Technical Standards for Carrying Out Operations and Providing Services Through Physical, Digital and Mobile Financial Correspondents and Financial Correspondent Administrators — BCR — SV

CNBCR-08/2022 NASF-11
TECHNICAL STANDARDS FOR CARRYING OUT OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL AND MOBILE FINANCIAL CORRESPONDENTS, AND FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022

THE COMMITTEE FOR STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That it is in the State's interest to promote access to formal financial services and the use of payment systems for its population, thereby facilitating their integration into productive activities, contributing to the improvement of quality of life and collective well-being. This is achieved through the incorporation of innovative mechanisms for providing the aforementioned financial and payment services in geographic areas usually underserved;

II. That international experience has shown that the implementation of the figure of financial correspondents and financial correspondent administrators by financial institutions, as an alternative channel for providing their services, constitutes an efficient tool for financial inclusion;

III. That it is necessary to have a regulatory framework that establishes the conditions and requirements that financial institutions must observe to conduct their operations and services through financial correspondents and financial correspondent administrators, as well as the requirements and conditions that these must comply with;

IV. That Article 70 of the Banks Law establishes that banks will conduct their operations and provide their services, in accordance with the provisions of the Commercial Code and other applicable laws, adhering to sound practices that promote the security of said operations and services and ensure adequate attention to users;

V. That Article 63 of the Banks Law and Article 41 of the Law on Cooperative Banks and Savings and Credit Societies establish that banks must develop and implement control policies and systems that allow them to adequately manage their risks and have reliable knowledge of their customers; and

VI. That it is in the State's interest to orient public policies so that low-income individuals and especially rural areas have access to financial services, which implies that institutions can make use of new technologies to provide low-cost operations and services through financial correspondents.

THEREFORE,

by virtue of the regulatory powers conferred upon it by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR CARRYING OUT OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL AND MOBILE FINANCIAL CORRESPONDENTS, AND FINANCIAL CORRESPONDENT ADMINISTRATORS

CHAPTER I
OBJECT, SUBJECTS AND TERMS

Object
Art. 1.- These Standards aim to establish the provisions regarding the procedures and requirements that the subjects listed in Article 2 of these Standards must comply with, to carry out operations and provide services either through physical, digital and/or mobile financial correspondents or through financial correspondent administrators, who act on behalf of and under the responsibility of the subjects, as well as the characteristics, conditions and prohibitions applicable to the aforementioned financial correspondents.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Banks constituted or created by Law in the country; b) Branches of foreign banks established in the country, insofar as pertinent; c) Savings and credit societies; and d) Cooperative banks.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Financial correspondent administrator or Administrator: A legal entity whose legal regime or corporate purpose includes affiliating and administering natural or legal persons who act as financial correspondents, with which the subjects listed in Article 2 of these Standards sign a contract without an employment relationship so that they act on behalf of and under the responsibility of the subjects; they may also exercise the function of financial correspondent; b) Web or mobile application, program or computer system: Any software used by the obligated subjects, financial correspondent administrators, or financial correspondents for the collection, storage, processing, visualization, or transmission of information related to the financial products or services that said entity offers to its customers;

c) Central Bank: Central Reserve Bank of El Salvador; d) Customer: Natural or legal person who maintains a contractual relationship with the Entity for the provision of one or more passive or active operations; e) Digital correspondents: Financial correspondents that make their web applications or mobile device applications available to the public for the provision of their operations and services; f) Financial correspondents or Correspondent: Natural or legal persons legally constituted who carry out acts of commerce in the Republic of El Salvador, operate in their own or third-party physical or mobile establishments and serve the public, or digitally, through a web or mobile application, program or computer system, with which the subjects listed in Article 2 of these Standards sign, either directly or through an Administrator, a contract without an employment relationship, so that on behalf of and under the responsibility of the latter, they can carry out the operations and provide the services to the public referred to in these Standards. Therefore, financial correspondents are considered a channel of the subjects, exercising activities complementary to their main commercial activity, according to a mandate contract. The Central Government, Municipalities, and Official Autonomous and Semi-Autonomous Institutions may be financial correspondents provided their legal framework authorizes it and there is no express prohibition. For the purposes of these Standards, financial correspondents shall not be considered Agents, Representatives or Distributors, regulated in Article 392 and following of the Commercial Code; g) Physical correspondents: Financial correspondents who provide their services in a fixed physical establishment, own or third-party, in which they develop their economic activity and serve the public; h) REPEALED (2); i) Mobile correspondents: Financial correspondents who provide their services on behalf of the subject entity, in a mobile manner, using electronic and/or digital means, connected to the subject entity via wireless connection with security mechanisms; j) Entity: The subjects obligated to comply with the provisions of these Standards, described in Article 2; k) Electronic and/or digital media: Tools to carry out operations and services, including but not limited to automated teller machines or ATMs, electronic kiosks, point of sale terminals or POS, telephony in any modality, and other communication networks; l) Administrative Body: The collegiate body that performs the administration function of the entity; for the purposes of these Standards, it refers to the Board of Directors or Board of Administration, as applicable; m) Risk profile: The consolidated result of the measurement of the risks to which the entity is exposed; n) Superintendency: Superintendency of the Financial System;

o) Transactions: Financial services and operations carried out through the financial correspondent; and p) User: Natural or legal person who operates with the Entities or makes use of the services they provide to the general public, to carry out payment orders, fund transfers or other operations.

CHAPTER II
ON THE NON-OBJECTION TO ACT THROUGH FINANCIAL CORRESPONDENTS

Art. 4.- In order to facilitate operations and the provision of financial services, the entity may hire a natural or legal person as a physical, digital or mobile financial correspondent, provided that the legal regime or corporate purpose of the latter does not prevent it, and the interested party to be a financial correspondent meets the profile established by the entity for these purposes and is not in any of the circumstances established in Article 16 of these Standards. Entities interested in acting through financial correspondents must adopt this decision through an agreement of the Administrative Body of the entity concerned, all of which must be recorded in the minutes.

Application for Non-Objection
Art. 5.- The entity interested in carrying out the operations and providing the services specified in Article 31 of these Standards through financial correspondents, must submit to the Superintendency an application accompanied by the following:
a) Copy of the agreement of the Administrative Body in which it has approved requesting the Non-Objection to begin operating through financial correspondents; b) Detailed description of the business operational model, which must comply at least with what is established in Article 10 of these Standards, with the approval of the Administrative Body of the entity concerned; and c) Model of financial correspondent contract, which must consider at least what is regulated in Article 11 of these Standards, with the approval of the Administrative Body of the entity concerned.

Additionally, interested entities must send to the Superintendency a Sworn Declaration signed by the Legal Representative, with its respective notarized authentication, in which they declare that:
i. It has been verified that their represented entity complies with the requirements and parameters contained in internal regulations;
ii. It has been verified that the content of the contracts to be signed, derived from operations through financial correspondents or Administrators thereof, as applicable, does not contain clauses contrary to current legislation and regulations;
iii. The proper functioning of the computer systems through which their represented entity ensures adherence to sound practices that promote the security of said operations and services and ensure adequate attention to users has been proven, attaching the verification report referred to in Article 13 of these Standards, the report requested in Article 40 of these Standards, and compliance with what is required in Annexes No. 4 or 5 of these Standards, as applicable to the type of Correspondent involved; and
iv. The adequate implementation of controls defined by their represented entity through the corresponding areas to achieve the aforementioned purposes has been proven.
In the content of said Declaration, the grantor must declare the truthfulness of what is expressed, and that they are aware of the implementation of the actions for the good implementation, adaptation, and compliance with the requirements imposed on their represented entity, for the purpose of obtaining the Non-Objection from the Superintendency to operate through financial correspondents or Administrators thereof, as applicable. The application and documentation may be submitted through the means made available by the Superintendency, which may be electronic. In any case, the period referred to in the first paragraph of Article 6 of these Standards will begin to run from the next business day after the application has been submitted.

Procedure for Application for Non-Objection
Art. 6.- Upon receipt of the Non-Objection application, in accordance with what is established in Article 5 of these Standards, the Superintendency will proceed to analyze it, and the Superintendent will communicate the Non-Objection of the application or object to it, within a maximum period of thirty business days. If this period expires and the Superintendency does not rule, it will be understood that the resolution of the Non-Objection is favorable for the entity. If the application is not accompanied by the complete and properly formatted information detailed in Article 5 of these Standards, the Superintendency may require the applicant entity to present the missing documents within a period of ten business days counted from the day following notification, a period that may be extended at the request of the interested parties when there are reasons justifying it. The Superintendency in the same notice will indicate to the applicant entity that, if it does not complete the information within the aforementioned period, it will proceed without further procedure to archive the application, without prejudice to its right to submit a new application.

If, after analyzing the documentation presented in accordance with Article 5 of these Standards, the Superintendency has observations or when the documentation or information presented is not sufficient to establish the facts or information intended to be proven, the Superintendency may notify the applicant entity to remedy the deficiencies communicated or present additional documentation or information as required. The applicant entity will have a maximum period of ten business days counted from the day following notification to resolve the observations or present the additional information required by the Superintendency. The Superintendency may, through a reasoned resolution, extend the period indicated in the previous paragraph by up to ten more business days, when the nature of the observations or deficiencies notified so requires.

Extension Period
Art. 7.- The entity may submit to the Superintendency an application for extension of the periods indicated in the second and fifth paragraphs of Article 6 of these Standards, before the expiration of said period, stating the grounds for the request and proposing, if applicable, the relevant evidence. The extension period may not exceed ten business days and will begin from the next business day after the expiration date of the original period.

Suspension of Period
Art. 8.- The thirty-business-day period indicated in the first paragraph of Article 6 of these Standards will be suspended for the days that elapse between the notification of the request for information or documentation referred to in the second and fifth paragraphs of said article, until the entity remedies the observations required by the Superintendency.

On the Resolution
Art. 9.- Once the required documents have been submitted in due form, the Superintendency will proceed to respond to the Non-Objection application.

Once the Non-Objection is issued to carry out operations and provide services through financial correspondents, the entity will be responsible for ensuring compliance with these Standards and the regulatory framework applicable to financial correspondents for their proper functioning.

Business Operational Model
Art. 10.- For the purposes of the Non-Objection, the business operational model presented by entities interested in carrying out operations and providing services through financial correspondents must contain at least the following:
a) Description of the transaction and operation recording system; b) Description of the management of risks associated with the provision of services or the carrying out of operations, especially financial and operational risks, which include technological risks, legal risks, risks related to money laundering and asset financing, terrorism financing, and financing for the proliferation of weapons of mass destruction, and reputational risk; c) Type of operations and services to be provided, in accordance with those established in Article 31 of these Standards, as applicable; d) Description of maximum amount limits per operation, the medium to be used to carry out the transaction, and the number of transactions that customers can carry out through financial correspondents, indicating the periodicity of these, taking into account the expected business volume, location of establishments in the case of physical correspondents, and risk associated with the type of operation involved. For the case of electronic money records and savings accounts with simplified requirements, the maximum balance limits, maximum amount per transaction, and accumulated transactions in a month will be those established by the Committee for Standards of the Central Bank, and must be incorporated into the model; (2) e) Internal Policies containing at least: types of business, entities or persons to be linked as Correspondent and those that cannot be considered, size and track record of the business, infrastructure and security of the establishment and geographic environment, the latter for the case of physical correspondents, among others, that guarantee adequate attention to the financial user; f) Description of mechanisms for identification, attention, and knowledge of customers and users at financial correspondents, including related to resource allocation; g) Detail of the frequency of on-site verification of compliance by financial correspondents with all their obligations, in accordance with the established risk profile and early alerts defined in monitoring, taking into account their risk management policies established for this type of business; and h) For the case of mobile financial correspondents, a detailed description of the security and safeguarding mechanisms to be implemented for documentation and values.

Financial Correspondent Contract
Art. 11.- The Financial Correspondent Contract that authorizes financial correspondents to carry out operations and provide services on behalf of and under the responsibility of the contracting entity must contain, at minimum, the following:
a) The express indication that the financial correspondent acts before the client or user, on behalf of and under the responsibility of the entity, with the latter being responsible for verifying compliance with the content of these Standards; b) The provisions that the parties establish regarding the administration of the financial correspondent's cash, and the way to cover the risks of cash handling; c) The measures that the entity will require and implement in the financial correspondent for the prevention of money laundering and asset financing, terrorism financing, and financing for the proliferation of weapons of mass destruction; d) The measures that the entity will require and implement in the financial correspondent for the adequate management of information security, for the case of digital correspondents; e) The obligation of financial correspondents to apply and execute mechanisms for the identification, attention, and knowledge of customers and users; f) The obligations of the financial correspondent to deliver to clients the support of the transaction carried out, whether physical or electronic; as well as to maintain reserve and confidentiality regarding the information to which they have access regarding the client; g) The economic obligations between the contracting parties; h) The public service hours of the financial correspondent; i) The obligation of the entity to train the financial correspondent or establish training mechanisms so that they carry out the operations and provide the agreed services adequately, and to guarantee that training is maintained during the execution of the contract, when any changes occur in it or in the operational guidelines; j) The security measures and the availability of human and/or technological resources that the financial correspondent must establish to carry out operations and provide services; k) Operations for which the financial correspondent is authorized; l) Contract term; m) Clauses for suspension and termination of carrying out operations and providing services through the financial correspondent, as well as their legal consequences; and n) Responsibilities and prohibitions of the financial correspondent and the entity, which must contain among others, the responsibility of the Correspondents for the commission of any crime committed in the exercise of their commercial activities. (2)

Additionally, clauses must be included that facilitate an adequate review of the respective carrying out of operations and provision of services through the financial correspondent, by the entities themselves or eventually by the Superintendency and other supervisory bodies.

No entity may develop financial correspondent services with a natural or legal person without having signed the corresponding service contract that complies at least with what is provided in this article.

Verification of the technological platform
Art. 13.- The entity must prepare a report on the verification of the technological platform, including at least:
a) Verification of the hardware, software, or electronic media to be used for the provision of services through financial correspondents with the entity; b) Verification of the access security mechanism to the electronic medium to be used, to carry out operations and services; c) Verification of the technical diagram for the sending and receiving of information between financial correspondents and the entity's servers; d) Determination that the databases of the financial correspondent or Financial Correspondent Administrator do not store client information; e) Information encryption mechanisms for client information throughout the entire operation flow; f) Transaction tests; g) Tests on client identification mechanisms; h) Transaction limit validation tests; i) Tests to validate the structure of banking product references; j) Tests to validate the content of operation receipts; k) Validation that client operations are performed online or in real time; l) Validation that Correspondents cannot perform balance inquiries for clients; m) Verifications of automatic blocks when clients' personal identification keys are entered incorrectly; and n) Ensuring that there are controls and mechanisms to register transactions and safeguard information transmitted and processed from where it is generated, up to the entity's central systems.

The report referred to in this article must be validated by the Risk Unit and by the entity's Internal Audit department.
Update or modernization of the technological platform Art. 14.- The entity's Administrative Body will resolve on the need to carry out replacements, substitutions, or acquisitions of the technological platform for the provision of operations and services through financial correspondents or financial correspondent administrators, documenting its decision in the corresponding Board Meeting Minutes. It is the responsibility of the entity's Administrative Body that the technological platform used complies with security mechanisms to guarantee the integrity of operations. The entity must carry out the update of the report required in article 13 of these standards, and the certification of compliance with the operational and security conditions detailed in Annexes Nos. 4 and 5 of these standards according to the type of correspondent, considering changes in the technological platform caused by replacements, substitutions, or acquisitions made by the entity. (2) Entities will inform the Superintendence about the Board Meeting Minutes of the first paragraph of this article, as well as the update of the report required in article 13 of these standards, within the first ten business days following implementation in production. (2) Operational guidelines Art. 15.- Entities must have operational guidelines for the carrying out and provision of services through Correspondents. These guidelines must include at least the following:
a) Business strategy to which the functioning of financial correspondents responds; b) Business continuity plans with financial correspondents; and c) Continuous Training Programs for financial correspondents. Circumstances that prevent the hiring of financial correspondents Art. 16.- Entities may not hire as a financial correspondent a natural or legal person who is in any of the following circumstances:
a) Minors; b) Directors and employees of financial entities, the Central Bank, and the Superintendence; c) Persons who have been judicially proven to have participated in activities related to drug trafficking and related crimes, money laundering and asset laundering, terrorism financing, and financing for the proliferation of weapons of mass destruction, both in the national jurisdiction or abroad; and d) Those who, due to their activity, condition, or legal situation, could affect the reputation or solvency of the entity. Additionally, entities may not hire as a financial correspondent who receives credits to accounts corresponding to deposits, as well as fund transfers affecting said accounts, a natural or legal person who is in any of the following circumstances:
i) Those who, in their condition as debtors, are classified in the financial system, on the date of contracting services with any entity, in the following risk categories: difficult to recover or irrecoverable; likewise, those debtors of the Salvadoran financial system for credits to which a 50% or more of the balance has been required for a cleanup reserve; and ii) Those who are in a state of bankruptcy, suspension of payments, or creditors' agreement, and in any case, those who have been judicially classified as responsible for negligent or fraudulent bankruptcy. Every entity, before hiring a financial correspondent and during the validity of the contract, will be responsible for verifying that they are not in the circumstances related in this article. In the event that, having signed the corresponding contract, any of the above circumstances arise for the financial correspondent, this must be considered a cause for termination of the contract; it must be communicated to the Superintendence within a maximum period of five business days counted from the date on which the entity became aware of such circumstance. Operation of financial correspondents with more than one entity Art. 17.- If a natural or legal person is hired by an entity and is operating as its financial correspondent and there is a new entity interested in contracting with the same, the latter entity must take into consideration the technical and operational capacity to handle the additional volume of operations and services, prior to signing a contract with said natural or legal person as its financial correspondent, which must be duly documented.

Art. 18.- In order to facilitate operations and the provision of financial services, the entity may hire as a financial correspondent administrator a legal person, provided that the legal regime or corporate object of the latter does not prevent it and the interested party to be a financial correspondent administrator meets the profile established by the entity for these purposes and is not in any of the circumstances established in article 23 of these Standards. Entities interested in acting through a financial correspondent administrator must adopt this decision through an agreement of the entity's Administrative Body, all of which must be recorded in minutes.

Of the Non-Objection
Art. 19.- The entity interested in carrying out the operations and providing the services specified in article 31 of these Standards through a financial correspondent administrator, must submit to the Superintendence a request for each Administrator accompanied by the following:
a) Copy of the agreement of the Administrative Body in which it has approved requesting the Non-Objection to operate through a financial correspondent administrator; b) Detailed description of the business operational model that must comply at least with what is established in article 20 of these Standards, with the approval of the entity's corresponding Administrative Body; c) Contract Model which must consider at least what is regulated in article 21 of these Standards, with the approval of the entity's corresponding Administrative Body; and d) Sworn Declaration signed by the Legal Representative of the Administrative Company stating that the Administrator is not in any of the causes that prevent its hiring, established in article 23 of these Standards.

Likewise, paragraphs two, three, and four of article 5, articles 6, 7, 8, and the first paragraph of article 9 of these Standards are applicable to entities.

Business operational model
Art. 20.- For the purposes of the Non-Objection, the business operational model that entities interested in carrying out operations and providing services through a financial correspondent administrator present must contain at least the following:
a) Description of the transaction and operation registration system, including the frequency of settlements between the entity and the Administrator, and from this with the financial correspondents it administers; b) Description of the management of risks associated with the provision of services or the carrying out of operations, especially financial and operational risks, which include technological risks, legal risks, those related to money laundering and asset laundering, terrorism financing, and financing for the proliferation of weapons of mass destruction, and reputational risk; c) Type of operations and services to be provided, in accordance with those established in article 31 of these Standards; d) Description of maximum amount limits per operation and number of transactions that clients can carry out through financial correspondents, taking into account the expected business volume, location, and risk associated with the type of operation in question. For the case of electronic money records and savings accounts with simplified requirements, the maximum balance limits, maximum amount per transaction, and accumulated transactions in a month will be those established by the Standards Committee of the Central Bank; e) Profile of the legal persons that can act as Administrator, attaching the Deed of Incorporation and its modifications, if any, Registered Credential of election of Board of Directors or Administrator of the Company, and share ownership; f) Internal Policies that contain at least: types of business, entities or persons to be linked as Correspondent and those that cannot be considered, size and track record of the business, infrastructure and security of the establishment, geographic environment, among others that guarantee the appropriate attention of the financial user; g) Description of identification and client/user attention mechanisms in financial correspondents, including what relates to the provision of resources; h) For the case of mobile financial correspondents, a detailed description of the security and safeguarding mechanisms to be implemented for documentation and values; and

Contract of financial correspondent administrator Art. 21.- The Financial Correspondentship Administrator Contract that authorizes the Administrator to affiliate and administer financial correspondents, without an employment relationship, so that they act on behalf of and under the responsibility of the contracting entity, must contain, at minimum, the following:
a) The express authority of the subject in favor of the Administrator so that it can hire financial correspondents, granted through mandate; b) The express indication that the administered financial correspondent acts before the client or user, on behalf of and under the responsibility of the entity, with the entity being responsible for verifying compliance with the content of these Standards; c) The provisions that the parties establish regarding the administration of the financial correspondent's cash, and the way to cover the risks of cash handling; d) The measures that the entity will require and that must be implemented in the Administrator and in the financial correspondent, for the prevention of money laundering and asset laundering, terrorism financing, and financing for the proliferation of weapons of mass destruction; e) The financial correspondent's obligation to deliver to clients the support of the transaction carried out; as well as to maintain reserve and confidentiality regarding the information to which it has access regarding the client; f) The economic obligations between the contracting parties; g) The entity's obligation to train the financial correspondent administrator or establish training mechanisms so that the administered financial correspondents carry out operations and provide the agreed services adequately, and to guarantee that training is maintained during the execution of the financial correspondentship contract, when any change occurs in it or in the operational guidelines; h) The security measures and the availability of human resources that the financial correspondent must establish to carry out operations and provide services; i) Operations, number of transactions, and maximum limits per operation, for which the Administrator is authorized to contract with the financial correspondent; j) Contract term; k) Suspension and termination clauses, as well as their legal consequences; l) The Administrator's obligation to have available to the entity the contracts signed with the financial correspondents;

CNBCR-08/2022 NASF-11
TECHNICAL STANDARDS FOR CARRYING OUT OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 m) The Administrator's obligation to previously communicate to the entity the incorporation of new financial correspondents or the suppression of these; and n) Responsibilities and prohibitions of the financial correspondent administrator, which must include among others the responsibility for the commission of any crime in the exercise of its activities. o) Mechanisms to receive complaints and claims from users who use the service. (2) In addition, clauses must be included that facilitate entities or eventually the Superintendence and other supervisory bodies, to carry out an adequate review and supervision of the Administrator, as well as of the operations and provision of services carried out through the administered financial correspondents. No entity may develop financial correspondent administrator services with a legal person without having signed the corresponding service contract that complies at least with what is provided in this article. Any correspondentship contract signed between the Administrator and the financial correspondents it administers must comply at least with the conditions established in this article and in article 37 of these Standards. Manual of administrators for financial correspondents Art. 22.- Entities must have a manual that the Administrator will implement with the financial correspondents it administers, which must contain at least what is stipulated in article 12 of these Standards. Circumstances that prevent the hiring of the Administrator Art. 23.- Entities may not hire as an Administrator a legal person that is in any of the following circumstances:
a) Those who, in their condition as debtors, are classified in the financial system, on the date of contracting services with any entity, in the following risk categories: difficult to recover or irrecoverable; likewise, those debtors of the Salvadoran financial system for credits to which a 50% or more of the balance has been required for a cleanup reserve; b) Those who are in a state of bankruptcy, suspension of payments, or creditors' agreement; c) Those who have been judicially proven to have participated in activities related to drug trafficking and related crimes, money laundering and asset laundering, terrorism financing, and financing for the proliferation of weapons of mass destruction, both in the national jurisdiction or abroad; d) Those who have been sanctioned administratively or judicially for their participation in serious infringement of laws and norms of a financial nature in national jurisdiction as well as abroad, especially the collection of funds from the public without authorization, the granting or receipt of related loans, in excess of the permitted limit, and financial crimes; and e) Those legal persons whose Legal Representative, Directors, and Managers, according to the Commercial Code, present any of the circumstances exposed in the previous letters. Every entity, before hiring an Administrator and during the validity of the contract, will be responsible for verifying that they are not in the circumstances related in this article. In the event that, having signed the corresponding contract, any of the above circumstances arise for the Administrator, this must be considered a cause for termination of the contract; it must be communicated to the Superintendence within a maximum period of five business days counted from the date on which the entity became aware of such circumstance. Operation of financial correspondent administrator with more than one entity Art. 24.- If a legal person is hired by an entity and is operating as an Administrator and there is a new entity interested in contracting with the same, the latter entity must consider the technical and operational capacity to handle the additional volume of operations and services, prior to signing a contract with said legal person as its Administrator, which must be duly documented. The entity must show the Superintendence, at the moment it requires it, the result of the analysis on the operational capacity and viability of the Administrator, on which it based the signing of an additional contract.
CHAPTER IV
RESPONSIBILITIES

Responsibilities
Art. 25.- The entity assumes towards the client or user complete responsibility for all operations and services carried out through financial correspondents that have been hired with them and are specific to its entity, as well as those carried out through Administrators. Entities will be responsible for ensuring that Administrators and financial correspondents have the necessary suitability, solvency, as well as physical, technical, and human resources infrastructure, in accordance with the type of operations and provision of financial services agreed to be carried out.

The entities will provide their financial correspondents themselves, through the Administrators or through third parties, information technology for exclusive use, documentation, support, training and necessary contingency measures to adequately carry out the agreed operations and services, unless the business operational model does not limit the exclusivity of the use and provision of information technology to the financial correspondents. Likewise, the entities will provide the Administrators and the financial correspondents with a telephone number for contact for permanent communication with the entity.

The entity will establish adequate mechanisms and procedures to attend to complaints from clients or users of its operations through financial correspondents, specifying the official means of receiving these, and must resolve them within a period that cannot exceed that established for the different products and services in the current legislation. In the event that there is no specific deadline in current legislation, these must be resolved within a reasonable period, which must be established in the procedure for attending to complaints. In any case, said procedure must incorporate internal controls on the queries attended to and responses provided. The entity must implement and disseminate the corresponding verification mechanisms, which allow clients to validate that mobile correspondents really provide the services offered on behalf of said entity. For the case of mobile correspondents, the entity must verify that they comply with the conditions of the security and safeguarding mechanisms to be implemented for documentation and values.

Art. 26.- The operations and services provided by entities through financial correspondents will comply with the legal and regulatory framework in matters of prevention of money laundering and assets, terrorism financing and financing for the proliferation of weapons of mass destruction, and must have a specific Manual in this matter for financial correspondents and Administrators. Entities may use all technological resources available to them to comply with the measures for the prevention of money laundering and assets, terrorism financing and financing for the proliferation of weapons of mass destruction. Entities will be directly responsible for verifying compliance with these. The entity will require its financial correspondents and Administrators to have measures to mitigate or cover the risks associated with carrying out operations and providing financial services, including those related to the prevention of money laundering and assets, terrorism financing and financing for the proliferation of weapons of mass destruction, which must include, among others, the establishment of limits for carrying out operations and providing services, such as amount per operation and number of transactions per client or type of transaction. The entity, with the aim of ensuring that its financial correspondents fully comply with their obligations, may require the guarantees it considers necessary.

Information Update
Art. 27.- When it is proven that a financial correspondent ceases to meet any of the characteristics considered for its hiring, the entities or the Administrators must terminate the signed contract, so this circumstance must be included within the causes for termination of this contract. The entities will inform the Superintendency, within the first seven business days of the month following the hiring or contract termination, as the case may be, of the new financial correspondents hired, indicating: type of Correspondent, date of hiring and start of operations, address and exact location; and of the contract terminations with the date and the respective cause. Updating its presence map in the country by geographic zone, which must be sent monthly, within the same deadline cited above, and include information modifications of existing Correspondents. However, they must request the Superintendency on the next business day after the hiring date, the assignment of codes to incorporate new financial correspondents based on Annex No. 6 prior to sending the information required in Annex No. 7 of these Standards.

Expansion of provision of operations and services and type of correspondent Art. 28.- REPEALED (2)

Supervision
Art. 29.- Entities will keep at the disposal of the Superintendency all the information it requires for the execution of its monitoring and supervision work, including complete and updated information on financial correspondents and Administrators, and must provide all necessary collaboration, whether in their field visits or in extra-situ monitoring.

The supervision of Administrators and financial correspondents will fall on the entity. However, the Superintendency may carry out direct supervision when it deems it appropriate.

Confidentiality
Art. 30.- Entities are responsible for the confidentiality of the information of clients or users to which their Administrators and financial correspondents have access, as well as for information subject to bank secrecy or reserve according to applicable laws.

CHAPTER V
OF THE OPERATION

Permitted operations and services
Art. 31.- The entity may carry out one or more of the following operations and services through financial correspondents:
a) Collection of public and private services; b) Collection and delivery of documentation for opening and closing deposit accounts; c) Collection and delivery of documentation for granting credits; d) Disbursements for active credit operations; e) Payments for active credit operations; f) Withdrawals or credits to accounts corresponding to savings deposits, deposits in simplified requirement savings accounts and demand deposits, as well as fund transfers affecting said accounts; g) Local fund transfers; h) Payment of transfers from abroad, including family remittances; i) Carry out the promotion and placement of insurance that are suitable for mass placement, provided that the entity is registered as a mass marketer. In these cases, the entity will be responsible for ensuring that the financial correspondent is duly trained for this purpose; j) Withdrawals and payments with credit and debit cards; k) Cash credits to contribution accounts; l) Collection and delivery of documentation for the opening of electronic money records, crediting and withdrawal of funds; m) Manage the opening and closing of deposits in simplified requirement savings accounts; n) Withdrawals or credits to deposits in simplified requirement savings accounts; o) Collection and delivery of documentation for opening and closing simplified deposit accounts, when applicable; and p) Other operations that are authorized by the Central Bank to the entity to carry out through financial correspondents. The permitted operations for each type of financial correspondent, subject to Non-Objection by the Superintendency, are detailed in Annex No. 8 of these Standards. The online interface mechanism with application access, program or computer system for operations and services through financial correspondents must comply with the operational and security conditions detailed in Annex No. 4 or 5 of these Standards, according to the type of Correspondent. The agreed service hours between the financial correspondent and the entity to which it provides its services may be different from the hours established for the provision of services in the entity's agencies or branches. Must at all times comply with the duty of mandatory operation to which they are subject, according to their respective special laws, except in cases of force majeure and fortuitous event. Payments made through the financial correspondent must be applied and treated under the criteria established in letters j) and l) of article 18 of the Consumer Protection Law. In the event that entities add a type of Correspondent, operations described in this article or modify the maximum limits of amount per operation, which have not been included in the initial Non-Objection request, they must request the corresponding Non-Objection from the Superintendency within fifteen business days prior to its operability, attaching the updated business operational model, incorporating the new operation(s) and/or changes in the maximum limits of
amount per operation, with its respective Board of Directors approval, as well as the updated report of the verification to the technological platform, manual for financial correspondents with the applicable modifications, certification report for the addition of services provided or changes in the limits originally established, confirming the verification of the processes involved in the modification. The Superintendency will have a period of twenty business days following the presentation of the request to issue the respective Non-Objection. (2)

Of the registration of operations
Art. 32.- The operations carried out through financial correspondents must be carried out through electronic and/or digital means, web or mobile applications, programs or computer systems connected online or in real time with the entity's technological platforms destined to provide the operations and services contracted with the correspondent according to what is established in article 31 of these Standards, as the case may be, and entities must have complete control of the account impact and guarantee service quality through the implementation of a contingency plan. Operations carried out through mobile financial correspondents can only be carried out within Salvadoran territory. Entities are obliged to safeguard information about operations carried out in secure storage media, in compliance with their internal policies regarding backup and information recovery, which must be preserved in accordance with the period established in the Law Against Money Laundering and Assets. (1) Entities must guarantee that both Administrators and financial correspondents do not store information in their databases that is considered subject to reserve or bank secrecy.

Receipt of operations and services
Art. 33.- The operations and services carried out through financial correspondents must generate a receipt, physical or electronic, for the client or user that allows them to verify that it has been completed successfully, which must include at least the transaction reference number that associates the client or user, the date, time, type and amount of the transaction, as well as the name of the financial correspondent and the respective entity. In the case of fund collection, it must indicate that the entity acting through the financial correspondent is authorized by the Superintendency to collect funds from the public, according to what is stated in article 54 of the Banks Law or article 35 of the Cooperative Banks and Savings and Credit Societies Law.

Monitoring of operations, services and complaints Art. 34.- Entities will carry out permanent monitoring of the compliance of their financial correspondents and their Administrators, and will also establish adequate internal control procedures and prevention of money laundering and assets, terrorism financing and financing for the proliferation of weapons of mass destruction, related to the carrying out of operations and the provision of services through financial correspondents. Entities will define in the business operational model the frequency and method of verification of compliance by financial correspondents and Administrators of all their obligations, in accordance with the established risk profile and early alerts defined in monitoring, taking into account their risk management policies established for this type of business. Entities will verify compliance through in situ actions and extra situ monitoring, using alternative mechanisms supported by information technologies that contribute to the fulfillment of scheduled supervision goals. Likewise, entities will keep control of complaints arising from operations and services carried out by financial correspondents, according to Annex No. 2 of these Standards.

Information for the public
Art. 35.- Entities must have dissemination means to inform about the location and operations or services provided through their financial correspondents, as well as about the commissions or surcharges they charge for such operations and services, with a minimum frequency of three months. Likewise, they will publish on their institutional website and other media, the updated detail of Administrators and financial correspondents.

Art. 36.- The entity will ensure that its financial correspondents place a notice in their facilities, digitally within their web or mobile applications, programs or computer systems, and for the case of mobile correspondents, the personnel duly identified. The notices and identifications must have a visible font and contain the following information:
a) The name of the contracting entity and that it acts as a financial correspondent of that entity; b) Unique identifier code or number assigned that validates it as a correspondent of the entity, for the case of the mobile correspondent. c) That the contracting entity is fully responsible before clients for the operations and services provided through the financial correspondent; d) That the financial correspondent is not authorized to carry out operations and provide financial services on its own behalf; e) The list of operations and services offered through the financial correspondent; f) The hours agreed with the entity for public service; g) The limits that have been established, such as amount per operation, number of transactions per client, or type of transaction; and h) The way to contact the entity to validate the correspondent and to attend to client complaints. Entities may promote and advertise, likewise they must collect and deliver documentation and information related to the operations or services they provide through financial correspondents. Financial correspondents, who are hired at the same time by several entities, must comply with the identification notice referred to in this article with respect to each of the contracting entities, being able to publish in a single notice the information that is common. The information referred to in letters a), b) and c) of this article must also be indicated on stationery and in general, in the documentation filled out by the financial correspondent, which is related to the financial operations allowed by the entity.

CHAPTER VI
PROHIBITIONS

Prohibitions for financial correspondents
Art. 37.- The entity must include in the contracts as prohibitions for financial correspondents the following:
a) Assign the contract in whole or in part; b) Offer or provide any type of guarantee in favor of clients regarding the services provided; c) Provide financial services on its own behalf, considered as illegal fund collection defined in articles 184 of the Banks Law and 117 of the Cooperative Banks and Savings and Credit Societies Law and in other laws and Standards related. In addition, a warning must be included that the carrying out of such activities will entail the consequences foreseen in the aforementioned articles; d) Carry out on behalf of the entity operations and services different from those agreed or in a manner different from that defined by the entity in the contract; e) Carry out operations on behalf of the entity outside the limits established by it; f) Condition the carrying out of operations and services on the acquisition of a product or service inherent to the commercial activity it exercises; g) Advertise or promote itself through stationery or on the front of the receipts they provide to clients or users on behalf of the entity in question; h) Carry out any type of charge different from that established by the entity regarding the provision of financial correspondent services; and i) Authorize and approve the celebration of contracts between the entity and clients.

Prohibition for the entity
Art. 38.- The entity cannot force Administrators and financial correspondents to sign exclusivity contracts for the carrying out of operations and the provision of services regulated in these Standards.

CHAPTER VII
OTHER PROVISIONS AND VALIDITY

Of the internal auditor
Art. 39.- Prior to issuing the Non-Objection, the Internal Auditor must issue a Certification Report in which it indicates that the entity complies with all the provisions of these Standards.

The entity's internal auditor must verify compliance with the obligations regulated in these Standards, and with the policies that the entity has issued to manage the risks associated with the hiring of Administrators and financial correspondents, and must inform the Superintendency of any alleged non-compliance, as well as corrective measures and follow-up results. Entities must consider in their annual audit plans the frequency and method of verification of compliance by financial correspondents and Administrators of all their obligations, in accordance with the established risk profile and early alerts defined in monitoring, taking into account their risk management policies established for this type of business. Likewise, the Internal Auditor must issue a Certification Report in the cases of Non-Objection requests, for the addition of services provided or changes in the limits originally established, certifying the verification of the processes involved in the modification, which will be verified by a supervision visit carried out by the Superintendency no later than six months after the Non-Objection is granted. (2)

Generation of statistical information
Art. 40.- The entity must have an automated system for recording, processing, storing, transmitting, producing, security and control of complaints or actions involving any complaint or disagreement expressed by the client, received in the previous month, which must contain among others, the number of cases, reason for complaints, cases in process or finished, according to the format described in Annex No. 2 of these Standards. The system will generate statistics to know which products offered by each entity are those that present the highest number of complaints or actions involving any complaint or disagreement expressed by the client, received in the previous month, related to financial products or services, with the aim that the Administration Body, takes decisions based on relevant and timely information in accordance with what is established in article 35 letters d), e), h) and j) of the Law on Supervision and Regulation of the Financial System. The Superintendency may request direct real-time access to said system, in accordance with article 32 of the Law on Supervision and Regulation of the Financial System.

Disclosure to the public about statistical summary Art. 41.- The entity must disclose on the website a link that directs to the statistical summary on the reasons for complaints or actions involving any complaint or disagreement expressed by the client, received in the previous quarter, related to the operations carried out, as well as efficiency indicators of resolved cases and maximum times for their resolution.

Information Submission to the Superintendence
Art. 42.- Entities shall submit, within the first seven business days of each month, the information indicated in Annex No. 1 of these Standards, through the electronic means defined by the Superintendence. Said Annex must contain information about their financial correspondents and the financial correspondents administered, separately.

Additionally, entities must submit monthly to the Superintendence, within a period of five business days following the reference month, the statistical control established in Annex No. 2 of these Standards.

In the event that there are no claims or procedures involving any complaint or dissatisfaction expressed by the client, received in the previous month, related to the operations carried out, the entity will submit a note to the Superintendence stating such situation.

Entities must send to the Superintendence, annually and no later than January 31 of each year, the events contained in Annex No. 3 of these Standards related to financial correspondents.

Technical Details for Information Submission to the Superintendence Art. 43.- The Superintendence will provide entities, with a copy to the Central Bank, within a maximum period of thirty business days after the effective date of these Standards, the technical details related to the submission of the information requested in Article 42 of these Standards. The technical details will be limited to the collection of information in accordance with what is regulated in these Standards.

Responsibility in Matters of Prevention of Money and Asset Laundering, Terrorism Financing, and Financing of Proliferation of Weapons of Mass Destruction Art. 44.- Entities will be directly responsible for compliance with the obligations imposed by the legal and regulatory framework in matters of prevention of money and asset laundering, terrorism financing, and financing of the proliferation of weapons of mass destruction in the operations and services they provide through financial correspondents.

Sanctions
Art. 45.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System, and the No Objection granted may be suspended, without prejudice to the legal actions that may arise.

Transitory
Art. 46.- No Objection requests submitted to the Superintendence that, on the effective date of these Standards, are in process, will continue and conclude in accordance with the Standards under which they began. Notwithstanding the foregoing, entities that find themselves in the circumstance mentioned in the preceding paragraph and decide to expand their business model with the figure of financial correspondent administrator, must withdraw their No Objection request and submit it again complying with the conditions established in these Standards. The information on districts referenced in Annex No. 6 of these Standards must be submitted to the Superintendence when the assignment of codes for new financial correspondents is required, starting from May 1, 2024. (1)

Unforeseen Aspects
Art. 47.- Unforeseen aspects in matters of regulation in these Standards will be resolved by the Central Bank through its Standards Committee.

Repeal
Art. 48.- These Standards repeal the and Provide Services through Financial Correspondents and Financial Correspondent Administrators -03), approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-06/2015, of March 13, 2015.

Validity
Art. 49.- These Standards will enter into effect starting from October 10, two thousand twenty-two.
MODIFICATIONS:
(1) Modifications in articles 32, 46, and Annex No. 2, approved by the Central Bank through its Standards Committee, in Session No. CN-10/2023, of November 28, two thousand twenty-three, with effect starting from December 13, two thousand twenty-three. (2) Modifications in articles 3, 10, 11, 14, 21, 31, 39, Annexes No. 4, 5, and 8, article 28 is repealed, approved by the Central Bank through its Standards Committee, in Session No. CN-11/2024, of December 19, two thousand twenty-four, with effect starting from January 3, two thousand twenty-five.

FINANCIAL CORRESPONDENT TRANSACTION REPORT
Amounts in United States Dollars
Entity Name:
Reference Date:
Field Description:
Correspondent Code: SSF code assigned to the Correspondent.
Administrator: Administrator to whom the financial correspondent belongs.
Transaction Type: Transaction authorized to the entity encoded according to the catalog available at www.ssf.gob.sv.
Transaction Number: Number of transactions carried out in the reported period.
Transaction Value: Accumulated value of transactions carried out in the reported period.

Correspondent Code
Administrator
Transaction Type
Transaction Number
Transaction Value

CLAIMS REPORT FOR OPERATIONS CARRIED OUT THROUGH FINANCIAL CORRESPONDENTS

Entity Name:
Reference Month:
Req. No. Description
1 Correspondent Code Code assigned to the Correspondent by the Superintendence.
2 Administrator to whom the financial correspondent belongs Identifier of the Administrator to whom the Correspondent belongs.
3 Transaction Type Transaction authorized to the entity encoded according to catalog available at www.ssf.gob.sv.
4 Control Number Tracking or control number assigned by the entity to reference the claim.
5 Claim Date Date on which the client or user presented their claim.
6 User or Client Name Name of the user or client presenting the claim.
7 User or Client Nationality
Nationality of the user or client presenting the claim.
8 Person Type (Natural or
Legal)
Whether the person presenting the claim is Natural or Legal.
9 Identification Document
Type
Document used for identification:
Unique Identification Document, Passport, or resident card.
10 Identification Document
Number Identification Document Number.
11 Sex Sex of the person (provided that this person is a natural person).
12 Claim Reason Claim code.
13 Claim Status Status of the claim: in process or completed.
14 Resolution Result Result of the claim resolution: favorable, unfavorable, or withdrawn by the client.
15 Resolution Date Date on which the claim management was finalized.
16 Claimed Amount Value of the claimed amount.

OPERATIONAL RISK EVENT TYPES IN FINANCIAL
CORRESPONDENTS

Entity Name:

Event Type
(Level 1)
Definition
Event Type
(Level 2)
Examples
Internal Fraud
Losses derived from any type of action directed to defraud, improperly appropriate goods or evade regulations, laws or policies in which at least one Correspondent is involved.
Unauthorized
Activities
Undisclosed operations
(intentionally), unauthorized operations (with economic losses), incorrect valuation of positions (intentional), exceeding unauthorized limits.
Theft and Fraud Theft, embezzlement, forgery, bribery, account appropriation, card cloning.
External Fraud
Losses derived from any type of action directed to defraud, improperly appropriate goods or evade the legislation, by a third party.
Theft, Fraud and
Extortion
Theft, forgery, extortion.
System Security
Damages from cyber attacks, information theft.
Clients, Products and
Business Practices
Losses derived from involuntary or negligent non-compliance with a contractual obligation or the nature or design of a product.
Confidence, Information
Disclosure and
Adequacy
Confidence abuses / non-compliance with guidelines, adequacy aspects / information disclosure (customer knowledge, etc.), infringing on privacy of customer information, infringing privacy, aggressive sales, abuse of confidential information. Improper Business or Market Practices Restrictive competition practices, improper commercial / market practices, market manipulation, abuse of privileged information (in favor of the entity), money laundering and assets, terrorism financing and financing of the proliferation of weapons of mass destruction. Selection, Sponsorship and Risks Lack of customer identification according to guidelines, excess of risk limits with customers. Business Interruption and System Failures Losses derived from business interruptions and system failures. Systems Hardware, software, or telecommunications failures; electrical power failure. Execution, Delivery and Process Management Losses derived from errors in the processing of operations or in the management of processes. Receipt, Execution and Maintenance of Operations Data entry errors, maintenance or download, non-compliance with deadlines or responsibilities, incorrect execution of operations and services Errors in the securities clearing process and cash settlement. Acceptance of Client Documentation Non-existent/incomplete legal documents. Client Account Management Unauthorized access to accounts, incorrect client records (generating losses), loss or damage of client assets due to negligence.

OPERATIONAL RISK EVENT TYPES IN FINANCIAL
CORRESPONDENTS

Entity Name:

Event Type
(Level 1)
Definition
Event Type
(Level 2)
Examples terrorism and financing of the proliferation of weapons of mass destruction.
Selection, Sponsorship and Risks
Lack of customer identification according to guidelines, excess of risk limits with customers.
Business Interruption and
System Failures
Losses derived from business interruptions and system failures.
Systems Hardware, software, or telecommunications failures; electrical power failure.
Execution, Delivery and
Process Management
Losses derived from errors in the processing of operations or in the management of processes.
Receipt, Execution and
Maintenance of
Operations
Data entry errors, maintenance or download, non-compliance with deadlines or responsibilities, incorrect execution of operations and services Errors in the securities clearing process and cash settlement. Acceptance of Client Documentation Non-existent/incomplete legal documents. Client Account Management Unauthorized access to accounts, incorrect client records (generating losses), loss or damage of client assets due to negligence.

MINIMUM OPERATIONAL AND SECURITY CONDITIONS FOR THE ONLINE INTERFACE MECHANISM WITH APPLICATION, PROGRAM, OR COMPUTER SYSTEM ACCESS FOR OPERATIONS AND SERVICES THROUGH PHYSICAL AND/OR DIGITAL CORRESPONDENTS

I.- Operational Aspects:
a) Redundancy schemes or alternate mechanisms in point-to-point telecommunications that allow for communication links that minimize the risk of interruption in the telecommunications service; b) Continuity strategy in computer services that provide the entity with the capacity to process and operate systems in case of contingency, failures, or interruptions in telecommunications and/or central computer equipment and others involved in the information processing service for operations or services; c) Mechanisms to establish and monitor quality in information services, as well as system and application response times; d) Technical support scheme, in order to solve problems and incidents; and e) Mechanisms by which the entity will maintain a copy of information considered critical for the continuity of the service. II.- Security Aspects:
a) Measures to ensure encrypted point-to-point transmission and security elements or controls in each of the nodes involved in the sending and receiving of data; b) Measures for the secure storage of data that compromise user information subject to confidentiality by Law, including that information safeguarded as backup or any other copy that might be made for any reason, as well as mechanisms for access control and use of information. The foregoing in accordance with what is provided in the Technical Standards for Information Security Management NRP-23) and Technical Standards on Cybersecurity Measures in Digital Channels NRP-32).

MINIMUM OPERATIONAL AND SECURITY CONDITIONS FOR THE ONLINE APPLICATION INTERFACE MECHANISM, PROGRAM, OR COMPUTER SYSTEM FOR OPERATIONS AND SERVICES THROUGH MOBILE CORRESPONDENTS (2)

I.- Service Continuity Aspects:
a) Continuity strategy in services that provide the entity with the capacity to process and operate systems in case of contingency, failures, or interruptions in telecommunications and/or electronic and/or digital media that are involved in the information processing service for operations or services; b) Mechanisms to establish and monitor quality in information services, as well as system and application response times; c) Technical assistance scheme, in order to solve problems and incidents; and d) Mechanisms by which the entity will maintain a copy of information considered by the entity as critical for the purposes of service continuity.

II.- Information Security Aspects:
a) Measures to ensure encrypted point-to-point transmission or by means of wireless connection with security mechanisms and security elements or controls involved in the sending and receiving of data; b) Measures for the secure storage of data that compromise user information subject to confidentiality by Law, including that information safeguarded as backup or any other copy that might be made for any reason, as well as mechanisms for access control and use of information. The foregoing in accordance with what is provided in the Technical Standards for Information Security Management NRP-23) and Technical Standards on Cybersecurity Measures in Digital Channels NRP-32).

REQUEST FOR CODE ASSIGNMENT TO INCORPORATE NEW FINANCIAL CORRESPONDENTS FINANCIAL SYSTEM SUPERINTENDENCE REQUEST FOR CODE ASSIGNMENT AND/OR MODIFICATION OF FINANCIAL CORRESPONDENT INFORMATION Request Date: DD/MM/YY Institution Code:
Institution Name:
Contact Name:
Position:
Phone:
Email:
Internal Code
Bank
SSF Code (*)
Commercial Name
Person Type
Natural or Legal Person Name
NIT Number
DUI Number
Business Type according to
SSF Catalog
Address
Department
Municipality and District (1)
Correspondent Type
Correspondent Classification
Administrator Name of the
Financial Correspondent
Reason for code request
(New,
Address Change,
Legal Name, etc.)
Previous
Information
2/

Justification:
AUTHORIZATION
Contact Signature and Institution Seal

CNBCR-08/2022 NASF-11
TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 34 /37
Annex No. 6
Notes:
1.- All fields must be complete
Data Description:

Internal Code: Code assigned internally by the institution.
Correspondent Code: SSF code assigned to the Correspondent.
Commercial Name: Commercial name of the financial correspondent.
Person Type: Natural or Legal.
Natural or Legal Person Name: Name according to NIT.
NIT Number Tax Identification Number.
DUI Number Unique Identification Document Number applies to natural persons.
Business Type: Business type according to catalog available at www.ssf.gob.sv Address: Full address where the financial correspondent is located or headquarters address in case of digital or mobile correspondent. Department, Municipality, and District: (1) Department, Municipality, and District of the Financial Correspondent. (1) Correspondent Type: Direct or administered, code according to catalog available at www.ssf.gob.sv Correspondent Classification: Physical, digital, or mobile. Financial Correspondent Administrator Name:
When the financial correspondent is administered by a financial correspondent administrator.
Reason for code request: State if it is a new hire, address change for a financial correspondent that already operates, change of legal name, etc.
Previous Information: Information of the financial correspondent to be replaced.

REPORT OF ACTIVE FINANCIAL CORRESPONDENTS AND DISASSOCIATED FINANCIAL CORRESPONDENT ADMINISTRATORS IN THE MONTH Entity Name:
Reference Date:
Correspondent Code
Administrator
Internal Code
Hiring Date
Start Date
Status
Contract End Date
Termination Cause
Data Description:
Correspondent Code: SSF code assigned to the Correspondent.
Administrator Identifier of the administrator to whom the Correspondent belongs when applicable.
Internal Code: Code assigned internally by the entity.
Hiring Date: Date on which the contract was celebrated.
Start Date: Date of commencement of operations.
Status: Identifier of association and/or disassociation of the Correspondent.
Contract End Date: Date on which the contract ended.
Termination Cause: Cause of contract termination.

CNBCR-08/2022 NASF-11
TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022
Annex No. 8
36 /37
OPERATIONS AND SERVICES BY TYPE OF FINANCIAL CORRESPONDENTS OPERATIONS AND SERVICES THROUGH CORRESPONDENTS Physical Correspondent REPEALED (2) Digital Correspondent Mobile Correspondent a) Collection of public and private services ✓ ✓ ✓ b) Collection and delivery documentation for opening and closing deposit accounts ✓ ✓ c) Collection and delivery documentation for granting of credits ✓ ✓ d) Disbursements for concept of active credit operations ✓ ✓ ✓ e) Payments for concept of active credit operations ✓ ✓ ✓ f) Withdrawals or credits to accounts corresponding to savings deposits, deposits in savings accounts with simplified requirements and at sight. ✓ ✓ g) Fund transfers that affect savings deposits, deposits in savings accounts with simplified requirements. ✓ ✓ ✓ h) Local fund transfers ✓ ✓ ✓ i) Payment of transfers from abroad, including family remittances ✓ ✓ ✓ j) Carry out promotion and placement of insurance that are suitable for ✓ ✓ ✓

CNBCR-08/2022 NASF-11
TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022
Annex No. 8
37 /37
OPERATIONS AND
SERVICES THROUGH
CORRESPONDENTS
Physical
Correspondent
REPEALED (2)
Digital
Correspondent
Mobile
Correspondent mass placement, provided that the entity is registered as a mass marketer. In these cases the entity will be responsible that the financial correspondent is properly trained for this k) Withdrawals and payments with credit and debit cards ✓ ✓ ✓ l) Cash credits to contribution accounts ✓ ✓ m) Collection and delivery documentation for opening of electronic money records, crediting and withdrawal of funds ✓ ✓ n) Manage the opening and closing of deposits in savings accounts with simplified requirements ✓ ✓ ✓ o) Withdrawals or credits to deposit accounts in savings accounts with simplified requirements ✓ ✓ ✓ p) Collection and delivery documentation for opening and closing of simplified deposit accounts, when applicable ✓ ✓

Similar documents from other regulators