Technical Standards for the Business Continuity Management System

NRP-24
OF THE BUSINESS
Approval:
14/04/2020
Validity: 01/07/2020

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That in accordance with Article 2, second paragraph of the Law on Supervision and Regulation of the Financial System, for the proper functioning of the Financial Supervision and Regulation System, it is required that the members of the financial system and other supervised entities comply with current regulations and adopt the highest standards of conduct in the development of their business, acts, and operations, in accordance with the provisions of the aforementioned Law, other applicable laws, regulations, and technical standards issued for this purpose.

II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendence of the Financial System.

III. That in accordance with Article 35, first paragraph and letter d) of the Law on Supervision and Regulation of the Financial System, directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations in compliance with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management are fulfilled, including among other actions, identifying, evaluating, mitigating, and disclosing them in accordance with international best practices.

IV. That in accordance with Article 99, letters a) and g) of the Law on Supervision and Regulation of the Financial System, the Central Bank of Reserve of El Salvador is the institution responsible for approving technical standards related to risk management by supervised entities, as well as those that define the minimum physical conditions that premises must meet, their security measures, and matters related to the conservation and archiving of documentation of the members of the financial system.

V. That international standards suggest, among other good practice activities, broad guidelines on business continuity, with a description of the methods, techniques, and approaches used worldwide to develop, implement, and maintain an effective business continuity management system.

VI. That it is convenient for entities to adequately manage the risks to which the different processes and activities they perform are exposed, in order to guarantee business continuity, ensuring efficient operational risk management.

NRP-24
OF THE BUSINESS
Approval:
14/04/2020
Validity: 01/07/2020

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE BUSINESS CONTINUITY MANAGEMENT SYSTEM

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Standards aim to establish the minimum provisions that entities must consider to establish a Business Continuity Management System and criteria for adopting policies, plans, methodologies, and procedures in accordance with international best practices, the size, nature of their operations, business segmentation, and the organizational complexity of each entity, and in this way, strengthen their operational risk management.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Banks incorporated in El Salvador, their offices abroad, and their subsidiaries; branches and offices of foreign banks established in the country; b) Companies that, in accordance with the Law, integrate financial conglomerates, or that the Superintendence of the Financial System declares as such, which includes both their holding companies and their member companies; c) Institutions administering pension funds and the funds they administer; d) Insurance companies incorporated in the country, their branches abroad, branches of foreign insurance companies established in the country, and Insurance Cooperative Associations incorporated in the country, insofar as it does not contradict their respective Law; e) Stock exchanges, brokerage firms, companies specialized in the deposit and custody of securities, risk classifiers, and agents specialized in securities valuation; f) Cooperative banks, savings and credit companies, and federations regulated by the Law on Cooperative Banks and Savings and Credit Companies; g) Mutual guarantee companies and their local guarantors; h) Companies that offer complementary services to the financial services of the members of the financial system, particularly those in which they participate as investors; i) Administrators or operators of payment systems and securities settlement systems; j) The Social Housing Fund and the National Popular Housing Fund, insofar as it does not contradict their creation laws or what is provided by the Court of Accounts; k) The National Institute of Pensions for Public Employees and the Salvadoran Institute of Social Security, the latter with respect to the Professional Risks Regime and technical health reserves; l) The Social Prevision Institute of the Armed Forces; m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador; n) Securitization companies and the funds they administer; o) Products and services exchanges; p) Investment fund managers and the funds they administer; q) Electronic Money Provider Companies; r) Data Information Agencies. (2) s) The Pension Unit of the Salvadoran Institute of Social Security; and (2) t) Investment banks, their offices abroad, and their subsidiaries. (2)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: the Executive President, Executive Director, General Manager, or acting person, and executive positions that report to them. For the case of the Development Bank of El Salvador and the National Institute of Pensions for Public Employees, the President; b) Threat: the potential cause of an unwanted event, which can affect business continuity; c) Business Impact Analysis (BIA): a process in which the business processes, functions, and activities are analyzed, along with the consequences of an interruption on them; d) Central Bank: Central Bank of Reserve of El Salvador; e) Business Continuity: is the capacity of an entity to continue offering its products or services at levels previously defined as acceptable after an interruption incident; f) Organizational Culture: is the set of attitudes, beliefs, behaviors, norms, and values accepted and applied daily by the members of an entity in their interaction among themselves and with the outside world; g) Entity: subject obligated to comply with the provisions of these Standards, described in Article 2 thereof; h) Event: occurrence or change of a particular set of circumstances; i) Business Continuity Management: comprehensive management process that identifies threats to which an entity is potentially exposed and the impact they could cause on business operations, should they materialize. This process provides a framework to build the organizational capacity to overcome an interruption incident and offer an effective response, thereby safeguarding corporate objectives, reputation, brand, and value-creation activities; j) Crisis Management: process by which an entity faces one or more events of considerable magnitude that threaten to affect the entity and stakeholders financially, economically, and reputationally, in front of its clients, users, or the general public. Such events might not imply the disruption of the entity's operations, such as the dissemination or publication of information that could damage its reputation; k) Stakeholders: individuals or organizations affected by an entity's operations. Examples: employees, clients, debtors, business partners, suppliers, shareholders, government institutions, among others; l) Interruption Incident: an event that has the capacity to generate an interruption in the products or services offered by an entity, which, if not managed appropriately, can cause an emergency, crisis, or disaster. It is also known as a disruptive incident; m) Board of Directors: collegial body responsible for the administration of the entity, with supervisory, directional, and control functions, or an equivalent body; for the case of Cooperative Associations, it will be the Board of Directors or as defined in its Creation Law; n) Maximum Tolerable Period of Disruption (MTPD): is the time it would take for adverse impacts to become unacceptable for the entity; o) Minimum Business Continuity Objective (MBCO): is the minimum acceptable level of products or
services that an entity must offer to achieve its objectives during an interruption incident; p) Business Continuity Plan (BCP): documented procedures that guide entities to respond, recover, and continue business at a predefined acceptable level of operation, following an interruption incident and within predefined recovery times; q) Process: refers to the set of interrelated and repeatable procedures and activities that produce an expected result; r) Product and service: beneficial results provided by the entity to critical services, clients, debtors, beneficiaries, and other stakeholders; s) Full tests: execution of all plans and procedures of the entire organization's recovery. Evaluation of alternative operational capabilities in a highly stressful environment, without this putting at risk the provision of products and services by the entity. Eventually, competent public sector entities could be involved; t) Test(s): simulation of an interruption of processes or operations to evaluate the components of a plan (for example, tasks, teams, personnel, procedures, among others) with the objective of verifying if it is viable and functional. Such tests may be as follows:

i. Desktop: A testing method to exercise plans, in which participants review and discuss action plans and procedures without executing them, in a safe and stress-free environment. It can be carried out with one or several teams or departments. It usually requires the guidance of a facilitator;
ii. Simulations: their process involves using a created situation to validate the plan's information, generating a theoretical response to the incident; and
iii. Functional: execution of the recovery plans and procedures of an area or line of business;
u) Recovery Point Objective (RPO): represents the maximum acceptable data loss for it to remain feasible to resume an operation and is expressed in units of time of lost information; v) Critical services: are the priority services and activities whose unavailability compromises the existence of the entity; w) Business Continuity Management System (BCMS): is part of the general management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity. That is, it provides a formal method to launch Business Continuity Management and verify that it is effective and consistent with defined continuity levels and organizational culture; x) Superintendence: Superintendence of the Financial System; y) Outsourcing of services: occurs when the entity entrusts the performance of a process to a third party, that is, to a natural or legal person distinct from the entity; and z) Recovery Time Objective (RTO): is the time established by the entity to resume the delivery of a product or service after an interruption incident. The RTO of each product, service, process, or activity is less than the respective Maximum Tolerable Period of Disruption.

CHAPTER II
ROLES AND RESPONSIBILITIES

Business Continuity Management
Art. 4.- The Board of Directors, Senior Management, and personnel must permanently manage the business continuity of the entities. The business continuity management of the entities must be adequate to the nature, size, and complexity of the operations, products, and services they offer. In this sense, entities must have an organizational or functional structure that clearly delimits the specific functions, roles, and responsibilities associated with business continuity, as well as the levels of dependence and interrelation that correspond to each of the other areas of the entity. Likewise, when the size and complexity of the entity's operations and services warrant it, the business continuity function may be performed by a unit, specialized area, or person designated by the Board of Directors and who guarantees its reporting to the same.

Responsibilities of the Board of Directors
Art. 5.- The Board of Directors will be responsible for establishing and maintaining a System for Business Continuity Management, which allows the entity to protect its personnel, assets, maintain operation at the minimum acceptable level when interruption incidents occur, and recover the normal level of operations once the emergency phases are overcome, so it must perform, at a minimum, the following:
a) Approve the strategies, policies, and manuals of the Business Continuity Management System of the entity, and ensure that Senior Management implements them effectively; b) Approve the allocation of necessary resources to establish, implement, and improve business continuity management in accordance with the defined recovery and continuity strategy; and c) Ensure that the Business Continuity Management System is implemented and maintained adequate to meet its objectives, for which it must, at a minimum, perform the following:
i. Periodically know the results of tests and evaluations of the System, ensuring that identified recommendations and improvement opportunities are incorporated;
ii. Ensure that Internal Audit verifies the existence and compliance of business continuity management; and
iii. Know the results of the activation of continuity plans after the response to interruption incidents, the adjustments, and improvement opportunities that must be implemented to strengthen the effectiveness of the BCMS.

Responsibilities of the Risk Committee
Art. 6.- The Risk Committee is responsible for ensuring sound business continuity management of the entity, so it must perform, at a minimum, the following:
a) Evaluate, review, and propose for approval by the Board of Directors the entity's business continuity strategies, policies, and manuals; b) Approve business continuity plans; c) Supervise that business continuity management is effective and that the business impact analysis is performed, identifying and prioritizing the entity's critical processes; d) Approve the business continuity testing program proposed by the unit, area, or person responsible for business continuity management, recommending additional actions or mechanisms for planning and execution thereof; likewise, perform follow-up on the execution thereof and on action or improvement plans resulting therefrom; e) Support the work of whoever holds the business continuity function in the implementation of business continuity management; and f) Perform follow-up on business continuity management.

Responsibilities of Senior Management
Art. 7.- Senior Management will be responsible for implementing the BCMS, for which it must perform at least the following activities:
a) Implement the entity's business continuity strategies, policies, manuals, and plans, in accordance with what is authorized by the Board of Directors and Risk Committee; b) Ensure that a business continuity testing program is performed and formulated; c) Ensure the promotion of a business continuity culture, motivating active participation and commitment of all employees; d) Activate continuity plans in response to the occurrence of interruption incidents; and e) Drive continuous improvement in the entity's business continuity management.

Responsibility of the Risk Unit
Art. 8.- In matters of business continuity management, the Risk Unit must carry out, at a minimum, the following:
a) Support in the design and submit for approval by the Board of Directors, through the Risk Committee, the business continuity strategies, policies, and manuals; b) Support in the design and submit for approval by the Risk Committee, the business continuity plans; c) Ensure that the business continuity management performed by the entity is consistent with the policies, methodologies, and procedures applied for risk management; and d) Propose to the Risk Committee or acting person, the creation of specialized Committees, areas, or positions to fulfill responsibilities related to business continuity management.

CHAPTER III
BUSINESS CONTINUITY MANAGEMENT SYSTEM

Business Continuity Management System
Art. 9.- The minimum elements to develop to implement a BCMS will be the following:
a) A business continuity policy; b) Roles and responsibilities of participants in business continuity management; c) The Business Impact Analysis (BIA); d) Threat analysis for business continuity; e) Design and selection of business continuity strategies and tactics; f) Development and implementation of the selected business continuity strategy(ies); f) Business continuity plans for processes that allow the delivery of critical products and services offered by the entity, including internal and external support services that become critical or enablers of business processes; g) Tests on business continuity plans; h) Integration of business continuity management into organizational culture through training, dissemination, and awareness of personnel, at least once a year; i) Crisis management strategy; and j) Periodic reviews of the BCMS.

Functions of the specialized unit or area in Business Continuity Art. 10.- The business continuity function will comprise at least the following aspects:
a) Design the entity's business continuity strategies, policies, manuals, and plans, with the support of the Risk Unit, to submit for approval by the Board of Directors; b) Design the entity's business continuity plans, with the support of the Risk Unit, to submit for approval by the Risk Committee; c) Elaborate roles and establish responsibilities of participants in business continuity management; d) Perform the Business Impact Analysis and the continuity threat analysis with the support of the Risk Unit and inform Senior Management, the Risk Committee, and the Board of Directors about the results obtained; e) Design and execute a business continuity testing program with the support of the Risk Unit, for approval by the Risk Committee, which allows verifying its applicability, subsequently informing Senior Management, the Risk Committee, and the Board of Directors about the results of said tests performed; f) Establish training and awareness programs for personnel, directly related to business continuity management, so that they know their role when facing a disruptive event; g) Define a primary responsible person and a substitute to communicate to the Superintendence the following:

i. The results of the tests;
ii. The activation of the business continuity plan when an interruption incident occurs; such communication must include; a description of each interruption affecting financial services at the time they have knowledge of the interruption incident, the plan or measures necessary to guarantee the continuity of operations or restore them, and complete the information related to the reported event, no later than ten days after notifying about the interruption, should

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020 include the following: date of occurrence, description of the incident, causes of the failures, technical diagnosis, affected channels, downtime, impact caused, corrective actions taken and/or action plan to be implemented by that entity to address the causes that originated the incident, as well as to prevent them in the future; in cases of preventive maintenance on technological infrastructure, they must inform about them with a two-day advance notice prior to execution; and (1)
iii. Interruptions that affect the connection directly with the Central Bank's Real-Time Gross Settlement system, in this case also
must inform the latter to the unit that administers the payment systems; and
iv. Prepare and present business continuity management reports to Senior Management, the Risk Committee, and the Board of Directors.
Business Continuity Policy
Art. 11.- The business continuity policy must provide the framework around which the business continuity management is designed and implemented and must be formulated in accordance with the nature, size, risk profile, and volume of operations of the entity. This policy must be adapted to the purpose and needs of the entity, clearly establishing what it must achieve in business continuity management. Likewise, it must be concise, clear, and precise, and must be communicated to all personnel of the entity. The business continuity policy will include at least the following:
a) Scope and objectives of business continuity; b) A set of principles, guidelines, and minimum standards for business continuity; and c) Commitment by the Board of Directors to provide resources to establish, implement, and improve business continuity management. Incorporation of Business Continuity into organizational culture Art. 12.- The entity must incorporate the concept and importance of business continuity into the organizational culture, so that all personnel work with a business continuity approach; that is, recognizing business continuity as a priority objective and completely aligned with the strategic and daily management of the entity. To ensure that business continuity is being incorporated into the organizational culture, the entity must develop periodic awareness and training activities on business continuity, as well as include them in personnel onboarding processes, in accordance with what is established in these Norms.

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020
Business Impact Analysis
Art. 13.- For the purpose of determining critical products or services and as a basis for business continuity management, the unit, area, or person responsible for business continuity management, together with the corresponding area or areas of the entity, must conduct a business impact analysis or BIA. The BIA must take into account all products and services delivered by an entity; as well as the processes related to them; it must also identify, quantify, and qualify the impacts of interruption incidents in terms of financial, reputational, operational, legal, and time impacts. Likewise, the BIA must involve the definition of the Maximum Tolerable Period of Disruption (MTPD), the Recovery Time Objective (RTO), Recovery Point Objective (RPO), Minimum Business Continuity Objective (MBCO), and indicate dependencies and support resources for these activities. The BIA must be reviewed and updated periodically, taking into account changes in the entity's strategic plan, as well as when there are launches of new products or services, significant changes in processes or technological infrastructure, and that may affect in a relevant way the activities and critical processes of the entity. Business Continuity Threat Analysis Art. 14.- The entity must establish, implement, and maintain a formal documented process for business continuity threat analysis that systematically identifies and evaluates the risk of interruption incidents in said entity. For this purpose, the entity must carry out the following activities:
a) Identify interruption threats capable of affecting critical processes and systems, information, people, assets, stakeholders, and other support resources; and b) Analyze and evaluate the identified threats in the previous letter and define treatment plans as appropriate, in accordance with the business continuity objectives and according to the entity's risk appetite. Design and selection of business continuity strategy Art. 15.- For the design and selection of continuity and recovery strategies, the entity must consider the results of the BIA and the result of the business continuity threat analysis. Likewise, the entity must take into account at least the following aspects:
a) Personnel safety; b) The protection and recovery of critical products, services, and support resources;

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020 c) The mitigation, response, and management of impacts generated by interruption incidents; d) Work facilities and technology infrastructure to continue and recover critical products and services within the identified time period and the agreed capacity; e) The necessary resources; and f) Information security. Implementation of the continuity strategy Art. 16.- For the implementation of the continuity strategy, the entity must execute, at a minimum, the following activities:
a) Formulate the business continuity plan in which priorities, procedures, incident response schemes, responsibilities, resources involved, among others, are documented, allowing the entity to handle and respond to an interruption incident, continue and recover critical products and services, as well as the information processing and storage computer systems that support them; b) Define a clear procedure known to all involved personnel for the activation and deactivation of the continuity plan, as well as mechanisms for notification and escalation of the incident; c) Periodically update the personnel involved in business continuity management, according to the roles and responsibilities derived from the business continuity policy, for the application of the selected continuity strategies and tactics and the development of their daily operations with the alternative procedures that the entity might have, when applicable; d) Define mechanisms for effective communication with internal and external stakeholders of the entity; e) Allocate sufficient resources for the implementation of the continuity strategies approved by the Board of Directors; f) Evaluate, in the case of entities belonging to financial conglomerates, the prioritization of recovery activities, use of shared facilities and resources, among others, for the uniform implementation of joint continuity strategies and tactics; and g) Have everything ready so that plans can be activated at any time and be executed with efficiency and effectiveness. Business continuity testing Art. 17.- The entity must conduct periodic tests, or when a significant change arises, of its business continuity plan to ensure that it is consistent with the policy and business continuity objectives defined. For the execution of these tests, it must establish a business continuity testing program.

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020
Business continuity exercises or tests will be developed according to the schedule and with the entity's own contingency resources and processes used to carry out its daily operations or processes, and the execution of such tests or exercises must be documented. For the planning and execution of tests, the entity must consider at least the following:
a) Realistic test scenarios with clearly defined purposes and objectives; b) That minimize the risk of interruption of the entity's operations; and c) Are documented by generating a formalized report after their execution, which will contain results, recommendations, and agreements to implement improvements in a timely manner. The tests that the entity conducts may be partial, temporary, and unannounced, up to complete tests of interruption scenarios involving the participation of external agents, mainly critical service providers. The execution of complete tests must be previously approved by the entity's Board of Directors. Art. 18.- Entities, at least 30 days in advance, must inform the Superintendence about the type and date of execution of unannounced and complete tests. Review and maintenance of the BCMS Art. 19.- The entity must, periodically, review and follow up on the BCMS to ensure its convenience, adequacy, and continuous effectiveness. The review must include the evaluation of improvement opportunities and the need to make changes in the BCMS, including the policy, objectives, strategies, and business continuity plans. The results of these reviews must be documented.
CHAPTER IV
INFORMATION AND CONTROL

Outsourcing
Art. 20.- Outsourcing or critical services provided by third parties will be framed within the management of operational risks, and entities must establish appropriate policies and procedures to evaluate, administer, and monitor critical services provided by third parties. The entity must require the service provider to provide a sworn statement or valid certification, indicating that they have business continuity management and plans, tests developed, and test results.

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020
The entity must guarantee the Superintendence access and availability of data or information related to the outsourced service without restrictions; likewise, guarantee the access conditions for internal audit and external audit firms that must carry out their evaluations in compliance with the current regulatory framework. The entity's business continuity plan must consider the critical information technology activities or operations that have been outsourced, as well as conduct tests to confirm the effectiveness of the continuity strategy. For the case of entities governed by the provisions of the Law on Acquisitions and Public Administration Contracts, they will carry out this activity without contravening said Law. Significant changes Art. 21.- Entities will analyze the impact that significant changes have on business continuity. Significant changes that may be considered, among others, are: changes in the technological infrastructure that support critical products or services, merger with another entity, implementation of a new product, service or service channel, change of a provider or change of head office, results of the business impact analysis, exercises or tests carried out on business continuity plans, incident management. Entities must update their business continuity plans, in accordance with significant changes that may arise. Technical details of information submission Art. 22.- The Superintendence will send to the entities, within a maximum period of ninety days after the effective date of these Norms, with a copy to the Central Bank, the technical details related to the submission of the required information. The information requirements will be limited to the collection of information as regulated in these Norms. Internal Audit Art. 23.- The Internal Audit Unit must consider in its annual work plan the evaluation of compliance with the provisions established in these Norms.
CHAPTER V
OTHER PROVISIONS AND VALIDITY
Sanctions
Art. 24.- Non-compliance with the provisions contained in these Norms, will be sanctioned in accordance with what is provided in the Law on Supervision and Regulation of the Financial System.

NRP-24
BUSINESS CONTINUITY
Approval:
14/04/2020
Validity: 01/07/2020
Adaptation Plan
Art. 25.- Entities, to comply with the provisions established in these Norms, must submit an adaptation plan to the Superintendence, within one hundred and eighty days following the validity of these Norms. Once the plan is presented, entities must implement it within a maximum period of twenty-four months counted from its presentation. Pending Procedures Art. 26.- Administrative procedures and resources that were pending to conclude on the date of validity of these Norms, will continue to be carried out in accordance with the regulations under which they began their procedure. Unforeseen Aspects Art. 27.- Aspects not provided for in the regulatory matter in these Norms, will be resolved by the Central Bank through its Standards Committee. Validity Art. 28.- These norms will enter into effect from the first day of July two thousand twenty.

MODIFICATIONS:
(1) Modification to Article 10 approved by the Central Bank through its Standards Committee, in Session No. CN-05/2024 of June 28, two thousand twenty-four, with effect from July 16, two thousand twenty-four. (2) Modifications in Article 2 approved by the Central Bank through its Standards Committee, in Session No. CN-08/2025, of September 30, two thousand twenty-five, with effect from October 15, two thousand twenty-five.