SBS Resolution No. 2660-2015: Regulation on Money Laundering and Terrorism Financing Risk Management

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 Lima, May 14, 2015 S.B.S. Resolution No. 2660-2015

The Superintendent of Banking, Insurance and Private Pension Fund Administrators WHEREAS: That, by Law No. 27693, the Financial Intelligence Unit of Peru, UIF-Peru, is created, responsible for receiving, analyzing, processing, evaluating and transmitting information for the detection of money laundering and/or terrorism financing (ML/TF), as well as contributing to the implementation, by obliged entities, of the system for detecting suspicious ML/TF operations; That, Article 3 of Law No. 27693, modified by Legislative Decree No. 1106, Legislative Decree for the Effective Fight against Money Laundering and other Crimes related to Illegal Mining and Organized Crime, establishes that the Superintendency of Banking, Insurance and AFPs has the function and power to regulate the general and specific guidelines, requirements, clarifications, sanctions and other aspects related to ML/TF prevention systems; That, by SBS Resolution No. 838-2008 and its modifying norms, the Complementary Norms for the Prevention of Money Laundering and Terrorism Financing were established; That, by SBS Resolution No. 11699-2008 and its modifying norms, the Internal Audit Regulation was approved, which establishes the requirements and standards for internal audit in relation to, among other aspects, the evaluation of the ML/TF prevention system; That, it is necessary to modify and approve the corresponding norms with the purpose of establishing criteria in ML/TF prevention, which allow increasing the effectiveness and efficiency of the ML/TF prevention system, considering international standards, best practices on the matter, as well as those aspects identified as a result of supervisory work; That, in order to gather public opinion regarding the proposed norms, the draft resolution was pre-published on the Superintendency's electronic portal, under the provisions of Supreme Decree No. 001-2009-JUS;

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 2 / 55 With the approval of the Assistant Superintendencies of Private Pension Fund Administrators, Insurance, Banking and Microfinance, Risks, Legal Advisory and UIF-Peru; and, In use of the powers conferred by numerals 7 and 10 of Article 349 and by the Fourteenth and Twenty-Fourth Final and Complementary Provisions of the General Law; RESOLVES: Article First.- Approve the Regulation on Money Laundering and Terrorism Financing Risk Management: REGULATION ON MONEY LAUNDERING AND TERRORISM FINANCING RISK MANAGEMENT TITLE I COMPLIANCE AND MANAGEMENT OF ML/TF RISKS CHAPTER I GENERAL PROVISIONS Article 1.- Scope1 The Regulation applies, as appropriate, to the companies indicated in Articles 16 and 17 of the General Law, to Banco Agropecuario, Banco de la Nación, the Guarantee Fund for Small Industry - FOGAPI, private pension fund administrators, Corporación Financiera de Desarrollo S.A. - COFIDE, Fondo Mivivienda S.A. and insurance brokers, hereinafter referred to as companies. Article 2.- Definitions and abbreviations For the purposes of the provisions of this Regulation, the following definitions and abbreviations shall apply: a) Days: calendar days. b) Board of Directors: the board of directors of the companies or any equivalent governing body or one that acts in its place. c) Identity document: national identity document for Peruvians, and the foreigner's card, passport or legally established document for the identification of foreigners, as appropriate. d) Legal entities: are i) autonomous assets managed by third parties, which lack legal personality or ii) contracts in which two or more persons, who associate temporarily, have a common right or interest to carry out a specific activity, without constituting a legal entity. Among others determined by the Superintendency, investment funds, mutual funds for investment in securities, trust assets and consortia are considered in this category. e) ML/TF: money laundering and terrorism financing.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 3 / 55 f) General Law: General Law of the Financial System and the Insurance System and Organic Law of the Superintendency of Banking and Insurance, Law No. 26702 and its modifying norms. g) Law: Law creating the Financial Intelligence Unit of Peru – UIF-Peru, Law No. 27693 and its modifying and complementary norms. h) Manual: manual for the prevention and management of ML/TF risks. i) Compliance officer: natural person responsible for overseeing the proper implementation and functioning of the ML/TF prevention system. This is the contact person of the obliged entity with the Superintendency and an agent on whom the latter relies in exercising its control and supervision work of the ML/TF prevention system. j) Unusual operation: an operation carried out or attempted whose amount, characteristics and periodicity do not bear relation to the client's economic activity, falls outside the normal parameters in force in the market or has no evident legal basis. k) Suspicious operation: an operation carried out or attempted whose amount or characteristics do not bear relation to the client's economic activity or which lacks economic justification; or which, due to its number, amounts transacted or its particular characteristics, may reasonably lead to suspicion that the company is being used to transfer, manage, profit from or invest resources originating from criminal activities or intended for their financing. l) Politically Exposed Persons (PEP): natural persons, national or foreign, who hold or have held prominent public functions or prominent functions in an international organization in the last five (5) years, whether in national or foreign territory, and whose financial circumstances may be subject to public interest. Likewise, the direct collaborator of the institution's highest authority is considered a PEP. m) Regulation: Regulation on Money Laundering and Terrorism Financing Risk Management, approved by the Superintendency. n) Regulation of the Law: Regulation of the Law creating the UIF-Peru, approved by Supreme Decree No. 018-2006-JUS. o) ML/TF Risks: the possibility that the company may be used for ML/TF purposes. This definition excludes reputational risk and operational risk. p) Superintendency: Superintendency of Banking, Insurance and Private Pension Fund Administrators. q) Worker: natural person who maintains an employment or contractual relationship with the company. r) UIF-Peru: Financial Intelligence Unit of Peru, a specialized unit of the Superintendency. s) Linkage and economic group: concepts defined in the Special Norms on Linkage and Economic Group. Article 3.- ML/TF prevention system Companies must implement an ML/TF prevention system with compliance and ML/TF risk management components to which they are exposed. The compliance component is made up of the policies and procedures established by companies within the framework of the Law, the Regulation of the Law, the General Law where applicable, this Regulation and other provisions on the matter, as well as the measures established by the company to guarantee the indefinite duty of confidentiality of information related to the ML/TF prevention system. The ML/TF risk management component includes, among other procedures and controls detailed in this Regulation, those related to the timely detection and reporting of suspicious operations, with the aim of preventing their use for ML/TF-related purposes.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 4 / 55 Article 4.- ML/TF Risk Factors Among the main ML/TF risk factors that must be identified and considered by companies are: a) Clients.- Companies must manage ML/TF risks associated with clients, their behavior, background and activities, at the beginning and throughout the commercial relationship. The analysis associated with this ML/TF risk factor incorporates client attributes or characteristics. b) Products and/or services.- Companies must manage ML/TF risks associated with the products and/or services they offer on their own behalf, during the design or development stage, as well as during their validity. The analysis associated with this ML/TF risk factor includes risks related to the distribution channels and payment methods with which they operate. c) Geographical area.- Companies must manage ML/TF risks associated with the geographical areas in which they offer their products and/or services, both locally and internationally, taking into account their security, economic-financial and socio-demographic characteristics, the provisions issued by competent authorities or the Financial Action Task Force – FATF with respect to said jurisdictions, among others. The analysis associated with this ML/TF risk factor includes the areas in which companies operate, as well as those related to the operation process. CHAPTER II INTERNAL ENVIRONMENT SUB-CHAPTER I ROLES AND RESPONSIBILITIES Article 5.- Board of Directors' Responsibility The board of directors is responsible for implementing the ML/TF prevention system and for fostering an internal environment that facilitates its development. To this end, it is the board's responsibility to: a) Take ML/TF risks into account when establishing business objectives. b) Approve and periodically review policies and procedures for ML/TF risk management. c) Approve the manual and the code of conduct. d) Establish and periodically review the functioning of the ML/TF prevention system based on the company's ML/TF risk profile. e) Appoint a compliance officer with the characteristics, responsibilities and attributions established by current regulations. f) Provide the resources (human, technological, among others) and infrastructure that allow, considering the size of the institution and the complexity of its operations and/or services, the adequate fulfillment of the compliance officer's functions and responsibilities. g) Establish measures to maintain the confidentiality of the compliance officer, so that their identity is not known by persons outside the company. h) Approve the compliance officer's annual work plan. i) Approve the risk-based training plan, established by the compliance officer.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 5 / 55 j) Where appropriate, approve the creation of an ML/TF risk committee, establishing its composition, functions and attributions. The foregoing is applicable without prejudice to the responsibilities contemplated in the norms on comprehensive risk management and other related norms issued by the Superintendency. Article 6.- Management's Responsibility General management, together with the board of directors, is responsible for implementing the ML/TF prevention system in accordance with current regulations. Managers, or persons in business or support organizational units, who perform equivalent functions, regardless of the title given to the position, within their scope of action, are responsible for complying with the measures associated with ML/TF risk control, in accordance with the defined policies and procedures, supporting the compliance officer in carrying out their work. The foregoing is applicable without prejudice to the responsibilities contemplated in the norms on comprehensive risk management and other related norms issued by the Superintendency. Article 7.- Compliance Officer The compliance officer must have a direct, full-time and exclusive employment relationship with the company. Likewise, they must be appointed by the board of directors, report and communicate directly to said governing body, and enjoy autonomy and independence in the exercise of their functions; and must have training and/or experience associated with ML/TF prevention and risk management. The compliance officer must be in the first-level management category, considering in this category those persons who, regardless of the title given to the position, are direct collaborators of the general manager in the execution of the board's policies and decisions, without implying subordination to said body in the exercise of their functions. In accordance with the foregoing, they must have the labor benefits typical of first-level management, which must be consistent with those corresponding to that category in the company. For the purposes of this Regulation, the first-level management category does not include those who maintain a subordinate relationship with respect to other first-level managers or lower categories. Provided that the autonomy and independence of the compliance officer in the exercise of their functions and their direct reporting to the board of directors are guaranteed, as well as compliance with the provisions developed in the Law and this Regulation, companies may structurally place the compliance officer position according to their size and complexity, solely for administrative coordination. The foregoing cannot imply the subordination of the compliance officer to other managers in fulfilling the responsibilities regarding the ML/TF prevention system, which correspond to them according to Article 11 of this Regulation. If the structure adopted by the company fails to comply with what is indicated in this article and/or does not allow for adequate ML/TF risk management, the Superintendency may require the modification of the position's placement decided by the company.2 Article 8.- Disqualifications for the Compliance Officer The following are disqualifications for being a compliance officer:

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 6 / 55 a) Having been declared bankrupt, convicted of intentional crimes or being subject to other disqualifications, other than that considered in numeral 2 of Article 365 of the General Law. In relation to the disqualification indicated in numeral 1 of the referred article, the compliance officer cannot directly or indirectly own capital in the company seeking to appoint them, nor in the companies, under the supervision of the Superintendency, that form its economic group.3 b) Being or having been the internal auditor of the company during the six (6) months prior to their appointment. c) In the case of savings and credit cooperatives not authorized to operate with public funds, additionally, being subject to the disqualifications of Article 33 of the General Law of Cooperatives. d) Being a spouse or cohabitant of any member of the board of directors or the general manager. e) Additionally, in the case of the corporate compliance officer, holding shares or participations in any of the members of the economic group, the ownership of which may cause a conflict of interest with the work they perform. f) Additionally, in the case of companies whose compliance officer is not exclusively dedicated, the director or advisor to the board, general manager or manager of any of the areas directly related to the activities provided for in the company's corporate purpose, or those who perform functions equivalent to those of said managers, regardless of the title given to the position, cannot hold said position. g) Others established by the Superintendency, in order to guarantee the suitability of the compliance officer. The disqualifications established in this article remain in force during the exercise of the position. If the compliance officer is in any of these situations, they cannot continue to act as such, without prejudice to legal responsibilities; therefore, they must communicate it in writing to the company within a maximum period of five (5) business days of the event occurring. In this case, the company must appoint a new compliance officer. Article 9.- Appointment, Removal and Vacancy of the Compliance Officer Position Companies must inform the Superintendency of the appointment of the compliance officer, within a period not exceeding fifteen (15) business days of its occurrence, by means of a communication addressed to UIF-Peru, stating at a minimum: full name, type and number of identity document, nationality, domicile, address of the office where they work, contact details (telephone and email), date of entry, whether they are exclusively dedicated or not, the position they hold in the company, curriculum vitae and a sworn declaration regarding compliance with Articles 7 and 8 of this Regulation. Any change in the compliance officer's information must be communicated by the company to UIF-Peru within a period not exceeding five (5) business days of its occurrence. Companies may appoint, at that time or later, an alternate compliance officer, who must meet the same conditions established for the principal, with the exception of that related to the manager category, to act as alternate compliance officer only in case of temporary absence or removal of the principal. Said communications must observe security measures, in order to protect the identity of the compliance officer and the alternate compliance officer. Additionally, to protect their identity, UIF-Peru assigns secret codes to companies, the compliance officer and

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 7 / 55 alternate compliance officer, after verifying the documentation and information referred to in this article. The removal of the compliance officer must be approved by the board of directors, as well as communicated to the Superintendency, within five (5) business days of the decision being adopted, indicating the reasons justifying such measure. The vacancy of the compliance officer position cannot last more than thirty (30) days. Article 10.- Exercise of Functions of the Alternate Compliance Officer In those cases where an alternate compliance officer is required to perform the functions established in this Regulation, without prejudice to complying with the provisions contemplated in the preceding article, the following must be considered: 10.1 In case of temporary absence or vacancy, the alternate compliance officer may perform their functions until the return or appointment of the new compliance officer, as appropriate. 10.2 In cases where the alternate compliance officer is required to perform the functions established in this Regulation, the company must communicate it in writing to UIF-Peru, within a period of no less than five (5) business days prior to the absence of the compliance officer or vacancy of the position, except in duly justified cases of force majeure. The communication must indicate the period of absence, when applicable, and request the activation of the secret codes referred to in Article 9, for the alternate compliance officer. 10.3 The period of temporary absence of the compliance officer cannot last more than four (4) months. Article 11.- Responsibilities and Functions of the Compliance Officer The responsibilities and functions of the compliance officer, among others contemplated in this Regulation, are the following: a) Propose the company's strategies to prevent and manage ML/TF risks. b) Oversee the proper implementation and functioning of the ML/TF prevention system. c) Evaluate and verify the application of the policies and procedures implemented in the ML/TF prevention system, as indicated in this Regulation, including the registration of operations and the timely detection and reporting of suspicious operations. d) Evaluate and verify the application of the policies and procedures implemented to identify PEPs. e) Implement policies and procedures to ensure adequate ML/TF risk management. f) Verify that the company's personnel have the appropriate level of training for the purposes of the ML/TF prevention system, which includes adequate ML/TF risk management. g) Verify that the ML/TF prevention system includes the review of the lists indicated in Annex No. 1. h) Propose alert signals to be incorporated into the manual. i) Maintain a record of those unusual operations that, after respective analysis, were not determined to be suspicious. j) Evaluate operations and, where appropriate, classify them as suspicious and communicate them, maintaining the duty of confidentiality referred to in Article 12 of the Law, through SARs to UIF-Peru, on behalf of the company. k) Issue quarterly and semi-annual reports on their management to the chairman of the board of directors.

Los Laureles No. 214 - Lima 27 - Peru Tel.: (511) 6309000 Fax: (511) 6309239 8 / 55 l) Verify the proper preservation and custody of documents related to the ML/TF prevention system. m) Act as the company's interlocutor before the Superintendency, on matters related to their function. n) Attend to requests for information or additional and/or complementary information requested by competent authorities. o) Inform the risk committee or the board of directors, if the composition of said committee is not required, regarding modifications and additions to the list of high-risk and non-cooperating countries published by the Financial Action Task Force - FATF. p) Others that are necessary or established by the Superintendency to monitor the functioning and level of compliance of the ML/TF prevention system. q) Verify, with due follow-up, the immediate execution of national freezing measures for funds or assets dictated by the SBS in cases related to ML/TF crimes, in accordance with numeral 11 of Article 3 of Law No. 27693.4 r) Verify