Technical Standards for Comprehensive Risk Management and Information Transparency of Investment Banks

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

THE NORMS COMMITTEE OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That article 3, paragraph 3 of the Investment Banks Law establishes that, in accordance with the Law on Supervision and Regulation of the Financial System, Investment Banks constituted in accordance with the Investment Banks Law shall have the status of members of the Financial System.

II. That article 38 of the Investment Banks Law establishes that Investment Banks may use any digital means available to perfect their contracts with clients and suppliers, using technological means such as electronic signature or any other that facilitates remote contracting.

III. That article 41, paragraphs 4 and 5 of the Investment Banks Law establishes that Investment Banks may contract with third parties any service inherent, necessary, or complementary to the realization of the operations described in said article. All services contracted with a third party are subject to the same regulation and supervision, where applicable, as the Investment Bank, with the latter being ultimately responsible for the integrity, availability, and confidentiality of the service provided and for providing any information that the Superintendence may request. Likewise, it is established that Investment Banks, as responsible parties to their clients, must carry out an extended "know your provider" procedure, ensuring the legal existence and technical capacity of the provider, as well as compliance with applicable regulations.

IV. That article 45 of the Investment Banks Law provides that Investment Banks shall freely establish interest rates, commissions, and surcharges. The interest rates, commissions, and other surcharges that Investment Banks apply to their operations must be made known to the public monthly or when modified. Under no circumstances may an Investment Bank increase them in active operations without having first made them known to the public.

V. That article 2 of the Law on Supervision and Regulation of the Financial System establishes that the Financial Supervision and Regulation System aims to ensure the efficiency and transparency of the financial system, as well as the adoption of the highest standards of conduct in the development of their business.

VI. That in accordance with article 3, letter c) of the Law on Supervision and Regulation of the Financial System, it is the responsibility of the Financial System Superintendence to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.

VII. That article 32 of the Law on Supervision and Regulation of the Financial System establishes that the Superintendence may require supervised entities direct access to all data, reports, or documents regarding their operations through the means and form defined by it.

VIII. That in accordance with article 35, letter d) of the Law on Supervision and Regulation of the Financial System, it is stipulated that directors, managers, and other officials holding positions of direction or administration of the members of the financial system must conduct their business, acts, and operations in compliance with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that the adoption and updating of policies and mechanisms for risk management are fulfilled in the institution they direct or work for, including among other actions, identifying, evaluating, mitigating, and revealing them in accordance with international best practices.

IX. That article 99, letter a) of the Law on Supervision and Regulation of the Financial System stipulates that it shall be the responsibility of the Norms Committee to approve technical standards, instructions, and provisions that the laws regulating the supervised entities establish must be issued to facilitate their application, including aspects inherent to risk management by the supervised entities.

THEREFORE,

by virtue of the regulatory powers conferred by article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object

Art. 1.- These Standards aim to establish the minimum provisions that Investment Banks must comply with regarding comprehensive risk management and information transparency, in accordance with applicable laws and international standards, consistent with the nature, size, types of products, services, clients, and scale of their activities.

These Standards complement the current general regulatory framework, of which the "Technical Standards on Corporate Governance" (NRP-17), approved by the Central Bank through its Norms Committee, is also a part.

Subjects

Art. 2.- The subjects obligated to comply with the provisions established in these Standards are Investment Banks.

Terms

Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:

a) Digital Asset: In accordance with article 3 of the Digital Asset Issuance Law, it is a digital representation that can be stored and transferred electronically, using a Distributed Ledger Technology system, or similar or analogous technology, in which records are linked and encrypted to protect the security and privacy of transactions, which are characterized by being ownable, exchangeable, transferable, negotiable, and promoted by natural and legal persons;

b) Easily Liquidated Assets: In accordance with article 4 of the Investment Banks Law, these are goods or resources owned by a natural or legal person that can be used immediately without legal or contractual restrictions, understanding that these assets are free of liens and any restriction that limits their use or alienation, such as: Bitcoin, Stablecoins, Treasury Bonds, Tokenized Treasury Bonds, Gold, Tokenized Gold, among others;

c) Senior Management: The President, Executive President, Executive Director, General Manager, or acting person, and the executive positions that report to them;

d) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plans;

e) Central Bank: Central Bank of Reserve of El Salvador;

f) Commission: The amount of money charged by Investment Banks to the sophisticated investor for the provision of an operation or an additional service effectively provided, identified and described in the contract, and which is not inherent to the contracted product or service;

g) Conflict of Interest: Any situation in which a personal benefit or interest of a third party may influence the professional judgment or decision of an entity member regarding the fulfillment of their obligations;

h) Comprehensive Risk Management Culture: Norms, attitudes, knowledge, and behavior of an entity related to risk and decisions on how to manage and control them;

i) Disclosure: Publications in newspapers, websites, any other medium or electronic device, as well as exhibitions on physical or electronic billboards of Investment Banks;

j) Risk Factors: Variables that entities must consider for adequate identification and mitigation of the risks to which they are exposed;

k) Sophisticated Investor: In accordance with article 4 of the Investment Banks Law, these are natural or legal persons, national or foreign, to whom Investment Banks are authorized to offer their services, who must meet the criteria established in said article;

l) Board of Directors: A collegiate body or equivalent body responsible for the administration of the entity, with functions of supervision, direction, and control;

m) Law: Investment Banks Law;

n) Multi-signature: A security mechanism characterized by requiring several keys for the authorization of operations;

o) Digital Platforms: In accordance with article 5 of the Digital Asset Issuance Law, these are digital infrastructures that allow two or more acquirers to interact and exchange digital assets for other digital assets or for fiat money;

p) Stress Tests: Scenarios used to evaluate and measure the resilience, vulnerability, and stability of an entity or financial system in the occurrence of possible extreme adverse events, and their impact on equity and/or the financial results of an entity;

q) Superintendence: Financial System Superintendence;

r) Risk Tolerance: Levels of risk-taking acceptable to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and is generally aligned with categories of risk, such as strategy, finance, people, or reputation;

s) Interest Rate: The price paid or received for the use of money, which is established as a percentage of the capital based on the days the debtor or depositor has or makes available from the date of disbursement or deposit;

t) Nominal Interest Rate: Annualized active or passive interest rate freely established by the Investment Bank and accepted by the sophisticated investor;

u) Effective Interest Rate or EIR: Annualized interest rate that allows equalizing the present value of all installments and other payments to be made by the sophisticated investor with the amount they will effectively receive as a loan; and

v) Reference Rate: A single rate that will serve as the basis for contracting operations with adjustable interest rates and will be established by the Investment Bank.

CHAPTER II
COMPREHENSIVE RISK MANAGEMENT

Comprehensive risk management

Art. 4.- Investment Banks must establish a comprehensive risk management system, understood as a strategic process carried out by the entire Investment Bank, through which they identify, measure, control, mitigate, monitor, and communicate the various types of risks to which they are exposed and the interrelationships that arise among them, to achieve their objectives. This management must be consistent with their nature, risk profile, volume, and complexity of activities, business lines, own and third-party resources, so as to promote the implementation of measures consistent with best practices for the transparent, efficient, and orderly functioning of the market.

The integral process for risk management must be duly documented and reviewed periodically based on changes in the Investment Bank's risk profile and the market. The policies, procedures, and manuals issued by Investment Banks must be in Spanish.

Stages of the comprehensive risk management process

Art. 5.- Investment Banks must have a documented continuous process for the comprehensive management of their risks, which must contain at least the following stages:

a) Identification: The stage in which existing risks in each operation, product, service, process, and business line developed by the Investment Bank and those that may arise in new business lines are recognized and understood. In this stage, risk factors that may generate changes in the Investment Bank's equity based on its own activities or operations and those carried out with sophisticated investors in accordance with the Law are identified;

b) Measurement: The stage in which risks must be quantified in order to determine compliance or adequacy of policies, fixed limits, and measure the possible economic impact on the Investment Bank's financial results. The methodologies and tools to measure each type of risk must be consistent with the size, nature of its operations, and the levels of risk assumed by the Investment Bank;

c) Control and mitigation: The stage that seeks to ensure that the policies, limits, and procedures established for the treatment and mitigation of risks are appropriately taken and executed; and

d) Monitoring and communication: The stage that provides systematic and permanent follow-up to risk exposures and the results of adopted actions. These information systems must ensure a periodic and objective review of risk positions and the generation of sufficient information to support decision-making processes and allow communicating the results of risk management in a timely manner.

Types of risks

Art. 6.- For the purposes of these Standards, Investment Banks must manage, according to their structures, size, businesses, and resources, at least the following risks:

a) Credit risk: The possibility of loss due to the non-compliance of contractual obligations assumed by a counterparty, understood as a borrower or a debt issuer, according to the Technical Standards issued by the Central Bank through its Norms Committee;

b) Market risk: The possibility of loss, resulting from movements in market prices that generate a deterioration in value within and outside the balance sheet or in the Investment Bank's financial results. Likewise, fluctuations in the price of a digital asset, ceded or held in custody, must be considered;

c) Liquidity risk: The possibility of incurring losses due to not having sufficient resources to fulfill assumed obligations, incurring excessive costs, and being unable to develop the business under the planned conditions;

d) Operational risk: The possibility of incurring losses due to failures in processes, people, information systems, and due to external events; it includes legal risk, fraud risk, technological or cybersecurity risk, strategic risk, custody risk, etc., according to the Technical Standards issued by the Central Bank through its Norms Committee; and

e) Reputational risk: The possibility of incurring losses, resulting from the deterioration of the Investment Bank's image, due to non-compliance with laws, internal regulations, corporate governance codes, codes of conduct, money laundering, among others.

With reference to the management of money laundering and asset confiscation risks, terrorism financing, and the financing of the proliferation of weapons of mass destruction, Investment Banks must apply what is established in the "Technical Standards for the Management of Money Laundering and Asset Confiscation Risks, Terrorism Financing, and the Financing of the Proliferation of Weapons of Mass Destruction" (NRP-36), approved by the Central Bank through its Norms Committee.

CHAPTER III
ENVIRONMENT FOR COMPREHENSIVE RISK MANAGEMENT

Organizational system

Art. 7.- Investment Banks must establish an organizational structure that allows for adequate comprehensive risk management, with the proper segregation of functions and hierarchical levels of operational support, business, and control areas that participate in the process, as well as levels of dependency, in accordance with the risk profile, size, and nature of their operations.

Investment Banks will establish and apply the methodologies they consider appropriate for the risk management model, without prejudice to the norms and minimum requirements established by the Central Bank through its Norms Committee.

Functions of the Board of Directors

Art. 8.- The Board of Directors is responsible for ensuring adequate comprehensive risk management, with among its functions at least the following:

a) Define and approve the Investment Bank's risk appetite and tolerance, as well as exposure limits for each specific risk according to its profile; likewise, it must establish respective controls for exceptions and deviations from these limits;

b) Approve the internal organizational or functional structure according to its business model, with respective organization manuals and segregation of functions, assigning the necessary resources to implement and maintain adequate risk management, effectively and efficiently;

c) Approve policies and manuals for the management of risks assumed by the Investment Bank, ensuring that they are implemented;

d) Create the Risk Committee, in accordance with the "Technical Standards on Corporate Governance" (NRP-17) approved by the Central Bank through its Norms Committee, approving the designation and removal of its members, when applicable, and ensuring its independence;

e) Create the Risk Unit and appoint the person in charge, ensuring its independence from the Investment Bank's business and operational areas to avoid conflicts of interest, as well as the separation of functions and corresponding responsibilities, and providing it with adequate resources, tools, materials, and technical training;

f) Know and understand all risks inherent to the businesses developed by the Investment Bank and to which it is exposed, their evolution, and their effects, especially at equity levels; as well as the methodologies and tools for risk management;

g) Approve the Investment Bank's involvement in new products, services, business lines, and operations, and ensure that they adhere to the entity's business strategies and risk management policies;

h) Ensure that an organizational culture of risk management is implemented within the Investment Bank; and

i) Ensure that Internal Audit verifies the existence and compliance of the Investment Bank's comprehensive risk management scheme.

The policies and manuals for risk management approved by the Board of Directors must be sent to the Superintendence for its knowledge, within the first ten business days following their approval or respective modification. The period between reviews and/or updates of policies or manuals must not exceed two years.

Functions of the Risk Committee
Art. 9.- The functions of the Risk Committee shall include, at a minimum, the following activities:
a) Approve the following:
i. The methodologies for managing the different types of risks to which the Investment Bank is exposed, as well as any eventual modifications, ensuring that they consider the relevant risks of the activities it carries out; and
ii. The corrective actions proposed by the Risk Unit and the involved areas, as well as the mechanisms for their implementation, in the event of deviation from the assumed exposure levels or limits.
b) Require and follow up on corrective plans to normalize non-compliance with exposure limits or reported deficiencies; c) Evaluate, endorse, and propose for approval by the Board of Directors, at least the following:
i. The strategies, policies, and manuals for integral risk management, as well as any eventual modifications made to them;
ii. The tolerance limits for exposure to the different types of risks identified by the Investment Bank, in accordance with its risk appetite; and
iii. The cases or special circumstances in which exposure limits may be exceeded, as well as the special controls over such circumstances.
d) Report to the Board of Directors on the risks assumed by the Investment Bank, their evolution, their effects, especially on equity levels and additional mitigation needs, as well as their corrective actions; e) Report to the Board of Directors on the exposures, deviations, and exceptions of the risks managed in the Investment Bank; and f) Report to the Board of Directors on the results of the reports prepared by the Risk Unit.

Functions of Senior Management
Art. 10.- Senior Management is responsible for establishing and executing the structural framework of the risk management system and shall report to the Board of Directors, adopting and ensuring compliance, at a minimum, with the following measures:
a) Establish the necessary conditions at the organizational level to foster an environment that promotes the development of the integral risk management process;

Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

b) Ensure that mechanisms exist that guarantee adequate flow, quality, and timeliness of information, between Business Units, operational support areas, and the Risk Unit, so that the latter appropriately develops its function; c) Ensure the establishment of mechanisms for disseminating the culture of integral risk management, at all levels of the organizational structure; and d) Ensure the execution of training and updating programs for the risk management of the Investment Bank.

Risk Unit
Art. 11.- The Board of Directors of the Investment Bank, to facilitate the evaluation of integral risk management, must create a specialized Risk Unit or designate a person from the Investment Bank, and provide it with sufficient resources to perform its function according to the size, structure, and risk profile of the Investment Bank; in all cases, it must ensure that there is independence from this unit with respect to business and operational areas, in order to avoid conflicts of interest and ensure adequate separation of functions and responsibilities. The object of said Unit must be to identify, measure, control, monitor, and communicate the risks faced by the Investment Bank in the development of its operations, whether these affect assets and liabilities within or outside the balance sheet, including, where applicable, the associated risks of the operations it carries out with member companies of the financial conglomerate or business group. The foregoing does not limit the role of the different operational units in the identification, measurement, control, monitoring, and communication of the risks faced by the Investment Bank. The head of the Risk Unit must possess a profile appropriate to the functions to be performed; for this purpose, the Investment Bank must consider their academic background, experience, and training in risk management. The Risk Unit must prepare an annual work plan, which must be approved by the Risk Committee and made known to the Board of Directors, for the purpose of adequately fulfilling risk management functions.

Functions and responsibilities of the risk unit Art. 12.- The Risk Unit must fulfill at least the following minimum functions:
a) Identify, measure, control, monitor, and communicate the risks incurred by the Investment Bank and their effects on its solvency; b) Prepare the annual work plan of the Unit and submit it for approval by the Risk Committee; c) Design and propose to the Risk Committee for approval by the Board of Directors the strategies, policies, manuals, and respective procedures for integral risk management and for each of the specific risks identified, as well as their modifications; d) Propose for approval the methodologies, models, and parameters for the management of the different types of risks to which the Investment Bank is exposed; e) Periodically report to the Risk Committee, as well as to Senior Management, on the evolution of the main risks assumed by the Investment Bank, including the detail of changes in applicable risk factors and the historical evolution of the risks assumed by it; f) Issue an opinion on the possible risks involved in the establishment of new products, services, operations, and activities prior to their start; as well as regarding significant changes in the business environment, documenting the analysis performed to issue its opinion; g) Periodically follow up on the corrective actions presented by the units for the improvement of integral risk management, which must be made known to the Risk Committee and Senior Management; h) Follow up on compliance with exposure limits to risk, their tolerance levels by type of risk, and propose mitigation mechanisms for exposures and inform the Risk Committee; i) Perform periodic monitoring of the results of the application of methodologies, tools, models, compliance with tolerance limits; and j) Prepare and propose to the Risk Committee stress tests that allow managing each of the risks to which such tests are applicable, in particular, and evaluate the resistance and stability of the Investment Bank in adverse situations.

Training programs
Art. 13.- Because integral risk management is a dynamic process, Senior Management must ensure that the Board of Directors, employees, and executives directly involved in risk management are trained in these topics, developing for this purpose an annual training plan, which may be incorporated into the Investment Bank's general annual training plan, in which it incorporates personnel to be trained, topics to be developed, and their scheduling. Likewise, since this management involves the entire organization, a dissemination program must be established that generates an organizational risk culture in all employees, levels of the organization, and in the induction programs for new personnel. The Training Plan may be reviewed every six months in order to make pertinent updates, to respond to the needs of the Investment Bank, availability of topics to be developed, and the amount of personnel to be trained.
CHAPTER IV
RISK MANAGEMENT FRAMEWORK

Policies for risk management
Art. 14.- Investment Banks must approve and develop policies to define the management framework for each of the types of risks to which they are exposed, as well as for the third-party resources they administer, which allow them to reduce their vulnerability and losses from such risks and promote at the organizational level the culture of prevention and risk management. The policies, manuals, and procedures for integral risk management must consider, among other aspects, the functions and responsibilities in said management; as well as the criteria and mechanisms for the identification, measurement, control, mitigation, monitoring, and communication of the risks to which the Investment Bank is exposed. The Investment Bank's policies, manuals, and procedures must be consistent with its structure, nature, size, complexity of its activities, operations, business lines, type of sophisticated investor it attends to, and with the obligations applicable to its activity. These policies, manuals, and procedures must also be in accordance with the operations authorized according to its object and applicable legal regime.

Risk management manual
Art. 15.- Investment Banks must have a risk management manual or manuals that, based on policies, group at a minimum, for the management of each of the risks faced by the Investment Bank: the associated processes; the functions and responsibilities of the involved areas, indicating the segregation of functions of key positions susceptible to risks; the methodology to measure risk detailing variables, criteria, tools used, and the periodicity with which information on exposure to each of the types of risks must be reported to the Risk Committee, the Board of Directors, and Senior Management. For the development of the risk management manual, Investment Banks must consider the implementation of prudential measures and best practices referred to risk management.
CHAPTER V
INFORMATION AND CONTROL SYSTEMS

Managerial information systems
Art. 16.- Investment Banks must have a managerial information system and statistical databases, which enable the generation of timely, reliable, consistent, and homogeneous information that allow the preparation of periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other interested parties responsible for decision-making in risk management.

Internal control system
Art. 17.- The Investment Bank must define internal control procedures relative to its own activities and operations and the services provided to sophisticated investors; said procedures will form part of an internal control manual, which must be approved by the Board of Directors. The internal control manual must include integral risk management that allows verifying compliance with the policies, limits, processes, and procedures established during the execution of the Investment Bank's operations. The internal control procedures must consider the following:
a) The definition of participants, functions, and inherent responsibilities of the service to sophisticated investors; b) Purchase and sale policies, transfers, and settlement of the assets that make up the services offered to sophisticated investors; and c) Segregation of functions policies. The internal control manual must also establish administrative, financial, and technological controls necessary for risk management that allow verifying compliance with the policies and mechanisms established during the execution of operations.

Role of internal audit
Art. 18.- The Internal Audit Unit must support the Investment Bank in evaluating and improving the quality and efficiency of risk management processes, for which it must observe what is established in the "Technical Standards for Internal Audit for Members of the Financial System" (NRP-15), approved by the Central Bank through its Standards Committee.

On external auditors
Art. 19.- The external auditors of Investment Banks must include in their periodic evaluation, the review of risk management functions and their results must be incorporated into the respective reports they issue in accordance with what is established in the "Technical Standards for the Provision of External Audit Services to Members of the Financial System" (NRP-18), issued by the Central Bank through its Standards Committee.

Annual report
Art. 20.- Investment Banks must submit to the Superintendence, within the first four months following the end of the reported accounting year, the "Technical Evaluation Report of Integral Risk Management", prior approval by the Board of Directors, which must contain at a minimum the following:
a) The organizational structure for integral risk management; b) Detail of the main risks assumed by the Investment Bank's activities;

c) List of policies, manuals, and procedures for integral risk management, including the date of the last modification; d) Description of the methodologies, systems, and tools used for each of the risks; e) The results of the evaluations carried out on integral risk management, in accordance with what is established in the "Technical Standards for Internal Audit for Members of the Financial System" (NRP-15), approved by the Central Bank through its Standards Committee; f) The execution of the training plan related to integral risk management established in article 13 of these Standards; g) Projects associated with risk management to be developed in the year following the reported one; and h) General conclusions on the risk management of the Investment Bank. Notwithstanding the foregoing, the Board of Directors must immediately inform the Superintendence upon becoming aware of relevant aspects related to risk exposure, which may negatively impact the Investment Bank either qualitatively or quantitatively.

Disclosure on integral risk management
Art. 21.- Investment Banks must summarize in a section of their Website, within the first three months of each year, the information relative to the policies, methodologies, and other relevant measures adopted for the management of each type of risk. Investment Banks must summarize in the notes to the annual closing financial statements the manner in which they manage risks and compliance with their policies.

Additional information
Art. 22.- The Superintendence may require Investment Banks to provide additional information it considers necessary for the adequate supervision of integral risk management and of each of the specific risks to which the Investment Bank in question is exposed. Investment Banks must have at all times available to the Superintendence all documents, records, files, in physical, electronic, or any other form, referred to in these Standards, as well as the information from audits or reviews conducted by their parent companies, in the case of the Investment Bank whose parent company is located outside the country. The information referred to in the preceding paragraph must be safeguarded for a minimum period of five years, from its generation; after said period, entities may destroy the information once they have the corresponding digital backup, provided there is no legal obligation to maintain it physically.

CHAPTER VI
MANAGEMENT OF DIGITAL ASSETS, GUARANTEES, AND SERVICE PROVIDERS

Management of digital assets
Art. 23.- Investment Banks must consider in their integral risk management, the operations referred to in this Chapter.

Operations and custody in digital assets
Art. 24.- The Investment Bank, in its activities, may carry out operations in bitcoin or digital assets, which will consist of the remunerated custody of said assets, in accordance with what is established in article 41 letter d) of the Law. For this reason, the Investment Bank must observe regarding these operations what pertains to Information Security, Cybersecurity, and Business Continuity, according to the Technical Standards that the Central Bank issues for such purposes through its Standards Committee.

On the guarantee
Art. 25.- The Investment Bank must manage the risk on the holding of a guarantee of easily liquidated assets, which will serve as backing for credit operations or other obligations with sophisticated investors.
For the Investment Bank to guarantee the validity of the guarantee, it must establish internal policies and controls that back designed contracts that clearly specify the terms and responsibilities of each of the parties, in order to mitigate risks associated with volatility and ensure the legal security of transactions. The foregoing implies that in case of default, the creditor may execute the asset pledged as guarantee, or the debtor transfer the ownership of said asset to the creditor as payment, in accordance with what is established in the terms of the contract.

Safeguarding of guarantees
Art. 26.- The guarantees that back the credit operations carried out by an Investment Bank must be custodied or safeguarded at all times on internationally recognized digital platforms or those of the Investment Bank itself.
The contracts must include clauses on the procedures and terms for the execution and movement of the guarantees.

Digital platform
Art. 27.- The Investment Bank may constitute and operate a digital platform, according to the applicable legal framework and regulation, which will allow the transfer of digital assets pledged as guarantee and custody operations. It must comply, at a minimum, with the following:
a) Not make changes to the configurations of the digital platforms that result in manipulation of the digital assets and their price; b) Present a real-time valuation of the price, in accordance with the trend of the market in question; c) Provide equal treatment insofar as it provides prices to sophisticated investors; d) Mechanisms for access to clear, timely, and reliable information; e) Measures to ensure the confidentiality, availability, integrity, and functionality of operations; f) The digital assets of the entity or those received as guarantee, and hosted on the Investment Bank's digital platform, in order to guarantee that there is no violation or manipulation of the assets pledged as guarantee or custody, these must be conditioned with multi-signature; and g) Other information considered important for sophisticated investors.

Treatment of devaluation of guarantees
Art. 28.- The Investment Bank must have control and follow-up systems on the value of the guarantees, which must be valued at market value. For the purposes of the foregoing, entities must use a valuation methodology that provides real-time information. In the event that the value of the easily liquidated assets given as guarantee decreases due to deterioration, wear and tear, depreciation, amortization, or other reasons, to such an extent that they no longer cover the amount of the debt plus the additional percentage defined by the Investment Bank, the sophisticated investor must be notified about the devaluation of the guarantee and required to improve it within the time frame and percentage determined by the Investment Bank in accordance with internal policy and what is established in the contract signed.

Outsourcing of services
Art. 29.- In the event that the Investment Bank executes any of its operations through a third party, these must guarantee the integrity of the service provided.
The quality of the contracted services is the responsibility of the Investment Bank, which will respond to sophisticated investors for any damage or prejudice that may be caused to them by the provision of said service. For such purposes, the Investment Bank must have policies and procedures regarding the contracting of services, which must guarantee the "Know Your Provider" procedure. Investment Banks that consider outsourcing any of their operations or activities must observe what is established in the "Technical Standards for the Management of Information Security (NRP-23), and when it comes to a Digital Platform, detailed information must be presented on the following:

a) Description and main characteristics of the services offered to the public; b) Types of operations performed; c) List of digital assets with which it operates; d) Technical description of the Digital Wallet; e) Description of the information that will be displayed on the platform used to provide services to sophisticated investors; f) Maximum balance limit and maximum amount per transactions achievable by clients, as well as a description of the mechanisms to ensure compliance, if applicable; and g) Documentation proving that the Digital Wallet is characterized by a broad ecosystem of products and services, a significant history of daily transactions, and liquidity.

Special Provision for Non-Objection of Outsourced Services Art. 30.- Prior to formalizing the outsourcing of any of its operations or activities, the Investment Bank must submit a non-objection request signed by the legal representative or attorney-in-fact to the Superintendency, attaching the information referenced in Annex No. 1 of the “Technical Standards for Information Security Management (NRP-23)”.

Procedure for Non-Objection of Outsourced Services Art. 31.- Upon receipt of the non-objection request in accordance with Article 30 of these Standards, the Superintendency will proceed to verify compliance with the requirements defined in the Law, the Law for the Supervision and Regulation of the Financial System, and these Standards, having a maximum period of up to twenty business days to authorize or deny the corresponding request. If the request is not accompanied by the complete and properly formatted information detailed in Article 30 of these Standards, the Superintendency, due to the lack of necessary requirements, may require the applicant to submit the missing documents within a period of ten business days counted from the day following the notification, a period that may be extended at the request of the interested parties when there are reasons justifying such extension. The Superintendency in the same notice will inform the Investment Bank that if the information is not completed within the aforementioned period, it will proceed without further procedure to archive the request, leaving the right to submit a new request intact. If after the analysis of the documentation presented in accordance with Article 30 of these Standards, the Superintendency has observations or when the documentation or information presented is not sufficient to establish the facts or information intended to be accredited, the Superintendency will notify the Investment Bank to remedy the deficiencies communicated or to present additional documentation or information requested. The Investment Bank will have a maximum period of ten business days counted from the next business day following the notification, to resolve the observations or present the additional information requested by the Superintendency. The Superintendency may, through a reasoned resolution, extend by up to another ten business days, the period indicated in the previous clause, when the nature of the observations or notified deficiencies so requires.

Extension Period
Art. 32.- The Investment Bank may submit a request for extension of the period indicated in the fifth clause of Article 31 of these Standards to the Superintendency, before the expiration of said period, stating the grounds for the request and proposing, if applicable, the relevant evidence. The extension period may not exceed ten business days and will begin from the next business day following the expiration date of the original period.

Suspension of Period
Art. 33.- The twenty-business-day period indicated in the first clause of Article 31 of these Standards will be suspended for the days that elapse between the notification of the request for information or documentation referred to in the second and fifth clauses of said article, until the observations requested by the Superintendency are remedied.

Resolution
Art. 34.- Once the complete and properly formatted documentation is submitted, the Superintendency will respond to the non-objection request through a resolution.
The Superintendency will proceed to notify the interested party and the corresponding entity of the resolution, within a maximum period of three business days from the date of issuance.

CHAPTER VII
ON THE SERVICE TO SOPHISTICATED INVESTORS
Ethical Conduct Standards
Art. 35.- The Investment Bank, in the development of its activities with sophisticated investors, must observe at least the following:
a) Maintain a detailed and independent register of the digital assets or assets with easy liquidity of each sophisticated investor and those of the Investment Bank; b) Do not reveal information to third parties regarding the investments, amounts, and asset portfolios managed for sophisticated investors, unless such information is requested by competent authorities within the framework of their legal powers; c) Refrain from using confidential or privileged information for its own benefit or that of third parties to the detriment of sophisticated investors or the market; d) Equal treatment of sophisticated investors, providing the same conditions and opportunities, avoiding any act, conduct, practice, or omission that may be detrimental to them; e) Transparency and timeliness in the dissemination of information regarding the application of commissions, expenses, surcharges, and any other charges associated with the services provided by the Investment Bank. This information must be accessible and in a format that allows for easy understanding; and f) Perform its activities with honesty and diligence, avoiding acts that may deteriorate market integrity. Likewise, it must ensure adequate transparency of the information regarding transactions to be made with sophisticated investors, establishing negotiation mechanisms that include at least the following:
a) Price and volatility of the value of Bitcoin or Digital Asset; b) Commissions to be charged for custody; c) Operations that can be performed when the Bitcoin or Digital Asset is in the custody of the Investment Bank, according to Article 41 of the Law; d) Risks associated with the investment operations to be performed; and e) Other information considered important for sophisticated investors. Code of Ethics or Conduct Art. 36.- The Investment Bank must consider what is established in Article 30 of these Standards, additionally in the Code of Ethics or Conduct approved by the Board of Directors, in accordance with the “Technical Standards for Corporate Governance” (NRP-17), approved by the Central Bank through its Standards Committee. Contracts Art. 37.- Investment Banks may use any available digital means to perfect their contracts with clients and suppliers, using technological means such as electronic signature or any other that facilitates remote contracting. To provide any type of financing to sophisticated investors, contracts must include at minimum: the credit amount, interest rates, terms, type of guarantee, and execution process, the conditions and powers granted to the Investment Bank, as well as the rights and obligations of the contracting parties.

The contract must specify the collateral, which must be adapted to the requirements and needs of each sophisticated investor. The Investment Bank must explain to the sophisticated investor that the goods given as collateral are subject to market fluctuation and other inherent risks; therefore, the collateral is subject to restitution with the purpose of ensuring that the value covers the debt amount and an additional percentage. The Investment Bank must record the foregoing in the respective contract. Likewise, within credit operations and collateral management, the Investment Bank may formalize the operation through a smart contract or any other mechanism that technology allows, contractually agreeing on the execution process of the collateral according to the Investment Bank's internal policy. Collateral may be executed under the terms and conditions established in the contract. In cases where the sophisticated investor chooses to execute the digital asset pledged as collateral in advance, in a context of appreciation of the same, such execution must be carried out by mutual agreement, considering that with the execution of the digital asset, the Investment Bank can recover the income related to the credit granted.

CHAPTER VIII
TRANSPARENCY AND DISCLOSURE OF INFORMATION
Principle of Information Transparency
Art. 38.- The principle of transparency aims to strengthen the relationship between the Investment Bank and sophisticated investors, in order to generate mutual trust through the disclosure of information regarding the application and modification of interest rates, commissions, surcharges, charges on behalf of third parties, associated with active and passive operations performed, as well as the services provided by Investment Banks. This information must be accessible and in formats that allow for easy understanding. With reference to the procedures and methodologies for credit card services, Investment Banks must apply what is established in the “Technical Standards for Transparency and Disclosure of Information in the Credit Card System” (NCM-04), approved by the Central Bank through its Standards Committee. Revelation and Access to Information Art. 39.- Investment Banks must promote transparency and reliability in the provision and access to information to sophisticated investors, the Superintendency, and the general public, considering the following aspects:
a) Guidelines ensuring that the information generated by the Investment Bank is timely, accessible, sufficient, truthful, comparable, and consistent; b) Dissemination of information regarding the characteristics of the products and services offered by the Investment Bank; and c) Dissemination of the Investment Bank's financial information, in accordance with the applicable legal framework. Information to Sophisticated Investors Art. 40.- The Investment Bank must provide sophisticated investors with all information they request prior to the execution of any contract. This may be done through physical delivery or electronic availability of information regarding interest rates, commissions, charges on behalf of third parties, and surcharges of the products and services offered by the Investment Bank, with the objective of facilitating the comparison of similar products offered by other Investment Banks. Art. 41.- The Investment Bank must ensure that in its agencies and other customer service channels, a notice is placed, with legible typography visible to the naked eye, containing information regarding the mechanism the Investment Bank has implemented to handle complaints and inquiries from its sophisticated investors, specifying the hours for customer service and communication means, such as: website, digital platforms, customer service phone, email, physical address of the service office, among others. Information on Promotional Conditions Art. 42.- Promotional conditions that incentivize the contracting of certain active, passive operations, or services, must be informed and maintained by the Investment Bank during the offered period, and if applicable, for the number of units offered or under any other circumstance subject to the promotional condition; likewise, these promotional conditions must be informed adequately and timely, including the nominal and effective rates of credit operations, as well as commissions, charges on behalf of third parties, and surcharges. Minimum Information in Passive Operations Art. 43.- The Investment Bank, prior to the execution of passive operation contracts, must deliver a form in physical or electronic format, according to the instructions of the sophisticated investors, with the following minimum information:
a) Nominal interest rate to be applied for the deposit; b) The cutoff dates or the periodicity for the crediting of interest; c) The amount and detail of any commission charge, expense, or charge passed on to the sophisticated investor, except taxes or special contributions; d) Penalties that will be applied for non-compliance with the obligations undertaken; and e) Other information that the Investment Bank considers relevant.

In addition to what is established in this article, the Investment Bank must inform the maturity date of the time deposit, if applicable, and the time the sophisticated investor has to cancel it before its automatic renewal.
The information required in this article must be complete, accurate, truthful, clear, and timely.

On Active Interest Rates
Art. 44.- The Investment Bank must establish and make public a single reference rate expressed as a percentage, for its loan operations in legal tender currency and another for its loan operations in foreign currency, in accordance with legal requirements. The calculation methodology must be documented and available to the Superintendency when requested. Regarding the nominal interest rate, it must be clearly differentiated in the disclosure of offered products and in the contractual document, whether it is fixed or variable or a combination of both; which must consider the Legal Maximum Rates, in accordance with the Anti-Usury Law and its technical regulations. The Investment Bank must inform the effective interest rate or TIE within the credit approval letter, contractual documents, and in all advertising of credit operations performed by any mass or individual medium, with similar emphasis on the publication of other financial variables such as the credit amount and term, installment amount, and total amount to be paid at the end of the term. To facilitate the decision-making of sophisticated investors regarding the products offered by Investment Banks, these may publish on their website the corresponding formula for the calculation of periodic interest, the formula and calculation method of the TIE, the method of amortizing credits with corresponding payments to principal, interest, and other applicable expenses, making available to users and sophisticated investors examples of such calculations and financial calculators for simulation purposes. Method of Calculation of Interest Art. 45.- For the computation of interest on active or passive operations, the Investment Bank must apply the exact simple interest method, which consists of counting the days of use of money based on the calendar year and using the divisor of 365 or 366 days, as applicable, using the following formula:
I = P * i * n

Where:
I = Interest to be paid
P = Outstanding capital i = Current nominal interest rate percentage n = The factor established by the relationship of the elapsed time divided by 365 or 366 if the year is a leap year For the calculation of interest on active and passive operations performed through information systems, six decimal places must be used to compute interest; the last retained digit must be rounded up to the immediate superior when the first lost digit is equal to or greater than five; the same criteria will be used for the storage of information. Effective Interest Rate Art. 46.- The calculation of the TIE will take into account the total charges that the Investment Bank will charge the sophisticated investor, including charges on behalf of third parties mandatory for financing according to the contract models deposited with the Superintendency, except notary fees, payment of taxes, fees, and contributions, incorporating the term and modalities to redeem the obligation and expressing it in percentage terms on the principal.

The Investment Bank must calculate the annualized TIE for each type of operation, according to the following methodology:
a) Determination of the maximum effective interest rate for publication purposes:
For active operations, the maximum annualized effective interest rate is understood as that which takes into account the total charges that the Investment Bank will charge the sophisticated investor, incorporating the term and modalities to redeem the obligation and expressing it in percentage terms on the principal. For each type of financial product of active operations offered to sophisticated investors, the Investment Bank must publish monthly the maximum annualized effective rate, which in terms of amounts and term represents the highest effective rate. The publication must contain a clarification of the parameters considered for the calculation of the aforementioned rate, based on the second clause of this article. b) Determination of the annualized effective interest rate for contract purposes:
It will be determined with the amount authorized to the debtor and will include the total charges that the Investment Bank will charge the sophisticated investor, including charges on behalf of third parties, mandatory for financing according to the contract models deposited with the Superintendency, except notary fees, payment of taxes, fees, and contributions.

Method of Calculation of the Effective Interest Rate Art. 47.- For each financial product of active operations offered to the sophisticated investor, the Investment Bank must calculate and publish a maximum annualized effective rate, which will be determined based on the following procedure:
a) First, the effective interest rate will be determined by equating the present value of all capital, interest, commission, and other payments to be made by the user, except the payment of taxes, with the loan amount. Its formula is expressed as follows:

∑ Dn (1+ ik )^-tn = ∑ Rm (1+ ik )^-tm n =1 m =1

Where:
D: disbursement amount, net of commissions, surcharges, and other charges related to it. n: number of disbursements. tn: time elapsed from the chosen calculation date (at the start) to the date of disbursement n.
R: payments for amortization, including interest, commissions, surcharges, and other charges included in the effective yield of the operation. m: number of payments. tm: time elapsed from the chosen calculation date (at the start) to the date of payment m. ik: effective rate per unit, referring to the time period chosen to express tn and tm in whole numbers.

b) The effective interest rate will be calculated using the following formula:
TIE = TIRp * K

Where:
TIE: annual effective interest rate.
TIR: internal rate of return. p: periodicity.
K: number of payments or installments during a year.

Periodicity (p) Number of Payments (K)
Daily 365
Weekly 52
Biweekly 26
Fortnightly 24
Monthly 12
Bimonthly 6

Periodicity (p) Number of payments (K)
Quarterly 4
Four-monthly 3
Semi-annual 2
Annual 1
At maturity 365/Number of days*

Number of days between the granting date and the maturity of the credit.

On Commissions
Art. 48.- Commissions must have a clear denomination and a concept or meaning for greater clarity and transparency to the general public. The terms and forms related to commissions must be previously known, accepted, and contracted; in addition, they must correspond to an additional service effectively provided by the Investment Bank and not be inherent to the product or service contracted by users in accordance with current legislation.

In accordance with the nature of a commission, the following shall not be considered as such: the charging of facilities such as: VIP attention, consultation attention, and management or others that the Investment Bank makes available to sophisticated investors for the provision of services in a comfortable and secure manner.

Two or more commissions shall not be charged for the same concept, nor surcharges or charges on behalf of third parties applied for the same fact or act.

The Investment Bank must be as specific as possible in the publication of its commissions, guaranteeing the transparency of the charges it makes to sophisticated investors.

On Surcharges
Art. 49.- The terms and form that give rise to surcharges must be available to the general public; and must be read and explained, accepted, and contracted by sophisticated investors in accordance with current legislation, and may be defined to the measure of the sophisticated investor.

The denominations of surcharges must allow for easy identification and understanding by the general public and must not be prone to confusion with commissions, nor with charges on behalf of third parties.

On Charges on Behalf of Third Parties
Art. 50.- In no case shall charges on behalf of third parties be applied for concepts not previously agreed upon with the sophisticated investor. Instructions for charges related to the contracting of products and services that the client has authorized third parties to carry out on their accounts are excepted, such as payments for water, electricity, telephone, municipal taxes, insurance, among others.

Regarding charges for insurance premiums in cases of collective policies contracted with the entity, the entity shall deliver to the sophisticated investor an extract of the policy that will be provided free of charge by the insurer and that will contain a detail of the risks covered, the rights and obligations of the client, the form of renewal and modifications to which the policy is subject. In any case, both the entity and the insurer must deliver a free copy of the policy upon request of the sophisticated investor.

In the case where the sophisticated investor pays an amount for appraiser services for valuations of movable and immovable property as a requirement linked to the operations to be contracted, the entity or the appraiser shall deliver to him an original of the appraisal performed and the proof of payment for this service.

Art. 51.- Any information disseminated regarding interest rates, nominal and effective, commissions, surcharges, and charges on behalf of third parties, even those of a commercial nature, must refer to a specific financial product or service when applicable or when it is appropriate to differentiate, so as not to induce error or confusion.

All commercial publications that disseminate interest rates must indicate the nominal rate and the effective rate in effect at the same frequency with the same font size, clearly establishing the corresponding restrictions. Investment Banks may make this information available to the general public through their website.

Likewise, Investment Banks must refrain from publishing commissions or surcharges that have been declared inappropriate, in a final judgment, by the competent authority.

Commissions, surcharges, or third-party charges must have the backing that allows proving the effective existence of the service or penalty and that justify the charge to the sophisticated investor.

The aforementioned backing must be available to the Superintendence at all times.

Submission of Information to the Superintendence Art. 52.- The Investment Bank must submit to the Superintendence, in electronic media or in the form it determines, in the last three business days of each month, the information regarding interest rates, commissions, surcharges, and charges on behalf of third parties, which will be published on the first day of the following month, in accordance with what is established in these Standards.

Art. 53.- For the purpose of promoting greater transparency, the Investment Bank must have commission and surcharge policies authorized by the Board of Directors, in which each of the commissions, charges on behalf of third parties, and surcharges, their meaning, operations on which they apply, maximum to be charged, and frequency of charge, among others, are defined and clarified; these policies must be submitted to the Superintendence within the first month of the current year.

When new commissions, charges on behalf of third parties, and/or surcharges are added, the Investment Bank must update the policies and submit them to the Superintendence within ten business days following approval by the Board of Directors.

Contract of Active Operations with Fixed Interest Rate Art. 54.- In the case of active operations contracted with the fixed interest rate modality, it must be established in the contract regarding the matter that the interest rate will remain fixed during the established term.

Contracts of Active Operations with Adjustable Interest Rate Art. 55.- In the case of active operations contracted with the adjustable interest rate modality, it must be established in the contract regarding the matter the differential with respect to the reference rate that will be applied during the validity of the operation, the periodicity of the adjustments, and the default interest that will be charged in cases of default. The established differential will be the maximum, and the default interest will remain fixed until the total extinction of the respective credit obligation.

Prior to the contracting of the operation, the sophisticated investor must be explained the fluctuations to which the interest rate of the contracted operation may be subject when the reference rate varies.

Modifications of the reference rate of active operations will affect all contracts that have been agreed upon with an adjustable rate, in accordance with the frequency established in the credit contract.

Any increase in the active interest rate must be communicated directly and in writing to the sophisticated investor, by any means the Investment Bank has available, fifteen days in advance of being applied, without prejudice to the publications that the Investment Bank must make in accordance with the Investment Banks Law.

In any case, physical or electronic evidence must be kept that the corresponding communication has been made.

Condition of Interest on Active Operations
Art. 56.- In the contracting of active operations, interest will be subject to the following provisions:
a) In contracts with active operations, the Investment Bank must state the nominal and effective rates, in this order, expressed in annualized form, in letters and numbers of larger size; b) Interest that has not accrued cannot be charged, notwithstanding any agreement to the contrary; operations for the discount of documents are excepted; c) The charging of interest on interest, nor interest on commissions and charges on behalf of third parties or surcharges, cannot be agreed upon; d) The computation of interest will be made from the day the resources are delivered to the sophisticated investor until one day before the repayment date, unless otherwise provided for the benefit of the debtor; and e) Interest will be applied only on outstanding capital balances during the time they have been pending, and in the case of default interest, it will be applied on the outstanding capital balance that has failed to be paid and not on the total debt.

Any amount received in concept of active operations will be imputed first to interest and the remainder, if any, to capital, unless otherwise provided for the benefit of the debtor.

When the payment deadline is a bank closing day, a holiday, a national day of rest, a weekend, or if the computer system or the possibility to make the payment is not enabled, the payment deadline will be extended to the next business day.

Condition of Interest in Passive Operations
Art. 57.- In the contracting of passive operations, interest will be subject to the following:
a) In savings deposits, interest will be computed from the day of receipt of the deposit or remittance, until the day prior to the date of withdrawal of the funds; and b) In other deposits, the computation of interest will be made from the day following the receipt of the funds, until the day of maturity of the term agreed upon for payment or cancellation.

Monthly Disclosures
Art. 58.- The Investment Bank must publish on the first day of each month, in two newspapers of national circulation, clearly and legibly, the reference interest rates, the nominal and effective rates, the commissions, the surcharges, and the charges on behalf of third parties, which will be in effect for that month, taking as a base the formats described in Annexes No. 3, 4, and 5 of these Standards.

The Investment Bank must display, starting from the first day of each month, on the bulletin boards installed in its central offices, in the agencies, and on its website in a clear, legible, and visible manner, the interest rates, commissions, surcharges, and charges on behalf of third parties applicable to its operations, which will be in effect for that month.

The interest rates of active and passive operations that are disseminated must be annual.

The information through the website must be shown through a link with a name related to information on products and services. This link will provide information on the fees charged by the Investment Bank for the different products and services it commercializes. The contracts, regulations, or annexes published on the websites must be updated and have the date of the last update, which must be identical to the information the Investment Bank disseminates in its customer service offices and in the newspapers.

Art. 59.- The nominal and effective interest rates disseminated must be the maximum for each type of credit operation, presented in percentage form, with two decimal places.

Art. 60.- Interest rates, commissions, surcharges, and charges on behalf of third parties will be in effect from the day of their dissemination, and those that have not been disseminated cannot be applied, except in the case of increases in interest rates on passive operations or decreases in interest rates on active operations and of commissions for services or surcharges.

Information on commissions, surcharges, charges on behalf of third parties, and other relevant conditions related to products and the provision of services must be detailed in order to allow sophisticated investors to have full knowledge of them, perform the corresponding verifications, and understand the cost involved.

Disclosure of Modifications
Art. 61.- Increases in interest rates on active operations, commissions for services, charges on behalf of third parties, as well as decreases in interest rates on passive operations, occurring after the monthly dissemination, must be disseminated eight days in advance of their validity, in the same manner as described in the second paragraph of Article 58 of these Standards. These disseminations must refer exclusively to the changes to be made.

When it concerns active operations that belong to special programs with an interest rate not linked to the reference rate, interest rate increases must be disseminated thirty days in advance.

Decreases in interest rates on time deposits that are renewed automatically must be disseminated eight days in advance of maturity. The notice of decrease must indicate that those who do not accept the new interest rate have a period of fifteen days counted from the maturity to withdraw it.

The disseminations referred to in this article will be carried out through the monthly publications and through subsequent publications, whenever there is a decrease in passive rates.

Correction of Publications
Art. 62.- The Superintendence may require new publications in cases where the requirements established by the Law and what is established in these Standards have not been met.

Public Offer
Art. 63.- Disseminations will have the character of a public offer and will bind the Investment Bank under the terms of Article 45, second paragraph, of the Law.

Disclosure of Passive Conditions
Art. 64.- The Investment Bank must disseminate information concerning terms, interest rates, capitalization of interest, surcharges, commissions, and other conditions that imply significant benefits or costs for sophisticated investors. The Investment Bank will publish such information in two newspapers of national circulation, at least three times a year, and it will be entirely at the disposal of sophisticated investors in its customer service offices, website, and other communication means that the Investment Bank deems convenient.

At the bottom of the dissemination of passive interest rates, it must be indicated that the different modalities of deposits offered have been approved by the Central Bank, regarding the transfer or negotiability and the term.

Provision of Services by Third Parties
Art. 65.- The Investment Bank must establish appropriate policies and procedures to evaluate and monitor the outsourcing of administrative collection management services.

For this purpose, the Investment Bank must formalize contracts, which include the scope and clearly define the responsibilities of the service provider and the Investment Bank. For the outsourcing of administrative collection management services, the Investment Bank must consider what is established in Articles 29, 30, and 31 of these Standards.

Additionally, the contracts must include as a minimum the following clauses:
a) Confidentiality of information; b) Obligation of the provider to comply with the legal provisions applicable to it and the penalties for its non-compliance; c) In cases where administrative collections are made, a detail of the administrative collection treatment or collection of default that will be carried out, as well as the fee table for the management performed. The charge made must be in concordance with the costs incurred by the Investment Bank; and d) Obligation of the provider to document the services provided in a way that facilitates an adequate review of the service provision, by the Investment Bank and by the Superintendence.

Collection Management Companies
Art. 66.- The Investment Bank must have available to its sophisticated investors, the updated data of the collection management offices, which must include as a minimum the following: office name, address, phone numbers, and the hours in which collections will be made. This information must be available to sophisticated investors through electronic means and in their agencies.

CHAPTER IX
OTHER PROVISIONS AND VALIDITY

Generation of Statistical Information
Art. 67.- The Investment Bank must have an automated system for recording, processing, storing, transmitting, producing, securing, and controlling claims or management involving any complaint or disagreement expressed by the sophisticated investor, received in the previous month, related to financial products or services, which must contain, among others, the number of cases, reason for claims, cases in process or completed, according to the format described in Annex No. 6 of these Standards.

The system will generate statistics to know which products offered by the Investment Bank are those that present the highest number of claims or management involving any complaint or disagreement expressed by the sophisticated investor received in the previous month, related to financial products or services, with the objective that the Administration Body takes decisions based on relevant and timely information in accordance with what is established in Article 35, letters d), e), h), and j) of the Law on Supervision and Regulation of the Financial System.

The Superintendence may require direct real-time access to said system, in accordance with Article 32 of the Law on Supervision and Regulation of the Financial System.

Disclosure to the Public on Statistical Summary Art. 68.- The Investment Bank must disseminate on its website a link that directs to the statistical summary on the reasons for claims or management involving any complaint or disagreement expressed by the sophisticated investor received in the previous quarter, related to financial products or services, as well as efficiency indicators of resolved cases and the maximum times for their resolution.

The Investment Bank must present the statistical summary taking into consideration what is established in Annex No. 6 of these Standards.

Submission of Information to the Superintendence Art. 69.- The Investment Bank must submit monthly to the Superintendence within a period of five business days following the month in reference, the statistical control established in Annex No. 6 of these Standards.

Likewise, in the case where a sophisticated investor files a claim for operations, services, and/or financial products without a valid contract with the Investment Bank, this must register them with code 26 "Other reasons", of Annex No. 8 of these Standards.

In case of no claims or management involving any complaint or disagreement expressed by the sophisticated investor received in the previous month, related to financial products or services, the Investment Bank will submit to the Superintendence a note stating such situation.

Technical Details for Submission of Information to the Superintendence Art. 70.- The Superintendence will submit to the Investment Bank, with a copy to the Central Bank, within a maximum period of thirty business days following the date of entry into force of these Standards, the technical details related to the sending of the information requested in Article 69 of these Standards.

The technical details will be limited to the collection of information in accordance with what is regulated in these Standards.

Applicable Regulation on AML/CFT/FPFAD
Art. 71.- It is the responsibility of the Investment Bank that foreign service providers and digital platforms selected for the custody or deposit of the guarantee observe, monitor, and comply with all measures in prevention of AML/CFT/FPFAD, in concordance with the requirements of the country and the Recommendations of the Financial Action Task Force (FATF).

The Investment Bank must verify, with respect to the country of origin, that the foreign service providers and digital platforms selected for the custody or deposit of the guarantee are not included, at least, in the lists of the Office of Foreign Assets Control, of the U.S. Department of the Treasury (OFAC) and of the United Nations; they must also review the pronouncements of regulatory or supervisory agencies and/or international bodies such as FATF and evaluate the risk presented by the country or jurisdiction in relation to the platform

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

of custody or deposit of the guarantee, or its head office are located or domiciled, especially when it comes to tax havens or countries considered as non-cooperative by the FATF.

Submission of Documentation
Art. 72.- Copies submitted to the Superintendence, in compliance with what is established in these Standards, must be legible and certified by a Salvadoran Notary.
In cases where the copies correspond to the Unique Identity Document (DUI) and the Tax Identification Number (NIT), notarial certification will not be required.

Likewise, signatures that match any type of documentation issued in El Salvador must be legalized by a Salvadoran Notary.

Notwithstanding the above, if the documentation presented comes from abroad, both copies and signatures appearing in it must be authenticated or certified by a foreign notary or official, as appropriate, and follow the apostille procedure in the case of countries signatories to the "Hague Convention Abolishing the Requirement of Legalisation for Foreign Public Documents"; otherwise, they must be legalized by the Head of the Diplomatic Mission, Consul, Vice-Consul, or Officer in Charge of Consular Affairs of El Salvador, or, in their absence, by officials of the Ministry of Foreign Relations from which such documents originate.

The procedures for authentication or certification and apostille will apply to the documentation where they are applicable. Notwithstanding, documentation originating from a foreign country, written in a language other than Spanish, to have legal effect in El Salvador, must be translated in accordance with what is established in the Law on the Practice of Notarization of Voluntary Jurisdiction and Other Proceedings.

Sanctions
Art. 73.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Unforeseen Aspects
Art. 74.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Central Bank through its Standards Committee.

Validity
Art. 75.- These Standards will enter into force as of the twenty-fifth of November two thousand twenty-five.

Annex No. 1
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

COMMISSIONS AND SURCHARGES

Commissions and Surcharges whose collection is appropriate, under the indicated conditions:

COLLECTION AGENCY PAYMENT COMMISSION: Its collection is only applicable if it is applied to the company to which the bank provides the collection service and not to the general public, provided that in the contracts with those companies the collection of this commission is agreed upon, also determining that, if the bank intends to provide such service only to its own clients, this must be stated in the collection contracts that the banks sign with the companies;
DOCUMENT REGISTRATION PROCESSING COMMISSION: The collection of this commission is applicable upon verifying that the banks manage the registration of documents that, ultimately, also benefit the client, by achieving promptness in the registry service and in the retrieval of documents that are in problem;
FRACTIONAL CURRENCY COUNTING COMMISSION: The collection of this commission is applicable provided that it is applied only to clients who, due to their commercial activity and the handling of high volumes of fractional currency, require such service;
ANNOTATION OR REASON APPLIED TO UNPAID CHECKS COMMISSION: Its collection is applicable when the bank's services are used for this purpose, considering that the interested party may request the professional services of a Notary for this purpose, as an option;
MAINTAINING THE VALIDITY OF THIRD-PARTY POLICIES COMMISSION: Its collection is applicable considering that some banks perform management for this purpose, which translates into the payment of a premium on behalf of the client, to keep the respective Policy valid, which is unrelated to the one marketed by the same bank or by entities belonging to the same financial conglomerate, which benefits the client;
EARLY PAYMENT SURCHARGE: The collection of this surcharge is only applicable in the exceptional cases foreseen in letter m) of article 19 of the Consumer Protection Law, considering the deadlines of the respective obligations according to what is provided in the last paragraph of article 59 of the Banks Law; and
REJECTED CHECKS SURCHARGE: The collection of said surcharge is only applicable if it is applied to the issuer of the unpaid check due to causes attributable to him, without its collection being transferable to the beneficiary of the same.

Commissions and Surcharges whose collection is inappropriate, with the exceptions indicated:

INSURANCE POLICY ADMINISTRATION COMMISSION: The collection of a commission with such denomination is not applicable, as banks do not administer Policies;
COUNTER TRANSACTIONS COMMISSION: It was determined that, by definition, the collection of this commission is not applicable, as counter transactions are part of the operational business of banking entities;
EXCESS CASH REMITTANCE COMMISSION TO AN AMOUNT DETERMINED BY THE BANK: The collection of this commission is not applicable, as the receipt of cash remittances, regardless of their amount, is part of the operational business of banking entities;
CHECK PROTEST COMMISSION: The collection of this commission does not respond to what the banking operation implies, which is a special annotation or reason stamped by each bank on checks that it does not pay for various lawful reasons;

SURCHARGE FOR PAYMENT OF CHECKS IN A NUMBER HIGHER THAN ESTABLISHED BY
THE BANK: By definition, the collection of this surcharge is not applicable, as the receipt of checks by a client, regardless of their amount, is part of the operational business of banking entities; and
ACCOUNT INACTIVITY SURCHARGE ON DEPOSIT ACCOUNTS: It was determined that the collection of
such surcharge is not applicable due to the legal aspects inherent to the topic, that is, it is a case that already has specific treatment in the Banks Law.
COMMISSION OR SURCHARGE FOR BALANCE INQUIRIES ON ATMS, ATM OR OTHER
ELECTRONIC MEANS: the first 10 operations related to balance inquiry will be free, provided that a receipt of the account balance is not required from the device through which the inquiry is made. Entities must implement in their ATM network messages about charges or commissions for the service, if any. The provisions of this paragraph will apply to debit products and in the entity's own network.

Likewise, commissions deemed inappropriate by jurisprudence will be considered inappropriate.

Annex No. 2
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

EXCHANGE RATES FOR DEBIT CARDS RECEIVED IN THE MONTH (a)

TYPE OF TRADE
DISCOUNT RATE (ACQUIRING) ISSUER EXCHANGE RATE RATE MINIMUM RATE MAXIMUM RATE AVERAGE DEBIT CARD Large distribution companies (b) Supermarkets Gas stations Retail trade (c) Hotels and similar accommodations Restaurants, cafeterias, bars and similar establishments Travel and entertainment (d) Public Services (Electricity and Water) Rest of the categories (e)

(a) The data that the entity must report are those corresponding to payment operations carried out in the month to which the data refer debit cards of sophisticated investors. The rates will be declared in percentages with two decimals and the amount in thousands of dollars. (b) Large distribution companies of food products, appliances, clothing, toys, books or sports articles, among others. (c) Small format businesses and of any nature, including those for daily use (such as pharmacies, jewelry stores, shoe stores and gifts, among others), unless due to their small amount they have to be classified as "Rest of the categories". (d) Businesses focused on travel, leisure and entertainment, except hotels and restaurants (such as travel agencies, passenger transport, car rental, casinos, shows, massages, saunas and nightclubs), unless due to their small amount they have to be classified as "Rest of the categories". (e) Rest of the commercial activities not included in the above categories (such as pharmacies, companies dedicated exclusively to non-presence sales, public services, charitable and non-profit societies and health services), as well as commercial activities whose prices are conditioned by a certain regulatory framework (for example, urban transport, parking, etc.) and that, in general, present a low average amount in card payments.

Annex No. 3
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

NOMINAL AND EFFECTIVE INTEREST RATES FOR ACTIVE OPERATIONS REFERENCE RATE FOR ACTIVE OPERATIONS ___% ANNUAL ACTIVE OPERATIONS LOANS PRODUCTIVE LOANS LOAN FOR MICRO AND SMALL ENTERPRISES CONSTRUCTION HOUSING PURCHASE CONSUMPTION REVOLVING FOR NATURAL PERSONS DISCOUNT OF DOCUMENTS CREDIT CARD CREDIT WITH TIME DEPOSIT GUARANTEE OTHER PURPOSES Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate Nominal Rate Effective Rate a) Up to one year term Own resources Third-party resources Special programs b) More than one year term Own resources Third-party resources Special programs c) Overdrafts d) Extra-financing credit card e) Guarantees f) Automatic loans g) Special programs LATE INTERESTS PAYMENT PLAN a) Amortization tables b) At maturity Note: The names of the products in the column titles are exemplary, the Investment Bank must name its own products.

Annex No. 4
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

COMMISSIONS FOR INTERNATIONAL TRADE OPERATIONS A. COMMISSIONS AT SIGHT WITH MINIMUM MATURITY CONCEPT*

Import Letters of Credit
Opening % On the base % On the base
Increase in value SAME SAME
Extension SAME SAME
Acceptance SAME SAME
Amendments and discrepancies SAME SAME
Cancellation SAME SAME
Export Letters of Credit
Notice and Confirmation % On the base % On the base Extension SAME SAME Acceptance, negotiation or payment SAME SAME Amendments and discrepancies SAME SAME
Issuance of drafts SAME SAME
Transfers SAME SAME
Collections
Imports % On the base % On the base
Exports SAME SAME
Other Commissions
Cash dollar remittances % On the base % On the base Suspension of draft payment plus expenses SAME SAME Payment orders from abroad SAME SAME Sale of traveler's checks SAME SAME B. EXPENSES FOR THE ACCOUNT OF THE USERS Specify the cost of the service Specify the cost of the service Communications, mail and stationery Others (detail) Note: The names of the commissions and expenses are illustrative, therefore, the Investment Bank must publish them according to the name with which it denominates them. *The concept of the commissions will be published only on the website and in the publications at the respective agencies

Annex No. 5
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

COMMISSIONS AND CHARGES FOR SERVICES AND INTEREST RATES FOR PASSIVE OPERATIONS COMMISSIONS FOR SERVICES AMOUNT

CHARGES FOR THE ACCOUNT OF THIRD PARTIES AMOUNT SURCHARGES AMOUNT INTEREST RATES FOR PASSIVE OPERATIONS PRODUCTS Annual interest rate (%) Note: The deposits described above are subject to the Standards approved by the Central Reserve Bank of El Salvador, regarding terms, transfer and negotiability.

Annex No. 6
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

COMPLAINTS OR REPORTS CONTROL

No. Requirement Description
1 Agency that received the complaint
Name of the agency, branch, office, unit, or channel in which the complaint was received by the Investment Bank 2 Control number Tracking or control number assigned by the Investment Bank to reference the complaint.
3 Date of complaint Date on which the sophisticated investor submitted their complaint.
4
Name of the user or sophisticated investor
Name of the sophisticated investor who submits the complaint.
5
Nationality of the user or sophisticated investor Nationality of the sophisticated investor who submits the complaint.
6 Type of person (Natural or Legal) If the person submitting the complaint is Natural or Legal.
7 Tax Identification Number
Tax Identification Number.
(Which will be required in cases defined by the Tax Administration).
8 Type of Identity Document
Document with which one identifies:
Unique Identity Document, Passport or resident card.
9 Identity Document Number Identity Document Number.
10 Sex Sex of the person (provided that this is a natural person).
11 Product, service or operation related to the complaint Code of the product, service or operation related to the complaint according to Annex No.
5.
12 Reason for complaint Complaint code according to Annex No. 6.
13 Status of the complaint Status in which the complaint is: in process or completed.
14 Resolution result
Result of the complaint resolution:
favorable, unfavorable or withdrawn by the sophisticated investor.
15 Resolution date Date on which the complaint management was finalized.
16 Name of the unit Name of the unit responsible for resolving the complaint.
17 Operational risk generating factors
Operational risk generating factors.

Annex No. 7
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

OPERATIONS – SERVICES – PRODUCTS CODES
CODE OPERATIONS – SERVICES – PRODUCTS
1 Savings Deposits
2 Time Deposits
3 Checking Account
4 Compensation Deposits for Service Time
5 Debit Cards
6 Corporate Credits
7 Consumer Credits
8 Mortgage Credits
9 Factoring and/or Discount
10 Bid Bonds / Guarantees
11 Guarantees and Other Collateral
12 Trusts
13 Safety Deposit Boxes
14 Fund Transfers
15 Electronic Banking
16 ATMs
17 Problems related to the user service of the financial system 18 Custody Service 19 Program for protection against theft, fraud, robbery and loss of debit card 20 Collection 21 Use of the digital platform 22 Other Operations, Services and/or Financial Products

Annex No. 8
Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-09/2025
NRP-93
TECHNICAL STANDARDS FOR THE COMPREHENSIVE RISK MANAGEMENT AND INFORMATION TRANSPARENCY OF INVESTMENT BANKS Approval: 10/11/2025 Validity: 25/11/2025

COMPLAINT REASON CODES
CODE COMPLAINT DETAILS
1 Contract clauses, conditions, agreements
2 Information on operations, products and services 3 Charges of interest, commissions, surcharges and third-party charges 4 Interest rates, commissions, or other agreed conditions 5 Account overdraft 6 Account operations (withdrawals and deposits) 7 Fund withholdings to credit and debit products 8 Account cancellation 9 Use of the digital platform 10 Incorrect settlements 11 Problems in the execution or appraisal of collateral 12 Problems in the custody service of securities in accordance with letter d) of article 41 of the Investment Banks Law, as applicable. 13 Unrecognized account operations (consumptions, cash withdrawals, withdrawals, charges, credits and balances) 14 Sending of correspondence (statements, debit notes, payment schedules, among others) 15 Information in the Risk Central and/or rectification of information 16 Unprocessed transactions (includes problems in the functioning of Internet operations, exchange rate differential problems, others) 17 Rectification of service payment (sophisticated investor / company) 18 Delay or lack of return of valued documents/goods 19 Problems related to electronic ATMs (did not dispense cash, voucher) 20 Problems with services provided through electronic channels 21 System failures that hinder operations and services 22 Dissemination of operation information without the authorization of the sophisticated investor 23 Delivery to beneficiaries of funds 24 Quality of user attention 25 Other reasons

Technical Standards for Comprehensive Risk Management and Information Transparency of Investment Banks

Lineage: In force

Similar documents from other regulators