Technical Norms for the Integral Risk Management of Entities in the Stock Markets

NRP-11
ENTITIES OF THE STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015

THE COMMITTEE OF NORMS OF THE CENTRAL RESERVE BANK OF EL SALVADOR, CONSIDERING:

I. That Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System establishes that: the proper functioning of the Financial Supervision and Regulation System requires, from the members of the financial system and other supervised entities, compliance with current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with what is established in the aforementioned Law, in other applicable laws, regulations, and technical norms issued for such effect.

II. That in accordance with Article 3, first paragraph, and letter c) of the Law on Supervision and Regulation of the Financial System, it is the responsibility of the Financial System Superintendence to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.

III. That according to Article 3, first paragraph, and letter i) of the Law on Supervision and Regulation of the Financial System, the Financial System Superintendence is responsible for supervising the individual and consolidated activity of the members of the financial system and other persons, operations, or entities mandated by the laws, and for such purposes, it is its responsibility to require that supervised entities and institutions be managed and controlled in accordance with international best practices referred to risk management as well as the technical norms issued.

IV. That Article 7, letters f), q), s), and u) of the Law on Supervision and Regulation of the Financial System, establishes that the following are subject to supervision by the Financial System Superintendence: stock exchanges, brokerage houses, securities deposit and custody companies, risk classifiers, institutions providing auxiliary services to the stock market, agents specialized in securities valuation, general warehouses for deposits, securitization companies, and exchanges for products and services.

V. That Article 35, letter d) of the Law on Supervision and Regulation of the Financial System, stipulates that directors, managers, and other officials holding positions of direction or administration of the members of the financial system, must conduct their business, acts, and operations complying with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management are fulfilled, including among other actions, identifying, evaluating, mitigating, and disclosing them in accordance with international best practices.

VI. That according to international standards, it is necessary to have a solid risk management framework to manage risks comprehensively according to the profile, magnitude of activities, business, resources of the entity, and best practices, so as to promote the implementation of prudential measures for the transparent, efficient, and orderly functioning of the market.

THEREFORE, by virtue of the normative powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES, to issue the following:
TECHNICAL NORMS FOR THE INTEGRAL RISK MANAGEMENT OF ENTITIES IN THE STOCK MARKETS

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Norms have as their objective to establish general prudential provisions to strengthen the integral management of risks that must be observed by the members of the financial system that make up both the securities market and the products and services market, in accordance with applicable laws and international standards in the matter, in accordance with the nature and scale of their activities.

Subjects
Art. 2.- The provisions established in these Norms are applicable to the following entities that are members of the financial system:
a) Stock exchanges; b) Exchanges for products and services; c) Brokerage houses; d) Companies specialized in the deposit and custody of securities; e) Risk classification companies; f) Agents specialized in securities valuation; g) General warehouses for deposit; h) Securitization companies and the funds they manage; and i) Investment fund managers and the funds they manage.

Terms
Art. 3.- For the purposes of these Norms, the terms indicated below have the following meaning:
a) Senior Management: The Chief Executive President, General Manager, or whoever acts in their place, and the executives who report to them; b) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plans; (2) c) Central Bank: Central Reserve Bank of El Salvador; (2) d) House: Brokerage House; (2) e) Financial Conglomerate: In accordance with Article 113 of the Banking Law, it is the set of companies characterized by the fact that more than fifty percent of their respective share capital is owned by a controlling company, which is also a member of the conglomerate. The controlling company of the conglomerate may be a company with exclusive purpose or a bank constituted in the country; (2) f) Custodian: Company specialized in the deposit and custody of securities, constituted in El Salvador and registered with the Financial System Superintendence; (2) g) Entity: Subject obliged to comply with the provisions of these Norms; (2) h) Manager: Investment Fund Management Company; (2) i) Business Group: In accordance with Article 5 of the Securities Market Law, it is that in which a company or set of companies has a common controller, who acting directly or indirectly participates with at least fifty percent in the share capital of each of them or that have common shareholders who, directly or indirectly, are holders of at least fifty percent of the capital of another company, which allows to presume that the economic and financial performance is determined by common interests or subordinate to the group; (2) j) Board of Directors: Collegiate body in charge of the administration of the entity, with supervision and control functions; (2) k) Risk Profile: Evaluation at a given moment in time of the exposure to risk; (2) l) Superintendence: Financial System Superintendence; (2) m) Securitization Company: Securitization Company; and (2) n) Risk Tolerance: Levels of risk-taking acceptable to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and, generally, is aligned with risk categories, such as strategy, finance, people, or reputation. (2)

CHAPTER II
ENVIRONMENT FOR INTEGRAL RISK MANAGEMENT

Risk Management
Art. 4.- Entities must establish an integral risk management system, which shall be understood as a strategic process carried out by the entire entity, through which they identify, measure, control, monitor, and communicate the different types of risks to which they are exposed. Such management must be in accordance with their risk profile, volume, and complexity of their activities, business, own resources, and third-party resources, so as to promote the implementation of measures in accordance with best practices for the transparent, efficient, and orderly functioning of the market.

Stages of the integral risk management process Art. 5.- Entities must have a continuous and documented process for the integral management of their risks, which must contain at least the following stages:
a) Identification: This is the stage in which existing risks in each operation, product, process, and business line developed by the entity and those that arise in new business lines are recognized and understood. In this stage, risk factors are identified, which are variables and whose movements can generate changes in the equity of the entity or in the funds it manages; b) Measurement: This is the stage in which risks must be quantified in order to determine compliance or adequacy of policies, fixed limits, and measure the possible economic impact on the financial results of the entity. The methodologies and tools to measure risks must be in accordance with their organizational structure, volume, and nature of their operations and the levels of risks assumed; c) Control and mitigation: This is the stage that seeks to ensure that the policies, limits, and procedures established for the treatment and mitigation of risks are appropriately executed; it refers to the actions or coverage and control mechanisms implemented by the entity with the purpose of preventing or reducing negative effects in case the adverse events of identified and managed risks materialize. An action plan must be established to implement measures that seek to mitigate identified risk events. This plan must detail the actions to be implemented, the estimated execution time, and the direct responsible parties for such execution; and d) Monitoring and communication: This is the stage that provides systematic and permanent follow-up to risk exposures, their evolution, trend, and the results of adopted actions. The systems used must ensure a periodic and objective review of risk positions and the generation of sufficient information to support decision-making processes.

Internal organizational structure
Art. 6.- Entities must establish an organizational or functional structure, in accordance with their business model and properly segregated, that delimits their functions and responsibilities, as well as the hierarchical levels, levels of dependence, and interrelation that correspond to each of the operational support, business, and control areas that participate in the risk management process to which they are exposed.

Functions of the Board of Directors
Art. 7.- The Board of Directors is responsible for ensuring adequate integral risk management, having among its functions at least the following:
a) Know and understand all risks inherent to the business developed by the entity, its evolution, and its effects on equity levels, as well as the methodologies for risk management; b) Approve the policies and manuals for risk management assumed by the entity, ensuring that they are implemented; c) Approve the internal organizational or functional structure in accordance with its business model, with their respective organization manuals and segregation of functions, assigning the necessary resources to implement and maintain adequate risk management, effectively and efficiently, including training programs, as well as ensuring independence between the unit or area responsible for risk management and the business areas of the entity; d) Create the Risk Committee, in accordance with the provisions of these Norms, approving the appointment and removal of its members, when applicable, ensuring its independence, this Committee being of a corporate nature in accordance with what is established in these Norms; e) Approve the exposure limits of each particular risk in accordance with the entity's profile; likewise, it must establish the respective controls for exceptions and deviations to such limits, as well as contingency plans to be adopted regarding extreme scenarios; f) Approve the entity's incursion into new business lines, operations, and activities, in accordance with business strategies and risk management policies; and g) Repealed; (1) h) Ensure that Internal Audit verifies the existence and compliance of the entity's risk management scheme. The policies and manuals for risk management approved by the Board of Directors must be sent to the Superintendence for its knowledge within the first ten business days after their approval or respective modification.

The Board of Directors must meet with the necessary frequency to perform its functions effectively, which must be at least quarterly. Meetings may also be held via videoconference; however, the agreements and resolutions taken must be documented in accordance with what is established in the Code of Commerce.

Functions of Senior Management
Art. 8.- Senior Management is responsible for the implementation of management for each particular risk applicable to the entity, and must report to the Board of Directors, adopting at least the following measures:
a) Implement the policies and manuals for risk management authorized by the Board of Directors; (1) b) Form the Risk Unit, or designate a person to perform this function, ensuring its independence from business and operational areas, as well as providing it with adequate human, material, and technical training resources; c) Establish procedures that ensure the flow, quality, and timeliness of information, between business units and the Risk Unit or whoever acts in their place, so that the latter appropriately develops its function; d) Ensure the establishment of mechanisms for disseminating the culture of integral risk management, at all levels of the organizational structure; e) Maintain permanent follow-up on the compliance of risk management work plans, as well as action plans derived from recommendations made in the risk management process; f) Establish conditions at the organizational level to promote an environment that seeks the development of the integral risk management process; and g) Establish and ensure the execution of training and updating programs for the entity's risk management.

Risk Committee
Art. 9.- Entities must have a Risk Committee, responsible for the follow-up of integral risk management. This Committee must have authority over operational areas to support the work performed by the Risk Unit -or the person in charge of exercising the risk function- and will be the link between the latter and the Board of Directors. The Risk Committee must be integrated, at minimum, by:
a) A member of the entity's Board of Directors, who will preside over the Committee in all sessions; b) The General Manager of the entity or a managerial official, whom he designates, without this exempting him from his responsibility; and c) The person in charge of the Risk Unit or whoever exercises its functions.

When the number of operations or the organizational structure of the entity does not allow the creation of the Risk Committee, the corresponding functions may be developed by the entity's Board of Directors or by a Corporate Risk Committee, provided that it complies with what is established in the applicable legal framework and with the provisions established in these Norms, ensuring objectivity, adequate handling of conflicts of interest, independence of criterion, confidentiality, and access to information. In these cases, the entity will be responsible for having the minutes, reports, and supporting documentation of the topics reviewed. The entity's Board of Directors will maintain responsibility for the execution of the functions defined in these Norms.

Functions of the Risk Committee
Art. 10.- The functions of the Risk Committee will include, at minimum, the following activities:
a) Ensure that the entity has the adequate organizational structure, policies, manuals, and resources for integral risk management; b) Propose for approval by the Board of Directors, at least the following:
i. The policies and manuals for integral risk management, as well as any eventual modifications made to them;
ii. The exposure limits to the different types of risks identified by the entity;
iii. The mechanisms for the implementation of corrective actions; and (1)
iv. The cases or special circumstances in which exposure limits may be exceeded, as well as special controls on such circumstances;
c) Validate:
i. The methodology to identify, measure, control, mitigate, monitor, and communicate the different types of risks to which the entity is exposed, as well as any eventual modifications, ensuring that it considers the critical risks of the activities performed by the entity; and
ii. The corrective actions proposed by the Risk Unit in case of deviation with respect to the assumed exposure levels or limits;
d) Inform the Board of Directors about the risks assumed by the entity, their evolution, their effects on equity levels, and additional mitigation needs, as well as their corrective actions; e) Inform the Board of Directors about the execution of approved policies, ensuring that the entity's operations comply with the policies and procedures defined for risk management; f) Require and follow up on corrective plans to normalize non-compliance with exposure limits or reported deficiencies; and g) Inform the Board of Directors about the result of the reports prepared by the Risk Unit or whoever acts in their place. The Risk Committee will review, at least once a year, what is stated in letters a), b), and c) of this article.

Meetings and agreements of the Risk Committee
Art. 11.- The Risk Committee must meet with the necessary frequency to perform its functions effectively, at least once every three months. The persons in charge of the different areas involved in the operations that generate risks may participate in the sessions, with the right to speak but without the right to vote.

Risk Unit
Art. 12.- The entity's Board of Directors, to facilitate the evaluation of integral risk management, must create a specialized Risk Unit or designate a person from the entity, and provide it with sufficient resources to perform its function in accordance with the size, structure, and risk profile of the entity; in any case, it must ensure that there is independence of this with the business and operational areas, in order to avoid conflicts of interest and ensure adequate separation of functions and responsibilities. The object of said Unit must be to identify, measure, control, monitor, and communicate the risks that the entity faces in the development of its operations, whether these affect assets and liabilities within or outside the balance sheet, including, where applicable, the associated risks of the operations it carries out with the member companies of the financial conglomerate or business group. The foregoing does not limit the role of the different operational units in the identification, measurement, control, monitoring, and communication of the risks that the entity faces. The person in charge of the Risk Unit must have a profile in accordance with the functions to be performed, for this, the entity must consider their academic training, experience, and training in stock markets and risk management.

Corporate Risk Unit
Art. 13.- The functions of the Risk Unit may be performed by another unit of the same type, provided that it complies with what is established in the applicable legal framework and with the provisions established in these Norms and that the adequate management of the risks of each of the entities under the respective Unit's charge is guaranteed, objectivity, adequate handling of conflicts of interest, independence of criterion, confidentiality, and access to information. In case the functions are performed by a Corporate Risk Unit, it must

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015 draft a minutes document containing the topics reviewed in said Committee. The Board of Directors of the entity subject to these Standards must have an original minutes point for the topics treated corresponding exclusively to the entity and the supporting documents that the Corporate Risk Unit used to perform the identification, measurement, control, monitoring, and communication of the risks associated with the entity subject to these Standards. In addition to the global risk management analysis that the Risk Unit may perform, said Unit must explicitly pronounce itself on the analysis of the risk management of the entity subject to these Standards. In these cases, the Board of Directors of the entity will maintain responsibility for the execution of the functions defined in these Standards.

Functions and responsibilities of the Risk Unit Art. 14.- The Risk Unit must fulfill at least the following functions:
a) Identify, measure, control, monitor, and communicate the risks incurred by the entity within its various business units, in accordance with approved policies and methodologies; b) Design and propose to the Risk Committee the strategies, policies, procedures, and manuals necessary for the integral and specific management of identified risks, as well as their modifications for respective approval; c) Propose for approval the methodologies, models, and parameters for the management of the different types of risks to which the entity is exposed; d) Periodically inform the Risk Committee about the evolution of the main risks assumed by the entity, including the detail of changes in the risk factors applicable to the entity and the historical evolution of the risks assumed by the entity; e) Opine on the possible risks involved in the establishment of new products, operations, and activities as well as significant changes in the entity's business environment; f) Monitor compliance with risk exposure limits, their tolerance levels by quantifiable risk type, and propose mitigation mechanisms for exposures and inform the Risk Committee; g) Periodically monitor corrective actions presented by units for the improvement of risk management, which must be made known to the Risk Committee and Senior Management; and h) Repealed; (1) i) Draft and propose to the Risk Committee the performance of stress tests in accordance with what is established in these Standards.

Training programs
Art. 15.- Due to the fact that integral risk management is a dynamic process, Senior Management must guarantee that employees and executives directly involved in risk management are trained in these topics, developing for this purpose an annual training plan, in which personnel to be trained, topics to be developed, and their scheduling are incorporated. Likewise, since this management involves the entire organization, a dissemination program must be established that generates an organizational risk culture in all employees and levels of the organization.

CHAPTER III
RISK MANAGEMENT FRAMEWORK

Policies for risk management
Art. 16.- Entities must develop policies to define the management framework for the different types of risks to which they are exposed as well as for third-party funds they administer, which allow them to reduce their vulnerability and losses from such risks and promote at the level of the entire organization a culture of prevention and control of risks, ensuring compliance with internal and external norms related to the same. Risk management policies must consider, among other aspects, the functions and responsibilities in risk management, criteria, information systems, as well as mechanisms for identification, measurement, control, and mitigation of the risks presented by the entity. The entity's policies and procedures must be consistent with its structure, nature, size, complexity of its activities, operations, business lines, type of clients it serves, and with the duties applicable to its activity. These policies and procedures must also be in accordance with the operations authorized according to its object and applicable legal regime.

Risk management manual
Art. 17.- Entities must have a risk management manual that, based on policies, groups for the management of each risk: the associated processes, the functions and responsibilities of the areas involved, indicating the segregation of functions of key positions susceptible to risks, the methodology for measuring risk detailing variables, criteria, tools used, and the periodicity with which information must be reported on exposure to each of the types of risks to the Risk Committee or whoever acts on its behalf, to the Board of Directors, or to Senior Management. The integral risk management manual must be a technical document that contains, in addition to the aspects mentioned in the previous paragraph, at minimum the following: information flow diagrams, risk matrix, categorization of loss events, models, methodologies, and calculations for the valuation of the different types of risks, stress tests, as well as the requirements for information processing systems and risk analysis.

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015
For the development of the risk management manual, entities must consider the implementation of prudential measures and best practices referred to risk management. The Superintendence will know these documents and may request explanations and expansions, being able to recommend modifications when it considers pertinent, in attention to best practices.

For the case of entities that administer third-party funds or securitization funds, the aforementioned manual must include the management of risks associated with said funds.

CHAPTER IV
MANAGEMENT BY TYPE OF RISK

Types of risks
Art. 18.- For the purposes of these Standards, entities must manage the risks they assume according to their structure, size, business, and resources, as well as those assumed by the third-party funds they administer. Considering, when applicable, credit risk, counterparty risk, custody risk, liquidity risk, market risk, operational risk, and reputational risk. In the case of Risk Rating Agencies and General Warehouses, they must manage especially what corresponds to operational risk and reputational risk.

Credit Risk
Art. 19.- Credit risk is understood as the possibility of loss due to the default of contractual obligations assumed by the issuer of a security or because the credit rating of the security, or in its absence, the issuer, has deteriorated. The management of this risk must consider, when applicable, the following aspects:
a) Identify the factors or variables whose movements may originate an increase in credit risk; b) Establish limits or thresholds of credit concentration, charged to an issuer or group of issuers that must be considered as a single source of risk due to their patrimonial or liability links; c) Have mechanisms to monitor identified risk factors, performing an analysis of concentration of its investment portfolio as well as estimations of the trends they present, considering for this: individual exposures against the same issuer, linked issuers and related groups, issuers in the same economic sector or geographic region; d) Monitor and control the nature, characteristics, diversification, correlation, and quality of risk exposure, considering the type of investment or instrument related to the operations; e) Analyze the recovery value, as well as mitigation mechanisms and estimate the expected loss in the operation; and

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015 f) Establish measures to mitigate exposure to this risk.

Counterparty Risk
Art. 20.- Counterparty risk is understood as the possibility of loss that may occur due to the default of contractual obligations assumed by a party for the settlement of an operation due to situations of illiquidity, insolvency, operational capacity, or improper actions. The management of this risk must consider, when applicable, the following aspects:
a) Identify and evaluate risk factors that may originate an increase in counterparty risk assumed by the entity; b) Establish limits or thresholds of concentration charged to one or a group of counterparties, that must be considered as a single source of risk due to their patrimonial or liability links; c) Analyze payment means; d) Analyze guarantees associated with operations carried out with counterparties, classifying assets as acceptable in accordance with the entity's policies and risk profile; e) Establish valuation methods for guarantees taking into consideration existing market conditions; and f) Establish measures to mitigate exposure to this risk. In the case of product and services exchanges, mechanisms and procedures must be foreseen to verify the transfer of ownership of products and services, as well as manage the settlement risk of operations carried out therein, considering the default of contracts and associated guarantees.

Custody Risk
Art. 21.- Custody risk is understood as the possibility of loss affecting values held in custody due to insolvency, negligence, fraud, poor administration, or inadequate maintenance of records by a custodian. The management of this risk must consider, when applicable, the following aspects:
a) Identify and evaluate risk factors; b) Establish necessary measures to safeguard assets and minimize the risk of loss; c) Establish measures that allow the entity to have the capacity to safeguard its own or third-party assets; and d) Establish measures to mitigate exposure to this risk. In the case of Custodians, they must have rules and procedures to safeguard the integrity of security issuances and security holders, to avoid the unauthorized creation or elimination of securities; likewise, they must have safeguard procedures and internal controls that fully protect assets.

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015

Liquidity Risk
Art. 22.- Liquidity risk is understood as the possibility of incurring losses due to not having sufficient resources to meet assumed obligations. The management of this risk applies only for the administration of third-party funds carried out by entities subject to these standards and must consider, when applicable, the following aspects:
a) Identify and evaluate risk factors; b) Establish minimum liquidity levels based on business and investment objectives, assumed risk profile, and redemption conditions of participation shares; c) Perform stress tests under a stress scenario based on the operations they carry out in accordance with assumptions or premises established individually according to the nature, complexity, vulnerability, and volume of operations performed by the entity; d) Draft contingency plans that incorporate actions to be taken in case of unexpected liquidity requirements, said plan must have roles and responsibilities of involved areas and events that activate the plan; e) Ensure that established liquidity levels are sufficient in relation to assumed obligations; f) Establish methodologies that quantify liquidity risk, which must relate to the level and risk profile, size, nature, complexity, and other characteristics of the entity's operations, as well as its liquidity indicators; g) Establish early warning indicators that allow identifying exposure to liquidity risk; h) Establish strategies to manage a potential lack of liquidity at the entity or systemic level; i) Establish a level of liquid assets free of any encumbrance, to be used in front of a series of liquidity stresses; and j) Establish measures to mitigate exposure to this risk.

Market Risk
Art. 23.- Market risk is understood as the possibility of loss, resulting from movements in market prices that generate a deterioration in value in the entity's positions or the funds it administers. The management of this risk must consider, when applicable, the following aspects:
a) Identify risk factors;

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015 b) Have a market analysis that allows monitoring identified risk factors; c) Evaluate significant variations in product and service prices, due to operations in product and services exchanges; d) Evaluate positions subject to market risk, using for this purpose models, tools, and limits that allow measuring potential loss in said positions associated with price, interest rate, or exchange rate movements; e) Evaluate the concentration, volatility, and correlation of its positions subject to market risk; f) Establish a methodology to be used for the valuation of financial instruments classified for trading, defining, if applicable, the respective price sources; g) Monitor movements in interest rates and foreign currency of active and passive positions, when applicable; h) Establish measures to mitigate exchange rate risk; and i) Establish measures to mitigate exposure to this risk. In the case of entities that administer third-party funds, they must carry out a sensitivity analysis especially in extreme situations and simulation of scenarios. Likewise, they must evaluate the impact of interest rate risk on services provided by the entity and the launch of new products.

Operational Risk
Art. 24.- Operational risk is understood as the possibility of incurring losses due to failures in processes, people, information systems, and due to external events; operational risk includes the management of information security, business continuity, and legal risk. Legal risk is understood as the possibility of occurrence of losses due to failures in the execution of contracts or agreements, non-compliance with norms, as well as external factors such as regulatory changes, judicial processes, among others. The management of operational risk must consider, when applicable, the following aspects:
a) Identify operational risk events grouping them according to Annex No. 1 of these Standards, in such a way that it allows establishing its operational risk map; b) In the case of stock exchanges, product and services exchanges, houses, custodians, general warehouses, securitization companies, and investment fund managers, the identification of events can be grouped additionally according to the business lines the entity maintains, as expanded in Annex No. 2 of these Standards;

c) Document processes that describe the functions of each organizational unit; d) Establish tolerance levels for each identified type of risk, defining their causes, origins, or risk factors; e) Analyze and order identified risks by priority, classifying them according to impact and probability on institutional objectives; f) Analyze exposure to potential losses due to various activities carried out by people participating in the administration business, processing errors, transactions, among others; g) Entities must form a centralized database that allows registering, ordering, classifying, and having information on operational risk events. These must be classified by factors, determining the frequency of the event and the effect produced, must contain as minimum the fields detailed in Annex No. 3 of these Standards; h) Give systematic and timely follow-up to operational risk events; i) Manage risks adequately through action plans to treat the risk; and j) Regarding legal risk management, entities must consider at minimum the following:
i. Establish specific policies and controls so that, prior to the celebration of legal acts, their validity is analyzed and adequate legal verification of them is sought. Likewise, these policies and procedures must contain aspects related to the orderly, complete, integral, and timely conservation of information and documentation that support the entity's operations, establishing mechanisms that allow giving adequate control and follow-up to its legal and regulatory obligations, as well as follow-up and compliance with observations made by its supervisors;
ii. Estimate the amount of potential losses derived from unfavorable judicial or administrative resolutions, as well as the possible application of sanctions, in relation to operations carried out. In said estimation, judicial litigations in which the entity is plaintiff or defendant, administrative procedures in which it participates, as well as litigations derived from the application of alternative means of conflict resolution must be included;
iii. Analyze acts carried out by the entity when governed by a legal system different from the national one and evaluate the differences existing between the system in question and the national one, including what relates to the judicial procedure;
iv. Ensure compliance with legal, regulatory, and contractual provisions to which the entity is subject and disseminate them to employees and members of the Board of Directors;

NRP-11
ENTITIES IN STOCK MARKETS
Approval:
15/07/2015
Validity: 10/08/2015
v. Make applicable legal and administrative provisions known to its directors and employees; and
vi. Maintain control of judicial and administrative resolutions, their causes, and costs.

Reputational Risk
Art. 25.- Reputational risk is understood as the possibility of incurring losses, resulting from the deterioration of the entity's image due to non-compliance with laws, internal norms, corporate governance codes, codes of conduct, money laundering, service provided, technological failures, among others. The management of this risk must consider, when applicable, the following aspects:
a) Identify and evaluate internal and external risk factors or events; b) Establish mechanisms to mitigate risks; c) Evaluate possible contagion risks that may affect the entity's reputation affecting the entity's security and solvency levels; and d) Establish measures to mitigate exposure to this risk.

Business Continuity Management System (2)
Art. 26.- Entities must implement a business continuity management system in case of interruptions that includes contingency plans, business impact analysis, disaster recovery plans, and incident management plans, which ensure normal business operability in the occurrence of adverse events. Business continuity plans must consider at minimum the following:
a) The identification of events that put business continuity at risk, the activities to be carried out to overcome them, operational alternatives, and return to normal activities; b) The definition of roles and responsibilities for their implementation; c) The performance of necessary tests to confirm their effectiveness and efficiency, at least once a year; and d) The dissemination of the plan to all members of the entity.

Provision of services by third parties
Art. 27.- Entities must establish appropriate policies and procedures to evaluate, supervise, and monitor the performance of critical services provided by third parties, that is, those that may interrupt the normal development of operations defined in each entity's policies. The provision of services must be formalized through signed contracts, which include the scope of the service and clearly define the responsibilities of the provider and the entity, establishing the liaison person between the entity and the provider. Likewise, they must include a clause that obliges the provider to document the services provided guaranteeing the adequate use of confidential information and the establishment of contingency and service continuity plans. In addition, clauses must be included that facilitate an adequate review of the respective service provision by the entities themselves or eventually by the Superintendence and other supervisory bodies. Likewise, entities must guarantee the continuity of activities provided by the provider in case of problems such as default or revocation of the contract, among others. Entities must have a centralized control of all services provided by third parties and as a minimum requirement must contain the name of the provider, the type of service, the contract amount, the counterparty within the entity, and its validity. Such control must be available to the Superintendence at the moment it requires it. Regardless of whether certain services are performed by third parties, the entity is responsible for ensuring compliance with the provisions applicable to it.

CHAPTER V
INFORMATION AND CONTROL SYSTEMS

Management Information Systems
Art. 28.- The entity must have managerial information and statistical databases that enable the generation of timely, reliable, consistent, and homogeneous information that allows for the preparation of periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other stakeholders responsible for risk management decision-making.

Entities must send the Superintendence, annually and no later than the thirtieth day of the year two thousand seventeen, by electronic means or in the manner determined by the Superintendence. Likewise, entities must remit operational risk events on the next business day after they occur; sending them by electronic means or in the manner determined by the Superintendence.

Internal Control System
Art. 29.- Integral risk management includes the internal control system that allows for verifying compliance with the policies, limits, processes, and procedures established for the entity's risk management. For this purpose, entities must establish the necessary administrative, financial, accounting, and technological controls in accordance with international standards on the matter.

Role of Internal Audit
Art. 30.- The Internal Audit Unit must include within its annual work plan, examinations of the work developed by the Risk Unit.

In the case of entities not linked to financial conglomerates, they may subcontract this service.

CHAPTER VI
INFORMATION TRANSPARENCY

Annual Report
Art. 31.- Entities must submit to the Superintendence, within the first one hundred twenty days following the end of the reported accounting period, the Board of Directors' report, which must contain at least the following:
a) The organizational structure for integral risk management; b) Detail of the main risks assumed as well as those to which the entity is exposed due to its activities; c) Updated policies for integral risk management; d) Description of the methodologies, systems, and tools used for each of the risks; e) Results of the evaluations carried out on integral risk management and actions taken; f) Projects associated with risk management to be developed in the period following the reported one; g) Execution of the training plan related to integral risk management established in Article 15 of these Norms; and h) General conclusions on the entity's risk management.

For items b) and e), entities must include statistics that allow for an analysis of the evolution of the entity's integral risk management, in those cases where they are quantifiable.

Notwithstanding the foregoing, the entity must inform the Superintendence within a maximum period of three business days upon becoming aware of any aspect related to risk exposure that could impact the entity qualitatively or quantitatively.

Disclosure on Integral Risk Management
Art. 32.- Entities must disclose in a summarized manner in a section of their Website, which may in any case use the Website of the financial conglomerate or business group to which they belong, within the first ninety calendar days of each year, information relating to the policies, methodologies, and other relevant measures adopted for the management of each type of risk.

Entities must disclose in a summarized manner in the notes to the annual closing financial statements how they manage risks and compliance with their policies.

CHAPTER VII
OTHER PROVISIONS AND EFFECTIVE DATE

Additional Information
Art. 33.- The Superintendence may require entities to provide any additional information it considers necessary for the adequate supervision of integral risk management and of each of the specific risks to which the entity in question is exposed.

Entities must always have available to the Superintendence all documents, records, and files, in physical, electronic, or any other medium, referred to in these Norms, as well as information from audits or reviews conducted by their holding companies, in the case of entities whose holding company is located outside the country.

Likewise, the Superintendence must have access to the documentation referred to in the previous paragraph, in cases where entities assign functions defined in these Norms to Committees or Risk Units.

Sanctions
Art. 34.- Non-compliance with the provisions contained in these Norms will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Unforeseen Aspects
Art. 35.- Aspects not provided for in regulatory matters in these Norms will be resolved by the Standards Committee of the Central Bank.

Transitory
Art. 36.- Subjects obliged to comply with these Norms, from the effective date thereof, will have a maximum period of six months to present to the Superintendence an Adaptation Plan to comply with the provisions established in these Norms. Once presented, entities must initiate and complete its execution within a period of twelve months, counted from the presentation thereof.

Effective Date
Art. 37.- These Norms will enter into force as of August 10, two thousand fifteen.

MODIFICATIONS:

(1) Modifications to articles 7, 8, 10, and 14 approved by the Standards Committee of the Central Bank of El Salvador in Session No. CN-17/2020 dated October 21, two thousand twenty, with effect from November 5, two thousand twenty. With the object of maintaining consistency with new regulations approved by the Standards Committee. (2) Modifications to articles 3 and 26 approved by the Standards Committee of the Central Bank of El Salvador in Session No. CN-04/2023 of June 28, two thousand twenty-three, with effect from July 14, two thousand twenty-three.

Annex No. 1

TYPES OF EVENTS BY OPERATIONAL RISK

Event Type (Level 1) | Definition | Event Type (Level 2) | Examples --- | --- | --- | --- Internal Fraud. | Losses derived from any type of action aimed at defrauding, improperly appropriating goods, or evading regulations, laws, or corporate policies in which at least one member of the entity is involved. | Unauthorized activities. | Unrevealed operations (intentional), unauthorized operations (with economic losses), erroneous valuation of positions (intentional).
| | Theft and fraud. | Theft, embezzlement, forgery, bribery, misappropriation, smuggling, tax evasion (intentional).
External Fraud. | Losses derived from any type of action aimed at defrauding, improperly appropriating goods, or evading legislation, by a third party. | Theft and fraud. | Theft, forgery.
System Security. | Damages from cyberattacks, theft of information. | | Labor Relations and Workplace Safety. | Losses derived from actions incompatible with labor legislation or agreements, regarding hygiene or workplace safety, regarding payment of claims for personal damages, or regarding cases related to diversity or discrimination. | Labor Relations. | Issues regarding remuneration, social benefits, termination of contracts.

	Hygiene and Safety at Work.	Cases related to hygiene and safety regulations at work; compensation to workers.
	Diversity and Discrimination.	Any type of discrimination.
Clients, Products, and Business Practices.	Losses derived from the involuntary or negligent non-compliance with a corporate obligation towards specific clients (including fiduciary and suitability requirements), or of the nature of an obligation.	Suitability, Disclosure of Information, and Trust.
	Improper Business or Market Practices in the Stock Industry.	Restrictive competition practices, improper commercial/market practices, unauthorized securities intermediation, fictitious transactions, executing transactions to artificially fix or vary prices, market manipulation, abuse of insider information (in favor of the entity), money laundering.
---	---	---
	Defective Products.	Product defects (unauthorized, etc.), error in contract models.
	Selection, Sponsorship, and Risks.	Lack of client research according to guidelines, excess of risk limits towards clients.
	Advisory Activities.	Litigation regarding results of advisory activities.
Material Asset Damages.	Losses derived from damages or harm to material assets as a consequence of natural disasters or other events.	Disasters and Other Events.
	Business Interruption and System Failures.	Losses derived from interruptions in business or trading sessions and system failures.
---	---	---
	Systems.	Deficiencies in information systems, hardware or telecommunications equipment; electrical power failures.
Execution, Delivery, and Process Management.	Losses derived from errors in the processing of operations or in process management, as well as relationships with different counterparties.	Receipt, Execution, and Maintenance of Operations.
	Errors in the process of securities transfers, securities clearing, and cash settlement.
Follow-up and Reporting.	Non-compliance with the obligation to report, inaccuracy of external reports (with generation of losses).
	Commercial Counterparties.	Failures of counterparties other than clients, other litigations with counterparties other than clients.
---	---	---
	Services by Third Parties, Distributors, and Suppliers.	Subcontracting, non-compliance with stipulated obligations (with generation of losses), litigations with suppliers.

Annex No. 2
DETAIL OF BUSINESS LINES

Level 1	Level 2	Activity Groups
STOCK EXCHANGES
Securities Registration.	Authorization of Issuances.	Review of compliance with the legal and regulatory framework, authorization of the issuance by the Board of Directors, submission to the Superintendence, etc.
Registration of the Issuance.	Enabling issuances in electronic trading systems.
Trading and Custody of Securities.	Trading Platforms and Systems.	Administration of electronic trading and information transfer systems.
Information Systems.	Administration of information systems related to dissemination.
Guarantees Received from Intermediaries.		Formalization of the receipt of guarantees, custody and administration of received guarantees, etc.
Monetary Clearing and Settlement.	Monetary Settlement Systems for Operations.	Administration of the electronic settlement system, use of banking settlement mechanisms, etc.
Contingency Management.	Contingency plans for events that may affect the clearing and settlement process.
DEPOSITARIES
Electronic Registration of Securities Issuances.	Creation of Authorized Issuances in the Registry.	Documentation of authorization of the issuance by the stock exchange and the Superintendence, prospectus, etc.
Legal Formalization.	Drafting of contracts.
---	---
Maintenance of Issuances.	Updating of interest rates, receipt and delivery of funds for the payment of property rights.
Registration in the Electronic System of Securities Accounts.	Creation of Securities Accounts.	Necessary documentation for identification of holders and formation of files, etc.
Securities Accounts.	Legal Formalization.	Drafting of contracts, etc.
Account Maintenance.	Periodic reviews, updating of information, etc.
Deposit, Custody, and Administration of Securities.	Deposits, Withdrawals, and Transfers.	Of local and foreign operations, authorizations, etc.
Exercise of Property Rights.	Control of coupon maturity, Receipt and payment of periodic interest, etc.
Securities Clearing and Settlement.	Local Operations.	Receipt of electronic information, clearing and settlement, etc.
Foreign Operations.	Submission of electronic information to the Sub-Custodian, clearing and settlement, control of balances in bank accounts, etc.
Electronic Shareholder Registry.	Creation of the Registry.	Necessary documentation for the identification of holders.
BROKERAGE FIRMS
Structuring of Issuances.	Structuring and Advisory.	Drafting of issuance contracts, analysis, prospectus, etc.
Drafting of Legal Documents.	Granting of contracts, processing of issuance authorization.
Securities Intermediation and Stock Advisory.	Primary Market Placement.	Contract, securities deposit, settlement and clearing, accounting registration, etc.
Local Market Securities Brokerage.	Contract, operation orders, trading, clearing and settlement, documentation of the advisory service, accounting registration, etc.
---	---
International Market Securities Brokerage.	Contract, operation orders, trading, clearing and settlement, documentation of the advisory service, accounting registration, etc.
Securities Custody.	Securities Custody.	Withdrawal, deposit, and transfer of securities, documentation, etc.
Exercise of Property Rights.	Receipt and payment of cash, periodic interest of issuances, redemption and maturity of securities, etc.
Individual Portfolio Administration	Asset Administration.	Registration of investments, strategy or investment policy according to what is established by the client, portfolio analysis, registration and custody of securities, asset valuation methodology, etc.
Local Market Securities Brokerage.	Contract, operation orders, trading, clearing and settlement, accounting registration, etc.
---	---
International Market Securities Brokerage.	Contract, operation orders, trading, clearing and settlement, accounting registration, etc.
ASSET SECURITIZERS
Structuring of Issuances.	Structuring and Advisory.	Securitization contracts, purchase and sale of assets, assignment of cash flows, etc.
Training and Financial Analysis.	Feasibility analysis for securitization, training for originator personnel.
Administration of Securitization Funds.	Administration of Assets.	Control and administration of securitized assets, prepayments, etc.
Administration of Securities Issuance.	Control and administration of the issuance of securitized securities, payment of property rights, maturity and redemption of securities, etc.
---	---
Treasury.	Management and control of funds generated by the assets.
PRODUCTS AND SERVICES EXCHANGES
Transactions of Products and Services.	Authorizations.	Authorization of exchange booths, exchange agents, licensees, etc.
Contract Registration.	Registration of contracts for contracts and services, guarantees, advisory services, etc.
---	---
Contracting Systems.	Contracting platforms and systems, monitoring of settlement, etc.
GENERAL WAREHOUSES
Custody and Storage of Merchandise.	Storage in Own Warehouse.	Issuance of certificates and bonds, formation of files, commissions, insurance, etc.
Storage in Fiscal Warehouse.	Issuance of certificates and bonds, authorization and validity of Customs, requirements, formation of files, commissions, letters of guarantee, insurance, etc.
---	---
Storage in Authorized Warehouse.	Lease contracts, issuance of certificates and bonds, formation of files, commissions, etc.
Merchandise Deconsolidation.	Merchandise Deconsolidation.	Deconsolidation, loading and unloading of merchandise, etc.
MANAGEMENT COMPANIES
Administration of Investment Funds.	Asset Management.	Registration of investments, investment strategies according to the internal regulations of the fund to be administered, portfolio analysis, divestment processes, registration and custody of assets, etc.
Accounting Systems of Administered Funds.	Accounting systems, asset valuation methodology and calculation of quota values, presentation of the performance of the administered fund, preparation of information directed to participants.
---	---	---
Marketing of Participation Quotas.	Subscription and Redemption of Participation Quotas.	Offer of participation quotas, request for contribution and redemption, registration of participants, computation of number of quotas and information provided to participants.

Annex No. 3

TABLE OF CONTENT OF THE EVENT REGISTRATION DATABASE

1 Reference. Internal code that identifies the event sequentially.
2 Operational Risk Factor. According to Article 24 of these Norms.
3 Loss Event Type. Identifies the type of loss, according to the classification in Annex No. 1.
4 Business Lines. Identification of the business line that originated the event, detailed in Annex No. 2, for the case of stock exchanges, depositaries, brokerage firms, securitizers, products and services exchanges, general warehouses, and management companies.
5 Description of the Event. Detailed description of the event.
6 Event Start Date. Date on which the event begins: day, month, year.
7 Event End Date. Date on which the event ends: day, month, year.
8 Discovery Date. Date on which the event is discovered: day, month, year.
9 Accounting Date. Date on which the economic loss from the event is registered: day, month, year, hour.
10 Amount. The amount of the loss, economic quantification of the occurrence of the operational risk event and the expenses derived from its handling.
11 Currency. Foreign currency in which the event materializes.
12 Affected Accounting Accounts. Identifies the accounts of the Chart of Accounts affected.
13 Process. Identifies the affected process.
14 Total Value Recovered. The total value recovered by the direct action of the entity. Includes amounts recovered by insurance.
15 Value Recovered by Insurance. Corresponds to the value recovered through coverage by an insurance policy.
16 Affected Product or Service. Identifies the product or service affected by the operational risk event.
17 Quantification of Damage Severity. Amount of the loss (net of any mitigant or recovery).

For the creation of the operational risk event register, entities may use, in addition to the fields described above, others that are considered relevant. An operational risk event is understood to be an occurrence or series of occurrences, of internal or external origin, that may or may not result in financial losses for the entity.

Entities that consider that their operational risk event databases are insufficient to quantify operational risk may opt for the use of external source databases, provided that such databases are normalized and adequate to the entity's internal databases.