Technical Standards for Conducting Operations and Providing Services Through Physical, Digital, and Mobile Financial Correspondents and Financial Correspondent Administrators

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 37

THE NORMS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That it is in the interest of the State to promote that its population has access to formal financial services and the use of payment systems to achieve their insertion into productive activities, thus contributing to the improvement of quality of life and collective well-being, which is achieved with the incorporation of novel mechanisms for the provision of said financial and payment services, in geographic areas usually neglected;

II. That international experience has shown that the implementation of the figure of financial correspondents and financial correspondent administrators, by financial institutions, as an alternative channel for the provision of their services, constitutes an efficient tool for financial inclusion;

III. That it is necessary to have a regulatory framework that establishes the conditions and requirements that financial institutions must observe to conduct their operations and services through financial correspondents and financial correspondent administrators, as well as the requirements and conditions that these must comply with;

IV. That Article 70 of the Banks Law establishes that banks will conduct their operations and provide their services, in accordance with the provisions of the Commercial Code and other applicable laws, adhering to sound practices that promote the security of said operations and services and that ensure adequate attention to users;

V. That Article 63 of the Banks Law and Article 41 of the Cooperative Banks and Savings and Credit Societies Law establish that banks must develop and implement control policies and systems that allow them to adequately manage their risks and know their clients in a reliable manner; and

VI. That it is in the interest of the State to orient public policies so that lower-income individuals and especially rural areas have access to financial services, which implies that institutions can have access to new technologies that allow providing low-cost operations and services through financial correspondents.

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 37

AGREES to issue the following:

TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS

CHAPTER I OBJECTIVE, SUBJECTS, AND TERMS

Objective Art. 1.- These Standards aim to establish the provisions regarding the procedures and requirements that the subjects listed in Article 2 of these Standards must comply with, to conduct operations and provide services either through physical, digital, and/or mobile financial correspondents or through financial correspondent administrators, who act on behalf of and under the responsibility of the subjects, as well as the characteristics, conditions, and prohibitions applicable to said financial correspondents.

Subjects Art. 2.- The subjects obligated to comply with the provisions established in these Standards are: a) Banks constituted or created by Law in the country; b) Branches of foreign banks established in the country, insofar as pertinent; c) Savings and credit societies; and d) Cooperative banks.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Financial correspondent administrator or Administrator: A legal entity whose legal regime or corporate purpose includes affiliating and administering natural or legal persons who act as financial correspondents, with which the subjects listed in Article 2 of these Standards sign a contract without an employment relationship so that they act on behalf of and under the responsibility of the subjects; they may also exercise the function of financial correspondent; b) Web or mobile application, program, or computer system: Any software used by the obligated subjects, financial correspondent administrators, or financial correspondents for the collection, storage, processing, display, or transmission of information related to the financial products or services that said entity offers to its clients;

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 37

c) Central Bank: Central Reserve Bank of El Salvador; d) Client: Natural or legal person who maintains a contractual relationship with the Entity for the provision of one or more passive or active operations; e) Digital correspondents: Financial correspondents that make their web applications or mobile device applications available to the public for the provision of their operations and services; f) Financial correspondents or Correspondent: Natural or legal persons legally constituted who conduct acts of commerce in the Republic of El Salvador, operate in their own or third-party physical or mobile establishments and serve the public, or digitally, through a web or mobile application, program, or computer system, with which the subjects listed in Article 2 of these Standards sign, on their own behalf or through an Administrator, a contract without an employment relationship, so that on behalf of and under the responsibility of the latter, they can conduct the operations and provide the services to the public referred to in these Standards; therefore, financial correspondents are considered as a channel of the subjects, who exercise activities complementary to their main commercial activity, according to a mandate contract. The Central Government, Municipalities, and Official Autonomous and Semi-Autonomous Institutions may be financial correspondents provided their legal framework authorizes it and there is no express prohibition. For the purposes of these Standards, financial correspondents shall not be considered Agents, Representatives, or Distributors, regulated in Article 392 and following of the Commercial Code; g) Physical correspondents: Financial correspondents who provide their services in a fixed physical establishment, own or third-party, in which they develop their economic activity and serve the public; h) REPEALED (2); i) Mobile correspondents: Financial correspondents who provide their services on behalf of the regulated entity, in a mobile manner, using electronic and/or digital means, connected to the regulated entity via wireless connection with security mechanisms; j) Entity: The subjects obligated to comply with the provisions of these Standards, described in Article 2; k) Electronic and/or digital media: Tools to conduct operations and services, including, but not limited to, automated teller machines or ATMs, electronic kiosks, point of sale terminals or POS, telephony in any modality, and other communication networks; l) Administrative Body: A collegiate body that performs the administration function of the entity; for the purposes of these Standards, it refers to the Board of Directors or Board of Administration, as applicable; m) Risk Profile: The consolidated result of the measurement of the risks to which the entity is exposed; n) Superintendence: Superintendence of the Financial System;

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 37

o) Transactions: Financial services and operations carried out through the financial correspondent; and p) User: Natural or legal person who operates with the Entities or makes use of the services that they provide to the general public, to carry out payment orders, fund transfers, or other operations.

CHAPTER II ON THE NO OBJECTION TO ACT THROUGH FINANCIAL CORRESPONDENTS

Art. 4.- With the aim of facilitating operations and the provision of financial services, the entity may hire a natural or legal person as a physical, digital, or mobile financial correspondent, provided that the legal regime or corporate purpose of this does not prevent it, and the interested party to be a financial correspondent meets the profile established by the entity for these purposes and is not in any of the circumstances established in Article 16 of these Standards. Entities interested in acting through financial correspondents must adopt this decision through an agreement of the Administrative Body of the entity corresponding, all of which must be recorded in minutes.

Request for No Objection Art. 5.- The entity interested in conducting the operations and providing the services specified in Article 31 of these Standards through financial correspondents must submit a request to the Superintendence accompanied by the following: a) Copy of the agreement of the Administrative Body in which it has approved requesting the No Objection to begin operating through financial correspondents; b) Detailed description of the business operational model that must comply at least with what is established in Article 10 of these Standards, with the approval of the Administrative Body of the entity corresponding; and c) Model of financial correspondent contract, which must consider at least what is regulated in Article 11 of these Standards, with the approval of the Administrative Body of the entity corresponding.

Additionally, interested entities must send to the Superintendence a Sworn Declaration signed by the Legal Representative, with its respective notarial authentication, in which they declare that: i. It has been verified that its represented entity complies with the requirements and parameters contained in internal regulations; ii. It has been verified that the content of the contracts to be signed, derived from operations through financial correspondents or Administrators thereof, as applicable, does not contain clauses contrary to current legislation and regulations related thereto; iii. The proper functioning of the computer systems through which its represented entity ensures adherence to sound practices that promote the security of said operations and services and that ensure adequate attention to users has been checked, attaching the verification report referred to in Article 13 of these Standards, the report requested in Article 40 of these Standards, and compliance with what is required in Annexes No. 4 or 5 of these Standards, as applicable to the type of Correspondent involved; and iv. The adequate implementation of controls defined by its represented entity through the corresponding areas, to fulfill the aforementioned purposes, has been verified. In the content of said Declaration, the grantor must declare the truthfulness of what is expressed, and that they are aware of the realization of the management for the good implementation, adaptation, and compliance with the requirements imposed on their represented entity, for the purpose of obtaining the No Objection from the Superintendence to operate through financial correspondents or Administrators thereof, as the case may be. The request and documentation may be submitted through the means made available by the Superintendence, which may be electronic. In any case, the period referred to in the first paragraph of Article 6 of these Standards will begin to run from the next business day after the request has been submitted. Procedure for Requesting No Objection Art. 6.- Upon receipt of the No Objection request, in accordance with what is established in Article 5 of these Standards, the Superintendence will proceed to analyze it, and the Superintendent will communicate the No Objection to the request or object to it, within a maximum period of thirty business days. If this period expires and the Superintendence does not rule, it will be understood that the resolution of the No Objection is favorable for the entity. If the request is not accompanied by complete and duly formatted information as detailed in Article 5 of these Standards, the Superintendence may require the requesting entity to present the missing documents within a period of ten business days counted from the day following notification, a period that may be extended at the request of the interested parties when there are reasons justifying it. The Superintendence in the same notice will indicate to the requesting entity that, if it does not complete the information within the aforementioned period, it will proceed without further procedure to archive the request, reserving its right to submit a new request.

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 5 of 37

If after analyzing the documentation presented in accordance with Article 5 of these Standards, the Superintendence has observations or when the documentation or information presented is not sufficient to establish the facts or information intended to be accredited, the Superintendence may notify the requesting entity to remedy the deficiencies communicated or present additional documentation or information requested. The requesting entity will have a maximum period of ten business days counted from the day following notification, to resolve the observations or present the additional information required by the Superintendence. The Superintendence may, through a reasoned resolution, extend by up to another ten business days, the period indicated in the previous paragraph, when the nature of the observations or deficiencies notified so requires.

Extension Period Art. 7.- The entity may submit to the Superintendence a request for extension of the periods indicated in the second and fifth paragraphs of Article 6 of these Standards, before the expiration of said period, stating the grounds for the request and proposing, if applicable, the relevant proof. The extension period may not exceed ten business days and will begin from the next business day after the expiration date of the original period. Suspension of Period Art. 8.- The thirty business day period indicated in the first paragraph of Article 6 of these Standards will be suspended for the days that elapse between the notification of the request for information or documentation referred to in the second and fifth paragraphs of said article, until the entity remedies the observations required by the Superintendence. On the Resolution Art. 9.- Once the required documents have been presented in due form, the Superintendence will proceed to respond to the No Objection request.

Once the No Objection is issued to conduct operations and provide services through financial correspondents, the entity will be responsible for ensuring compliance with these Standards and the regulatory framework applicable to financial correspondents, for their proper functioning.

Business Operational Model Art. 10.- For the purposes of the No Objection, the business operational model presented by entities interested in conducting operations and providing services through financial correspondents must contain at least the following: a) Description of the transaction and operation recording system; b) Description of the management of risks associated with the provision of services or the conduct of operations, especially financial and operational risks, which include technological risks, legal risks, those related to money laundering and asset financing, terrorism financing, and financing for the proliferation of weapons of mass destruction, and reputational risk; c) Type of operations and services to be provided, in accordance with those established in Article 31 of these Standards, as applicable; d) Description of maximum amount limits per operation, the medium to be used to conduct the transaction, and the number of transactions that clients can perform through financial correspondents, indicating the periodicity of these, taking into account the expected business volume, location of establishments in the case of physical correspondents, and risk associated with the type of operation involved. For the case of electronic money records and savings accounts with simplified requirements, the maximum balance limits, maximum amount per transaction, and accumulated transactions in a month will be those established by the Norms Committee of the Central Bank, and must be incorporated into the model; (2) e) Internal Policies containing at least: types of business, entities or persons to be linked as Correspondent and those that cannot be considered, size and track record of the business, infrastructure and security of the establishment and geographic environment, the latter for the case of physical correspondents, among others, that guarantee adequate attention to the financial user; f) Description of mechanisms for identification, attention, and knowledge of clients and users in financial correspondents, including matters related to resource allocation; g) Detail of the frequency of on-site verification of compliance by financial correspondents with all their obligations, in accordance with the established risk profile and early alerts defined in monitoring, taking into account their risk management policies established for this type of business; and h) For the case of mobile financial correspondents, a detailed description of the security and safeguarding mechanisms to be implemented for documentation and values. Financial Correspondent Contract Art. 11.- The Financial Correspondent Contract that authorizes financial correspondents to conduct operations and provide services on behalf of and under the responsibility of the contracting entity must contain, at least the following: a) The express indication that the financial correspondent acts before the client or user, on behalf of and under the responsibility of the entity, with the entity being responsible for verifying compliance with the content of these Standards;

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 6 of 37

b) The provisions that the parties establish regarding the administration of the financial correspondent's cash, and the way to cover the risks of cash handling; c) The measures that the entity will require and implement in the financial correspondent for the prevention of money laundering and asset financing, terrorism financing, and financing for the proliferation of weapons of mass destruction; d) The measures that the entity will require and implement in the financial correspondent for the adequate management of information security, in the case of digital correspondents; e) The obligation of financial correspondents to apply and execute mechanisms for the identification, attention, and knowledge of clients and users; f) The obligations of the financial correspondent to deliver to clients the receipt of the transaction performed, either physically or electronically; as well as to maintain reserve and confidentiality regarding the information to which they have access regarding the client; g) The economic obligations between the contracting parties; h) The public service hours of the financial correspondent; i) The obligation of the entity to train the financial correspondent or establish training mechanisms so that it performs the operations and provides the agreed services adequately, and to guarantee that training is maintained during the execution of the contract, when any changes occur in it or in the operational guidelines; j) The security measures and the availability of human and/or technological resources that the financial correspondent must establish to conduct operations and provide services; k) Operations for which the financial correspondent is authorized; l) Contract term; m) Clauses for suspension and termination of the conduct of operations and provision of services through the financial correspondent, as well as their legal consequences; and n) Responsibilities and prohibitions of the financial correspondent

CNBCR-08/2022 NASF-11 TECHNICAL STANDARDS FOR CONDUCTING OPERATIONS AND PROVIDING SERVICES THROUGH PHYSICAL, DIGITAL, AND MOBILE FINANCIAL CORRESPONDENTS, AND OF FINANCIAL CORRESPONDENT ADMINISTRATORS Approval: 09/23/2022 Validity: 10/10/2022 Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 7 of 37

o) The obligation of the entity to monitor the activities of the financial correspondent; p) The obligation of the financial correspondent to report to the entity any irregularities or incidents that occur in the performance of their functions; q) The obligation of the entity to provide the financial correspondent with the necessary tools and resources to perform their functions; r) The obligation of the financial correspondent to comply with the instructions and guidelines issued by the entity; s) The obligation of the entity to provide the financial correspondent with the necessary training and support; t) The obligation of the financial correspondent to maintain the confidentiality of the information obtained in the performance of their functions; u) The obligation of the entity to provide the financial correspondent with the necessary security measures; v) The obligation of the financial correspondent to comply with the security measures established by the entity; w) The obligation of the entity to provide the financial correspondent with the necessary technological support; x) The obligation of the financial correspondent to comply with the technological standards established by the entity; y) The obligation of the entity to provide the financial correspondent with the necessary legal support; z) The obligation of the financial correspondent to comply with the legal standards established by the entity.

CHAPTER III ON THE ADMINISTRATORS OF FINANCIAL CORRESPONDENTS

Art. 12.- The administrators of financial correspondents are legal entities that affiliate and administer natural or legal persons who act as financial correspondents. They must comply with the requirements established in these Standards and the regulatory framework applicable to them.

Art. 13.- The administrators of financial correspondents must have a risk profile that allows them to adequately manage the risks associated with the activities of the financial correspondents they administer.

Art. 14.- The administrators of financial correspondents must have internal policies that include, at least, the following: a) Procedures for the affiliation and administration of financial correspondents; b) Procedures for the monitoring and supervision of the activities of the financial correspondents; c) Procedures for the management of risks associated with the activities of the financial correspondents; d) Procedures for the prevention of money laundering and asset financing, terrorism financing, and financing for the proliferation of weapons of mass destruction; e) Procedures for the protection of personal data and confidentiality of information.

Art. 15.- The administrators of financial correspondents must submit to the Superintendence a request for No Objection, accompanied by the documentation required in Article 5 of these Standards.

Art. 16.- The administrators of financial correspondents must comply with the obligations established in these Standards and the regulatory framework applicable to them.

CHAPTER IV ON THE PROHIBITIONS AND RESPONSIBILITIES OF FINANCIAL CORRESPONDENTS

Art. 17.- Financial correspondents are prohibited from: a) Conducting operations or providing services that are not authorized by the entity; b) Disclosing confidential information obtained in the performance of their functions; c) Using the funds of the entity for purposes other than those authorized; d) Conducting operations or providing services that are not in accordance with the instructions and guidelines issued by the entity; e) Conducting operations or providing services that are not in accordance with the security measures established by the entity.

Art. 18.- Financial correspondents are responsible for: a) Complying with the instructions and guidelines issued by the entity; b) Complying with the security measures established by the entity; c) Complying with the legal standards established by the entity; d) Reporting to the entity any irregularities or incidents that occur in the performance of their functions.

CHAPTER V FINAL PROVISIONS

Art. 19.- These Standards will enter into force on the date of their publication in the Official Gazette.

Art. 20.- The Superintendence of the Financial System is responsible for the interpretation and application of these Standards.

Art. 21.- These Standards may be modified or repealed by the Norms Committee of the Central Reserve Bank of El Salvador.

Art. 22.- These Standards are issued in San Salvador, on September 23, 2022.

[End of Document]