Resolution No. CD-SIBOIF-721-1-MAR26-2012 dated 26 March 2012

STANDARD FOR THE REFORM OF ARTICLES 8, 10, 11, 12, 13, 14, 15, 16, 21, 26 and 28 OF THE STANDARD FOR THE MANAGEMENT OF PREVENTION OF THE RISKS OF MONEY, GOODS OR ASSETS LAUNDERING; AND OF TERRORISM FINANCING

The Board of Directors of the Superintendency of Banks and Other Financial Institutions, after deliberations thereon,

WHEREAS

SOLE

That it is necessary to reform the Standard for the Management of Prevention of the Risks of Money, Goods or Assets Laundering; and of Terrorism Financing, based on experiences in the supervised sectors.

THEREFORE

In accordance with the foregoing and based on and in exercise of the power conferred by articles 3, numeral 13), and 10, numeral 5), of Law No. 316: “Law of the Superintendency of Banks and Other Financial Institutions”, and its reforms; and article 36, second paragraph, of Law No. 285: “Law on Narcotics, Psychotropics and Other Controlled Substances; Money and Assets Laundering from Illicit Activities”.

In use of its powers,

RESOLVES

To issue the following:

Resolution No. CD-SIBOIF-721-1-MAR26-2012

STANDARD FOR THE REFORM OF ARTICLES 8, 10, 11, 12, 13, 14, 15, 16, 21, 26 and 28 OF THE STANDARD FOR THE MANAGEMENT OF PREVENTION OF THE RISKS OF MONEY, GOODS OR ASSETS LAUNDERING; AND OF TERRORISM FINANCING

First: Reform literal e) of article 8, of the Standard for the Management of Prevention of the Risks of Money, Goods or Assets Laundering; and of Terrorism Financing contained in Resolution CD-SIBOIF-524-1-MAR5-2008, dated 05 March 2008 and published in the Official Gazette, La Gaceta, editions number: 63, 64, 65, 66 and 67 corresponding to 4, 7, 8, 9 and 10 April 2008 and its reforms (hereinafter, Standard PLD/FT), which must be read as follows:

“e) The Supervised Entity must not initiate, establish, accept, maintain, execute or develop:

i.- Anonymous accounts and/or business relationships, or those appearing under fictitious, inaccurate, encrypted, fantasy or coded names; or that in any way are not in the name of the client-person holding them. Every account or business relationship must be in the name of a client identified and identifiable unequivocally, whether a natural person or legal person. When dealing with temporary or participating associations that the law

recognizes but without granting them legal personality, or when dealing with projects clearly specified financed by specialized organizations or funds recognized for those purposes; the accounts and/or business relationships may be named with the name of said association or with the references of said project, but must also be accompanied by the name of the natural or legal person that is its main link and/or person in charge and/or executor and/or responsible party, the latter being, for all purposes, the person considered client of the Supervised Entity.

ii.- Accounts of a person (natural or legal) used to serve as a nest or bridge for the purpose of depositing, managing or facilitating the transfer of funds from businesses and/or income belonging to another person (natural or legal), whether or not owned by the account holder, and with which the supervised entity has no contractual relationship or reasonable justification for the operation.

iii.- Any commercial relationship or transaction with high-risk clients that, even applying the provisions of articles 6, literal “l” and 11, literal “g”, of this Standard; do not present the complete information required to obtain full certainty about their identity, the purpose of said relationship and the specific justification of the origin of the funds or assets managed or to be used.”

Second: Reform the first paragraph of article 10, of the Standard PLD/FT, which must be read as follows:

“The Supervised Entity, when initiating a business relationship with a client and without prejudice to other Standards of the Superintendency and Internal Regulations and Policies of each Entity, in the application of the DDC policy in matters of Prevention LD/FT must require the following documents, as applicable in each case; these documents must be valid at the time of opening the account or beginning of the relationship, as established by the laws on the matter:”

Third: Reform literal a) of article 10, of the Standard PLD/FT, which must be read as follows:

“a) Legal, official, valid, reliable and indubitable identification document for natural persons, in accordance with the laws on the matter:

i.- Identity Card for Nicaraguans residing in the country.

ii.- Identity Card or Residence Card and/or Passport for Nicaraguans not residing in the country.

iii.- Residence Card for foreigners residing in the country.

iv.- Passport with valid entry stamp for foreigners not residing in the country. In the case of foreigners not residing in the country who have not entered the country, it will not be necessary to require the entry stamp.

v.- Passport or Identity Card for foreigners not residing in Nicaragua and coming from a country member of CA-4.

vi.- Card or official document issued by competent national authority, for foreigners members of representations or organizations with diplomatic rank; and/or the Passport issued by their respective country.”

Fourth: Reform literal i) of article 10, of the Standard PLD/FT, which must be read as follows:

“i) RUC Card (Single Taxpayer Registry) for legal persons or equivalent document of the corresponding country for legal persons not domiciled in Nicaragua, in accordance with the law and regulations on the matter.”

Fifth: Reform literal l) of article 10, of the Standard PLD/FT, which must be read as follows:

“l) Personal, banking or commercial references in favor of the client, as the case may be. The number of references and the manner of obtaining them shall be defined in the internal policies of each Supervised Entity in accordance with the level of DDC they apply. The following exceptions or differentiated treatment with respect to this requirement are established:

i.- For accounts in the name of government entities, it shall not be necessary to require references from them.

ii.- In the case of deposit accounts for the payment and withdrawal of the client's salaries or wages, only the reference of the employer who is in turn a client of the supervised entity with a payroll or salary account shall be required.

iii.- If the contractual relationship is limited to loan operations, it shall be sufficient for the Supervised Entity to require the client's references through the loan application forms, which must be verified by acceptable means, such as telephone, fax, email, mandatory consultation with the Superintendency's Credit Bureau, and Private Credit or Credit Information Bureaus when the latter have been so established in their policies, and additionally, leave written evidence of the manner in which such verification was carried out. This exception also applies in the case of loans in which the client must open a deposit account for the exclusive purpose of crediting the disbursement thereof, making deposits for its payment and/or depositing funds from their economic activity in accordance with the declared Profile."

Sixth: Amend literal i) of article 11 of the PLD/FT Standard, which shall read as follows:

"i) Verify, within the legal framework and in accordance with the level of LD/FT risk, the origin of the funds, assets or merchandise deposited by the client, or that are involved in the transaction, in the following cases:

i.a.- At the beginning of the contractual relationship.

i.b.- When in the course of the relationship there are alerts, changes, variations, inconsistencies or disproportionate or atypical or significant increases in the client's behavior or in their accounts or transactions with respect to the information on their economic activity, income or expected monthly activity declared by the client.

i.c.- In significant transactions with occasional clients with whom there is no contractual relationship.

i.d.- Whenever they are clients classified as high risk.

i.e.- In the case of clients from whom the entities have received information requests from the competent authorities."

Seventh: Amend literal a) of article 12 of the PLD/FT Standard, which shall read as follows:

"a) Data on the client - natural person:

i.- Names and surnames in accordance with an official, valid and unquestionable identification document; number, date of issuance, date of expiration and issuing country of the identity document; sex, marital status, date of birth, country of birth, nationality.

ii.- Name by which, socially and/or publicly, they are known.

iii.- Address and home or mobile telephone, contact telephone, personal electronic address, profession and current occupation, as applicable. Name and address of their workplace, job position and monthly salary, as applicable. Income range in which they qualify.

iv.- REPEALED.

v.- Data on the certificates and/or licenses and/or permits, or equivalent documents, as applicable according to the client's activity; including the entity that issues it, date of issuance and expiration.

vi.- Account numbers and/or contractual business relationships maintained between the client and the Entity, including types, dates of engagement, currency, initial deposit, and forms of payment as applicable.

vii.- Annual income and/or approximate sales volume obtained or generated by the client.

viii.- The origin of the funds and assets to be managed, purpose and nature of the relationship.

ix.- Volume of the activity and/or normal transactions expected from the client monthly in each of their accounts and/or contractual relationships with the Entity, including number of transactions, amounts in debits, credits, transfers and average balances, among other criteria, that allow their monitoring and comparison in an agile and timely manner with the client's actual activity.

x.- General data on the accounts and/or business relationships with other financial institutions, national or foreign.

xi.- The client's LD/FT risk level in accordance with their own risk rating system.

xii.- Data on the references in favor of the client, including name of the grantor, number of their identification document, address, contact telephone, workplace, length of time knowing the referred client, and brief description of the result of the verification of the references indicating the employee who verifies it, date, time, name and signature of the verifier.

xiii.- The names of their major clients and suppliers, as applicable.

xiv.- The set of information established in articles 8 through 11, inclusive, of this Standard, as applicable.

Eighth: Amend literals e) and f) of article 12 of the PLD/FT Standard, which shall read as follows:

"e) The Supervised Entity must not create, update and modify the PIC on its own initiative. The creation and updating of the PIC must be based on information given by the client and verified by the Supervised Entity. The updating of the PIC shall be done in the following cases, requiring the client to provide the explanations and necessary supporting documents that justify it:

i.- Every two years in the case of high-risk clients. This periodicity may be shorter in consideration of the importance of the commercial relationships and the LD/FT risk levels in accordance with the policies of the Entity itself. For Medium or Low risk clients, when atypical or significant changes, variations or increases are reflected.

ii.- When its economic activities in terms of markets, sales and/or annual income experience atypical or significant changes, variations or increases in relation to its original PIC. It is the responsibility of each Supervised Entity to define in its LD/FT Prevention policies from what percentage or reasonable parameter it will be considered a significant variation.

iii.- When atypical or significant changes, variations or increases are reflected in the actual activity with respect to the expected monthly transactional activity originally declared by the client. It is the responsibility of each Supervised Entity to define in its LD/FT Prevention policies from what percentage or reasonable parameter it will be considered a significant variation.

iv.- When new accounts are opened and/or new business relationships are established with the client.

f) The PIC must, in addition, comply with the following guidelines:

i.- The initial PIC must be signed by the client, by the officer who fills it out and reviews it, and by the officer who authorizes it. In the case of subsequent updates of the PIC, both for natural and legal persons, it is not necessary for the client to sign again. Its updating may be carried out by the entity through the use of means or mechanisms that allow it to receive and documentarily evidence the pertinent information endorsed by the client and/or by those authorized by the client to modify their information, such as: email, fax, scanner, internet. The entity must keep records and/or a log that allows reconstructing the information changed in the PIC, the date of each update, the officer who made it and the officer who authorized it.

ii.- Before the client's signature, there must be a note stating: "I authorize the entity to verify, by any legal means, all the information I have provided for the purposes of the relationships or accounts that support this Profile".

iii.- In the updates of the PIC for natural or legal person clients, the signature of the latter shall not be mandatory and it may be done directly through mechanisms that allow evidencing that an update of the information was made, such as: email, fax and scanner, and leave evidence in the system of the date of the last update and of the officer who made it.

iv.- When the updating of the information on the client is carried out through online banking and/or electronic service, the Supervised Entity must

take the measures that are necessary to provide security and reliability to the information entered, in correspondence with article 25 of this Norm. "

Ninth: Amend article 13 of the PLD/FT Norm, which must be read as follows:

"Art. 13.- Client File

The Supervised Entity must form and keep, in good condition and updated, a physical file for each client, in which a copy of the initial PIC and its updates must be filed, the supports of the application of the DDC according to the risk level, as well as all the information and documents indicated in articles 8 to 11, inclusive, of this Norm, as applicable to each type of client."

Tenth: Amend article 14 of the PLD/FT Norm, which must be read as follows:

"Art. 14.- Standard DDC

a) The Supervised Entity must apply a standard or ordinary DDC to clients and operations that, according to its LD/FT risk level rating matrix, classify as medium or normal risk clients; applying the measures provided in articles 8 to 13, inclusive, of this Norm, as applicable.

b) The Supervised Entity, on the basis of risk sensitivity, must apply a differentiated or graduated DDC in terms of intensifying or simplifying it with respect to the standard DDC, as the risk level of clients or the business relationship varies according to the updates of its matrix; and must consider the changes that occur, among others, in the following circumstances:

i.- The legal structure of the client and its background.

ii.- The geographic location, jurisdiction or country of origin of the client, and of the origin of the funds to be used.

iii.- The economic sector where the client operates and its activity within the sector.

iv.- The work and professional environment of the client, including the determination of whether they hold a significant public or private position.

v.- The characteristics, complexity and changes in the transactions, product or service required by the client.

vi.- Significant changes in the expected monthly activity declared by the client with respect to their actual activity.

vii.- The channels and means of delivery or distribution of services and products, including the use of intermediaries, agents, brokers, managers or electronic banking.

viii.- The use of complex legal or fiduciary structures with low transparency and uses of bearer instruments or shares or convertible to bearer.

ix.- The means of payment used.

x.- The use of intermediaries and third parties. xi.- The linking of accounts, or businesses with relatives, representatives, or with the Supervised Entity or a group affiliated with it.

xii.- Any other indicator that each Supervised Entity deems pertinent according to its own line of business and risk level, or in accordance with any guideline or other mechanisms issued by the Superintendency or competent authority."

Eleventh: Amend article 15 of the PLD/FT Norm, which must be read as follows:

"Art. 15.- Intensified DDC

a) The intensified DDC (DDC-I), reinforced, enhanced or expanded, is the set of policies, procedures and differentiated measures of management and internal control reasonably more robust, rigorous, demanding and exhaustive that the Supervised Entity must establish for clients classified by regulatory provision or, by its internal policies or, international standards as high risk. The DDC-I must be applied in accordance with the following provisions:

i.- Qualified clients under literal c) of this article and/or in accordance with international standards as High-Risk Clients, the supervised entity must apply the DDC-I to them.

ii.- Clients not covered by the provision of the preceding numeral, and whom the supervised entity qualifies as High Risk when applying its rating matrix for the individual LD/FT risk level in which it combines at least the risk factors indicated in literal b) of this article, must be subject to the DDC-I.

iii.- The Supervised Entity must apply at least a Standard Due Diligence (DDC-E) to the clients indicated in literal d), numeral i), of this article, only in cases where, when applying its rating matrix for the individual LD/FT risk level of its clients, it justifies that they did not require a DDC-I.

iv.- For clients that the entity initially qualifies as high risk in accordance with the provisions of numeral ii) of this article, and that in subsequent updates and/or application of the rating matrix for the individual LD/FT risk level, the result reflects a lower risk, the entity must define policies, procedures, criteria, controls and authorized instances to authorize their transfer to the lower category; it must keep records and/or logs that allow reconstructing the different risk levels assigned to a client during the contractual relationship and after the initial level, date of change, criteria or variables determining the change, name and position of the officer or instance that authorized them.

b) Risk factors are all those circumstances and characteristics of the client, their activities and operations that generate a greater probability of LD/FT risk and that therefore warrant special attention and an intensified DDC. Without prejudice to the LD/FT risk factors that each supervised entity may additionally include based on its own policies, procedures, methodologies and internal processes, it must consider, combine and weigh in its rating matrices for the individual LD/FT risk level of its clients or as instructed by another authority with competence in the matter, or as recommended by the best international prevention practices, at a minimum, the LD/FT risk factors indicated in literal d) of this article.

c) For purposes of this Standard and in accordance with the main international standards, the following must be considered as high-risk clients and to whom the supervised entity must apply a DDC-I:

i.- Clients engaged in activities or lines of business, such as: Exchange Houses and Money Changers; Persons or companies engaged in the handling of transfers, transportation or physical movement of money or securities, and/or sending of funds or remittances; Non-Bank Financial Institutions that provide services or carry out operations with electronic money; Casinos and companies or gambling businesses under any of their modalities; Non-Profit Civil Associations; Foundations or Non-Governmental Organizations (NGOs); Persons or entities engaged in unregulated financial or credit activities, Savings and Credit Cooperatives, Microfinance institutions or microfinance entities, Pawnshops, Loan-Granting Companies and Individual Lenders. The risk will be even greater when, being obligated by national legislation, they do not develop PLD/FT programs, or, while developing them, they are not subject to an effective regulation and supervision regime in PLD/FT matters, or, if they are, it is inadequate.

ii.- Auto lots, marketers or Lessors or providers of services for watercraft or aircraft.

iii.- Marketers under Multi-Level or Pyramid Sales System schemes (network marketing);

iv.- Marketers of antiques, jewelry, precious metals and stones, coins, art objects and postage stamps;

v.- Marketers of weapons, explosives and ammunition.

vi.- Politically Exposed Persons (PEP), nationals and foreigners, including close family members, associates and close collaborators of such persons. When the PEP has ceased to hold public office, the financial institution may apply a DDC-E in accordance with its DDC policies with a risk-based approach, provided that, from the application of its rating matrix for the individual LD/FT risk level, it is justified that they did not require a DDC-I.

vii.- Commercial Companies or Companies with bearer shares or shares convertible to bearer.

viii.- Trusts or legal structures especially when they function as holding companies abroad for the administration of assets and property, or as providers of fiduciary services.

ix.- Companies, businesses or enterprises that offer or whose transactions are not carried out "face to face" or whose execution does not require the physical presence of the parties or that facilitate anonymity.

x.- Legal persons incorporated, and/or established, and/or domiciled, and/or with presence or operations in territories known as tax havens or Offshore.

xi.- Clients that have been the subject of a Suspicious Operation Report (ROS) and/or clients about whom investigation and/or judicial authorities have requested information in LD/FT matters and/or any other manifestation of

organized crime. Without prejudice to the functions and powers of the competent authority to analyze the STRs, the information on these clients is for the exclusive consideration and internal handling of the reporting Supervised Entity itself, which must not disclose to any other Supervised Entity the names of its clients that are being analyzed or considered for a possible STR or when said Report has been submitted, in accordance with the provisions of article 29, literal "e", of this Standard, and the provisions of the banking law.

d) Based on international standards and best practices, the following factors together with the variables or categories that belong to each of them, supervised entities must assign weights or ponderations to them, and combine them in the rating matrix of the individual level of ML/TF risk of clients, to determine the type of DDC corresponding to each level on a risk-focused management basis for ML/TF and in accordance with the policies, procedures and methodologies that each entity must have in its SIPAR ML/TF. These factors with their variables or categories are the following:

i.- Factor: Client: Persons engaged in activities and/or categories that are part of the variables to be considered in this factor, and without prejudice to others determined by the entity, are the following:

i.a- Free Zones.

i.b.-Investors, merchants and/or Real Estate Agencies;

i.c.- Foreign persons and persons domiciled abroad.

i.d.- Motor vehicle leasing companies

i.e- Clients with accounts and/or transactionality that present high activity of handling funds in cash and/or in transfers, and/or in deposit instruments and/or in exchange desk operations or purchase and sale of foreign currency.

i.f.- Clients constituted by professionals who at an individual level, in partnership, alliances, consortium or in firms, are providers of Legal, Notarial or Accounting services, provided that the following characteristics are present:

i.f.i- That their services are related or habitually directed to the purchase and sale or intermediation of real estate and commercial, industrial or financial entities; or to the administration on behalf of third parties, of accounts, securities, funds or other assets; or, to the advisory, incorporation, creation, organization, operation or administration of companies, enterprises, legal persons or legal structures or provision of registered addresses, shareholders, directors or nominal representatives.

i.f.ii- That they are not subject to an effective regime of regulation and supervision in matters of ML/TF Prevention and obligation of Reporting of Suspicious Operations.

i.g.- Notoriously Public Persons (PNP). i.h.- Clients or users who recurrently or habitually make use of transactional channels that are not "face to face", or that do not require or minimize the physical presence of the parties, and/or that facilitate anonymity.

i.i.- Clients engaged in international land transport and/or international excursions.

i.j.- Natural persons who individually or jointly maintain in the Supervised Entity balances and/or flows of debits and/or flows of monthly credits, whether in passive, active or trust operations through accounts and/or transactions under any business modality, for amounts equal to or greater than two hundred thousand United States of North America dollars (US$ 200,000.00), in national currency or any other, and that additionally, these are not related to their profile.

i.k.- Clients or habitual or recurrent users of private banking services and/or correspondent banking and/or Trusts and/or Payable Through Accounts.

i.l.- Natural or legal persons with financial, economic or commercial activity in countries, territories or jurisdictions that are considered by specialized international organizations in the matter as non-cooperative in the fight against ML/TF; and/or as tax havens and/or of high banking secrecy; and/or of low, poor, weak or null legislation and supervision in matters of AML/CFT.

ii.-Factor: High-Risk Products, and/or Services, and/or Accounts: The products, services or activities that are part of the variables to be considered in this factor are the following:

ii.a.- Private Banking.

ii.b.- Correspondent Banking and/or Correspondent Relationships.

ii.c.- Electronic Banking, via Internet or Telephone, or other electronic forms of sophisticated technologies for the provision of financial services, and/or businesses or transactions that are not "face to face", or that do not imply the physical presence of the parties, or that facilitate anonymity.

ii.d.- Electronic or wire transfers of funds.

ii.e.- Monetary instruments.

ii.f.- Safe Deposit Boxes.

ii.g.- Exchange Desk or Purchase and Sale of Foreign Currency.

ii.h.-Loans secured with liquid guarantees (cash previously deposited in accounts, commercial securities, Certificates of Time Deposit, Government Bonds, etc).

ii.i.- Trusts and asset administration services.

ii.j.- Payable Through Accounts services.

ii.k.- Accounts managed at Representation Offices.

ii.l.- Accounts of Stockbrokers, intermediaries or investment agents or that act on behalf of third parties.

iii.- Factor: Distribution Channels: The distribution channels and/or provision of products and/or services that are part of the variables to be considered in this factor are the following:

iii.a.- Electronic Banking, via Internet or Online Branches.

iii.b.- Telephone Banking.

iii.c.- Automated Teller Machines.

iii.d.- Financial services provided through the use of sophisticated electronic forms and/or cutting-edge technology that diminish or do not require the physical presence of the parties, facilitating or that could facilitate anonymity.

iii.e.- Businesses or transactions through agents or intermediaries.

iv.- Factor: Countries, Jurisdictions and/or Geographic Areas: The following form part of the geographic variables to be considered herein:

iv.a.- Those considered by specialized bodies such as FATF as non-cooperative or whose systems for preventing ML/TF risks are considered non-existent or, if existing, are not effectively applied.

iv.b.- Those considered by international bodies, such as the UN, as collaborators of international terrorism.

iv.c.- Those considered of special attention due to their high incidence in the production, and/or trafficking and/or consumption of illicit drugs.

iv.d.- Those considered by international bodies working in the fight against ML/TF and/or in favor of international transparency as offshore financial centers, tax havens, with high banking and tax secrecy, or with a high level of perceived public corruption.

iv.e.- Those that have been subject to sanctions by international bodies or included in lists of special attention due to the high ML/TF risk they represent.

iv.f.- National or internal geographic areas of the country itself, when there is public information from official entities that these are being frequently used for the transit or transfer of illicit drugs, illegal immigrants or any other form of human trafficking, smuggling of goods, or the smuggling or illegal transfer of cash.

iv.g.- Those identified by the Supervised Entity itself as deserving special attention based on its experience with them, due to the history of monitored transactions originating from them, due to the presence of high indicators of public corruption, among others.”

Twelfth: Amend subsection d) of article 16 of the ML/TF Standard, which shall read as follows:

“d) Require updated Financial Statements or a photocopy of the most recent tax return from high-risk clients that are legal entities.”

Thirteenth: Amend subsection k) of article 16 of the ML/TF Standard, which shall read as follows:

“k) The Supervised Entity must also apply enhanced CDD to clients and transactions that, originally considered normal risk, present any of the following circumstances:

i.- There are doubts about the validity or sufficiency of the client information derived from the identification and verification process.

ii.- The client is included in lists of persons convicted, prosecuted or under investigation for ML/TF matters by competent national authorities; or who appear on national, foreign, international or specialized body lists of persons linked to these risks; or due to any other information of which the Entity itself is aware.

iii.- There are sudden and unjustified changes in the client.

iv.- These are transactions and business relationships with clients operating from high-risk countries, jurisdictions and geographic areas that do not comply with or do not sufficiently implement international standards on ML/TF prevention.

v.- The Entity itself has suspicion or grounds to suspect that there is ML/TF risk, regardless of the amount of the operation or the type of client; or, when said client has been the subject of a Suspicious Transaction Report (STR) and the Entity decides to continue the contractual relationship.”

Fourteenth: Amend subsection a) of article 21 of the ML/TF Standard, which shall read as follows:

“a) In the case of national or international Electronic Transfers of Funds and Remittances or Money Remittance, whether habitual or occasional; the Supervised Entity, when acting as originator, intermediary or beneficiary, must:

i.- Include in the electronic funds transfer forms, in the corresponding automated system and in the related associated messages through the payment chain, the exact, precise and valid information on the client sending or receiving said transfer (name, type and number of identification, address, telephone and account number). This requirement must be met at least at the first and last link of the payment chain, as applicable.

ii.- Ensure that the foregoing information is maintained with the transfer and messages throughout the entire payment cycle.

iii.- Examine more thoroughly funds transfers that do not contain complete information on the sender, or refrain from receiving them.

iv.- In the case of family remittances from abroad, banks must keep records of the name of the originator and country of origin of

where the remittance comes from, as well as the beneficiary's data (name, type and number of identification and address).”

Fifteenth: Amend subsection b) of article 26 of the ML/TF Standard, which shall read as follows:

“b) When the Supervised Entity, through its monitoring system for the early detection of unusual and/or suspicious activities, transactions or operations or in any other way, becomes aware of these in accordance with the preceding subsection, it must carry out its documented examination, scrutiny or analysis through the application of enhanced due diligence measures within fifty (50) days following its detection, in order to determine whether it should dismiss the suspicion or proceed with sending the Suspicious Transaction Report to the competent authority. Written evidence of this process and its conclusions must be kept and filed for the legal term.”

Sixteenth: Amend subsection c) of article 28 of the ML/TF Standard, which shall read as follows:

“c) The STR must also be submitted:

i.- When the Supervised Entity cannot comply with enhanced CDD.

ii.- When in the scrutiny process, request for information from the client for the justification and analysis of transactions, operations or activities detected from the implementation of monitoring procedures and systems; the Supervised Entity could thereby directly or indirectly warn said client that they are being analyzed for a possible ROS. In this case, the scrutiny and request for information from the client must also be discontinued.

iii.- When dealing with clients whose movements and actual balances in accounts and/or in a business relationship with the Supervised Entity are not consistent with the expected activity according to the Comprehensive Client Profile (PIC); and/or that are not related to the nature and size of the client's business or occupation, without reasonable justification duly documented.

iv.- When the Supervised Entity cannot determine the origin of the funds to be used in the accounts and/or in the business relationship.”

Seventeenth: This reform norm shall enter into force upon its notification to the Banks and Non-Bank Financial Institutions subject to the supervision of the Superintendency of Banks, without prejudice to its subsequent publication in the Gazette, Official Journal.

(f) illegible (Alberto Guevara Obregón) (f) V. Urcuyo V. (f) Gabriel Pasos Lacayo (f) illegible (Silvio Moisés Casco Marenco) (f) Fausto Reyes B. (f) U. Cerna B.

URIEL CERNA BARQUERO
Secretary Board of Directors SIBOIF