Requests for authorization to the Superintendency shall be submitted at least sixty (60) calendar days before the submission of their annual plan, for which they shall submit the following documentation:

a) Request made by the Internal Auditor or Audit Committee,

b) Description of the risk-based audit approach and associated methodology.

c) List of existing human and technical resources, as well as related procurement policies, such as, for example, specialized system audit services, among others.

d) Self-assessment carried out by the Internal Auditor on the degree of compliance with the “International Standards for the Professional Practice of Internal Auditing” according to the Institute of Internal Auditors (IIA), and the measures it will take in relation to cases where there is a significant deviation.

The Superintendency shall determine the term of the authorization, either indefinitely or only for a specific fiscal year, as well as any exceptions it deems necessary, based on the evaluation of the information submitted by the applicant company. Likewise, if as a result of its supervisory work it deems it necessary to carry out certain examinations excluded by the company, it may require them for inclusion as an unscheduled activity.

The Superintendency's authorization does not exempt the company from complying with the examinations required by laws in force, it being understood that this authorization is limited only to those activities required by regulations issued by the Superintendency.

Fourth.- Agreements

Supervised companies may establish collaboration and mutual support agreements, technology transfer or others, for the proper application of this Regulation.

Fifth.- Complementary and Related Service Companies

For the purposes of the provisions of Article 11 of this regulation, in the case of Complementary and Related Service Companies, such companies shall be subject to the provisions of the aforementioned article, in accordance with the magnitude of the operations they carry out.

Funds Transfer Companies (FTC) whose monthly average of funds transferred in the last twelve (12) months is equal to or exceeds four thousand (4,000) Tax Units

[8] Paragraph amended by SBS Resolution No. 02535-2024 published on 22.07.2024.

[9] Paragraph amended by SBS Resolution No. 467-2023 published on 13.02.2023, effective as of the audit plan corresponding to fiscal year 2024.

Tax Units (UITs), must have a full-time Internal Auditor. The Internal Auditor of FTCs whose aforementioned monthly average is less than the referred 4,000 UITs may be hired part-time and under any modality, and must comply with the requirements and functions set forth in this Regulation.

TRANSITORY PROVISION

FIRST: 10 Excepcionalmente, tratándose del Plan anual de trabajo de auditoría correspondiente al año 2009, la solicitud de autorización a que hace referencia la Tercera Disposición Final, deberá presentarse cuando menos treinta (30) días calendarios antes de la presentación del Plan.

SECOND:11 Las exigencias contempladas en el Reglamento resultarán aplicables a la Federación Peruana de Cajas Municipales de Ahorro y Crédito (FEPCMAC) en tanto se encuentre bajo la supervisión de la Superintendencia, de conformidad con lo establecido en el artículo 21 del Decreto Supremo N° 157-90-EF y sus normas modificatorias.

THIRD: 12 Tratándose del Plan anual de trabajo de auditoría a que hace referencia la Tercera Disposición Final, las empresas que cuenten con autorización deberán incorporar en su plan, las actividades 23 y 24 del numeral I del Anexo “Actividades programadas”.

[10] Numbering amended by SBS Resolution No. 1325-2018 published on 06.04.2018.

[11] Provision incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018.

[12] Provision incorporated by SBS Resolution No. 467-2023 published on 13.02.2023, effective as of the audit plan corresponding to fiscal year 2024.

ANNEX

PROGRAMMED ACTIVITIES

As part of the annual plan, companies must consider at least conducting examinations aimed at evaluating and verifying the proper functioning of the following matters:

I. COMPANIES REFERRED TO IN LITERALS A, B AND C OF ARTICLE 16 OF THE GENERAL LAW (EXCEPT BONDING AND GUARANTEE COMPANIES), BANCO DE LA NACIÓN, BANCO AGROPECUARIO, FONDO MIVIVIENDA AND CORPORACIÓN FINANCIERA DE DESARROLLO (COFIDE)13:

1) Evaluation of compliance with the companies' operational limits, both individual and global;

2) Evaluation of the criteria for allocation and compliance with capital requirements for each risk, the calculation of leverage and total effective equity;

3) Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as the provisions of current regulations on business continuity management and information security and cybersecurity14;

4) Evaluation of market risk management, which must include a review of compliance with management and operational requirements for operations that generate market risk. Likewise, the evaluation of market risk management must include:

a) Review of compliance with policies and procedures.

b) Review of compliance with regulatory and internal limits.

c) Review of the assumptions and results of market risk measurement models, as well as models for stress testing and backtesting, if applicable.

d) Review of the quality of information in the applicable regulatory annexes, verifying compliance with the respective methodological notes, as well as the reasonableness of the assumptions, and the timely submission of information to the Superintendency.15

4A) Evaluation of liquidity risk management; 16

5) Evaluation of credit risk management; which must include the review of the classification of a representative sample of debtors from the non-retail credit portfolio, at least every four months, with the composition of the sample being able to vary in each review. The methodology for determining the representative sample and its modifications must be duly documented and remain at all times available to the Superintendency. This control body may require modifications to said methodology.

[13] Title modified by Resolution SBS N° 8934-2012 published on 01.12.2012. Subsequently modified by Resolution SBS N° 3544-2015 published on 26.06.2015.

[14] Item replaced by Resolution SBS N°504-2021 published on 23.02.2021, effective from the audit corresponding to fiscal year 2022.

[15] Item replaced by Resolution SBS N° 4906-2017 published on 26.12.2017.

[16] Item incorporated by Resolution SBS N° 9075-2012 published on 07.12.2012.

The methodology for determining the representative sample must consider, among other criteria: the largest individual exposures, debtors that have been subject to alerts, debtors that have had repeated occasional arrears and debtors that have improved their classification during the last year. It must also include debtors of refinanced and restructured credits, credits granted to persons related to the financial system company itself, and debtors reclassified by the company or by the Superintendency.

For the review of the classification of retail credit debtors, permanent automated controls must be implemented. Likewise, companies must use data integrity analysis and perform representative sample analysis, as review procedures, at least once a year.

In the case of economic groups or the presumption of single risk referred to in Article 203 of the General Law, the review shall be carried out treating them as a single client.

5A) ‘Evaluation of the process of management, classification and recording of commitments, including that the areas responsible for defining the amount of commitments are the competent ones according to the company's internal policies; 17

6) Evaluation of credit foreign exchange risk management;

6A) Evaluation of country risk management;18

7) Evaluation of compliance with the provisions set forth in the special rules on related parties and economic group;

8) Analysis of the mechanisms for comprehensive risk management of the financial group, taking into account the risk exposure from operations carried out with natural persons, legal persons or related legal entities and companies of the conglomerate. Evaluation of the significant accounting policies used in the consolidation of the financial statements of the financial group and of the consolidatable groups, as well as the evaluation of compliance with capital requirements, global and concentration limits, and the other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates; 19

9) Evaluation of compliance with the rule on Requirements regarding Ethical Conduct and Professional Capacity of Persons participating in the Investment Process of Banking, Insurance and Portfolios Managed by AFPs;

10) Evaluation of the nature and frequency of claims submitted to the companies as well as the treatment given to them;

11) Evaluation of compliance with the recommendations made by the UAI, the external auditors and by the Superintendency;

12) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons who carry out said function. 20

[17] Item incorporated by Resolution SBS N°4345-2023 published on 04.01.2024, effective from the information for July 2025.

[18] Item incorporated by SBS Resolution No. 7932-2015 published on 04.01.2016.

[19] Item amended, as of 01-01-2011, by SBS Resolution No. 11823-2010 of 29-09-2010 and by SBS Resolution No. 779-2021 as of 01.04.2021

[20] Item amended by SBS Resolution No. 8754-2011 published on 05.08.2011.

13) Evaluation of credit portfolio transfer and acquisition operations. 21

14) Evaluation of trust operations.22

15) Evaluation of compliance with the provisions set forth in the Regulation for Social and Environmental Risk Management, if said regulation is applicable.23

16) Evaluation of the remuneration system for workers and board members, which must include at least:

• Measurement, evaluation, frequency and payment method criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.

• Policies regarding variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others24 .

17) Evaluation of compliance with the Regulation for the Classification and Valuation of Investments of Financial System Companies, the Rules for Investment in Instruments Traded through Non-Centralized Negotiation Mechanisms and the Regulation for the Negotiation and Accounting of Derivative Financial Products in Financial System Companies. 25

17A) Annual evaluation of the procedures that the company has established and uses in calculating the amounts of deposits subject to coverage and the premium paid to the Deposit Insurance Fund. The auditor must evaluate at least two of the quarters included in the last twelve months, counted from the date on which the review begins.26

18) In the case of CMACs, verification of compliance with Supreme Decree No. 157-90-EF and its amending rules and the regulations issued by the Superintendency, which includes at least the provisions of articles: 8 (not considering 8-A and 8-B), 11 and 12 of the aforementioned Supreme Decree No. 157-90-EF, as well as the first final complementary provision of Law No. 30607. 27

19) For the Municipal Savings and Credit Banks:28

a) The evaluation of compliance with the standards set forth in the Special Rules for the implementation of Law No. 30607 regarding the capitalization of profits.

b) The evaluation of compliance with the provisions of the Regulation for the Participation of Municipal Savings and Credit Banks in the Law that promotes regional and local public investment with private sector participation, if applicable.

20) Evaluation of compliance with the provisions set forth in the Minimum Procedures for the management, classification, reporting and constitution of provisions for disputes.29

21) For the companies included in literals A and B of article 16 of the General Law, the Banco de la Nación and Banco Agropecuario; in accordance with the provisions of article 1 of

[21] Item amended by SBS Resolution No. 1308-2013 published on 20.02.2013.

[22] Item incorporated by SBS Resolution No. 1882-2014 published on 29.03.2014.

[23] Item incorporated by SBS Resolution No. 1928-2015 published on 28.03.2015.

[24] Item incorporated by SBS Resolution No. 272-2017 published on 23.01.2017.

[25] Item incorporated by SBS Resolution No. 4906-2017 published on 26.12.2017. Subsequently renumbered by SBS Resolution No. 681-2018 published on 24.02.2018.

[26] Item incorporated by SBS Resolution No. 2448-2020 published on 09.10.2020.

[27] Item incorporated by SBS Resolution No. 1325-2018 published on 06.04.2018.

[28] Item incorporated by SBS Resolution No. 1706-2018 published on 04.05.2018.

[29] Item incorporated by SBS Resolution No. 2451-2021 published on 24.08.2021 effective as of the audit corresponding to fiscal year 2022.

the Provisions for the application of maximum interest rates, approved by SBS Resolution No. 02192-202230:

Evaluation of the procedures established by the company for the proper application of maximum interest rates in its consumer credit operations, and for small and microenterprises, which must include at least the following:

a) Establishment and implementation of procedures in accordance with the provisions associated with the application of maximum interest rates.

b) Designation of a person responsible for monitoring and reporting the application of maximum interest rates, as well as the level of compliance with their duties.

c) Timeliness and quality of the information submitted to the Superintendency.

22) Evaluation of compliance with the provisions set forth in the Model Risk Management Regulation, if said regulation is applicable.31

23) Evaluation of the balances and movements of operations in process, as well as their age. It must be verified that the balances do not exceed the maximum periods allowed by accounting provisions, as well as analyze the cases that have exceeded said periods and the reasons for this, and also evaluate the accounting dynamics in such cases. In addition, a significant sample of the recorded items must be identified, which includes at least the most significant movements of the operations in process items, those that are not carried out regularly, those carried out with related parties, in order to identify the nature of said movements, regardless of the balances at closing.32

24) Evaluation of the balances and movements of operations between the head office, branches and agencies. It must be verified that the active and passive accounts corresponding to the head office, branches and agencies of the company are used in accordance with accounting provisions and that their balances are duly offset, as well as analyze the cases in which this is not met. In addition, a significant sample of the recorded entries must be identified, including at a minimum the most significant movements and those that are not carried out on a regular basis, those corresponding to transactions with other companies, such as their related parties, in order to identify the nature of said movements and the reclassifications that must be made.33

25) For the companies included in subparagraphs A and B of article 16 of the General Law, as well as for the Banco de la Nación and the Banco Agropecuario, evaluation of compliance with the requirements for the use of transactional information for the estimation of sales, income and expenses of the family-business unit of debtors with small business or microenterprise loans, if applicable. 34

The other evaluations and reports that the companies must carry out periodically in accordance with the current provisions of this Superintendency." 35

[30] Item incorporated by Resolution SBS No. 2192-2022 published on 14.07.2022.

[31] Item incorporated by Resolution SBS No. 00053-2023 published on 11.01.2023.

[32] Item incorporated by Resolution SBS No. 467-2023 published on 13.02.2023, effective as of the audit plan corresponding to fiscal year 2024.

[33] Item incorporated by Resolution SBS No. 467-2023 published on 13.02.2023, effective as of the audit plan corresponding to fiscal year 2024.

[34] Item incorporated by Resolution SBS No. 2368-2023 published on 19.07.2023, effective as of the audit plan corresponding to fiscal year 2025 to be submitted to the SBS no later than 31.12.2024.

[35] Paragraph incorporated by Resolution SBS No. 8754-2011 published on 05.08.2011.

II. INSURANCE AND/OR REINSURANCE COMPANIES:

1) Evaluation of the management of risks other than technical insurance risks, which include operational, market, credit, liquidity risk, among others; as well as evaluation of compliance with the procedures used for the identification, measurement, control and reporting of said risks; 36

2) Evaluation of the management of policy underwriting and premium collection;

3) Evaluation of compliance with the procedures carried out by the person(s) in charge of the actuarial function and the technical risk management function; 37

4) Evaluation of the management of coinsurance and reinsurance, as well as the determination of the quality of the reinsurers; 38

5) 39

6) Evaluation of compliance with the procedures carried out to guarantee the quality of the data used in pricing, in the calculation of technical reserves and the solvency margin; 40

7) Evaluation of investment management and its valuation. As part of this evaluation, the following must be included:41

a) Verify that a record is kept of the personal investments of those who make decisions in the investment process, including the personnel of the risk and investment committees and the board of directors.

b) Verify that there is independent control so that personnel who have access to information regarding the analysis, strategies, positions, among other confidential information regarding the company's investments, sign sworn declarations of compliance with the Policies for the appropriate use of confidential information; and so that these are available to the Superintendency.

c) With respect to the assets that are subject to the notification and authorization processes, within the framework of the provisions of articles 26, 27 and 28 of the Investment Regulation for Insurance Companies, reasonable compliance with the minimum requirements established for the investment and risk units indicated in articles 13 and 15 of said Regulation must be verified, which contribute to ensuring the adequate investment process linked to the instrument under analysis. 42

8) Evaluation of the management in the marketing of policies and the transparency of information to potential insured parties;

9) Evaluation of compliance with the provisions of the Superintendency regarding the grounds for rejection of claims;

10) Evaluation of the nature and frequency of the claims submitted to the companies, as well as the treatment given to them;

[36] Item amended by Resolution SBS No. 2507-2010 published on 19.03.2010. Subsequently amended by Resolution SBS No. 00053-2023 published on 11.01.2023. Subsequently amended by Resolution SBS No. 397-2024 published on 05.02.2024, effective as of 01.04.2024. Subsequently amended by Resolution SBS No. 1660-2025 published on 09.05.2025, effective as of 01.01.2026.

[37] Item amended by Resolution SBS No. 3863-2016 published on 16.07.2016.

[38] Item amended by Resolution SBS No. 4706-2017 published on 13.12.2017.

[39] Item deleted by Resolution SBS No. 3863-2016 published on 16.07.2016.

[40] Item amended by Resolution SBS No. 3863-2016 published on 16.07.2016.

[41] Item replaced by Resolution SBS No. 1041-2016 published on 27.02.2016.

[42] Subparagraph incorporated by Resolution SBS No. 556-2025 published on 18.02.2025.

11) Evaluation of compliance with the provisions set forth in the special rules on related-party transactions and economic group;

12) Analysis of the mechanisms for the comprehensive risk management of the financial group, taking into account the risk exposure from transactions carried out with natural persons, legal persons or related legal entities and companies of the conglomerate. Evaluation of the significant accounting policies used in the consolidation of the financial statements of the financial group and of the consolidable groups, as well as the evaluation of compliance with the capital requirements, the global and concentration limits, and the other provisions established in the Regulation for the Consolidated Supervision of Financial and Mixed Conglomerates 43

13) Evaluation of compliance with the regulation on the Requirements regarding Ethical Conduct and Professional Capacity of Persons participating in the Investment Process of Banking, Insurance and Portfolios Managed by AFPs;

14) Evaluation of compliance with the recommendations made by the IAD, the external auditors and by this Superintendency;

15) Evaluation of the custody and intermediation of the company's investments and, where applicable, of the implementation and exercise of investment mandates, in accordance with the provisions of the Regulation for the Classification and Valuation of Investments of Insurance Companies; 44

16) Evaluation of compliance with the regulatory limits established by the Superintendency. 45

17) Evaluation of the quality of the information submitted to the Superintendency on financial statements and accounting information (forms, annexes, reports and statements) required by the regulations issued by the Superintendency. 46

18) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or non-existence of incompatibility of functions of the persons who carry out said function. 47

19) Evaluation of trust operations.48

20) Evaluation of the remuneration system for workers and board members, which must include at least:

• Measurement, evaluation, periodicity and payment method criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.

• Policies referring to variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others49 .

21) Evaluation of compliance with the provisions set forth in the Minimum Procedures for the management, classification, reporting and constitution of provisions for

[43] Item amended by SBS Resolution No. 11823-2010 of 29-09-2010 published on 01.10.2010 in force as of 01.01.2011. Subsequently amended by SBS Resolution No. 779-2021 published on 19.03.2021 in force as of 01.04.2021

[44] Item amended by SBS Resolution No. 5027-2017 published on 30.12.2017 in force as of the audit corresponding to fiscal year 2018.

[45] Item amended by SBS Resolution No. 2507-2010 published on 19.03.2010.

[46] Item incorporated by SBS Resolution No. 2507-2010 published on 19.03.2010.

[47] Item amended by SBS Resolution No. 8754-2011 published on 05.08.2011.

[48] Item incorporated by SBS Resolution No. 1882-2014 published on 29.03.2014.

[49] Item incorporated by SBS Resolution No. 272-2017 published on 23.01.2017.

disputes.50

22) Review of the consistency of the information contained in the database of insured assets to calculate the Risk Loss (LaR) in the calculation of the catastrophic reserve, which is submitted to the Superintendency through Annex No. SG-4, as well as the information contained in Annex No. SG2, Annex No. SG-3, Annex No. SG-4A and Annex No. SG-7. 51

23) Evaluation of asset and liability management. As part of this evaluation, the following must be included: 52

a) Review of compliance with policies and procedures.

b) Review of compliance with regulatory and internal limits.

c) Evaluation of the procedures carried out to guarantee the quality of the information submitted to the Superintendency regarding the Homogeneous Groups of Regulatory Obligations, the Asset Sufficiency Analysis, the interest rate risk indicators, the liquidity indicators, the stress tests and the liquidity contingency plan.

24) Evaluation of the following aspects of the parametric insurance regulations:

a) Compliance with the characteristics established by the Superintendency regarding products registered as parametric insurance.

b) Compliance with the procedures carried out for the marketing, monitoring and verification of the parameter, as well as for the determination of the parametric insurance claim.

c) Evaluation of the technical capacity of the calculation agent and compliance with the functions assigned to it

The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency. 53

III. COMPANIES OF COMPLEMENTARY AND RELATED SERVICES:

1) Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as the provisions of the current regulations on business continuity management and information security and cybersecurity;54

2) Evaluation of the nature and frequency of claims submitted to the companies as well as the treatment given to them;

3) Evaluation of compliance with the operational limits established by the Superintendency:

4) Evaluation of compliance with the recommendations made by the internal audit unit, the external auditors and by this Superintendency;

5) In the case of general deposit warehouses:

a) Evaluation of the client portfolio for storage services, and

b) Evaluation of the control, valuation, and responsibility policies for the custody of

[50] Item incorporated by SBS Resolution No. 2451-2021 published on 24.08.2021 in force as of the audit corresponding to fiscal year 2022.

[51] Item incorporated by SBS Resolution No. 3661-2021 published on 03.12.2021 in force as of 01.07.2023.

[52] Item incorporated by SBS Resolution No. 1660-2025 published on 09.05.2025, in force as of 01.01.2026.

[53] Paragraph incorporated by SBS Resolution No. 2507-2010 published on 19.03.2010.

[54] Item replaced by SBS Resolution No. 504-2021 published on 23.02.2021, in force as of the audit corresponding to fiscal year 2022.

the stored goods, in the case of general deposit warehouses.

6) Additionally, the Fund Transfer Companies (FTC) must include in the Work Plan the following activities:

a) Evaluation of the commissions charged to foreign companies for the delivery of funds to beneficiaries in Peru, as well as their accounting record, whose execution frequency of the activity must be semiannual.

b) Evaluation of the adequate identification and control of available own and third-party funds, subject of the service, whose execution frequency of the activity must be semiannual.

c) Evaluation of compliance with deadlines for the delivery of funds to third parties in accordance with the policies and internal rules established by the company, the commitments assumed with users, as well as adequate advertising and information to clients, whose execution frequency of the activity must be semiannual.

d) Evaluation of compliance with the company's operational limit referred to available funds, whose execution frequency of the activity must be quarterly.

e) Evaluation of compliance with Board Agreements, whose execution frequency of the activity must be semiannual.

f) Evaluation of the adequate supervision and centralization of operations of the Agents, if any, whose execution frequency of the activity must be semiannual.

7) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons who carry out said function. 55

8) Additionally, the Electronic Money Issuing Companies (EMIC) must include in the Work Plan the following activities:56

• Evaluation of compliance with the limits and operational conditions established by the Law that regulates the basic characteristics of electronic money as an instrument of financial inclusion, Law No. 29985; the Regulation of Law No. 29985 that regulates the basic characteristics of electronic money as an instrument of financial inclusion, approved by Supreme Decree No. 090-2013-EF; and the Regulation of Operations with Electronic Money, approved by SBS Resolution No. 6283-2013.

• Evaluation of the commissions charged for operations, as well as their accounting record.

• Evaluation of compliance with the commitments assumed with clients, as well as the adequate information and advertising provided to them.

• Evaluation of compliance with Board Agreements.

• Evaluation of compliance with the provisions regarding guarantees: constitution, operation, balances and effective coverage, etc.

• Evaluation of the adequate supervision and centralization of operations of the correspondent cashiers, if any.

9) Evaluation of the remuneration system for workers and members of the board of directors, which must include at least:

• Measurement, evaluation, frequency and form of payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.

[55] Numeral modified by SBS Resolution No. 8754-2011 published on 05.08.2011.

[56] Numeral incorporated by SBS Resolution No. 6284-2013 of 18-10-2013. Subsequently replaced by SBS Resolution No. 03932-2022 published on 22.12.2022 in force as of 01 January 2023.

• Policies referred to variable remuneration, which include bonuses for compliance with the strategic plan, annual productivity bonuses, among others57 .

10) Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting and constitution of provisions for disputes.58

The other examinations and reports that companies must periodically carry out in accordance with the current provisions of this Superintendency.59

IV. SURETY AND GUARANTEE COMPANIES:

1) Evaluation of the guarantees granted;

2) Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as the provisions of current regulations on information security and Cybersecurity60 .

3) Evaluation of the nature and frequency of claims submitted to the companies as well as the treatment given to them;

4) Evaluation of compliance with the operational limits established by the Superintendency:

5) Evaluation of compliance with the recommendations formulated by the IAD, the external auditors and by this Superintendency;

6) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons who carry out said function. 10

7) Evaluation of the criteria for allocation and compliance with capital requirements for each risk, the calculation of leverage and total effective equity.61

8) Evaluation of the operations of transfer and acquisition of credit portfolio. 62

9) Evaluation of trust operations. 63

10) Evaluation of compliance with the provisions indicated in the Regulation for Social and Environmental Risk Management, if said regulation is applicable.64

11) Evaluation of the remuneration system for workers and members of the board of directors, which must include at least:

• Measurement, evaluation, periodicity and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.

• Policies relating to variable remuneration, which includes compliance bonuses

[57] Numeral incorporated by SBS Resolution N° 272-2017 published on 23.01.2017.

[58] Numeral incorporated by SBS Resolution N° 2451-2021 published on 24.08.2021 effective from the audit corresponding to the 2022 fiscal year.

[59] Paragraph incorporated by SBS Resolution N° 8754-2011 published on 05.08.2011.

[60] Numeral replaced by SBS Resolution N°504-2021 published on 23.02.2021, effective from the audit corresponding to the 2022 fiscal year.

[61] Numeral incorporated by SBS Resolution N° 8934-2012 published on 01.12.2012.

[62] Numeral modified by SBS Resolution N° 1308-2013 published on 20.02.2013.

[63] Numeral incorporated by SBS Resolution N° 1882-2014 published on 29.03.2014.

[64] Numeral incorporated by SBS Resolution N° 1928-2015 published on 28.03.2015.

25 of the strategic plan, annual productivity bonuses, among others 65 . 12) Evaluation of compliance with the provisions set forth in the Minimum Procedures for the management, classification, reporting and establishment of provisions for disputes. 66 13) Evaluation of compliance with the requirements for the use of transactional information for the estimation of sales, income and expenses of the family-business unit of debtors with small business or microenterprise credits, where applicable. 67 The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency. 68 V. MUTUALS AND PENSION FUNDS: 1) Evaluation of the deliveries to render account and their regularization; 2) Evaluation of the company's investment management, its valuation, the establishment of provisions and adequate backing of obligations with its members; 3) Evaluation of operational risk management and compliance with the procedures used for the administration of operational risks; as well as compliance with the provisions of current regulations on business continuity management and information security and Cybersecurity 69; 4) Evaluation of the establishment of technical reserves and liabilities for obligations with its members. 5) Evaluation of the nature and frequency of claims filed against companies as well as the treatment given to them; 6) Evaluation of compliance with policies and procedures implemented for the granting and classification of debtors in its credit portfolio; as well as regarding the adequate establishment of provisions. 7) Evaluation of compliance with recommendations formulated by the UAI, external auditors and by this Superintendency; and, 8) Evaluation of the performance of the regulatory compliance function, as well as evaluation of the existence or not of incompatibility of functions of the persons carrying out said function. 10 9) Evaluation of the remuneration system for workers and members of the board of directors, which must include at least: - Measurement, evaluation, periodicity and payment criteria, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company. - Policies relating to variable remuneration, which includes compliance bonuses for the strategic plan, annual productivity bonuses, among others 70 . 65 Numeral incorporated by SBS Resolution N° 272-2017 published on 23.01.2017. 66 Numeral incorporated by SBS Resolution N° 2451-2021 published on 24.08.2021 effective from the audit corresponding to the 2022 fiscal year. 67 Numeral incorporated by SBS Resolution N° 2368-2023 published on 19.07.2023, effective from the audit plan corresponding to the 2025 fiscal year to be submitted to the SBS no later than 31.12.2024. 68 Paragraph incorporated by SBS Resolution N° 8754-2011 published on 05.08.2011. 69 Numeral replaced by SBS Resolution N°504-2021 published on 23.02.2021, effective from the audit
corresponding to the 2022 fiscal year. 70 Numeral incorporated by SBS Resolution N° 272-2017 published on 23.01.2017.

10) Evaluation of compliance with the provisions set forth in the Minimum Procedures for the management, classification, reporting and establishment of provisions for disputes.71

11) Additionally, in the case of Mutuals, the evaluation of information by type of activity and business unit. 72

The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency.73

VI. PRIVATE PENSION FUND MANAGERS (AFP):

1) Evaluation of operational risk management and compliance with the provisions of current regulations on business continuity management and information security74;

2) Evaluate the investment risk management system, within which the following must be included, at a minimum75:

a) The development of investment risk management in accordance with the provisions set forth in Chapter XI of Title VI and in the policies and procedures manual established by the AFP.

b) The organization of the investment risk unit, which includes the assignment of responsibilities within the investment risk unit; and its independence from other functional areas.

c) The sufficiency, integrity, consistency and degree of integration of information processing systems and for the analysis of investment risks.

d) The consistency, accuracy, integrity, timeliness and validity of the information sources used in measurement models.

e) Modifications to risk measurement models and their corresponding approval by the investment risk committee.

f) The approval process for the risk measurement models used by personnel in the various areas and for operations control.

3) Assessment of the nature and frequency of claims filed against companies as well as the treatment given to them;

4) Assessment of compliance with the standard on the Requirements regarding the Ethical Conduct and Professional Competence of the Persons participating in the Investment Process of Banking, Insurance Companies and Portfolios Managed by the AFPs;

5) Assessment of the measures taken to implement the recommendations formulated by the UAI, the external auditors and by this Superintendency; and,

6) Assess at least annually the compliance with Title VI of the Compendium of Regulatory Superintendency Standards of the Private Fund Administration System of

[71] Numeral incorporated by SBS Resolution N° 2451-2021 published on 24.08.2021, effective from the corresponding audit for the 2022 fiscal year.

[72] Numeral incorporated by SBS Resolution N° 02738-2023 published on 22/08/2023, effective from the 2025 Annual Work Plan to be submitted no later than 31 December 2024.

[73] Paragraph incorporated by SBS Resolution N° 8754-2011 published on 05.08.2011.

[74] Numeral replaced by SBS Resolution N°504-2021 published on 23.02.2021, effective from the corresponding audit for the 2022 fiscal year.

[75] Numeral amended by SBS Resolution N° 6253-2014 published on 22.09.2014.

Pensions referred to Investments, and must report to the board of directors of the AFP and to the Superintendency once said evaluation is completed, including the preventive and corrective measures adopted. 76

7) Assessment of the performance of the regulatory compliance function, as well as assessment of the existence or not of incompatibility of functions of the persons carrying out said function. 77

8) Assess at least semi-annually the process related to the direct investment of Pension Funds in local and foreign derivative instruments, including compliance with the applicable regulations of the investment units, investment risks and back office.78

9) Assess compliance with the requirements associated with the general authorization process established by Circular N°AFP-140-2014. The conclusions of the assessment must contain any change and/or modification that has been made and may affect compliance with any of the requirements indicated in Circular N°AFP-140-2014. 79

10) Assessment of the remuneration system for workers and members of the board of directors, which must include at least:

• Measurement criteria, assessment, periodicity and form of payment, as well as the correspondence between the indicators used to measure performance and the risk appetite defined by the company.

• Policies relating to variable remuneration, including bonuses for compliance with the strategic plan, annual productivity bonuses, among others80.

11) Evaluation of compliance with the provisions indicated in the Minimum Procedures for the management, classification, reporting and constitution of provisions for disputes.81

The other examinations and reports that companies must carry out periodically in accordance with the current provisions of this Superintendency. 82

[76] Amended by Resolution SBS N° 2111-2010 published on 08.03.2010. Subsequently amended by Resolution SBS N° 1293-2014 published on 03.03.2014. Subsequently amended by Resolution SBS N° 6253-2014 published on 22.09.2014.

[77] Item incorporated by Resolution SBS N° 8754-2011 published on 05.08.2011.

[78] Item incorporated by Resolution SBS N° 6412-2014 published on 29.09.2014.

[79] Item incorporated by Resolution SBS N° 6412-2014 published on 29.09.2014.

[80] Item incorporated by Resolution SBS N° 272-2017 published on 23.01.2017.

[81] Item incorporated by Resolution SBS N° 2451-2021 published on 24.08.2021, effective as of the audit corresponding to fiscal year 2022.

[82] Incorporated by Resolution SBS N° 2111-2010 published on 08.03.2010.