Technical Standards for Corporate Governance (NRP-17)

NRP-17
Validity: 02/05/2019
THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:
I. That Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System establishes that the proper functioning of the Financial Supervision and Regulation System requires, from the members of the financial system and other supervised entities, compliance with current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with the provisions of the aforementioned Law, other applicable laws, regulations, and technical standards issued for such effect.

II. That according to Article 3, first paragraph and letter i), of the Law on Supervision and Regulation of the Financial System, the Superintendency of the Financial System is responsible for supervising the individual and consolidated activity of the members of the financial system and other persons, operations, or entities mandated by the laws, and for such purposes, it is incumbent upon it to require that supervised entities and institutions be managed and controlled in accordance with international best practices referred to corporate governance management, as well as the technical standards issued.

III. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendency of the Financial System.

IV. That Article 35, letter k), of the Law on Supervision and Regulation of the Financial System stipulates that directors, managers, and other officials holding positions of direction or administration of the members of the financial system must adopt and implement corporate governance standards in the management, direction, and control of their operations.

V. That Article 99, letter a), of the Law on Supervision and Regulation of the Financial System establishes that it corresponds to the Central Bank of Reserve of El Salvador, in its capacity as regulator, to approve technical standards, which the laws regulating the supervised entities establish must be issued to facilitate their application, especially regarding good corporate governance practices.

VI. That international experience has shown that the application of good corporate governance practices strengthens proper administration, contributes crucially to achieving the entities' objectives, reduces the existence of conflicts among stakeholders, mitigates risks related to the entity's administration, improves the capacity for decision-making and risk classification of the entities, promoting security and confidence in financial markets.

NRP-17
Validity: 02/05/2019
THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following:
TECHNICAL STANDARDS FOR CORPORATE GOVERNANCE

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- These Standards aim to establish regulations regarding the corporate governance bodies of the entities subject to their application; as well as the policies and procedures that must be issued, in order to ensure the adoption of sound corporate governance practices and the adoption of an adequate framework of transparency and protection of the interests of the entity's shareholders and clients, in accordance with applicable laws and international best practices in the matter, consistent with the nature and scale of their activities. Each entity will design, implement, and evaluate its corporate governance framework, considering the laws applicable to it, the size, ownership structure, and legal nature of the entity, as well as the scope and complexity of its operations, corporate strategy, the risk profile the entity is willing to assume, and the potential impact of its operations on third parties.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Specialized Agents in Securities Valuation; b) General Warehouses for Deposit; c) Development Bank of the Republic of El Salvador, insofar as it does not contradict its Creation Law; (1) d) Agricultural Development Bank, insofar as it does not contradict its Creation Law; e) Mortgage Bank of El Salvador, S.A.; f) Banks constituted in El Salvador and their subsidiaries abroad; g) Cooperative Banks, Savings and Credit Societies, and Federations regulated by the Law on Cooperative Banks and Savings and Credit Societies, insofar as pertinent; h) Investment Banks and their subsidiaries abroad; (3) i) Product and Services Exchanges; (3) j) Securities Exchanges; (3) k) Brokerage Houses; (3)

NRP-17
Validity: 02/05/2019 l) Social Housing Fund and National Popular Housing Fund, insofar as it does not contradict their Creation Laws; (3) m) Investment Fund Managers; (3) n) Institutions Administrating Pension Funds; (3) o) Social Insurance Institute of the Armed Forces, insofar as it does not contradict its Creation Law; (3) p) Risk Rating Societies; (3) q) Insurance Companies constituted in the country and Cooperative Insurance Associations constituted in the country, insofar as it does not contradict their respective Law; (3) r) Specialized Societies in the Deposit and Custody of Securities; (3) s) Electronic Money Provider Societies; (3) t) Branches of Foreign Banks established in the country, insofar as pertinent; (3) u) Branches of Foreign Insurance Companies established in the country, insofar as pertinent; (3) v) Securitization Companies; (3) w) Legal persons that carry out money sending or receiving operations systematically or substantially, by any means, at the national and international level. It will be understood that money sending or receiving operations are carried out systematically or substantially when such activity is carried out habitually or constitutes an important activity within the entity's business operations; (1) (3) x) Reciprocal Guarantee Societies and their local guarantors; (1) (3) y) Administrating or Operating Societies of Payment and Securities Settlement Systems; (1) (3) z) Foreign Currency Exchange Houses; and (1) (3) aa) Societies that offer complementary services to the financial services of the members of the financial system, particularly those in which they participate as investors. (1) (3) Those entities that administer third-party funds must establish adequate segregation of functions and responsibilities that allow them to properly manage conflicts of interest in the administration of such funds. The entities listed in letters n) and r) of this article are responsible for demonstrating to the Superintendency of the Financial System the effectiveness of their corporate governance framework and indicating the aspects that, due to their own characteristics and nature, are not applicable to them, with due justifications.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Shareholder: owners of the shares of the subjects obligated to the application of these Standards; the term will also serve to refer to the associates of the Cooperative Associations subject to the application of these Standards;

NRP-17
Validity: 02/05/2019 b) Senior Management: the Executive President, Executive Director, General Manager, or acting person, and the executive positions that report to them. For the case of the Development Bank of the Republic of El Salvador, the President; (1) c) Cooperative Association: those governed administratively by the General Law of Cooperative Associations and its Regulations; d) Central Bank: Central Bank of Reserve of El Salvador; e) Investment Bank: In accordance with Article 3, first paragraph, of the Law on Investment Banks, these are institutions that act habitually in the financial market, being able to carry out operations and provide services exclusively with Sophisticated Investors, according to the active, passive, and investment operations established in this Law on Investment Banks or those duly authorized by the Central Bank within its competence; (3) f) Client: natural or legal person who maintains a contractual relationship with the entity for the provision of financial services or products that it offers, which in these Standards may refer to: depositors, investors, contributors, affiliates, pensioners, insured, debtors, co-debtors, contributors, or participants, among others; (3) g) Code of Ethics or Conduct: document that must contain the system or set of behavioral values, policies, and mechanisms for compliance that an entity establishes through the adoption of ethical and moral guidelines applicable to the administration of the Board of Directors, Senior Management, and generally to all members of the organization; (3) h) Corporate Governance Code: document that must contain the entity's philosophy as its vision, mission, values, practices, and policies adopted in matters of Good Governance to conduct the entity, especially regarding the functions and responsibilities of shareholders, Board of Directors, Senior Management, and other control bodies or organs, while also developing the management of relationships with entities or persons interested in the good performance of the entity; (3) i) Support Committees: committees composed of members of the Board of Directors, Board of Trustees, or Boards of Administration and executive personnel; (3) j) Board of Directors Committees: committees composed exclusively of members of the Board of Directors, Board of Trustees, or Boards of Administration; (3) k) Conflict of Interest: any situation in which it may be perceived that a personal benefit or interest of a third party may influence the professional judgment or decision of an entity member regarding the fulfillment of their obligations; (3) l) Financial Conglomerate: in accordance with Article 113 of the Banking Law, it is the set of societies characterized by the fact that more than fifty percent of their respective share capital is owned by a controlling society, which is also a member of the conglomerate. The controlling society of the conglomerate may be a society of exclusive purpose or a bank constituted in the
country; (3)

NRP-17
Validity: 02/05/2019 m) Executive Director: that which exercises the highest administrative authority within the entity, and who may also be part of the Board of Directors; frequently referred to as Executive President, General Manager, or acting person; (1) (3) n) External Director: that which is not an employee nor holds an executive position in the entity; (3) o) Employees: Personnel who provide their services with direct subordination or labor dependence in the entity; (2) (3) p) Entity: subject obligated to comply with these Standards; (2) (3) q) Corporate governance: is the system by which entities are managed and controlled; its structure must establish the powers and obligations of those participating in its administration, supervision, and control, such as the General Meeting of Shareholders or its equivalent, the Board of Directors, members of Senior Management, Committees, and Control Units; likewise, it must provide an adequate framework of transparency of the organization and the protection of the interests of the entity's clients; (2) (3) r) Stakeholder Group: are persons or groups of persons who pursue objectives different from the purposes of the owners and administrators, but are affected or may be affected by the decisions and activities of the entity. Stakeholder groups are considered to be the entity's employees, holders of negotiable securities, regulatory, control, and oversight bodies, competitors, suppliers, creditors, and other groups that have various relationships with the entity; (2) (3) s) Business Group: in accordance with Article 5 of the Securities Market Law, it is that in which a society or set of societies has a common controller, who acting directly or indirectly participates with at least fifty percent in the share capital of each of them or that have common shareholders who, directly or indirectly, are holders of at least fifty percent of the capital of another society, which allows presuming that the economic and financial performance is determined by common interests or subordinate to the group; (2) (3) t) Departments: Positions within the entity that have an area or functional unit under their direction and responsibility; (2) (3) u) Supervisory Board: body that exercises in Cooperative Associations the supervision of all activities of the entity and oversees the acts of the administrative bodies as well as those of the employees. For the case of the Social Housing Fund, it refers to the Supervisory Council; (2) (3) v) Board of Directors: collegial body or equivalent body responsible for the administration of the entity, with functions of supervision, direction, and control; for the case of Cooperative Associations, it will be the Board of Administration or as defined in its Creation Law; (2) (3) w) Social Pact: constitutive and organizational instrument of the entity; in the case of Cooperative Associations, it will refer to the Statutes; (2) (3) x) Cooperative Society: Cooperative Banks governed by the
Code of Commerce and the Law on Cooperative Banks and Savings and Credit Societies; and (2)

NRP-17
Validity: 02/05/2019
(3) y) Superintendency: Superintendency of the Financial System. (2) (3)

CHAPTER II
ON SHAREHOLDERS

On the General Meeting of Shareholders
Art. 4.- The General Meeting of Shareholders or its equivalent is the highest authority of the entity. The Social Pact or Statutes must recognize this attribution as well as its fundamental functions and powers to adopt any kind of agreements regarding its governance and in general, all measures that require the fulfillment of the Social Pact and the common interest of the shareholders. This term will also serve to refer to the General Assemblies of Associates of the Cooperative Associations subject to these Standards. In the case of entities created by Law, the provisions thereof shall be observed. In addition to the functions recognized in applicable laws, the Social Pact or Statutes must be submitted for approval by the aforementioned Meeting for operations that imply, in particular, the following:
a) Any corporate operation that implies the forced modification of shareholders' participation in the entity's capital; b) The acquisition or disposal of assets or liabilities that limit or prevent the normal development of the entity's main activity; c) When it implies a modification of the social object, Social Pact, Statutes, or generates effects equivalent to a structural modification of the entity; and d) Operations whose effects lead to the liquidation of the entity. Shareholders may make recommendations on the corporate governance of the entity. For the application of this article, in the case of entities created by Law, they must observe what is established in said laws.

Shareholder Responsibility
Art. 5.- It is the responsibility of shareholders to diligently elect the Directors who will integrate the Board of Directors, ensuring that they meet the requirements of suitability and availability to direct the entity with honesty and efficiency, in accordance with what is established in the regulatory framework and in Article 11 of these Standards. In addition, shareholders must know their rights, requirements, and disqualifications contained in the Social Pact, Statutes, laws, and norms, in order to comply with them when required.

Convening the General Meeting of Shareholders
Art. 6.- The General Meetings of Shareholders held by entities will be subject to the provisions and procedures contemplated in the Social Pact or Statutes of the Society, the legal or regulatory provisions that regulate them, and in default, what the Code of Commerce and Common Law regulate. (1) Without prejudice to the holding of General Meetings in which all shareholders or representatives of all shares in which the social capital is divided are present, the call to the General Meeting of Shareholders must include, in addition to the minimum content contemplated in applicable laws, the place and the manner in which shareholders can access the documentation and information related to the points considered in the agenda. In accordance with what is provided in Article 236 of the Code of Commerce, the books and documents related to the purposes of the General Meeting of Shareholders will be available to shareholders at the entity's office or in other means that facilitate their consultation, from the publication of the call so that they can learn about them. Entities that do not meet half plus one of the shares in the first call to the General Meeting of Shareholders must make efforts to increase attendance, using means additional to those provided in applicable laws, to hold it in a second call and, when announcing and holding it in a third call, if applicable. The foregoing will not apply in the case provided for in Article 233 of the Code of Commerce and for Cooperative Associations, what is established in the General Law of Cooperative Associations will apply.

Agenda of the General Meeting of Shareholders
Art. 7.- The points to be addressed in the agenda of the General Meeting of Shareholders must be clear, precise, and appear expressly, in such a way that each topic is discussed separately, facilitating its analysis and thereby avoiding the joint voting of topics that must be resolved individually. Any other point may be included in the agenda when all shares are represented and so agreed upon unanimously. In the case of Cooperative Associations, any point agreed upon by the attending associates at the time of approving the agenda may be discussed in the General Assembly.

Shareholder's Right to Information
Art. 8.- In accordance with Article 245 of the Code of Commerce, shareholders have the right to request information or clarification from Senior Management on the points included in the agenda before or during the holding of the session.
The Board of Directors must ensure that the information is made available to the shareholder in writing before or at the latest on the day of the holding of the General Meeting of Shareholders or access to it by any technological means that allows confidentiality.

CHAPTER III
ON THE BOARD OF DIRECTORS

Mission of the Board of Directors
Art. 9.- The Board of Directors or its equivalent must ensure the strategic direction of the entity, good corporate governance, and the monitoring and control of management delegated to Senior Management. The Board of Directors will establish the organizational structure, adequate segregation of functions, and policies that allow the entity to balance profitability and risk management, which promote its stability and ensure proper attention to the clients of the products and services offered. (2) In their relations with stakeholder groups, members of the Board of Directors must ensure that the entity acts in accordance with applicable laws and regulations, must fulfill their obligations in good faith, and make decisions with independent judgments, observing those additional principles of social and environmental responsibility that they had previously accepted. They must especially ensure:
a) Protecting the rights and interests of clients in general; b) Protecting the rights and interests of shareholders and establishing mechanisms for their equitable treatment; c) Developing a communication and information policy with shareholders and clients in general; and d) Performing their functions prioritizing the interest of the entity and with independent criteria. For the application of this article, in the case of entities created by Law, they must observe what is established in said laws.

Composition
Art. 10.- The Board of Directors will be composed of the number of members established in the Social Pact or Statutes within the margins fixed therein, always respecting the minimum number of members established in applicable laws.
In order to strengthen the general supervision function, the Board of Directors of entities may only have one Executive Director.
The mechanism for replacement due to resignations and temporary or definitive absences, as well as the mechanism to cover vacancies of Directors, must be established in the Social Pact or Statutes.
For the application of this article, in the case of entities created by Law, they must observe what is established in said laws.

Suitability

NRP-17
Vigencia: 02/05/2019

Art. 11.- The entity must establish the profile of the members of the Board of Directors, considering the following: prohibitions, requirements, and disqualifications established by the applicable legal framework and the requirements contained in the Social Pact or Bylaws, the latter when applicable.

Likewise, the entity must establish in the Corporate Governance Code the requirements related to good reputation, professional competence, objectivity, experience related to risk management, finance, and availability of time to exercise their functions.

Furthermore, entities must establish the mechanisms and means of control to accredit compliance with the prior requirements for their appointment and during the exercise of their functions.

Without prejudice to the composition of the Board of Directors established in their respective Social Pacts or Bylaws, the principal and alternate members of the Board of Directors must have the status of External Directors. Notwithstanding the foregoing, the Chief Executive Officer or the person exercising the highest authority in the entity may be a member of the Board of Directors. Likewise, at least one of the External Directors must meet at minimum the following conditions:
a) Not having or having had during the last two years a direct employment relationship with the entity, with the members of its Board of Directors, with the parent company or central office, or companies linked to the Business Group or Financial Conglomerate; b) Not having direct or indirect share ownership in the entity; and c) Not being a spouse, cohabitant, or having kinship within the second degree of consanguinity and first degree of affinity with other members of the Board of Directors.

For the case of Cooperative Banks, Savings and Credit Societies, and Cooperative Associations, as established by the Law of Cooperative Banks and Savings and Credit Societies and the General Law of Cooperative Associations, the condition stated in literal b) of this article is not applicable for the category of External Director.

Employees of Cooperative Banks and Savings and Credit Societies may not apply for executive positions in the respective entity where they work; therefore, the category of Executive Director is not applicable as established by Article 15 of the Law of Cooperative Banks and Savings and Credit Societies.

In the case of Federations, the category of External Director does not apply; the President and their alternate must not hold executive or Director positions in the cooperative system to which the federation belongs.

The Board of Directors must have a procedure or mechanism for the induction of each new member, which aims to facilitate the process of knowledge and understanding of the current legal framework and the most relevant items of the financial statements of the last year. (2)

In the case of entities created by Law, for the application of this article, they must consider what is established in their Law.

Responsibilities of the Board of Directors

Art. 12.- The Board of Directors must supervise and control that Senior Management complies with the objectives established by the Board, respects the strategic guidelines, the approved risk levels, and maintains the general interest of the entity.

Even considering the duties expressly ordered by laws and other regulations and, where applicable, their respective creation laws, the Board of Directors must:
a) Approve the entity's strategic plan and annual budget, when applicable; b) Approve, instruct, and verify that the Corporate Governance Code is disseminated within the entity, which must comply with what is established in Article 13 of these Standards; (2) c) Approve at minimum the following policies:
i. Risk management policy;
ii. Related-party transactions policy;
iii. Remuneration and performance evaluation policy. In case of variable remuneration, it must consider that it is granted based on medium and long-term management results; and
iv. Policy for the development of procedures and internal control systems.
d) Appoint, remunerate, and dismiss the Executive Director or General Manager of the entity, as well as their indemnification clauses, considering the policy established regarding this matter. When applicable; e) Ratify the appointment, remuneration, and dismissal of the other members of the entity's Senior Management, as well as their indemnification clauses, when applicable; f) Appoint the members of the Internal Audit Committee and other Support Committees, necessary for the efficient fulfillment of the objectives assigned to said Committees, when applicable; (2) g) Present to the General Shareholders' Meeting or General Partners' Assembly the proposals for remuneration and benefits of its members, when they have not been fixed in the Social Pact or Bylaws; h) Review the reports submitted by Support Committees, Board of Directors Committees, and internal and external audits, when applicable, and take the decisions considered appropriate; i) Approve the organization and functions manual of the entity, defining clear lines of responsibility; j) Ensure the integrity and updating of accounting and financial information systems, guaranteeing the adequacy of these systems to the laws and applicable standards; k) Present to the General Shareholders' Meeting or General Partners' Assembly each of the members of the Board of Directors proposed for election or ratification; l) Ensure that external audit complies with the legal requirements regarding independence and define a policy for the periodic rotation of the audit, considering the respective applicable laws; m) Approve policies on ethical conduct standards, which may be gathered in a Code of Ethics or Code of Conduct, which must contain at minimum what relates to confidentiality, reserve, and the use of privileged information, general and specific conduct norms, market manipulation, information disclosure, disclosure of the code of ethics, management of delegations and segregation of functions, management and control of conflicts of interest in the approval of transactions affecting the entity, Group, or Financial Conglomerate, management of relationships with third parties, and responsibilities for their compliance. These must include any total or partial updates or modifications that are necessary; n) Periodically evaluate their own corporate governance practices regarding the best standards in the matter, identifying gaps and opportunities for improvement in order to update them; o) Train at least once a year on topics related to corporate governance, considering the best practices in this regard; p) Ensure that the corporate governance culture reaches all levels of the entity; and q) Ensure that a structure is established that promotes transparency and reliability in the provision and access to information in accordance with what is established in Article 27 of these Standards.

The aforementioned powers may only be delegated to Board of Directors Committees or Support Committees, for which the respective Social Pacts or Bylaws must authorize it. The designation and fulfillment of these powers must be evidenced in the agreements taken by the Board of Directors, and the supporting documentation must be available to the Superintendence when requested.

If the Social Pact or Bylaws authorizes it, the Board of Directors may delegate its administrative and representation powers to one of the Directors or to commissions designated from among its members, who must adhere to the instructions they receive and periodically report on their management within the timeframes established for such purpose.

When a new Board of Directors takes office, the delegated powers must be ratified.

Any modification made to the documentation described in the aforementioned literals must be known to the Superintendence by the entity within a period not exceeding ten business days after approval.

The policy for the management and control of conflicts of interest, referred to in literal m) of this article, must contain at minimum what is established in Article 14 of these Standards.

Corporate Governance Code

Art. 13.- The Corporate Governance Code must contain, at minimum, the policies related to the compliance with principles, rules, and standards in the handling of business that establish to achieve corporate objectives; in particular, policies and practices relative to the following must be developed:
a) Policies on shareholder relations, which must have the objective of ensuring equitable treatment and transparent access to information about the entity. Such policies must contain guidelines for access to the entity's information and shareholder participation and the administration of conflicts of interest in the approval of transactions affecting the entity, Group, or Financial Conglomerate; b) Responsibilities of the administrative bodies; c) Mechanisms for the election and substitution of the members of Senior Management; and d) In the specific case of Risk Rating Agencies, the Corporate Governance Code must incorporate the establishment of independence norms, with respect to the issuing companies.

Likewise, it must broadly describe the composition of the Board of Directors, the Supervisory Board, or equivalent body, if applicable, its functioning in accordance with the applicable laws and what is established in the Social Pact or Bylaws. Establishing in the same Code, requirements related to good reputation, professional competence, objectivity, and experience in risk management or finance for the members of the Board of Directors.

It must also detail the minimum general principles and guidelines for the adoption and implementation of corporate governance practices contained in these Standards, as well as those that each entity voluntarily decides to include and the mechanisms to verify compliance.

In no case may the Corporate Governance Code contradict the obligations contained in the applicable legal framework.

Policy for the management of conflicts of interest

Art. 14.- In the Code of Ethics or Code of Conduct, in addition to what is established in Article 12, literal m), the policy for the management of conflicts of interest must be developed, which must stipulate the mechanisms that allow preventing, identifying, managing, mitigating, informing, and registering conflicts of interest that may arise between the members of the Board of Directors, Senior Management, representatives, Directors, and other employees of the entity and stakeholder groups.

In these policies, it must be established:
a) Scope of application; b) Identification of possible conflicts of interest in which persons included in the scope of application may incur, derived from their functions; and c) The control and management mechanisms for conflicts of interest.

Senior Management must prepare a report on the compliance with the policies for the Management and Control of conflicts of interest and related-party transactions, which will form part of the Annual Corporate Governance Report.

The entity will maintain an updated record, which may be centralized or decentralized, of the cases of conflicts of interest that arise in the entity. In the record, the following information must be clearly and consecutively numbered: (2) a) The identity of the persons who have been exposed to the conflict of interest; b) The department or areas involved in the conflict of interest; c) Date on which the conflict originated; d) Reason for the appearance of the conflict and detailed description of the situation; e) Documents proving the conflict, when applicable; f) Financial instruments or services to which the conflict refers, when applicable; g) Description of the management, minimization, or, where applicable, remediation process of the situation; h) Date of remediation of conflicts of interest; and i) Estimation of damages or harm caused to clients, when applicable.

The record must be available for review by the Superintendence at any time it requests.

Right to Information of Directors

Art. 15.- For the exercise of their functions, the members of the Board of Directors will have access to complete, timely, and truthful information about the situation of the entity and its environment, so that in the Social Pact or the Corporate Governance Code of the same, the right to information of the Directors must be recognized, which authorizes them to request additional information on matters of the entity. Additionally, the members of the Board of Directors must obtain and have access to information about the points to be discussed in each session, at least one day in advance. When all members of the Board of Directors agree, urgent points not previously informed may be discussed, which must be recorded in the minutes.

NRP-17
Vigencia: 02/05/2019

CHAPTER IV
FUNCTIONING OF THE BOARD OF DIRECTORS OR EQUIVALENT BODY

Call and frequency

Art. 16.- The Board of Directors will be called by its President, the Secretary, or when at least two principal Directors request it; when so established by its Social Pact or Bylaws.

The Board of Directors must meet with the frequency necessary to perform its functions effectively, for which a frequency of at least once every three months is recommended. Meetings may also be held via videoconferences; however, the agreements and resolutions taken must be documented in accordance with what is stated in the Commercial Code.

The minutes of the sessions held by the Board of Directors or equivalent body must be drafted clearly and in detail to understand the basis of the agreements taken and the topics known, implementing a sequential numbering system for the minutes of the Board of Directors meetings.

Rotation or permanence policy

Art. 17.- Entities must establish rotation or permanence policies for the members of the Support Committees, the Board of Directors Committees, and the Board of Directors, in the latter case, the policy must consider what is established in the Social Pact or its Creation Law, when applicable.

Grounds for removal

Art. 18.- The Social Pact, the Creation Law, or the Bylaws of the entity, without prejudice to what is established in the applicable legal framework, may define the procedure and grounds for removal applicable. Considering among them, actions that go against the image of the entity.

Of Senior Management

Art. 19.- Senior Management must carry out its functions in accordance with what is established in the Corporate Governance Code; likewise, it is responsible for the implementation of the policies and internal controls approved by the Board of Directors and for ensuring their execution and reporting to the Board at least annually.

The members of Senior Management who generate financial data, as well as the Board of Directors, are responsible for ensuring that the financial information reflects the true financial situation of the entity, for which they must establish the necessary internal control systems to obtain reliable financial information.

CHAPTER V

NRP-17
Vigencia: 02/05/2019

OF THE BOARD OF DIRECTORS COMMITTEES AND SUPPORT COMMITTEES

Establishment of Committees

Art. 20.- For the adequate exercise of the supervision and control function, the Board of Directors may constitute the Board of Directors Committees and Support Committees it deems appropriate, establishing the form of integration, their functioning, and powers, incorporating them into the Corporate Governance Code. Notwithstanding the foregoing, for the proper functioning of the entity's internal control and risk management, the Board of Directors must constitute an Audit Committee and a Risk Committee, whose competencies and powers will be determined in the Corporate Governance Code, what is established in these Standards, and the provisions of the Standards regarding risk management that the Central Bank issues through its Standards Committee for such effects.

Minutes must be drawn up from the sessions held by the Committees and be available to the members of the Board of Directors. The minutes must be drafted clearly and in detail to understand the basis of the agreements taken and the topics known, implementing a sequential numbering system for the minutes of the meetings.

A summary of the most important aspects on which each Board of Directors Committee and Support Committee has reviewed and decided must be recorded in the minutes of the session held by the Board of Directors in the following semester. Likewise, the dates on which the corresponding reports have been presented and the agreements taken by the Board of Directors must be included. If there are relevant facts that the Board must know, these must be presented by the aforementioned Committees in the next session held by the Board of Directors.

Committee sessions may be carried out via videoconferences through different technological means that allow the identification and participation of the member in the session; however, the agreements and resolutions taken must be documented, in accordance with what is established in the second paragraph of this article.

Audit Committee

Art. 21.- The Board of Directors must form an Audit Committee, as a support body for the control and monitoring of the policies, procedures, and controls established, and at least two External Directors must be part of said Committee, where applicable. The Board of Directors must ensure the management of conflicts of interest, objectivity, and independence of criteria in the composition of said Committee.

The members of the Audit Committee must have experience in audit or finance.

Likewise, the Board of Directors, in the appointment of the members of the Audit Committee, must value that they have the availability of time to participate in the sessions and fulfill the responsibilities established for the said Committee.

For the case of Federations, the composition of the Audit Committee will be in accordance with what is provided in the Law of Cooperative Banks and Savings and Credit Societies.

For the case of banks, the composition of the Audit Committee must comply with what is established in the Law of Banks.

Investment Banks will form an Audit Committee in accordance with what is Regulated in the Law of Supervision and Regulation of the Financial System and the Technical Standards of Internal Audit for the Members of the Financial System (NRP-15). (3)

In the case of branches of Foreign Banks and branches of Foreign Insurance Companies established in the country, the Audit Committee will be constituted by its Representative or acting representative, a high-level executive manager, and the Internal Auditor or acting representative. (3)

For the case of Cooperative Associations, the Supervisory Board may assume the role of the Audit Committee, provided that the Internal Auditor is integrated into it as an additional member beyond what is required by the applicable laws, and the rest of the members meet the requirements for External Directors contemplated in these Standards and applicable laws. (3)

Functioning of the Audit Committee

Art. 22.- The Audit Committee will meet at least once every three months. The Committee must meet with the majority of its members.

When any member of the Committee has a personal interest in any matter to be discussed in the Committee, they must excuse themselves from knowing it with a motivated expression of cause and in writing, before the Committee.

The members of the Committee who have knowledge of any potential conflict of interest of any of the other members must manifest it so that it is deliberated whether the withdrawal of the member from the session is appropriate. Such deliberation will be recorded in the minutes of the said Session.

Responsibilities of the Audit Committee

Art. 23.- The Audit Committee will have the following responsibilities:
a) Ensure compliance with the agreements of the General Shareholders' Meeting, or its equivalent depending on the entity in question, the Board of Directors or its equivalent, and the provisions of the Superintendence, the Central Bank, and other public institutions when applicable;

NRP-17
Vigencia: 02/05/2019

NRP-17
Vigencia: 02/05/2019

b) Follow up on observations made in the reports of the Internal Auditor, the External Auditor, the Superintendence, and other public institutions, to correct them or contribute to their resolution, which must be reported promptly to the Superintendence; c) Regularly inform the Board of Directors about the follow-up on the observations from the reports listed in letter b) of this article; d) Collaborate in the design and application of the internal control framework by proposing appropriate corrective measures; (2) e) Supervise compliance with the external audit contract, monitoring the response process to the observations included by the External Auditor in their Management Letter; f) Provide opinions to the Board of Directors on:
i. Any difference of criteria between management and the External Auditors regarding accounting policies and practices;
ii. The final report of the External Auditors, especially regarding qualifications or any qualification of the opinion; and
iii. The analysis carried out from a technical standpoint to hire the same auditor for the following period or to replace them if necessary.
g) Evaluate the work of Internal Audit, as well as compliance with its annual work plan and other obligations contained in the Technical Standards for Internal Audit for Members of the Financial System (NRP-15), approved by the Central Bank through its Standards Committee; h) Propose to the Board of Directors, and this in turn to the General Meeting of Shareholders, the appointment of External Auditors and the Fiscal Auditor. In the hiring of External Auditors, their independence regarding other professional services provided must be considered, as established in the article regarding incompatibility with other professional services established in the Technical Standards for the Provision of External Audit Services (NRP-18), approved by the Central Bank through its Standards Committee. In the case of public institutions, verify that the terms of reference for the hiring of External Auditors and the Fiscal Auditor consider conditions of independence regarding other professional services provided, such as consultancies, in which their judgment could be affected; i) Know and evaluate processes related to financial information and the internal control systems of the entity; and j) Ensure that interim and year-end financial statements are prepared in compliance with regulatory guidelines.

For the case of Pension Fund Administrators, the Audit Committee must ensure that they carry out an adequate segregation of functions and the respective internal controls in the administration of the Solidarity Guarantee Account, so that contributions, pension payments, and all records associated with the different transactions of the account, comply with the applicable legal and regulatory framework.

NRP-17
Vigencia: 02/05/2019
Correspondence File
Art. 24.- It shall be the responsibility of the entity to maintain a correspondence file, allowing access at any time to the members of the Audit Committee.
This file must contain the following:
a) Correspondence received from the Superintendence, the Court of Accounts of the Republic, or any other public institution, when applicable, regarding the results of audits conducted, examinations, and account evaluations; b) Correspondence and reports received from External Auditors regarding the development of the audit; c) Responses issued by the audited entity to the Superintendence and External Auditors, including plans for determining corrective actions on the observations noted, indicating responsible parties, deadlines, and periods for their completion; and d) Copies of internal audit reports and the responses given by the different units on those reports.

The correspondence file may be kept in electronic media and must be available for review by the Superintendence at the time it requires it.
From the effective date of these Norms, the entity must permanently maintain the information in the correspondence file referred to in this article.

Risk Committee
Art. 25.- The Risk Committee must be constituted by an odd number of members, who may be External Directors or at least one External Director, a senior management official, and an Executive who has responsibility for the risk management of the entity. The Committee will be chaired by a Board Director with knowledge in finance and risk management.

When appointing the members of the Risk Committee, the Board of Directors must assess that they have the time availability to participate in sessions and fulfill the responsibilities established for the said Committee.

When the number of operations or the organizational structure of the entity does not allow for the creation of the Risk Committee, the corresponding functions may be developed by the Board of Directors of the entity or by a Corporate Risk Committee, provided it complies with the provisions in the applicable legal framework and with the provisions established in these Norms, ensuring objectivity, adequate handling of conflicts of interest, independence of criteria, confidentiality, and access to information. In these cases, the entity will be responsible for having the minutes, reports, and supporting documentation of the topics reviewed. The Board of Directors of the entity

NRP-17
Vigencia: 02/05/2019 will maintain responsibility for the execution of the functions defined in these Norms.

In the case of Investment Banks, branches of foreign banks established in the country, and branches of foreign Insurance Companies established in the country, the Risk Committee will be constituted by its Representative or whoever acts on their behalf, a senior management official, and an Executive who has responsibility for the risk management of the entity. The Committee will be chaired by one of its members who has knowledge in finance. (3)

The Risk Committee will comply at minimum with the provisions established in the Norms relative to Risk Management that the Central Bank issues for such purposes through its Standards Committee.

Other Committees
Art. 26.- Each entity may constitute other Support Committees for the work of the Board of Directors, specific to its main business.

CHAPTER VI
INFORMATION TRANSPARENCY
Disclosure and access to information
Art. 27.- Entities must establish a structure that promotes transparency and reliability in the provision and access to information, both for the entity's clients, as well as for shareholders, the supervisor, and the general public. This structure must allow members of the Board of Directors, Senior Management, members of Support Committees, and other employees, to provide the necessary information for the performance of their functions, considering the following aspects:
a) Guidelines that ensure that the information generated by the entity is timely, accessible, sufficient, truthful, comparable, and consistent; b) Dissemination of information regarding the characteristics of the products and services offered by the entity; c) Dissemination of financial information of the entity, its own products, those it administers, and the services it offers in accordance with the applicable legal framework; and d) Guidelines for the administration of confidential information and the limitation on the improper use of non-public information.

Annual Corporate Governance Report
Art. 28.- Entities must annually prepare a Corporate Governance Report, which may be part of their annual work report. The Board of Directors will be responsible for its content, approval, and publication, ensuring that it contains at least what is established in Annex No. 1 of these Norms.

The Corporate Governance Report must be sent to the Superintendence during the first quarter of the year following the one to which the report refers.

For branches of Foreign Banks established in the country and branches of Foreign Insurance Companies established in the country, only numbers 3 of Roman I, Roman IV, Roman V, and Roman VI of Annex No. 1 of these Norms will be applicable.

Art. 28-A.- Entities must send to the Superintendence in electronic format the information requested in Annex No. 2 of these Norms; this information must be sent semi-annually, within the first thirty days following each semester. (2)

Branches of Foreign Banks established in the country and branches of Foreign Insurance Companies established in the country will send only the information related to the branches established in the country, from items 2, 3, 4, 5, 7, and 8, of said Annex No. 2 of these Norms. (2)

Art. 28-B.- The Superintendence will send to the Central Bank, within a period not exceeding five business days after the deadline established in article 28-A of these Norms, the information sent by the entities referred to in Annex No. 2 of these Norms. (2)

Information on website
Art. 29.- On the entity's website, or that of its Financial Conglomerate or Business Group to which it belongs, there must be a specific section titled with the following information:
a) Articles of Incorporation and Bylaws; b) Members of the Board of Directors and Senior Management; c) Annual report; d) Corporate Governance Code; e) Code of Ethics or Conduct; f) Annual Corporate Governance Report; g) Risk classification reports, when applicable; h) Means of attention and communication to its shareholders; i) Financial statements with the frequency established in applicable norms and respective laws; j) Detail of relevant related-party transactions; k) Annual Report of the External Auditor; l) Information on the Board of Directors, including their studies, resume excerpts, position held in the entity and in other entities; m) Information on Senior Management, such as academic degree, position; n) Information relative to committees, which considers, among others: objectives, responsibilities, composition, and frequency of meetings; and o) Report on corporate governance standards to which it complies,

NRP-17
Vigencia: 02/05/2019 establishing the corresponding justification for those it does not comply with.
Considering for this purpose the standards that it has previously accepted to apply, depending on the type of entity in question.

For the case of banks, they will also include the Quarterly Financial Report, as required by the Norms for the Preparation of the Quarterly Financial Report (NPB4-38).

In the case of branches of Foreign Insurance Companies and branches of Foreign Banks established in the country, only letters b), e), f), g), i), and k) of this article will be applicable.

The content of the information to be provided on the website must be in Spanish and will be the responsibility of the Board of Directors. It may also be in another language.

The reports referred to in this article, listed in letters c), f), g), i), and k), must have a history of at least five years on the website, a period that will begin from the effective date of these Norms.

Entities referred to in article 2 of these Norms and that are part of a Financial Conglomerate or Business Group may share the Corporate Governance Code and Code of Ethics or Conduct provided they meet the requirements established in these Norms, observing the due formalities for this purpose.

The provision in the previous paragraph will be applicable to entities subject to these Norms, in the case that their respective applicable legal framework does not prohibit it.

The entity must update the information detailed in the previous letters when there are changes in them and inform the Superintendence within the following ten business days of the change occurring.

CHAPTER VII
CORPORATE FUNCTIONS

Local Administration
Art. 30.- For entities that are part of a Financial Conglomerate whose parent company is located abroad, the control and reporting management established by the parent company do not substitute the indelegable functions of the local Board of Directors.

On the Audit Committee
Art. 31.- The Audit Committee of the banking entity member of a Financial Conglomerate, in order to be informed about internal control, must meet at least once a year, with those who perform the audit function in the other entities of the Financial Conglomerate, in order to know about:
a) Integrity of financial information systems; b) Internal control systems; c) Disclosure of financial and non-financial information; d) Compliance with legislation and regulation applicable to the entities of the Financial Conglomerate; and e) Corrective actions on identified risks that affect the entity.

On the Risk Committee
Art. 32.- The Risk Committee of the banking entity member of a Financial Conglomerate, in order to be informed of the risks incurred by the conglomerate's companies and that could affect the entity, must meet at least twice a year, with those who perform this function in the other entities of the Financial Conglomerate.

On the management of conflicts of interest
Art. 33.- The Boards of Directors of the entities subject to these Norms that are members of a Financial Conglomerate must ensure that Senior Management identifies possible conflicts of interest between the companies of the conglomerate and applies the policies approved for such purposes.

CHAPTER VIII
OTHER PROVISIONS AND EFFECTIVE DATE

Sanctions
Art. 34.- Non-compliance with the provisions contained in these Norms will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Repeals
Art. 35.- These Norms repeal the following:
a) Financial Entities (NPB4-48), approved in Direct Council Session No. CD-06/2011 of February 9, 2011, by the Direct Council of the Superintendence of the Financial System whose Organic Law was repealed in accordance with Legislative Decree No. 592 which contains the Law on Supervision and Regulation of the Financial System, published in Official Diary No. 23, Volume No. 390, dated February 2, 2011; and b) Stock Markets, (NRP-13), approved on October 12, 2016, by the Central Bank through its Standards Committee.

Transitional
Art. 36.- Entities, to comply with the provisions established in these Norms, must present to the Superintendence an adaptation plan, within thirty days following the effective date of these Norms. Once the plan is presented, entities must implement it within a maximum period of eleven months counted from its presentation.

Art. 37.- Boards of Directors that are not constituted in accordance with what is established in these Norms may maintain their appointment until the term for which they were elected ends. Entities must, once the terms of their Director members have concluded, proceed to integrate them with Directors who meet the conditions regulated in these Norms.

Art. 38.- Entities that, according to their segregation of functions upon the entry into force of these Norms, already have a Risk Committee constituted, may maintain said Committee. Its composition must be adapted and comply with the provisions established in these Norms within the period indicated in article 36.

Art. 38-A.- The first submission of the information required in Annex No. 2 of these Norms must be made in February 2024, with information corresponding to the last semester of 2023. (2)

Unforeseen Aspects
Art. 39.- Aspects not foreseen in regulatory matters in these Norms will be resolved by the Central Bank through its Standards Committee.

Effective Date
Art. 40.- These Norms will enter into force from May 2, 2019.

MODIFICATIONS:
(1) Modifications in articles 2, 3, and 6 approved by the Central Bank through its Standards Committee, in Session CN-02/2022, of February 21, 2022, with effect from March 8, 2022.
(2) Modifications in articles 3, 9, 11, 12, 14, and 23 and incorporation of articles 28-A, 28-B, 38-A, and Annex No. 2, approved by the Central Bank through its Standards Committee, in Session CN-11/2023, of December 14, 2023, with effect from January 2, 2024. (3) Modifications in articles 2, 3, 21, and 25 approved by the Central Bank through its Standards Committee, in Session CN-08/2025, of September 30, 2025, with effect from October 15, 2025.

NRP-17
Vigencia: 02/05/2019
Annex No. 1
CORPORATE GOVERNANCE REPORT
Entity: _________________ Reported Period: _________________

I. GENERAL INFORMATION

1. Local Financial Conglomerate to which it belongs, when applicable.
2. Member entities of the Local Financial Conglomerate, when applicable and main business.
3. International Financial Group to which it belongs, when applicable.
4. Business Group to which it belongs, when applicable.
5. Shareholding structure of the entity.

II. SHAREHOLDERS

1. Number of Ordinary Meetings held during the period and quorum.
2. Number of Extraordinary Meetings held during the period and quorum.

III. BOARD OF DIRECTORS

1. Members of the Board of Directors and changes in the reported period.
2. Number of sessions held during the reported period, detailing the dates of the same.
3. Description of the Policy for the appointment of Board of Directors members.
4. Transactions carried out by Board of Directors members with other related parties in accordance with the applicable legal framework to the entity.
5. Description of the policy on the rotation or permanence of members, if applicable.
6. Report on training received on corporate governance or related matters.
7. Indicate that it has a Board of Directors Remuneration Policy.

IV. SENIOR MANAGEMENT

1. Members of Senior Management and changes during the reported period.
2. Senior Management selection policy.
3. Report on compliance with policies and internal controls approved by the Board of Directors

V. AUDIT COMMITTEE

1. Members of the Audit Committee and changes during the reported period.
2. Number of sessions in the period and the dates on which they were held.
3. Detail of the main functions developed in the period.
4. Corporate topics known in the period.
   VI. RISK COMMITTEE
5. Members of the Risk Committee and changes during the reported period.
6. Number of sessions in the period.
7. Detail of the main functions developed in the period.
8. Corporate topics known in the period.

NRP-17
Vigencia: 02/05/2019
Annex No. 1

VII. CORPORATE GOVERNANCE AND ETHICAL STANDARDS.

1. Description of changes to the Corporate Governance Code during the period.
2. Description of changes to the Code of Ethics or Conduct during the period.
3. Report on compliance with Conflict of Interest Management and Control policies and transactions with related parties.

VIII. TRANSPARENCY AND INFORMATION DISCLOSURE

1. Customer attention: mechanisms with which the entity has for customer attention as well as the handling of complaints and claims must be indicated.
2. Detail of the main relevant events of the entity, in accordance with applicable regulations, during the annual report period.

IX. OTHERS

1. Any other information or clarification related to its corporate governance practices that it considers relevant for the understanding of its corporate governance.