Technical Standards for the Authorization, Registration, and Operation of Data Information Agencies and Credit History Information Services

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That by Legislative Decree No. 128, dated August 17, 2021, published in Official Diary No. 166, Volume No. 432, of September 1 of the same year, the Law on the Regulation of Credit History Information Services was amended.

II. That Legislative Decree No. 128 amended, among others, article 14 letter a) and article 17 letter h) of the Credit History Law, whereby it is established that data information agencies must implement other mechanisms or technological developments that contribute to facilitating access to information and that are user-friendly so that consumers can have real-time access to queries of their credit history, as well as receive alerts via instant messaging service when the same is being reviewed by an economic agent of any kind.

III. That article 5 of the Law on the Regulation of Credit History Information Services establishes that it is the responsibility of the Central Bank of Reserve of El Salvador to issue the Technical Standards for the organization, operation and control and other aspects related to Data Information Agencies on Credit History and those personal data that must be provided by consumers or clients to Economic Agents.

IV. That article 7 of the Law on the Supervision and Regulation of the Financial System establishes that the Financial System Superintendence is responsible for the supervision of specialized companies providing credit information services operating in El Salvador.

V. That article 78 letter l) of the Law on the Supervision and Regulation of the Financial System establishes that the Financial System Superintendence will organize and keep updated the records of companies and persons providing services related to credit information and history.

VI. That article 24 of Legislative Decree No. 128, dated August 17, 2021, published in Official Diary No. 166, Volume No. 432, of September 1 of the same year, establishes that the Committee of Standards of the Central Bank of Reserve will issue the corresponding regulations within a period of two months from the entry into force of said Decree.

VII. That Legislative Decree No. 280, dated April 24, 2025, amended letter n) of article 17 and letter h) of article 19 of the Law on the Regulation of Credit History Information Services, whereby it is established that storage and processing services in cloud computing technology may be used for the database and its backup, with storage permitted within national territory, and in both cases providing unrestricted access to the Central Bank of Reserve of El Salvador, and to the Financial System Superintendence, for which Technical Standards will be issued to guarantee compliance with cybersecurity and data protection standards in the administration and backup of databases. (2)

VIII. That in order to safeguard the right to personal privacy and the right to informational self-determination, ensuring equality in the treatment of credit data and in accordance with the Law on the Regulation of Credit History Information Services, it is necessary to issue new Technical Standards that allow the development of the reforms approved to the aforementioned Law.

THEREFORE, by virtue of the regulatory powers conferred by article 99 of the Law on the Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE AUTHORIZATION, REGISTRATION AND OPERATION OF DATA INFORMATION AGENCIES AND CREDIT HISTORY INFORMATION SERVICES

TITLE I
GENERAL ASPECTS

CHAPTER I
OBJECT, SUBJECTS AND TERMS

Object
Art. 1.- These Standards aim to establish the requirements for authorization, organization, registration, operation, closure of operations, risk management, and the execution of mechanisms or technological developments to be implemented that must be complied with by legal entities, public or private, that are authorized by the Financial System Superintendence to operate as Data Information Agencies.

Likewise, it establishes the requirements that legal entities, public or private, must comply with, in accordance with the Law on the Regulation of Credit History Information Services, who intend to obtain authorization to operate as a Data Information Agency.

Furthermore, it establishes the personal and reference data to be collected from economic agents, the treatment of negative information of consumers or clients, and the proper handling of data for the creation of the credit history, guaranteeing the protection, confidentiality and integrity of the information of consumers or clients, in accordance with what is established in the Law on the Regulation of Credit History Information Services.

Subjects
Art. 2.- The subjects obliged to comply with the provisions established in these Standards are:
a) Legal entities, public or private, that have expressed their interest before the Financial System Superintendence to obtain authorization to operate as Data Information Agencies; b) Authorized Data Information Agencies; and c) Economic Agents in accordance with what is regulated in article 2 of the Law on the Regulation of Credit History Information Services.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Data update: Process in which Data Information Agencies update their databases with true and reliable information provided monthly by Economic Agents in the first ten calendar days and in the second half of each month with information related to the data holder, such as: corrections, settlements, modifications or deletions due to erroneous and inaccurate data; b) Data Information Agency or DIA: Any legal entity, public or private, excluding the Financial System Superintendence, that is dedicated to collecting, storing, preserving, organizing, communicating, transferring or transmitting data on the credit history of consumers or clients, through automated or non-automated technical procedures; c) Economic Agents or EA: Natural or legal persons, providers of goods and services, that register, supply and obtain information from a database; d) Authenticity: Condition under which the information is originated by who says to be the author or owner and received by who is the recipient; and that has not been altered at any time; e) Central Bank: Central Bank of Reserve of El Salvador;

f) Database: Organized set of data on current or active credit history, cancelled or inactive that the consumer or client has or has had, regardless of the form or modality of its creation, storage, organization and access; g) Complaint Resolution Center: Administrative offices enabled by Data Information Agencies for the resolution of concerns, handling of complaints and other procedures contemplated in the Law on the Regulation of Credit History Information Services, by consumers or clients; h) Confidentiality: Characteristic of the information by which it is considered accessible only to those duly authorized and only for the clearly and expressly delimited purposes, in accordance with what is established by the Law on the Regulation of Credit History Information Services; i) Consumer or client: Any natural or legal person who acquires, uses or enjoys goods or services provided by an economic agent, regardless of the public or private, individual or collective character of those who produce, commercialize, facilitate, supply or issue them; j) Data: Information on the credit history of consumers or clients, which is owned by them and recorded in a database; k) Negative data: Information recorded in a DIA database, relating to the history of defaults or delays in fulfilling credit obligations and all those obligations agreed or payable in future or deferred payments, in their different unsatisfied modalities by consumers or clients; l) Ombudsman: Consumer Ombudsman; m) Authentication factor: Information used to verify the identity of a person; n) Credit History: Data of consumers or clients, duly incorporated into a database, that reflect economic, commercial, financial or banking transactions payable at installments; o) Sensitive information: Information of clients and entities that cannot be exposed or shared with the public according to legislation; p) Integrity: Automated or non-automated mechanisms by which it is safeguarded that the information is complete, accurate and valid; q) Credit History Law: Law on the Regulation of Credit History Information Services; r) Mechanisms or technological developments: Web applications, mobile applications, among others, that DIAs implement so that consumers or clients can access their credit history information; s) Order for correction or data update: Order issued by an EA, the Superintendence or the Ombudsman to a DIA, in which it attests that the credit history data of a client or consumer have been corrected or updated, modified or deleted on a specific date, with the object that the DIA corrects or updates its corresponding database. This order refers to cases of correction, update, modification or deletion of information, established in article 14 letter e) of the Credit History Law; t) Consultation Points: Kiosks or offices enabled by Data Information Agencies so that consumers or clients can access their credit history information; u) Backup: Copy of the original data made in order to have a
means for its recovery in case of partial or total loss of these; v) Superintendence: Financial System Superintendence; w) Cloud computing technologies: Refers to the model of delivery of processing, storage, software and other services through the Internet, instead of storing them locally on a device, server or physical data center; and (2) x) Data processing: Any operation or set of operations or technical procedures, automated or not, that, within a database, allow collecting, storing, organizing, elaborating, selecting, extracting, confronting, sharing, communicating, transmitting or canceling data of consumers or clients, regarding their credit history.

CHAPTER II
AUTHORIZATION AND REGISTRATION OF DATA INFORMATION AGENCIES

Authorization
Art. 4.- The provision of credit history information services for persons will be carried out exclusively by DIAs, which must be previously authorized by the Superintendence to exercise this activity.

Without prejudice to what is established in the applicable legal framework, DIAs that decide to merge, transform, change their name or any other relevant fact, must notify the Superintendence sixty business days in advance.

Likewise, DIAs may provide the service of credit risk profile rating of a person, consumer or client, provided that it is guaranteed that such service does not violate the rights of persons, considers the principles for the protection of the rights of consumers and clients contemplated in the Credit History Law.

Minimum Capital
Art. 5.- DIAs must have a minimum social capital in accordance with what is stipulated in article 8 of the Credit History Law.

Authorization Request
Art. 6.- Any legal entity, public or private, interested in operating a DIA for the provision of credit history information services for persons, must submit to the Superintendence an authorization request, signed by the legal representative, attaching the following information and documentation:
a) Request made on plain paper or form that must contain the following information:
i. Name or trade name of the requesting person;
ii. Class of society or association involved;
iii. Date of its registration in the corresponding public registry, with indications of the volume, folio and entry respectively;
iv. Names of its directors, legal representative and general attorney, if any;
v. Legal domicile of the requesting person;
vi. Trade name of the DIA;
vii. Exact address of the commercial establishment, telephone number, postal and email, if any; and
viii. Tax identification number.
b) Copy of the public deed of Incorporation of the Society or association involved and of the reforms, if any, duly registered in the corresponding Registry, in the case of private DIAs, its constitutive deed must contain as main purpose the collection of data information on the credit history of persons; c) Certification of the respective Registry, where the validity and registration data of the legal entity are recorded, as well as the names of the directors, legal representative and attorney, if any; d) Certified photocopy of the Unique Identity Document, valid passport or residence card as the case may be and photocopy of the Tax Identification Number or its Graphic Representation of its directors, legal representative and general attorney, if any; (1) e) Police background check, issued by the National Civil Police, of the directors, legal representative and general attorney, if any; f) Criminal background check, issued by the General Directorate of Penal Centers of the Ministry of Justice and Public Security, of the directors, legal representative and general attorney, if any; g) Deposit of format of credit history service contracts at the Superintendence and the Ombudsman, as well as any subsequent modifications to them; h) Number, location and schedule of consultation points and complaint resolution centers; i) Description of the procedure or system established for customer service in accordance with what is established in the Credit History Law; j) Description of the procedure for the correction and update of data in accordance with what is established in the Credit History Law; k) Appointment of the external auditor, registered at the Superintendence;

l) Organizational chart of the DIA with indication of the position and name of the administrators and directors, specifying the position to be performed regarding support staff; m) Financial, tax and municipal solvency of the society; n) General operating program, which must include at least the following:
i. Description of computing systems and information collection and processing processes, attaching the inventory and description of the computer systems and databases that the DIA will use in its operations, as well as the description of the computer platform on which they have been developed;
ii. Backup procedures manual and description of security policies and controls applied to computer systems and databases in accordance with the [Reference missing in source text];
iii. Description of the characteristics of the products and services to be provided, as well as the amount of charge to be made for them. For this purpose, they must present the detail of the parameters used to determine said amount;
iv. Service provision policies with which it intends to operate;
v. Detail of security and control measures, in order to avoid improper handling of information;
vi. Organizational chart and job description manual for each area of the DIA; and
vii. Contingency plan in case of disaster.

In addition to the documentation indicated in the letters above, DIAs must present the business continuity plan and information security policies, in accordance with what is established in the [Reference missing in source text], approved by the Central Bank, through its Committee of Standards.

Authorization Procedure to Operate
Art. 7.- Upon receipt of the authorization request, in accordance with what is established in article 6 of these Standards, the Superintendence will proceed to verify compliance with the requirements established in the Credit History Law and these Standards, having a period of no more than sixty calendar days in accordance with article 11 of said Law, for the authorization or denial of the authorization of the corresponding entry.

If the request is not accompanied by the complete and proper information detailed in article 6 of these standards, the Superintendence, in the absence of necessary requirements, may require the applicants to present the missing documents within a period of ten business days counted from the day following the notification, a period that may be extended at the request of the applicants, when there are reasons justifying it.

The Superintendence in the same notice will indicate to the applicants that, if they do not complete the information within the aforementioned period, it will proceed without further procedure to archive the request, leaving them free to present a new request.

If after the analysis of the documentation presented, in accordance with article 6 of these Standards, the Superintendence has observations or when the documentation or information presented is not sufficient to establish the facts or information intended to be accredited, the Superintendence may warn the interested party in operating a DIA only once to remedy the deficiencies communicated or present additional documentation or information requested.

The interested party in operating a DIA will have a maximum period of ten business days counted from the day following the respective notification, to remedy the observations or present the additional information requested.

The Superintendence may, by reasoned and justified resolution, extend by another ten business days the period indicated in the previous paragraph, when the nature of the observations or deficiencies warned so requires.

Extension Period
Art. 8.- The interested party in operating a DIA may submit to the Superintendence a request for extension of the periods indicated in the fifth paragraph of article 7 of these Standards, before the expiration of said period, expressing the reasons on which the request is based, proposing, if applicable, the relevant proof.

The extension period may not exceed ten business days and will begin to run from the business day following the expiration date of the original period.

Suspension of the deadline
Art. 9.- The sixty-calendar-day period indicated in the first paragraph of Article 7 of these Standards shall be suspended for the days that elapse between the notification of the request to complete information or documentation referred to in the second and fifth paragraphs of Article 7 of these Standards, until the date on which the interested parties present the written document in which they remedy the observations required by the Superintendency.

Once the complete documentation is presented in due form, the Superintendency shall proceed without further procedure to respond to the request for authorization of the entry in the corresponding Registry, within a maximum period of three business days counted from the date of its approval.

The authorization issued by the Superintendency must be inscribed in a special registry created for such purposes, in accordance with what is stipulated in Article 12 of the Credit History Law.

Modification of the registry
Art. 10.- Any change or modification that affects the data of the respective inscription, in accordance with Article 13 of the Credit History Law, must be communicated by the legal representative of the AID to the Superintendency, within ten business days following the date on which it occurred, in order to carry out the corresponding enablement, which shall be noted in the marginal inscription in the Registry, without prejudice to what other laws establish.

Consultation points and complaint resolution centers Art. 11.- Once operations begin, the AID must comply with the duties and obligations established in Chapter IV of the Credit History Law and guarantee the rights of customers, consumers, or credit users of which they possess information in accordance with said Law; likewise, AIDs must have complaint resolution centers in three zones or regions of the country with attention on business days, as well as a consultation point in each department of the country, in central and easily accessible places, with attention seven days a week.

For these purposes, each region of the country shall be understood as the three geographic zones in which El Salvador is territorially divided: Western Zone, Central Zone, and Eastern Zone.
The procedure for the opening, operation, and closing of Consultation Points and Technical Standards for the Opening, Operation, and Closing of Consultation Points and Centers -31), approved by the Central Bank, through its Standards Committee.

Authorization of new products and services
Art. 12.- AIDs that, in the course of their operations, offer new products and services related to the consumer's or client's credit history, must present the following information to the Superintendency:
a) Letter signed by the Legal Representative or Attorney-in-fact of the AID, in which they explain the reasons for requesting approval of the new product or service; b) Description of the characteristics of the product or service; c) Result of the risk assessment implied by the adoption of the new product or service and the mechanisms or procedures to mitigate them; d) Security measures on electronic platforms and others related to user protection; e) Detail of the charges that the consumer or client will incur at the time of

TITLE II
ON CREDIT HISTORY
CHAPTER I
INFORMATION FOR CREDIT HISTORY

Personal data for credit history
Art. 13.- The personal data that may be requested by an AE from its consumers or clients in accordance with their internal policies, to prepare the credit history, are the following:
a) Person type, indicating whether it is a natural or legal person; b) Unique Identity Document (DUI) number, or valid document in case of being a foreigner (Passport or residence card); c) Tax Identification Number (NIT); d) Alternative identification number used by the person, in addition to the DUI, such as: passport, social security, residence card, driver's license, Taxpayer Registry Number (NRC) or VAT, this same may be used to discard homonyms; e) Name of natural person, considering: first surname, second surname, married surname, first name, second name, and third name if any; f) Sex; g) Marital status; h) Debtor's occupation (for natural persons); i) Resident (whether the person is a resident or not in the country); j) Country of residence; k) Date of birth; l) Name of legal person; m) Corporate name; n) Trade name;

The foregoing, without prejudice to the information that AEs may request in order to carry out their respective risk analyses, studies, and customer knowledge for the granting of credit; as well as the information requirements established by other applicable norms or laws.

Reference data
Art. 14.- The personal data of consumers or clients that, with their prior authorization, may be shared between AEs and AIDs, for the purpose of forming the credit history of consumers or clients, are those detailed in Article 13 of these Standards; likewise, they may share the reference data of the obligations of consumers or clients that the AEs possess, in accordance with the following:
a) Type of credit or obligation reported:
i. Commercial credit card;
ii. Bank credit card;
iii. Commercial credit;
iv. Installment credit, counted in 30 days;
v. Decreasing bank credit;
vi. Revolving bank credit; or
vii. Other (specify).
b) Economic destination of the credit or loan; c) Name of the entity that granted the credit or loan; d) Currency type of the credit or loan; e) Amount or limit of the credit or loan; f) Date of granting; g) Term granted for the credit or loan; h) Cancellation date; i) Total balance; j) Reference number; k) Due date; l) Payment method (monthly, bi-weekly, weekly, others); m) Installment amount (Installment amount established for the credit or loan, which includes only principal and interest); n) Number of installments; o) Days of default on principal;

The information regarding the reference data described in this article is optional and will depend on their generation by the AE in accordance with its internal policies, but the credit histories shown by AIDs to AEs cannot contain more information than that established in Articles 13 and 14 of these Standards.

AIDs must create the necessary mechanisms to validate that the information they receive from AEs is only the data established in Articles 13 and 14 of these Standards.

Use and transmission of information
Art. 15.- The information detailed in Articles 13 and 14 of these Standards is confidential and sensitive.

All natural or legal persons, public or private, who have access to any information related to the credit history, must keep due confidentiality regarding said information and, consequently, may not reveal or disclose it, totally or partially, to third parties, unless it concerns a competent authority or information included in ordinary operations within the scope of information agencies. Therefore, information related to the credit history may only be collected, used, and transmitted to AIDs and supplied by them to AEs in accordance with what is established in the Credit History Law, these Standards, and the applicable legal framework.

In the case where AIDs decide to use cloud computing storage and processing services for databases and/or their backups, they must comply with the following: (2) a) Ensure that data is encrypted. This encryption must be implemented in such a way that data can only be read or decoded by the AID itself, maintaining its confidentiality even from the cloud service provider. Under no circumstances shall the cloud service provider have access to decryption keys or mechanisms that allow them to access the stored information; (2) b) Ensure to complete and certify in advance the necessary operational tests of their information and control systems, in said environment; and (2) c) In the case of data migrations from local servers to cloud computing storage and processing services, they must establish policies and procedures for the elimination of information and the treatment of old equipment that contained this information, in the event that the AID decides not to retain said equipment. (2)

No third party providing cloud storage services may retain any backup, physical or electronic, of the databases, which must be stipulated from the service agreements or terms. The backup referred to in Article 19 of these Standards is excepted from the indication in this paragraph. (2)

-23) regarding the outsourcing of information technology activities or operations. (2)

In the case where AIDs decide to use cloud computing storage and processing services for databases and/or their backups containing the credit history information of their clients, they must submit to the Superintendency a copy of the contract signed with the provider of said service. (2)

Consumer or client authorization
Art. 16.- AEs must obtain the express authorization, either physically or electronically, of consumers or clients, for the purpose of transmitting or consulting with AIDs the data related to their credit history as well as their phone number and email address, as established in Article 14 letter a) and Article 17 letter h) of the Credit History Law, which must be recorded in a special individual document or other medium extended for such effect and cannot be part of general contract clauses. Likewise, AEs must deliver to consumers or clients a physical or electronic copy of the duly signed authorization, where the AID(s) in which the consultation of their data or transmission of their data will be carried out is specified.

The authorization referred to in the previous paragraph shall observe the deadlines established in Article 15 of the Credit History Law, being the responsibility of AEs to guarantee compliance with this paragraph.

AIDs may not include in their databases, without the express consent of the consumer or client, their payment history of basic residential services, such as: telephone, electricity, water, sewerage, and garbage collection. Such consent shall be issued in an individual form. In the event that the Superintendency or the Ombudsman identify this or other types of information without the proper authorization of the consumer or client, their elimination shall be requested, without prejudice to the sanctions established by the Credit History Law for such purposes.

AIDs must include in their consultation formats or screens, alert mechanisms or security notices to AEs, such that, at the time of performing a credit history consultation of a consumer or client, it indicates the reason for the consultation, with the object that the AE knows that it must have the express consent given by the consumer or client to consult their information.

The obligation to have authorization from consumers or clients is excluded for information requested by the Superintendency, Ombudsman, Attorney General's Office, and judicial courts, as well as in cases of checks that have been

Under no circumstances shall the consumer or client be obliged to sign authorization to share their credit information, nor shall it be a condition for the granting of a product or service, so it is up to them to sign or not sign said authorization.

Art. 17.- In the case of information related to the phone number and email address, the AE must facilitate the option for the consumer or client to decide the collection and transmission of said data, clarifying in the authorization document referred to in the previous article that if they do not provide their consent, they would not receive alerts via instant messaging service or by email when it is being reviewed by an economic agent of any kind, nor receive notifications related to consultation processes, complaints, or claims made at consultation points and/or complaint resolution centers.

The information referred to in the previous paragraph shall be used exclusively for instant messaging and sending emails, which includes the verification of identity of consumer or client user accounts to access mechanisms or technological developments and the sending of alerts or notification processes of credit history review by AIDs.

Without prejudice to what is established in the Credit History Law, in those cases where the consumer or client requests credit history information or requires sending of notifications related to complaint or claim processes through a consultation point and/or complaint resolution center, and has not provided their authorization to the AE to share their phone number and email address, AIDs may, only in these cases and at the request of the consumer or client, obtain said information, for the purpose that it can carry out the corresponding notifications. Likewise, AIDs must document the request received through consultation points and/or complaint resolution centers.

Consistency mechanisms
Art. 18.- AIDs must implement mechanisms to validate that the number of authorizations corresponds to the number of consultations performed or records transmitted related to the consumer's or client's credit history.

Likewise, AIDs must have mechanisms that validate that the number of authorizations received from AEs and the requests obtained directly from consultation points and/or complaint resolution centers for the collection and transmission of the consumer's or client's phone number and email address coincide with the number of records incorporated into the database created for such purposes.

Database
Art. 19.- The AID may maintain in the country the database containing the credit history of persons or use cloud computing storage and processing services for its safeguard. Likewise, it must have a backup or copies of said database, in case of contingencies or force majeure, for which it may likewise use cloud storage services or store it within national territory. The AID shall be responsible for the use and manipulation of the information contained in said backups. (2)

Data update
Art. 20.- AEs will provide monthly in the first ten calendar days the updated, true, and reliable information of all their records to the data information agencies, to which they are affiliated. Likewise, in the second half of each month, with the information that is related to the data holder, such as: rectifications, settlements, modifications, or eliminations due to erroneous and inaccurate data, observing for this purpose the deadlines established for such effects in the Credit History Law.

Art. 21.- AIDs must update their databases every fifteen days, in accordance with what is established in Article 17 letter b) of the Credit History Law, in the following manner:
a) In the first half of the month, the monthly information received from the AE referred to in Article 18 letter a) of the Credit History Law; and (2) b) In the second half of the month, incorporating the information that is related to the data holder, such as: rectifications, settlements, modifications, or eliminations due to erroneous and inaccurate data. Notwithstanding the foregoing, AIDs must strive to comply with the deadlines established in the Credit History Law.

In cases where the consumer or client fully cancels their credit, AIDs must eliminate from the database the information that negatively affects their credit history immediately, no later than the next business day after receiving the information from AEs.

CHAPTER II
NEGATIVE DATA

Requirements for inclusion of negative data
Art. 22.- The inclusion of negative data in an AID database will only be possible when there is a prior existence of a certain, partial or fully due, exigible debt that has resulted unpaid. Likewise, the failure to pay memberships associated with credit cards without principal or overdue interest balance will not be considered negative data.

Additionally, in the case of the guarantor and joint and several co-debtor, a prior payment request must be made to the principal co-debtor.
The Economic Agent (AE) or whoever acts on their own behalf or interest is obligated to keep available to the Data Information Agency (AID), the Superintendence, and the Consumer Ombudsman, sufficient documentation that proves compliance with the requirements for data inclusion.

Identification of the quality of guarantor or joint and several co-debtor Art. 23.- The AE must specify when any negative data of a customer or consumer is associated with or derived solely from their status as a guarantor or joint and several co-debtor, in accordance with subsection s) of Article 13 of these Standards.

Time of permanence of negative data
Art. 24.- The AID must permanently delete and render unusable negative data from the consumer's or customer's credit history, once a period of no more than three years has elapsed, from the incorporation of said data into the database.

Notwithstanding the above, in case the consumer or customer fully cancels their credit obligations, the AE must, within a maximum period of three business days, notify the AID, so that the information negatively affecting their credit history is immediately removed from the database, no later than the next business day after receiving the information from the AEs. In case the consumer or customer identifies that their negative data has not been removed from their credit history and informs the AID, if such inconsistency is attributed to the lack of communication by the AE, the AID must immediately inform the Superintendence and the Consumer Ombudsman, so that the corresponding sanctions established in the Credit History Law are applied. The AID must include within their policies and operational manuals, procedures that demonstrate compliance with the provisions of this article, through the implementation of mechanisms for the deletion of negative data, which allow the interruption of the distribution of said data to the AEs, meaning that these data cannot be part of the credit histories shown by the AID to the AEs. In this case, the AID must maintain logs indicating the deleted data, reasons, participants, and dates on which such deletion was performed. The AID must have backup mechanisms for information that allow the preservation of deleted information for a minimum of ten years, as established in the Commercial Code.

Art. 25.- The AID must send monthly, within a period of fifteen business days following the reference month, a report on the information of persons whose data affecting their credit history negatively has been permanently deleted, in accordance with what is established in Article 24 of these Standards. Such report must be sent to:
a) The AEs that granted the credit or loan; b) The AEs that have the respective authorization; and c) The Superintendence.
The minimum content that the report must include is detailed in Annex No. 1 of these Standards.

Art. 26.- In order to comply with Article 14 subsection j) of the Credit History Law, the AEs must send to the AID information regarding cancelled credits, duly updated.

Obligation of Economic Agents
Art. 27.- The AEs are obligated to keep available to the AID, the Superintendence, and the Consumer Ombudsman, sufficient documentation that proves compliance with the requirements for the inclusion of negative data, in accordance with what is established in Article 22 of these Standards, as well as the mechanisms used to carry out the collection of the obligation in question. This information that proves compliance with the data inclusion requirements generated must be preserved for a minimum of ten years, as established in the Commercial Code.

Furthermore, no later than within a period of seven business days counted from the date a credit is fully cancelled, the AE must issue the corresponding discharge certificate to the consumer or customer. For these purposes, technological mechanisms must be implemented that allow the consumer's or customer's information to be updated in the most immediate manner. The technological mechanisms referred to in the preceding subsection must guarantee the protection, confidentiality, and integrity of the information during the transmission process and must be subject to what is established in Article 49 of these Standards.

Consultation of Negative Data
Art. 28.- The AEs members of the financial system may consult the negative data of consumers or customers from the credit information system managed by the Risk Central of the Superintendence, corresponding to the last three years, counted from the date of consultation.

CHAPTER III
ON THE REPORT OF THE CREDIT HISTORY OF INDIVIDUALS

Access to credit history
Art. 29.- Consumers or customers may access free of charge the information about themselves registered in the databases managed by the AID, who must provide the credit history in written form or through any other technological means, at the moment it is requested. Prior to the delivery of said information, the consumer or customer must have requested it through the means enabled by the AID for such purposes, who must have verified faithfully in accordance with their internal policies, the identity of the requesting consumer or customer or, in their absence, through a duly authorized representative. Furthermore, the AID must inform the consumer or customer of the list of AEs that accessed their credit history in the last three years and the use for which it was requested. For these purposes, the AID must keep control and record of the following information:
a) Date of consultation; b) Record of the Names of the AEs and users authorized by the AEs before the AID; and c) Reason for consultation (such as: credit evaluation, portfolio study or monitoring, or legal requirement).

Content of the report on credit history
Art. 30.- In addition to what is established in Article 14-A of the Credit History Law, the report on the consumer's or customer's history must incorporate the following information:
a) Specification of negative data associated with or derived from the status of guarantor or joint and several co-debtor, if applicable, for which the AID must detail the date from which the negative data affected their credit record and the new rating obtained, derived from it; b) List of discharge certificates received from the AEs and the date of updating the consumer's or customer's information; c) Detail of the last date of updating the consumer's or customer's information; and d) Period during which the consumer or customer has been reported without negative data based on the situations indicated in Article 37-A of the Credit History Law.

On the rating of credit history
Art. 31.- The rating of credit history referred to in Article 14-A of the Credit History Law must be performed based on technical criteria and parameters, ensuring that it does not violate the rights of individuals.
The methodologies applied by the AID must be available to the Superintendence, who, in case of identifying needs for adjustments to said methodologies, will communicate the observations they consider pertinent.
The AID that offer to the AEs the service of rating the credit risk profile of a person, consumer, or customer, as well as the information provided by these, must always observe the current legal framework, with special emphasis on information subject to confidentiality. Quality controls Art. 32.- The AID and the AEs must adopt adequate quality controls of credit information in accordance with Article 4 of the Credit History Law; however, the legality, truthfulness, accuracy, integrity, and validity of the information are the responsibility of the AEs. Therefore, the AEs must establish information confidentiality policies to ensure the proper handling of information. It is the legal responsibility of the AID to report and certify the information without any alterations or modifications in relation to the information received from the AEs.

CHAPTER IV
PROCEDURE FOR THE RECTIFICATION, MODIFICATION AND CANCELLATION OF DATA

Exercise of rights
Art. 33.- The rights of access, rectification, modification, and cancellation of the data stored to provide data information services on credit history may be exercised by the consumer or customer before the AE, the AID, the Superintendence, or the Consumer Ombudsman. The consumer or customer will request the rectification of their data through the means and processes established in the Credit History Law, being able to use technological means, which must have the necessary mechanisms or security policies to determine the identity of the consumer or customer at the time of their attention, which must primarily ensure the protection, confidentiality, and integrity of the consumers' or customers' information. The Superintendence may hear actions related to the exercise of the rights of access, rectification, modification, and cancellation of stored data in accordance with the preceding subsection, when the holder of such rights is a client of an entity under the supervision of the Superintendence.

Attention to consumer or customer
Art. 34.- The AID must establish the necessary internal procedures to provide efficient, effective, and timely attention to requests for access, update, rectification, or elimination submitted by consumers or customers, guaranteeing the deadlines and rights of the same in accordance with what is established by the Credit History Law; as well as clearly determine the adequate communication and coordination mechanisms with the AEs in order to attend to the requests, said mechanisms must guarantee the quality and truthfulness of the data. In order to provide a more efficient service to the consumer or customer, regarding the attention to requests for access, update, rectification, or elimination of data, the AID must make available to them, in accordance with their internal policies, the following:
a) Consultation points and Complaint Resolution Centers in accordance with what is established in Article 11 of these Standards; b) Mechanisms or technological developments (such as: Website, email, technological applications, or other mechanism of equal nature), in order for the consumer or customer to have real-time access to queries of their credit history. In this case, the AID must have the necessary security measures or authentication factors to determine the identity of the consumer or customer at the time of their attention and maintain the confidentiality of the data to be provided; and c) Postal mail or physical correspondence.

The mechanisms or technological developments implemented by the AID and the information obtained from the consumer or customer for these purposes, at the time of registration to obtain their user and access key or for identity verification processes, cannot be used for purposes other than those established in the Credit History Law. The AID must provide an access key to consumers or customers, through the means previously agreed with them, in order to consult the information on the credit history on the Website. For this, they must send a temporary access key in order for it to be personalized by the consumer or customer.

Presentation of complaints or reports
Art. 35.- The presentation of a complaint or report, derived from the actions of rectification, modification, or elimination, before the AE, the AID, the Superintendence, or the Consumer Ombudsman, must be made by printed request, by email, or other technological means and must comply with the requirements established in Article 21 of the Credit History Law, always applying security measures to faithfully determine the identity of the consumer or customer at the time of the attention of the complaint or report. When the consumer or customer directs the complaint or report to the AE or the AID, a record of the day and hour it is made must be left, and it must be responded to within a period of no more than three business days.

On the resolution of the request
Art. 36.- In case that the period referred to in Article 35 of these Standards has elapsed and the AE or the AID has not resolved the consumer's or customer's request, or provided an unsatisfactory response, they may go before the Consumer Ombudsman so that this proceeds with the corresponding investigation to determine if such a request is appropriate, for which the consumer or customer must present the request or response, in the cases where there is one. The Consumer Ombudsman must issue a reasoned and motivated resolution of the request submitted by the consumer or customer, in accordance with the procedure established in Article 24 of the Credit History Law, within a period of five business days following. In the case that the complaint or report is presented before the Superintendence, the procedure established in this Chapter will apply as appropriate and based on its legal competencies.

Updated report
Art. 37.- When an update, rectification, or elimination of information that was considered erroneous, inaccurate, ambiguous, incomplete, outdated, or false is registered, pursuant to the assumptions established in Article 14 subsection e) of the Credit History Law, the AID must make available to the holder a new updated credit history. To carry this out, it will be the responsibility of the AEs to create the processes for rectification, update, or elimination of information so that it is supplied efficiently to the AID, and to comply with the correction of data within a term of no more than three business days after the date of the consumer's or customer's request. For the rectification order to be valid, it must be sent through the means and persons assigned by the AEs and the AID, and also in accordance with applicable laws and documented as part of their processes. The AID must maintain logs indicating the updated or modified data, reasons, participants, and dates on which the same were performed.

Control of rectifications
Art. 38.- The AID must establish a register for the statistical control of claims in cases of rectification, update, modification, or elimination of inaccurate information contained in the databases, detailing: the number of cases, the type of claims received, the cases resolved, time spent to resolve, and the cases pending resolution, in accordance with the format described in Annex No. 2 of these Standards. The register must be sent monthly to the Superintendence within a period of seven business days following the reference month, in accordance with the technical guidelines issued by the Superintendence as established in Article 61 of these Standards.

TITLE III
ON MECHANISMS OR TECHNOLOGICAL DEVELOPMENTS

SINGLE CHAPTER
ON MECHANISMS OR TECHNOLOGICAL DEVELOPMENTS

Purpose of mechanisms or technological developments Art. 39.- The AID must implement mechanisms or technological developments such as websites, mobile applications, or other platforms that contribute to facilitating access to the information of consumers or customers. These must be user-friendly in order to have real-time access to queries of their credit history, as well as to receive alerts via instant messaging service when the same is being reviewed by an AE of any kind. In the provision of the services referred to in the preceding subsection, the AID must have security mechanisms that guarantee the protection, confidentiality, and integrity of the consumers' or customers' information.

Applicable principles
Art. 40.- The creation, implementation, and operation of mechanisms or technological developments by the AID will be governed by what is provided in Article 4 of the Credit History Law.

Multi-factor authentication
Art. 41.- Entities must implement the use of multi-factor authentication in any account accessed through the Internet, including among these the user accounts of consumers or customers to access mechanisms or technological developments, such that two or more additional layers of security are added to each online platform accessed. Such authentication factors will be, among the following:
a) Authentication factor category 1: Composed of information obtained from the consumer or customer and the use of products, services, or operations carried out by them through various channels. This information will be used through the application of questions to the client through the mechanisms or technological developments. b) Authentication Factor category 2: Composed of passwords that only the client knows and enters through an access mechanism or device. c) Authentication Factor category 3: Composed of dynamic one-time keys, generated by electronic devices or any other means. d) Authentication factor category 4: Composed of client information, derived from their biometric characteristics. The AID must implement at least two of the factors listed in the preceding subsections.

Rights and Protection of Consumer or Customer
Art. 42.- Consumers or customers who make use of the mechanisms or technological developments implemented by the AID will observe the rights established in Article 14 of the Credit History Law.

Information available for consultation by consumers or customers Art. 43.- The mechanisms or technological developments must show the information established in Article 14-A of the Credit History Law and in the Technical Standards for Credit History Information Services for Individuals. Furthermore, they must provide the consumer or customer with the option to download the credit history report, as well as other facilities related to the following minimum aspects:
a) Updating of consumer or customer information, if applicable; b) Search by time periods; c) Graphical information showing the evolution of the consumer's or customer's ratings; d) Contact form for queries, requests, complaints, or claims related to the information consulted or to the operation of the mechanisms or technological developments; e) Hours, means of attention to the consumer or customer, and locations; and f) Notification configuration, if applicable.

Art. 44.- The AID will ensure that the information presented to the consumer or customer does not induce confusion or inaccurate or ambiguous interpretations of their credit behavior.

TITLE IV
ON RISK MANAGEMENT

CHAPTER I
GENERAL ASPECTS
Risk Management
Art. 45.- Data Reporting Agencies (AID) must establish a risk management system through which they identify, measure, control, mitigate, monitor, and communicate the risks to which they are exposed and the interrelationships that arise among them, which may affect the course of their operations and the provision of services to Credit Reporting Agencies (AE) and consumers or clients. Such management must be consistent with the nature of the aforementioned entities and their respective operations. The risk management process must be duly documented and reviewed periodically based on changes occurring in the environment. The policies, procedures, and manuals issued by AID must be in the Spanish language.

Stages of the risk management process
Art. 46.- AID must have a documented continuous process for managing their risks, which must contain at least the following stages:
a) Identification: Existing risks in each operation, service, and process developed are recognized and understood. In this stage, risk factors that may generate changes in the confidentiality, availability, integrity, and functionality of technological platforms and the information handled regarding AEs and consumers or clients are identified; b) Measurement: Risks must be quantified in order to determine the compliance or adequacy of policies and mechanisms, to measure the possible economic impact for both AID and AEs, as well as for the consumer or client. The methodologies and tools for measuring risks must correspond to the nature of each entity and its respective operations; c) Control and mitigation: Seeks to ensure that the policies and mechanisms established for the treatment and mitigation of risks are appropriately taken and executed; and d) Monitoring and communication: Systematic and permanent follow-up is given to the risks faced by AID and the results of actions adopted. These information systems must ensure a periodic and objective review of risks and the generation of sufficient information to support decision-making processes and allow the results of risk management to be communicated in a timely manner.

Regarding Information Security and Business Continuity Art. 49.- AID, in the exercise of their operations and in the mechanisms or technological developments made available to the consumer or client, must comply with what is established in the (NRP- -24), approved by the Central Bank, through its Standards Committee, according to their size, nature, and volume of activities. (2)

CHAPTER II
RISK MANAGEMENT FRAMEWORK

Policies for Risk Management
Art. 50.- AID must approve and develop policies to define the risk management framework to which they are exposed, in such a way that they allow them to reduce their vulnerability and losses due to such risks and promote at the level of the entire organization a culture of prevention and risk management. Risk management policies must consider, among other aspects, the functions and responsibilities that directors, executives, and employees will have in such management, as well as the criteria and mechanisms for the identification, measurement, control, mitigation, monitoring, and communication of the risks presented by the entity. Likewise, they must be consistent with the nature of the entities and their respective operations, according to the applicable legal regime. Mechanisms for Risk Management Art. 51.- AID must have mechanisms for risk management that, based on policies, allow them to monitor associated processes, the functions and responsibilities of the involved areas, the methodologies for measuring risks detailing variables, criteria, tools used, and the periodicity with which information on exposure to identified risks must be reported.

Information Systems
Art. 52.- AID must have mechanisms that enable the generation of timely, reliable, consistent, and homogeneous information on risk management, which must be reported to the directors and executives of said entities, as well as to other interested parties responsible for decision-making in risk management. Internal Control System Art. 53.- The internal control system includes risk management, which allows verifying compliance with the policies and mechanisms established during the execution of AID operations. For this purpose, the aforementioned entities must establish the necessary administrative, financial, and technological controls, in accordance with the current legal framework. Annual Report Art. 54.- AID must submit to the Superintendence within the first one hundred [days] containing at least the following:
a) The organizational structure for risk management; b) Details of the main risks assumed derived from the entity's activities; c) List of policies and mechanisms for risk management, including the date of the last modification; d) Description of the methodologies, systems, and tools used for risk management; and e) General conclusions on the entity's risk management. Notwithstanding the foregoing, AID must immediately inform the Superintendence upon becoming aware of any aspect related to risk exposure, which may impact qualitatively or quantitatively the provision of products and services to AEs and consumers or clients, as well as the confidentiality, availability, integrity, and functionality of technological platforms. Disclosure on Integrated Risk Management Art. 55.- AID must disclose in summary form on their Website and electronic platforms, within the first ninety calendar days of each year, information regarding the policies, mechanisms, and other relevant measures adopted for risk management. In any case, AID must ensure that such information is duly updated.

SINGLE CHAPTER
OTHER PROVISIONS AND VALIDITY

Outsourcing of technological mechanisms or developments or consumer/client attention Art. 57.- In the event that AID execute the creation of the mechanisms or technological developments referred to in article 35 of these Standards through a third party, the provisions of (NRP- -23) approved by the Central Bank through its Standards Committee, shall apply, as applicable. In cases where AID provide consumer/client attention through a third party, such relationship must be perfected and formalized through the signing of a contract stipulating the obligations for each of the parties. The quality of contracted services is the responsibility of the AID, which will be liable to third parties as if it had performed them itself. For these purposes, the AID must have policies and procedures regarding the contracting of services. Access to Databases Art. 58.- The Central Bank and the Superintendence will have unrestricted access to the real-time data information systems, in accordance with what is established in article 5 and 17 letter n) of the Credit History Law. (2) Term of Operations Art. 59.- When an AID voluntarily agrees to terminate its operations, it must communicate this to the Superintendence sixty business days in advance, in order for said Superintendence to verify that the closure process is orderly, the authorization granted is revoked, and its corresponding registration is cancelled. For the delivery of the database, what is established in article 56 of these Standards will be considered.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-16/2021
NRP-30
TECHNICAL STANDARDS FOR THE AUTHORIZATION, REGISTRATION, AND OPERATION OF DATA REPORTING AGENCIES AND CREDIT HISTORY INFORMATION SERVICES FOR PERSONS Approval: 06/11/2021 Validity: 23/11/2021 Safeguarding and Seizure of Databases Art. 60.- In cases where the Superintendence proceeds in accordance with what is established in article 32 of the Credit History Law, it will require the AID to deliver the databases for safeguarding, within a period of three business days, counted from the notification of the authorization revocation. The aforementioned request will be notified to the legal representative of the AID, stating the object of the proceeding and the place where it will be carried out. The appearance or non-appearance of the legal representative of the AID will be recorded in minutes. After the seizure of the databases of an AID, minutes must be drawn up before a Notary Public recording the result thereof, making a concise and detailed account of what occurred, placing special emphasis on those circumstances useful for the case. The minutes must include the appearance of the legal representative of the AID or person authorized for such effect and the delegates of the Superintendence, with the notary attesting to the appearance or non-appearance of the AID's representatives, as well as the consent to the signing of the minutes. AID may not retain any backup, physical or electronic, of the databases. The minutes will be signed by the legal representative of the AID, if present, and by the delegates of the Superintendence. AID may not retain any backup, physical or virtual, of the database. If the AID does not comply with the aforementioned deadline, the Superintendence will proceed within a maximum period of twenty-four hours, with the assistance of the public force and without further procedure, to seize the databases. In the case of authorization revocation, if the AID overcomes the causes that caused the revocation, the Superintendence will proceed to return the database within a period not exceeding five business days, counted from the date the revocation causes have been overcome. Technical Details of Information Submission Art. 61.- The Superintendence will send to the subjects subject to these Standards, with a copy to the Central Bank, the technical details related to the submission of information required in these Standards, which will be communicated within a period of ninety calendar days following the validity of the Standards. The information requirements will be limited to the collection of information

MODIFICATIONS:
(1) Modifications in article 6 approved by the Central Bank through its Standards Committee, in Session No. CN-02/2022, dated February 21, two thousand twenty-two, due to reforms contained in Legislative Decree No. 203 to the Law on Registration and Special Control of Taxpayers to the Treasury, with effect from March 8, two thousand twenty-two. (2) Modifications in articles 3, 15, 19, 21, 49, and 58, and incorporation of a new consideration VII, approved by the Central Bank through its Standards Committee, in

REPORT ON PERSONS WHOSE DATA AFFECTING THEIR CREDIT HISTORY NEGATIVELY HAS BEEN PERMANENTLY REMOVED

No. Concept Description
1 Correlative Number Indicate the request number.
2 User Name Indicate the name of the debt holder.
3 Unique Identity Document Number (DUI) Indicate the unique identity document number or valid document in case of being a foreigner (passport or residence card).
4 Credit Reference Number Indicate the credit reference number.
5 Elimination Reference Number Control and tracking number assigned by the AID.
6 Total Balance Corresponds to the total outstanding balance.
7 Last Payment Date Indicate the last payment date.
8 Cancellation Date Date on which the total debt payment was made.
9 Credit Type Indicate the type of credit or obligation.
10 Entity Indicate the name of the entity that granted the credit.
11 Amount Indicate the amount granted or credit limit.
12 Granting Date Indicate the date of granting the credit.

No.
Correlative
Type of
Claims
Date of
Presentation
Name of the
Consumer or
Client
Unique Identity Document Number
(DUI)
No.
Reference of the
Claim
Related
AE
Description of the Claim
Date of
Resolution
Type of resolution
Office that attended the
Claim Favorable Unfavorable In process
Instructions:
No. Correlative: Number of claims in this report.
Type of Claim: Classification of the claim: rectification, modification, cancellation, or elimination.
Date of Presentation: Date on which the consumer or client presented the claim to the AID.
Consumer Name: Name of the Claimant.
Unique Identity Document Number (DUI): Indicates the unique identity document number or valid document in case of being a foreigner (passport or residence card).
Claim Reference Number: Control and tracking number assigned by the AID.
Related AE: Name of the AE related to the client and the claim.
Claim Description: Description of the user's disagreement motivating the claim.
Resolution Date: Date on which the AID responded to the consumer or client.
Type of Resolution: Favorable: When recognized in favor of the consumer or client, Unfavorable: When resolved that the claim is unfounded or inadmissible in accordance with what is established by the Credit History Law and these Standards, or In Process: When the claim is still under analysis at the date of the report submission. Office that Attended the Claim: Name of the AID unit responsible for attending the claim.

Field Name Description a) Type of credit or loan reported:
i. Commercial credit card;
ii. Bank credit card;
iii. Commercial credit;
iv. Term credit, counted at 30 days;
v. Decreasing bank credit;
vi. Revolving bank credit; or
vii. Others.
Refers to the type of obligation. (for example:
Card, commercial credit, term credit, etc.) b) Economic destination of the credit or loan: Refers to the economic destination of the loan:
i. Agricultural and livestock;
ii. Mining and Quarries;
iii. Manufacturing industry;
iv. Construction;
v. Electricity, Gas, Water, and Sanitary Services;
vi. Commerce;
vii. Transportation, Warehousing, and
Communications;
viii. Services;
ix. Housing acquisitions;
x. Consumption (personal loans);
xi. Financial institutions; and
xii. Other activities.
c) Name of the entity that granted the credit or loan; Indicate the name of the entity granting the credit or obligation. d) Currency type of the credit or loan; The currency in which the amount granted of the credit or obligation is specified. e) Amount or limit of the Credit or loan; Indicate the disbursed amount corresponding to the reference or the limit of the same. f) Granting Date; Indicate the date on which the credit or obligation was originally granted. g) Granted Term of the credit or loan; Indicate the granted term of the credit or obligation. h) Cancellation Date; Cancellation date of the reference. i) Total Balance; Indicate the total balance of the reference. j) Reference Number; Indicate the reference number of the obligation or the BIN Code of the reference. k) Maturity Date; Indicate the maturity date of the reference of the obligation, according to the original document.

Field Name	Description
l) Payment method;	Indicate the payment method of the reference, such as: monthly, bi-weekly, weekly, among others.
m) Installment amount;	The installment amount established for the credit, which includes only principal and interest.
n) Number of installments;	Indicate the number of installments of the reference.
o) Days overdue on principal;	Indicate the days overdue on principal of the reference.
p) Days overdue on interest;	Indicate the days overdue on interest of the reference.
q) Start date of principal delinquency;	Indicate the start date of the principal delinquency balance.
r) Start date of interest delinquency;	Indicate the start date of the interest delinquency balance.
s) Risk category or Debtor rating (objective or technical ratings);	Indicate the risk category assigned to the debtor in accordance with the internal policies of the DII. In the case of DIIs subject to supervision, it must be carried out in accordance with [Reference to Risk and Reserves Regulation -022)].
t) Principal delinquency balance;	Indicate the principal delinquency balance of the reference.
u) Interest delinquency balance;	Indicate the interest delinquency balance of the reference.
v) Overdue principal balance;	Indicate the overdue principal balance of the reference.
w) Overdue interest balance;	Indicate the overdue interest balance of the reference.
x) Last interest payment date;	Indicate the date of the last interest payment of the reference.
y) Last principal payment date;	Indicate the date of the last principal payment of the reference.
z) Negative data date;	Indicate the date of the failure to meet a payment obligation subject to a loan contract.
aa) Type of guarantee (Example: mortgage, pledge, or personal);	Indicate the type of guarantee of the reference.
bb) Status of the guarantee (presented or registered);	Indicate the status of the guarantee, for example: guarantee presented, guarantee registered, and guarantee pending presentation.

Alameda Juan Pablo II, between 15 and 17 Norte Ave, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-16/2021
NRP-30
TECHNICAL STANDARDS FOR THE AUTHORIZATION, REGISTRATION AND OPERATION OF DATA INFORMATION AGENCIES AND CREDIT HISTORY INFORMATION SERVICES FOR INDIVIDUALS Approval: 06/11/2021 Validity: 23/11/2021
Annex No. 3

GLOSSARY OF TERMS

Field Name	Description
cc) Mortgage degree;	Indicate the degree of the guarantee (first, second, etc.).
dd) Principal advance;	Advance payment of principal made by the client.
ee) Interest payment day;	Indicate the day corresponding to the interest payment of the reference.
ff) Principal payment day;	Indicate the day corresponding to the principal payment of the reference.
gg) Credit status (active, overdue, cured, etc.);	Indicate the status of the credit as of the cut-off date, considering:

Active: References that are current or with delinquency less than 90 days;
Overdue: Reference with delinquency greater than 90 days;
Cancelled: References cancelled in the month;
Cured: Reference liquidated against a cure reserve, whether by prescription, judicial sentence, considering it unrecoverable, or in compliance with the current accounting framework;
Judicial Route: Reference to which the collection process has been initiated via judicial route. |
| hh) Judicial stage (indicates that the credit is in that stage); | Indicate the stage of the credit in the judicial route, for example: lawsuit, summons, answer to the lawsuit, opening of evidence, sentence and appeal. |
| --- | --- |
| ii) Amount disbursed; | Indicate the amount disbursed of the reference data. |
| jj) Interest grace period; | Indicate the grace period for interest payment. |
| kk) Principal grace period; | Indicate the grace period for principal payment. |
| ll) Cure reserve constituted (total per debtor or per reference); | Cure reserve provisions constituted and accounted for by the entity for each debtor or reference. The calculation must [Reference to Risk Classification Regulation -022)], when applicable or in accordance with internal policies of the DII. |

GLOSSARY OF TERMS

Field Name	Description
mm) Total debtor risk;	Risk category assigned to the debtor.
nn) Active principal balance;	Indicate the active principal balance of the reference.
oo) Active interest balance;	Indicate the active interest balance of the reference.
pp) Date of credit status change;	Indicate the date of the change in credit status.
qq) Balance status;	Indicate balance status (active or overdue).
rr) Portfolio code: Type of portfolio to which
the debtor's references belong;
Indicate the type of portfolio to which the debtor's references belong.
---
ss) Asset code: Type of risk asset to which
the debtor's references belong;
Indicate the type of risk asset to which the debtor's references belong.
---	---
tt) Cancelled reference flag;	Indicate the cancelled reference flag of the reference.
uu) Creditor reference;	Indicate the creditor reference of the obligation.
vv) Principal payment amount;	Indicate the principal payment amount.
ww) Interest payment amount;	Indicate the interest payment amount.
xx) Credit line.	Indicate the status of the credit line if it is active or overdue.

Lineage: No known changes

Similar documents from other regulators