Technical Standards for Access and Use of the Debtor Inquiry System

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Article 61 of the Banks Law establishes that the Superintendence shall maintain a credit information service regarding users of the institutions that are part of the financial system, with the objective of facilitating the risk assessment of their operations for the same, and that banks and other institutions supervised by the Superintendence of the Financial System shall be obligated to provide the information required by the same.

II. That Article 39 of the Law on Cooperative Banks and Savings and Credit Societies establishes that cooperatives shall be obligated to provide the information that the Superintendence requires to maintain its credit information system; likewise, they shall have the right to use the aforementioned credit information service.

III. That Article 71 of the Investment Banks Law establishes that what is established in Article 61 of the Banks Law shall apply to Investment Banks, among others, insofar as it does not contravene the Investment Banks Law, nor the nature or purpose of Investment Banks. (1)

IV. That Article 3 literal c) of the Law on Supervision and Regulation of the Financial System establishes that it is the responsibility of the Superintendence of the Financial System to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity. (1)

V. That Article 35, first paragraph, literal d) of the Law on Supervision and Regulation of the Financial System establishes that directors, managers, and other officials holding positions of direction or administration of the members of the financial system must conduct their business, acts, and operations in compliance with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work for, the adoption and updating of policies and mechanisms for risk management are fulfilled, and among other actions, identifying, evaluating, mitigating, and revealing them in accordance with international best practices. (1)

VI. That Article 99, third paragraph, literal a) of the Law on Supervision and Regulation of the Financial System establishes that it is the responsibility of the Committee of Standards of the Central Reserve Bank of El Salvador to approve technical standards on any other aspect inherent to risk management by the supervised entities. (1)

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

VII. That it is necessary to have an updated regulatory framework in accordance with current legislation so that entities of the financial system can query the debtor information of the Risk Central administered by the Superintendence of the Financial System. (1)

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR ACCESS AND USE OF THE DEBTOR INQUIRY SYSTEM

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Standards aim to establish the guidelines for access to and use of the Debtor Inquiry System that the Superintendence of the Financial System has made available to the entities of the financial system.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Cooperative Associations providing insurance services constituted in the country; b) Banks constituted in El Salvador; c) Cooperative Banks; d) Investment Banks; (1) e) Entities subject to the supervision, inspection, and oversight of the Superintendence of the Financial System that have within their activity the granting of credits and have requested the creation of access keys for the consultation of the aforementioned System; (1) f) Federations of Cooperative Banks; (1) g) Fund for Sanitation and Financial Strengthening; (1) h) Official Credit Institutions; (1) i) Insurance Companies constituted in El Salvador; (1) j) Savings and Credit Societies; (1) k) Reciprocal Guarantee Societies; (1) l) Branches of foreign banks authorized and established in El Salvador; (1) m) Subsidiaries of controlling banks or holding companies of exclusive purpose constituted in El Salvador; (1) and

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

n) Branches of foreign insurance companies authorized and established in El Salvador. (1)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Central Bank: Central Reserve Bank of El Salvador; b) Automatic Query: Queries performed through a software program or online, by one or more users, so that the financial entity accesses and uses the automated query of the debtor system. The financial entity must comply with the security protocols defined by the Superintendence of the Financial System; c) Manual Query: Queries performed through human action by authorized users for the access and manual use of the Debtor Inquiry System; d) Debtor(s): Person(s) who have one or more credits in the entities of the financial system, either directly, as principal debtor, or indirectly as co-debtor or guarantor; e) Link Executive: Person responsible for coordination with the Superintendence for the management of access, modification, and deactivation of users of the Debtor Inquiry System; f) Entity/entities: Subjects referred to in Article 2 of these Standards; g) Debtor Information: Information regarding the behavior of Debtors of the Financial System in their various credit obligations, which contributes to facilitating the risk assessment of the same; h) System or Inquiry System: Debtor inquiry system that the Superintendence has made available to the entities; i) Superintendence: Superintendence of the Financial System; and j) User: Person who has the corresponding permissions for access to and use of the Debtor Inquiry System, authorized to perform queries, either in manual or automatic mode, of which they will be the direct responsible party.

CHAPTER II
OF THE ACCESS OF ENTITIES TO THE DEBTOR INQUIRY SYSTEM

Of the System
Art. 4.- The Superintendence, through the Debtor Inquiry System, will provide entities with agile access to useful information for the evaluation of credit risks of debtors of the financial system.

Of access to the System
Art. 5.- The entity interested in having access to the Debtor Inquiry System must submit to the Superintendence a Commitment Letter signed by its president or Legal Representative, authenticated before a Notary, in accordance with the model of Annex No. 1 of these Standards, in which said entity commits to handle the information obtained from the System confidentially, as well as to adequately use the user names and passwords assigned by the Superintendence. Additionally, the entity must present attached to the Commitment Letter, the designation of the person who will perform the role of Link Executive, identifying the main holder and their substitute, submitting to the Superintendence their respective Commitment Letters and other requirements established in the literals of Article 8 of these Standards.

Link Executive
Art. 6.- The entity, through its president, legal representative, or authorized agent with sufficient powers, must designate a Link Executive and their substitute, who will be responsible for direct communication and coordination with the Superintendence, and will be responsible for requesting access keys to the System, as well as keeping control of active users, whether these are of automatic or manual mode, and informing about users who must be deactivated from the System due to transfer or separation. The person performing the functions of Link Executive must preferably hold a position of direction, management, or equivalent in the risk, business, or similar area of the entity, in addition to having worked for it for more than six months.

CHAPTER III
OF THE USERS OF THE DEBTOR SYSTEM

Of the users
Art. 7.- The entity may access the inquiry system through users, to whom access credentials will be assigned, with the purpose of performing queries of debtor information, for their respective credit evaluation. The person designated as a user may perform queries according to the authorized mode, that is, manual and/or automatic, and will also be the direct responsible party for such queries. In any case, it must be verified that the queries performed comply with the policies and risk manuals associated with the use of the System, in accordance with what is established in Chapter V of these Standards, ensuring the safeguarding and confidentiality of the information accessed. Users must work in risk management, commercial, business, or similar areas, in addition to having worked for the entity for at least three months or having previously worked in similar positions or having held these same accesses in other entities.

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

Of the user request
Art. 8.- The entity requiring the creation of a new user must submit to the Superintendence the request signed by the Link Executive, attaching the following documentation:
a) Commitment Letter signed by the user, in accordance with Annex No. 2 of these Standards; b) Certificate issued by the Head of Human Management or similar, of the entity, stating the position and the employee's start date, for whom access is being requested; c) Description of the current position, signed and stamped by the Human Resources department, according to the Job Manual, where the activities of the position held by the designated employee are evidenced; and d) User information table in accordance with Annex No. 3 of these Standards.

Assignment of keys
Art. 9.- Upon receiving the request and the documentation established in Article 8 of these Standards, the Superintendence will assign to the entity the codes and access keys of the user(s) requested through the Link Executive, in accordance with the request and the documentation established in Article 8 of these Standards (1). The submission of the access codes and keys must be made no later than within a period of eight business days from the date on which the request documents have been received completely and in due form.

Change or addition of users
Art. 10.- The entity requiring a change of users must submit through the Link Executive, the corresponding request accompanied by the documentation referenced in Article 8 of these Standards as applicable, in addition to the detail of the users to be deactivated. In case the entity requires additional users, the Link Executive must submit the request in accordance with what is established in Article 8 of these Standards, which must contain the justification of the request.

CHAPTER IV
RESPONSIBILITIES AND HANDLING OF INFORMATION OF THE USER ENTITIES OF THE DEBTOR SYSTEM

Responsibilities of entities for access to the Debtor System Art. 11.- Regarding the use of the System, the entity must comply with the following:
a) Establish security conditions on the computer equipment on which access to and use of the debtor system is performed; b) Inform in writing to the Superintendence, no later than five business days after any of its designated employees, either as responsible or Link Executive, has been removed due to separation from their position, transfer, or any other circumstances; and c) Answer for non-compliance that System users make to the regulations established in these Standards, and in the policies and risk manuals associated with their use.

Of the responsibilities of users
Art. 12.- Regarding the use of the System, users must comply with the following:
a) Whenever access to the System is required, persons authorized through a user to perform manual queries must enter their user name and access key, refraining from configuring the device they use with the user and key reminder function; b) Persons authorized to access the System through a user to perform manual queries must safeguard the user codes and access keys assigned to them confidentially; consequently, these means will only be used by said persons; c) For manual queries, user codes and keys will be for the exclusive use of employees requested by the Link Executive; therefore, they must not be transferred or shared with any other person or with an entity different from the one that requested them; d) For automatic queries, they must guarantee the security of access and use in the resources or activities that automate the queries to be performed. Likewise, the codes and keys of users authorized to perform automatic queries cannot be used for purposes other than those for which they were created, nor can they be transferred or shared with an entity different from the one that requested them; e) Adequate handling, control, and follow-up of the queries performed under the code authorized to them must be ensured, in accordance with the entity's information security policies; and f) Comply at all times with the policies and risk manuals associated with the use of the System.

Handling of information
Art. 13.- The information contained in the System is considered reserved; therefore, the entity must handle it as such and attend to at least the following:
a) The information must be known and used only by the entity with the sole purpose of facilitating the risk evaluation of its credit operations; b) Safeguard the confidentiality of the information, as well as contemplate the security measures of the users and personnel who have access to the information of the referenced System; c) The information from the System's databases that the Superintendence provides to entities must not be used to create other databases for searching for potential clients, except when it concerns information related to received credit requests; d) No entity or person, free of charge or for consideration, must transfer the information received from the System; and e) Reports generated by the System regarding debtor ratings are confidential; therefore, they cannot be public domain, but only of the user entity.

Of communication with the Superintendence
Art. 14.- Communication between the entity and the Superintendence on topics related to the Debtor Inquiry System must be channeled exclusively through the Link Executive or their substitute.

CHAPTER V
OF RISK MANAGEMENT OF USER ENTITIES OF THE DEBTOR INQUIRY SYSTEM

Of risk management policies and manual
Art. 15.- The entity using the Debtor Inquiry System must approve and implement risk management policies and manuals associated with the use of the System by its users, in accordance with what is established in Chapters II and IV of the Technical Standards for Integral Risk Management of Financial Entities (NRP-20), in order to proactively monitor risks associated with the use of the System and guarantee the confidentiality of the information of consulted debtors.

Of the submission of risk management policies and manual Art. 16.- The entity, prior to having access to the inquiry System, must submit to the Superintendence, through the means defined by the latter, the risk management policies and manual authorized by the corresponding body, in accordance with what is established in Article 15 of these Standards.

CHAPTER VI
OTHER PROVISIONS AND VALIDITY

Supervision of System use
Art. 17.- The Superintendence will conduct audits periodically in the entities, to verify the proper use of the System, for which the audited entity must provide the information and documents necessary to the delegate of the Superintendence. If as a result of the audit it is determined that any of the users has infringed any of the provisions contained in these Standards, the Superintendence will make the entity aware of said situation and the suspension of access to the System by the infringing user will proceed, without prejudice to the legal actions that may arise, and it will only be restored once it is proven that the entity has remedied the deficiencies that caused the infractions.

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

Art. 18.- Once the entity has remedied the deficiencies that gave rise to the suspension of access to the System, the Link Executive must submit the request to the Superintendence so that they are enabled to access the System again or attending to what is established in Article 9 of these Standards, as applicable.

Users and Link Executives authorized before validity Art. 19.- System users, who prior to the date of entry into force of these Standards, the Superintendence had authorized user codes and access keys to access the System, may continue using them for such purposes; nevertheless, the entity within a maximum period of thirty business days after the entry into force of these Standards must submit to the Superintendence the Commitment Letter of each of the users, according to the model contained in Annex No. 2 of these Standards. This provision will be applicable to Link Executives. The entity that on the date of entry into force of these Standards has access to the debtor inquiry system will be exempt from presenting the Commitment Letter established in Annex No. 1 of these Standards.

Sanctions
Art. 20.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Derogation
Art. 21.- These Standards repeal the "Standards for the Use of the Internet Debtor Inquiry System of the Risk Central" (NPB4-40), approved in Session No. 18/2009 of May 6, 2009 by the Board of Directors of the Superintendence of the Financial System, whose Organic Law was repealed by Legislative Decree number 592 containing the Law on Supervision and Regulation of the Financial System, published in the Official Journal No. 23, Volume No. 390, dated February 2, 2011.

Transitory
Art. 22.- Entities that on the date of entry into force of these Standards already have access to the Inquiry System must submit within a period of sixty business days after the entry into force of these, the risk management policies and manual authorized by the corresponding body, in accordance with what is established in Article 15 of these Standards.

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

Unforeseen aspects
Art. 23.- Aspects not foreseen in regulatory matters in these Standards will be resolved by the Central Bank through its Committee of Standards.

Validity
Art. 24.- These Standards will enter into force from April 3, 2023.

MODIFICATIONS:

(1) Modifications in Considerations III, IV, V, and VI, and incorporation of Consideration VII, modifications in Articles 2 and 9, and in Annexes Nos. 1 and 2, approved by the Committee of Standards of the Central Reserve Bank of El Salvador, in Session No. CN-09/2025, of November 10, 2025, with validity from November 25, 2025.

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

Annex No. 1

ENTITY COMMITMENT LETTER

In the city of San Salvador, at ___________ hours and _____ minutes of the day ______ of ______ of two thousand _______. Before me, ________, Notary, of this domicile, appears the gentleman ______________, of ______ years of age, _________ of the domicile of ____________, whom I know, holder of his Identity Document (DUI / Passport) with number ____________________, who acting in his capacity as Legal Representative of (name of the entity) ____________, entity of the financial system of this domicile, legitimacy which is legitimate and sufficient having had the following documents in view:
___________________________________________________________________________ _____and that, in the expressed character, he declares under oath that the entity he represents commits not to share with entities that are outside the financial system, the data obtained from the credit information service operated by the Superintendence of the Financial System regarding users of the institutions that are part of the financial system, as this service is destined exclusively to facilitate to said entities, the credit risk evaluation of their operations, in accordance with Article 61 of the Banks Law, Article 71 of the Investment Banks Law, and Article 39 of the Law on Cooperative Banks and Savings and Credit Societies. Thus expressed the appearing party, to whom I explained the legal effects of this notarial act consisting of one page and read by me in a single act, without interruption, ratifies its content and we sign. I CERTIFY. (1)

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023
Annex No. 2
EXECUTIVE LINK/USER COMMITMENT LETTER

(city)_____________, (day)__of (month)__of(year)

I ______________, aged ______years, residing at ____________, holder of my Identity Document (DUI/Passport) number ____________________, I commit not to share with any person, whether natural or legal, the data that as a result of my duties I obtain from the credit information service operated by the Superintendence of the Financial System regarding the users of the entities that are part of the financial system, as this service is intended exclusively to facilitate for said entities, the risk assessment of their operations, in accordance with Article 61 of the Banks Law, Article 71 of the Investment Banks Law and Article 39 of the Cooperative Banks and Savings and Credit Societies Law; furthermore, I commit to comply with the policies and manuals of the risks associated with the use of the System, as well as to safeguard the user codes and the access passwords that have been assigned to me and that in no case or circumstance I will transfer, share, nor use for the benefit of other entities other than in favor of the one that has designated me for such purposes. (1)

Signature Executive Link/User

NRP-38
DEBTOR INQUIRY SYSTEM
Approval: 17/03/2023
Validity: 3/04/2023

Annex No. 3

DEBTOR INQUIRY SYSTEM
USER INFORMATION FOR WHICH SYSTEM ACCESS IS REQUESTED

ENTITY: ___________________________________

No.
Name of the
Person
Position
Organizational
Unit
Time working at the entity
Address
Electronic
Mail
Telephone
Functions
Performed
Internet
Protocol
(IP)
Name of the
Immediate
Supervisor
Consultation
Modality
(Manual
/Automatic)

Executive Link: _______________________________________ Signature: _______________________________