Technical Standards for Credit Risk Management, Limits on Risk Assumption and Loans to Related Parties of Development Banking Entities

Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 21 CNBCR-20/2020 NASF-08 TECHNICAL STANDARDS FOR CREDIT RISK MANAGEMENT, LIMITS ON RISK ASSUMPTION AND LOANS TO RELATED PARTIES OF DEVELOPMENT BANKING ENTITIES Approval: 12/03/2020 Validity: 12/22/2020

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING: I. That in accordance with Article 3, letter c) of the Law on Supervision and Regulation of the Financial System, it is the responsibility of the Superintendence of the Financial System to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity. II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes that the Development Bank of the Republic of El Salvador, formerly the Development Bank of El Salvador and formerly the Multisectorial Investment Bank, is a member of the financial system. III. That in accordance with Article 3, letter d) of the Law on Supervision and Regulation of the Financial System, it is stipulated that directors, managers, and other officials holding positions of direction or administration of the members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct, acting with the diligence of a good merchant in their own business, being obligated to comply with and ensure that in the entity they direct or work for, the adoption and updating of policies and mechanisms for risk management are fulfilled, including among other actions, identifying, evaluating, mitigating, and disclosing them in accordance with international best practices. IV. That Article 99, letter a) of the Law on Supervision and Regulation of the Financial System stipulates that it will be the responsibility of the Committee of Standards to approve technical standards, instructions, and provisions that the laws regulating the supervised entities establish must be issued to facilitate their application, including aspects inherent to risk management by the supervised entities. V. That by Legislative Decree No. 847, dated September 22, 2011, published in the Official Journal No. 197, Volume No. 393, of October 21 of the same year, the Financial System Law for Development Promotion was issued. VI. That by Legislative Decree No. 653, dated June 4, 2020, published in the Official Journal No. 117, Volume No. 427, of June 9 of the same year, the Financial System Law for Development Promotion was reformed, changing its name to the Law of the Development Bank of the Republic of El Salvador, among others.

Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 21 CNBCR-20/2020 NASF-08 TECHNICAL STANDARDS FOR CREDIT RISK MANAGEMENT, LIMITS ON RISK ASSUMPTION AND LOANS TO RELATED PARTIES OF DEVELOPMENT BANKING ENTITIES Approval: 12/03/2020 Validity: 12/22/2020 VII. That Article 92 of the Law of the Development Bank of the Republic of El Salvador establishes that regarding financial operations that the Bank enters into directly with eligible subjects, with its own resources or with the resources of the Economic Development Fund or the Salvadoran Guarantee Fund, and whose provisions are not contemplated in the aforementioned Law, the Bank must observe the pertinent provisions of the Banking Law regarding prohibitions on the assumption of risks, credits, and contracts with related parties. VIII. That Article 34 of Legislative Decree No. 653, dated June 4, 2020, establishes that the Central Bank through its Committee of Standards will issue the necessary technical standards for the application of the Law on the Creation of the Development Bank of the Republic of El Salvador, which must be carried out taking into account its nature.

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following: TECHNICAL STANDARDS FOR CREDIT RISK MANAGEMENT, LIMITS ON RISK ASSUMPTION AND LOANS TO RELATED PARTIES OF DEVELOPMENT BANKING ENTITIES

CHAPTER I OBJECTIVE, SUBJECTS, AND TERMS

Objective Art. 1.- The objective of these Standards is to provide guidelines applicable to development banking operations for the adequate management of credit risk, and criteria for the adoption of policies and procedures related to the development of methodologies for their identification and measurement, as well as for the establishment of limits and mechanisms for monitoring, control, and mitigation of exposure levels to this risk, in accordance with the nature, scale of activities, and risk profile. Likewise, they also aim to regulate the application of limits on the granting of credits to related persons or groups of persons, whether domiciled in the country or not.

These standards complement the provisions established in the standards for classifying credit risk assets and establishing sanitation reserves for development banking.

Subjects Art. 2.- The subjects obliged to comply with the provisions established in these Standards are the entities that carry out development banking operations and that by Law are under the supervision of the Superintendence of the Financial System, and where applicable, insofar as it does not contradict their creation law and what is provided by the Court of Accounts. Development banking operations constitute credits granted to subjects and financial institutions, discounted documents, bonds and other debt instruments acquired, sureties, guarantees, and any form of direct or indirect financing or other operation that represents an obligation for the entity.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Senior Management: The President, Executive President, Executive Director, General Manager, or whoever acts in their place and the main executive positions recognized as such by the Board of Directors; b) Governors' Assembly: The highest instance that normally transfers guidelines and supervises the performance of the Board of Directors in some Development Institutions; c) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives for development purposes; d) Guarantee: A guarantee is understood as the financial commitment or obligation, accessory to the entity, to respond for a credit obligation of a third party, committing itself to the creditor in whole or in part, if the principal debtor does not fulfill it; e) Central Bank: Central Reserve Bank of El Salvador; f) Development Banking: Banks or financial institutions that support economic and social development, channeling resources mainly in the medium and long term, assigning resources to public and private banking in lines of financing and guarantee to productive sectors, especially to the sectors of the economy traditionally excluded or neglected by commercial banking, including access to education and business training; and that within their funding mechanisms do not include the capture of deposits;

g) BANDESAL: Development Bank of the Republic of El Salvador; h) Credit Concentration: Refers to the exposure in amount and number of credits that an Institution has with individual counterparties, groups of individual counterparties or related parties, counterparties in specific geographic locations, economic sectors, service providers, and specific products; i) Credit risk concentration: Refers to the potential exposure to produce large losses, sufficient to threaten the stability of an entity or the ability to maintain its main operations. The potential for loss reflects the size of the exposure and the magnitude of the loss given a particular adverse circumstance; j) Entity or Institution: Is the subject obliged to comply with the provisions established in these Standards; k) Risk Factors: Represent those variables that entities must consider for adequate identification and mitigation of the risks to which they are exposed; l) Credit Management: Is the process by which the Entity or Institution, based on approved internal policies and procedures, administers a credit, from prospecting, until its recovery; m) Credit Risk Management: Process that incorporates the identification, measurement, control, and mitigation of risks associated with the granting of credits, as well as the monitoring and timely communication of the same; n) Board of Directors: Collegiate body or equivalent body in charge of the direction and administration of the entity, with functions of supervision, direction, and control; o) Development banking operations: Are financial operations carried out by Development Institutions or Banks, and are characterized by having terms normally in the medium and long term; that are granted without charging any type of commission, at interest rates usually lower in relation to commercial banking, that contribute to correcting market failures, and that seek to complement the operations carried out by commercial banking; p) Related Parties: Those who have the capacity to influence credit granting decisions or who have a conflict of interest when making those decisions; q) Credit Risk: Is the possibility of loss, due to the non-compliance with contractual obligations assumed by a counterparty, understood as a borrower or a debt issuer, it also incorporates credit concentration; r) Credit Concentration Risk: Is the possibility of loss originating from the concentration in the granting of credits to clients or sectors of the economy; s) Superintendence: Superintendence of the Financial System; and

t) Risk Tolerance: Levels of acceptable risk-taking to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and, generally, is aligned with risk categories, such as strategy, finance, people, or reputation.

CHAPTER II CREDIT RISK MANAGEMENT

Organizational System Art. 4.- Entities must establish an adequate organizational or functional structure for the management of their own development banking operations, which must allow for adequate segregation and delimitation of functions and responsibilities, as well as the levels of dependence and interrelation that correspond to each of the areas involved in credit risk management. All these aspects must be contemplated in the respective Manual or Policies, approved by the Board of Directors of the entity.

Responsibilities of the Board of Directors Art. 5.- The Board of Directors of the entity is the organ directly responsible for the management of credit risk and credit concentration risk, and therefore must: a) Approve the strategies, policies, and manuals for the management of credit risk and credit concentration risk, which must treat, at a minimum, the diversification of risks, credit and investment limits by country, and within these, sub-limits by economic sector, term of operations, among others, and ensure that Senior Management implements them effectively; b) Assign and approve the necessary resources to implement and maintain the management of credit risk and credit concentration risk in an effective and efficient manner; c) Designate the administrative unit responsible for the control and follow-up of credit risk and credit concentration risk; d) Schedule periodic evaluations on the compliance with strategies, policies, and prudential regulations; e) Ensure that internal audits are carried out by personnel independent of the area in charge of credit risk and credit concentration risk; f) Implement internal control procedures that allow the identification, measurement, monitoring, and control of credit risk and credit concentration; and g) Be informed monthly of the situation of credit risk and credit concentration risk, as well as the exposure of these risks with respect to the main debtors.

The agreements of the Board of Directors must be duly expressed in the respective minutes book.

Responsibilities of Senior Management Art. 6.- Senior Management is responsible for the implementation of the management of credit risk and credit concentration risk, of the strategies, policies, and manuals authorized by the Board of Directors.

Stages of the management process Art. 7.- For the management of credit risk and credit concentration risk, entities must have a continuous and documented process to determine credit assets exposed to credit risk; as well as to identify, measure, control, and mitigate, monitor, and communicate the referred risk.

Identification Art. 8.- Entities must establish a process for identifying the factors that can cause an increase in credit risk or credit concentration risk in each operation, product, or line of business they develop, whether with their own resources or with third-party resources.

Measurement Art. 9.- Entities must estimate the expected losses derived from credit activity, considering the criteria of frequency and severity of defaults.

Control and mitigation Art. 10.- Entities must implement controls for the management of credit risk and credit concentration risk, as well as evaluate their adequate functioning. This phase includes the application of measures directed to mitigate the effect that the materialization of this risk could produce on the financial situation of the entity. Likewise, the Internal Audit area must include in its work plans the verification of compliance with policies related to credit risk and credit concentration risk, whether from the point of view of development banking or risk management per se.

Monitoring and communication Art. 11.- Entities must establish mechanisms for the continuous monitoring of this risk, including processes that help to adjust timely, based on changes in the economic environment, the policies, processes, and procedures to manage credit risk and credit concentration risk. The monitoring activity is the responsibility of Senior Management, which includes the Risk Area and the Risk Committee, as well as other instances involved in the process, which will have sufficient and timely information to support decision-making.

CHAPTER III CREDIT RISK MANAGEMENT POLICIES

Risk management policies Art. 12.- Entities must have explicit policies for the management of credit risk and credit concentration risk, which must be approved by the Board of Directors and be adequate to the characteristics of their products and target market. These policies must at least orient towards establishing levels of tolerance for exposure to credit risk, as well as performing a correct valuation of credit risk assets based on the probability of portfolio recovery. Aspects specifically related to credit risk management must be duly documented and identified. The entities' policies must contain aspects of credit granting, follow-up, collection, recovery, and treatment of exceptions to policies. They must be consistently understood by those involved in credit management, so they must be widely disseminated.

Procedures manuals Art. 13.- Entities, based on their policies, must establish adequate processes and procedures for the granting, follow-up, collection, and recovery of credit; including, in addition, the stages of the credit risk management process. The foregoing must be documented in the respective manual, approved by the Board of Directors.

CHAPTER IV CREDIT CONCENTRATION RISK

Credit concentration policies Art. 14.- Subjects must have a policy regarding credit concentration risk, according to the segmentation that each entity defines in accordance with their legal frameworks, which must be duly documented and approved by the Board of Directors and subjected to periodic reviews to take into account eventual changes in risk limits and in the economic environment; in addition, they must contain the treatment of exceptions to the limits.

Management of credit concentration risk Art. 15.- Entities must establish adequate internal procedures for the identification, measurement, control, monitoring, and communication of credit concentration risk, in accordance with the nature, risk profile, and scale of their activities.

Establishment of limits Art. 16.- Entities must establish, according to a prior analysis, the limits, thresholds, or similar concepts of credit concentration, as well as the procedures to be followed in the application of these, in order to guarantee that the level of credit risk determined by the Board of Directors is not exceeded. Entities must perform concentration analysis of their credit and investment portfolios, as well as estimates of the trends they present, considering at least the following aspects: a) Large individual exposures to the same counterparty, to linked counterparties, and to related groups. For these purposes, the definition of linked must be broad enough to include exposures linked by common factors, such as ownership and administration. The entity may consider in this definition the cases of linked guarantors or guarantors; b) Exposures to counterparties in the same sector or economic segment or geographic region, including exposures for non-domiciled credits; c) Levels of delinquency and recovery; d) Effectiveness of mitigants for credit risk; and e) Similarities between risk factors to non-linked exposures or exposures to common factors. The results of these analyses must serve to adjust procedures and the limits established in the management of credit concentration risk, and if considered necessary, they must be submitted to their respective approval by the Board of Directors.

Monitoring Art. 17.- The management and communication systems of credit concentration risks must incorporate monitoring functions, such as: a) Review of the risk environment of the sector or segment in question; b) Scenario analysis including stress tests; c) Economic results of large individual exposures; d) Review of authorization levels for new operations; or e) Periodic review of risk mitigants, their value, and legal feasibility in case of recovering the loan with the guarantee.

The results of these analyses must be submitted to the Risk Committee or the Board of Directors for consideration, so that they take the pertinent measures.

Risk coverage Art. 18.- Entities must ensure that their levels of provisions and capital are sufficient to cover credit risk and credit concentration risk.

CHAPTER V INFORMATION SYSTEMS AND DETERMINATION OF DATABASES

Management information systems Art. 19.- Entities must have an internal information system to manage credit risk and credit concentration risk, in order to measure their exposure and facilitate decision-making. The management information system must allow the entity to identify, measure, control, monitor, and follow up on credit risk and credit concentration risk.

Databases Art. 20.- Entities must have databases that allow them to estimate their expected loss, for which they will use the following components: a) Probability of default; b) Loss given default; and c) Exposure at default. The database must be constructed in accordance with the risk profile of Development Banking and with the activities and sector