SBS Resolution No. 17026-2010: Approves the External Audit Regulations (includes annexes to the Regulations)

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 1

Lima, December 10, 2010

S.B.S. Resolution No. 17026 -2010 The Superintendent of Banking, Insurance and Private Pension Fund Administrators: WHEREAS: That, in accordance with the provisions of article 180 of the General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its amendments, hereinafter General Law, it is the responsibility of this Superintendency to establish the requirements and standards for external auditing for companies in the financial system and the insurance system, in order to provide adequate protection to savers and insured persons; That, likewise, numeral 1 of article 134 of the General Law establishes that it is the responsibility of this Superintendency to order the practice of external audits by firms previously qualified and registered in the corresponding registry; That, by SBS Resolution No. 1042-99 dated November 26, 1999 and its amendments, the External Audit Regulations were approved, which regulate the practice of external audits for companies under the control of the Superintendency of Banking, Insurance and Private Pension Fund Administrators; That, in accordance with subsection e) of article 57 of the Consolidated Text of the Private Pension Fund Administration System Law, approved by Supreme Decree No. 054-97-EF, it is the attribution and obligation of this Superintendency to supervise AFPs in compliance with the legal provisions and administrative directives that govern them, which is why it is convenient to include them within the scope of application of the External Audit Regulations;

That, for its part, in accordance with the Law for the Creation of the Financial Intelligence Unit of Peru (UIF-Peru), approved by Law No. 27693 and its amendments, this Superintendency will rely, among other agents, on external audit firms to exercise its supervision function of the anti-money laundering and terrorism financing prevention system, which must issue an independent compliance report, which has its own purpose, not complementary to the annual financial report;

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 2 That, on July 25, 2006, the Regulations of the aforementioned law were published, approved by Supreme Decree No. 018-2006-JUS, which regulates various aspects related to the independent compliance reports that must be issued by external audit firms other than those that issue the annual financial statements report or a completely different team from the latter; That, insofar as the work carried out by external audit firms constitutes a fundamental support mechanism for the supervision and control carried out by this Superintendency, in their respective areas, and a means of protection for savers, insured persons and AFP affiliates, it is necessary to establish additional requirements for contracting the services of external audit firms, as well as guidelines for carrying out the audit; That, consequently, this Superintendency considers it necessary to issue new External Audit Regulations; That, likewise, it is necessary to incorporate into the Sanctions Regulations approved by SBS Resolution No. 816-2005 of June 3, 2005, the infractions applicable to external audit firms; Based on the opinion of the Deputy Superintendencies of Banking and Microfinance, Risks, Insurance, Private Pension Fund Administrators, Economic Studies, Legal Advisory, the Financial Intelligence Unit of Peru –UIF; and, In use of the powers conferred in numeral 7 of article 349 and numeral 7 of article 367 of the General Law; RESOLVES: Article First.- Approve the External Audit Regulations, which forms an integral part of this Resolution, as indicated below. EXTERNAL AUDIT REGULATIONS CHAPTER I GENERAL PROVISIONS Article 1.- Scope These regulations are applicable to the companies indicated in articles 16 and 17 of the General Law, as well as to Private Pension Fund Administrators (AFPs), hereinafter companies. In the case of Municipal Savings and Credit Banks (CMAC), the Guarantee Fund for Loans to Small Industry (FOGAPI), Banco de la Nación, Banco Agropecuario, Corporación Financiera de Desarrollo (COFIDE), Fondo MIVIVIENDA S.A., Derramas and Benefit Funds under the control of the Superintendency, the Peruvian Federation of Municipal Savings and Credit Banks (FEPCMAC) and the

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 3 Fund of Municipal Savings and Credit Banks (FOCMAC), these regulations will apply as long as they do not conflict with the specific regulations that govern the actions of these companies. Article 2.- Definitions For the application of these regulations, the following definitions must be considered: a) Days.- Calendar days. b) Board of Directors.- Any reference to the board of directors shall also be understood as referring to any equivalent body. c) Internal control.- A process, carried out by the Board of Directors, Management and personnel, designed to provide reasonable assurance in achieving objectives related to the effectiveness and efficiency of operations, reliability of financial information, and compliance with applicable laws and regulations. d) Comprehensive risk management.- A process, carried out by the Board of Directors, Management and personnel, applied throughout the company and in the definition of its strategy, designed to identify potential events that may affect it, manage them according to its risk appetite and provide reasonable assurance in achieving its objectives. e) Significant facts.- Those facts that may have a significant impact on the financial situation of the company, or on the achievement of its objectives. f) International Financial Reporting Standards (IFRS).- These are the Standards and Interpretations formalized by the Accounting Standards Council in Peru. They include: i) International Financial Reporting Standards (IFRS); ii) International Accounting Standards; and, iii) the Interpretations developed by the International Financial Reporting Interpretations Committee (IFRIC) or issued by the former Interpretations Committee (SIC). g) RESAE.- Superintendency's Registry of External Audit Firms. h) Audit firms.- External Audit Firms. i) Superintendency.- Superintendency of Banking, Insurance and Private Pension Fund Administrators. CHAPTER II OF THE AUDITED COMPANIES Article 3.- Requirements for contracting Companies may only contract the services of audit firms that meet the following requirements, which, where applicable, shall be extended to the partners: a) Be registered and authorized in the Registry of one of the Departmental Colleges of Public Accountants of the Republic and in the RESAE of this Superintendency; b) Have adequate infrastructure and human and technical resources for the volume and complexity of the operations carried out by the audited company, including specialized systems audit services; c) Have experience of not less than three (3) years in auditing activities; d) The partners and audit personnel assigned to provide service to the companies must possess professional training and experience in the matters related to the engagements established by this standard, and others indicated by the Superintendency; likewise, the partners and manager in charge of the audit must have experience of not less than three (3) years in functions inherent to external auditing; e) Not have been contracted by the company to perform services incompatible with external auditing in the exercise of its functions;

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 4 f) Not have been sanctioned by this Superintendency, or another public or private body, for omission or non-compliance with the provisions on external auditing activities established in the current regulatory framework, classified as serious or very serious infractions, or their equivalents; g) Not have a direct or indirect ownership, management or kinship link with the company or with the legal entities that are part of the conglomerate to which the company belongs, nor with its shareholders or partners, directors, managers, legal representatives or principal officers, respectively, in accordance with the regulations issued by this Superintendency. Kinship shall be understood as spouses and relatives up to the second degree of consanguinity and the first degree of affinity; h) Not have overdue debts with said company, which is extensible to the responsible partners; and, i) Others indicated by this Superintendency, through general rules. Article 4.- Minimum contract conditions Contracts signed with audit firms must consider the following minimum aspects: a) The start of external audit examinations must take place no later than ninety (90) days before the close of the corresponding fiscal year; b) The scope of the examination and the content of the external auditors' reports must comply with the provisions of these regulations and other complementary rules issued by this Superintendency; c) The declaration by the audit firm, its partners and each member of the team that will audit the company, of knowing and accepting the obligations and responsibilities established by this Superintendency and the current regulations on the performance of external auditing, the confidentiality of the information obtained and the rotation requirements established in article 12 of these regulations; d) The deadline for submitting reports; e) The obligation of the audit firm to make available to this Superintendency the working papers and other supporting documentation for the reports it issues and, if applicable, to justify the respective report at the simple request of this Superintendency; f) A penalty clause that financially sanctions delays in the presentation of reports, with respect to the deadlines established by current regulations, the amount of which will be deducted from the firm's fees; g) A clause stating that the audit firm is obliged to disclose, within the framework of the engagements received, situations that demonstrate the lack of solvency, insufficient equity and/or accentuated financial or economic weakness of the audited company, and to disclose any act or omission that violates any provision that companies are obliged to comply with; h) The list of members of the audit team: partner, manager and senior in charge, specifying those contracted on a temporary and/or permanent basis, indicating their experience, professional level, time spent auditing the company and the responsibilities of each of them; and, i) The commitment of the audit firm not to replace the partner, manager or senior auditor in charge of the audit without authorization from the audited company; except in cases of force majeure; and, j) The obligation to participate in working meetings, as appropriate, with the Superintendency, the company's board of directors, its management team and/or its internal auditor. Article 5.- Company responsibility in external audit examinations The board of directors, the audit committee, when it exists, and management are directly responsible for providing the contracted audit firm with the information and facilities necessary for it to carry out its work adequately, independently and timely.

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 5 Likewise, it is the responsibility of said bodies to ensure compliance with the provisions established in these regulations, and management must communicate, by means of an affidavit, to the Audit Committee that access to information has not been limited. Article 6.- Examinations applicable to companies Companies must contract external audit firms for the following required examinations: a) The reasonableness of financial statements and the evaluation of the aspects indicated in Annex I corresponding to complementary reports; b) The evaluation of the internal control system within the scope of external auditing; and, c) The evaluation of the anti-money laundering and terrorism prevention system. Article 7.- 1 Article 8 Other special examinations The Superintendency may order the contracting of a different audit firm or expand the scope of the audit performed, as well as the timing of the examinations, at the companies' expense, when: a) The results of the audits performed do not comply with the provisions of these regulations, or are not satisfactory in the opinion of this Superintendency; and/or, b) In its opinion, complementary examinations to those established in these regulations are required. Article 9.- Information to be submitted to the Superintendency The following information prepared by external audit firms must be submitted by the company to this Superintendency: a) The opinion containing the auditor's opinion on the reasonableness of the financial statements, attaching the audited financial statements, as well as the complementary reports indicated in Annex I; b) The Report on the evaluation of the internal control system, within the scope of external auditing; c) 2 d) 3 In the case of the Report on the anti-money laundering and terrorism financing prevention system, the conclusions of said Report must be submitted directly by the audit firm to this Superintendency, which may request a copy of the Report from the audit firm or the company. The Superintendency may subsequently define the electronic means for submitting the report on the evaluation of the internal control system and the report on the anti-money laundering and terrorism financing prevention system, including additional information that facilitates its processing. The financial statements referred to in literal a) must correspond to the forms established by the Superintendency in the corresponding accounting standards, presented comparatively with the previous year, in thousands of soles and must contain only the total balances column.4 1 Article eliminated by SBS Resolution No. 779-2021 published on 03.19.2021 (effective from 04.01.2021). 2 Literal eliminated by SBS Resolution No. 779-2021 published on 03.19.2021 (effective from 04.01.2021). 3 Literal eliminated by SBS Resolution No. 779-2021 published on 03.19.2021 (effective from 04.01.2021). 4 Paragraph incorporated by SBS Resolution No. 2405-2019 published on 05.31.2019. Subsequently modified by SBS Resolution No. 1065-2025 published on 03.21.2025 (effective from 01.01.2026).

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 6 Article 10.- Knowledge of opinions and reports by companies The board of directors must take note of all opinions and reports issued by the audit firm and order the adoption of necessary corrective measures. Prior to this, the audit firm must inform the audit committee of the opinions and reports indicated in article 9 of these regulations. The receipt and acknowledgment of the opinions and reports of the audit firms by the board of directors must be recorded in the respective Minute Book. Likewise, the opinion on the financial statements must be brought to the attention of the general meeting of shareholders or partners, together with the company's annual report. Article 11.- Information to the Superintendency on non-compliance by audit firms In the event that audit firms fail to comply with their obligations, the audited company must inform this Superintendency within ten (10) days of the non-compliance occurring. Likewise, companies must inform this Superintendency, with supporting documentation, of the reasons for changing external audit firms after the respective contract has been signed. In both cases and when deemed pertinent, this Superintendency may summon the representatives of the audit firm. CHAPTER III OF AUDIT FIRMS Article 12.- Rotation requirement for the partner and audit team The audit firm is responsible for rotating the partners responsible for issuing an opinion on the reasonableness of financial statements after five (5) consecutive annual fiscal years of having performed audit work for the same company. Once the aforementioned maximum period has concluded, a period of at least two (2) years must elapse before said persons can again evaluate the reasonableness of the company's financial statements. In the case of the report on the evaluation of the anti-money laundering and terrorism financing prevention system, this must be carried out by a different audit firm or a completely different team from the one that issued the opinion on the reasonableness of the financial statements. The rotation required for the audit of financial statements is also applicable to the audit firm and the team that prepares the report on the evaluation of the anti-money laundering and terrorism financing prevention system. For all purposes mentioned in the preceding paragraphs, the work performed by said persons in the audited company is cumulative, even if they have been part of another audit firm. Article 13.- Reporting of significant facts Audit firms are obliged to communicate in writing to this Superintendency within ten (10) days of becoming aware of them, any significant facts they detect during the audit process of companies, without prejudice to including them in the corresponding reports.

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 7 Article 14.- Responsibility of audit firms Audit firms assume full responsibility for the opinions and reports they issue that do not appropriately reveal the financial situation, operating results, and cash flows of the company in accordance with the accounting standards issued by the Superintendency, as well as non-compliance with current regulations resulting from the audit. In the event that audit firms identify problems that prevent the adequate performance of the examinations, they must immediately communicate this to this Superintendency and indicate in the respective reports the reasons that prevented such evaluation. Article 15.- Application of international auditing standards The examinations that audit firms carry out in accordance with the provisions of these regulations shall be performed applying the International Standards on Auditing and Related Services issued by the International Auditing and Assurance Standards Board (IAASB) of the International Federation of Accountants (IFAC) and approved by the Board of Deans of the College of Public Accountants of Peru, as well as the provisions established by this Superintendency. Article 16.- Retention of documents supporting the opinion and reports Audit firms must retain the documentation supporting the reports issued, resulting from the examinations carried out on companies, for a period of ten (10) years after the audited fiscal year. Article 17.- Justification of the opinion and reports This Superintendency may require the justification of the opinion and reports, in which case the audit firm must make available the working papers and other documentation that support said requirement. CHAPTER IV AUDIT OF FINANCIAL STATEMENTS Article 18.- Contracting of audit firms Companies must contract audit firms for the evaluation of the reasonableness of financial statements, the evaluation of the aspects indicated in Annex I corresponding to complementary reports, the evaluation of the internal control system within the scope of external auditing, no later than June 30 of each year, with prior approval from the General Meeting of Shareholders, the board of directors or equivalent body, in accordance with their bylaws.5 Companies must inform this Superintendency, no later than May 31 of each year, of the audit firm or firms they have pre-selected, if applicable, indicating their authorization in the Registry of External Audit Firms (RESAE) of this Superintendency and in the Registry of one of the Departmental Colleges of Public Accountants of the Republic. The Superintendency, within fifteen (15) days of receiving the communication, will make any observations it deems pertinent. A copy of the contract signed between the company and the audit firm must be submitted to this Superintendency within five (5) days following its signing. The documentation supporting 5 Paragraph replaced by SBS Resolution No. 779-2021 published on 03.19.2021 (effective from 04.01.2021)

Los Laureles No. 214 - Lima 27 - Peru Tel. : (6309000) 8 compliance with the contracting requirements referred to in article 3 of these regulations must be available to this supervisory body. Article 19.- Financial statement opinion The financial statement opinion must contain the audit firm's opinion regarding the reasonableness of the financial statements, in accordance with the provisions issued by this Superintendency, and if there are situations not foreseen in said standards, in accordance with the International Financial Reporting Standards. If there are qualifications to the opinion, these must be clearly identified and, when appropriate, quantified within the opinion itself. 6 Article 20.- Report on the internal control system The report on the internal control system carried out by external auditors forms part of the control component in comprehensive risk management, focusing on the information objective, fundamentally external accounting and financial information. The report on the internal control system must consider, at least, the following: a) Evaluation of the internal control system within the scope of external auditing, which must include details of the deficiencies found, analysis of their origin and suggestions for overcoming them, focusing mainly on the areas