Technical Standards for the Integral Risk Management of Electronic Money Provider Companies

THE STANDARDS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR, CONSIDERING:

I. That Article 2, paragraph 3 of the Law for Facilitating Financial Inclusion, establishes that Electronic Money Provider Companies are members of the financial system.

II. That in accordance with Article 3, letter c) of the Law for the Supervision and Regulation of the Financial System, it is the responsibility of the Financial System Superintendence to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.

III. That in accordance with Article 35, letter d) of the Law for the Supervision and Regulation of the Financial System, it is stipulated that directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work for, the adoption and updating of policies and mechanisms for risk management are fulfilled, including among other actions, identifying, evaluating, mitigating, and revealing them in accordance with international best practices.

IV. That Article 99, letter a) of the Law for the Supervision and Regulation of the Financial System, stipulates that it will be the responsibility of the Standards Committee to approve technical standards, instructions, and provisions that the laws regulating the supervised entities establish must be issued to facilitate their application, including aspects inherent to risk management by the supervised entities.

V. That in accordance with international standards, it is necessary to have a solid risk management framework that allows for the integral management of risks according to the profile, magnitude of activities, business, resources of the entity, and best practices, in such a way as to promote the implementation of prudential measures for the transparent, efficient, and orderly functioning of the market.

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law for the Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF ELECTRONIC MONEY PROVIDER COMPANIES

CHAPTER I
OBJECTIVE, SUBJECTS, AND TERMS

Objective
Art. 1.- These Standards have as their objective to establish the minimum elements that entities must observe for the integral management of risks in accordance with applicable laws and international standards in the matter, consistent with the nature and scale of their activities.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are the Electronic Money Provider Companies.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:

a) Senior Management: The Chief Executive President, Executive Director, General Manager, or whoever acts in their place, and the executive positions that report to them;

b) External Events: Events associated with the nature or caused by third parties, which escape in terms of cause and origin from the control of the entity;

c) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plans;

d) Central Bank: Central Reserve Bank of El Salvador;

e) Client: Natural person holder of an electronic money registry;

f) Conflict of Interest: Any situation in which it may be perceived that a personal benefit or interest of a third party may influence the professional judgment or decision of a member of the entity regarding the fulfillment of its obligations;

g) Integral risk management culture: Norms, attitudes, knowledge, and behavior of an entity related to risk and decisions on how to manage and control them;

h) Electronic Money: Monetary value registered in favor of a holder or client, which constitutes a payment obligation enforceable against its Electronic Money Provider, which is accepted by other actors who have agreed to receive or provide this service, as a means of payment in an amount equivalent to the cash delivered, and is stored in an electronic medium;

i) Entity: Subject obligated to comply with the provisions established in these Standards;

j) Operational risk event: An event or series of events, of internal or external origin, that may or may not result in financial losses for the entity;

k) Operational risk factor: The primary cause or origin of an operational event;

l) Board of Directors: Collegiate body or equivalent body in charge of the administration of the entity, with supervisory, directional, and control functions;

m) Business Line: A specialization of the business that groups processes aimed at generating products and services to serve a target market segment;

n) Risk Map: A tool that allows presenting an overview of the risks to which the entity is exposed; independent of the form of its presentation, in which the areas/activities/assets (processes) that could be affected during the occurrence of an adverse event are identified and located. It allows seeing the threats and measuring the magnitude of each risk (probability and economic impact). They are a graphical instrument for risk management that allows comparing risks by their relative importance as well as collectively, allowing the entity to establish acceptable levels of risk;

o) Mitigation measures: Set of actions taken by entities to technically manage risks, so that potential losses derived from their materialization are minimized;

p) Action Plans: Consist of a set of corrective measures proposed by the entity. These action plans contain the objectives, activities, responsible parties, and completion dates;

q) Risk Profile: Consolidated result of the measurement of the risks to which an entity is exposed;

r) Personnel: The set of collaborators directly or indirectly linked to the execution of the entity's processes;

s) Process: The set of interrelations of activities for the transformation of input elements into products or services, to satisfy a need;

t) Inherent risk: Level of risk inherent to the activity, without taking into account the effect of controls;

u) Residual risk: Level resulting from the risk after applying controls. It is the risk that remains, once the appropriate controls for its treatment have been implemented. In any case, it requires permanent monitoring to observe its evolution;

v) Superintendence: Financial System Superintendence; and

w) Information Technology: The set of technological tools used to support the entity's processes.

CHAPTER II
ON INTEGRAL RISK MANAGEMENT

Integral Risk Management
Art. 4.- Electronic Money Provider Companies must establish an integral risk management system, which shall be understood as a strategic process carried out by the entire entity, through which they identify, measure, control, mitigate, monitor, and communicate the different types of risks to which they are exposed and the interrelationships that arise among them, for the achievement of their objectives. Such management must be in accordance with their nature, risk profile, volume and complexity of their activities, business lines, own and third-party resources, in such a way as to promote the implementation of measures consistent with best practices for the transparent, efficient, and orderly functioning of the market.

The integral process for risk management must be duly documented and reviewed periodically based on changes that occur in the risk profile of the entities and in the market. The policies, procedures, and manuals issued by the entities must be in the Spanish language.

Stages of the integral risk management process Art. 5.- Entities must have a continuous documented process for the integral management of their risks, which must contain at least the following stages:

a) Identification: This is the stage in which existing risks in each operation, product, service, process, and business line developed by the entity and those that may occur in new business lines are recognized and understood. In this stage, the risk factors that can generate changes in the entity's equity are identified;

b) Measurement: This is the stage in which risks must be quantified in order to determine compliance or adequacy of policies, fixed limits, and measure the possible economic impact on the entity's financial results. The methodologies and tools to measure each type of risk must be in conformity with the size, nature of their operations, and the levels of risks assumed by the entity;

c) Control and mitigation: This is the stage that seeks to ensure that the policies, limits, and procedures established for the treatment and mitigation of risks are appropriately taken and executed; and

d) Monitoring and communication: This is the stage that provides systematic and permanent follow-up to risk exposures and the results of adopted actions. These information systems must ensure a periodic and objective review of risk positions and the generation of sufficient information, to support decision-making processes and allow communicating the results of risk management in a timely manner.

CHAPTER III
ENVIRONMENT FOR INTEGRAL RISK MANAGEMENT

Organizational System
Art. 6.- Entities must establish an organizational structure that allows for adequate integral risk management, with the proper segregation of functions and hierarchical levels of operational support, business, and control areas that participate in the process, as well as levels of dependence, in accordance with the risk profile, size, and nature of their operations.

Entities will establish and apply the methodologies they consider appropriate for the risk management model, without prejudice to the standards and minimum requirements established by the Central Bank through its Standards Committee.

Functions of the Board of Directors or Equivalent Governing Body Art. 7.- The Board of Directors is responsible for ensuring adequate integral risk management, having among its functions at least the following:

a) Define and approve the entity's risk appetite and tolerance, as well as the exposure limits of each particular risk according to its profile; likewise, it must establish the respective controls for exceptions and deviations from said limits;

b) Approve the internal organizational or functional structure according to its business model, with their respective organization manuals and segregation of functions, assigning the necessary resources to implement and maintain adequate risk management, effectively and efficiently;

c) Approve the policies and manuals for the management of risks assumed by the entity, ensuring that they are implemented;

d) Create the Risk Committee, in accordance with what is established in the "Technical Standards of Corporate Governance" (NRP-17) approved by the Central Bank, through its Standards Committee, approving the appointment and removal of its members, when applicable, and ensuring its independence;

e) Create the Risk Unit and appoint the person in charge of it, ensuring its independence from the entity's business and operational areas to avoid conflicts of interest, as well as the separation of corresponding functions and responsibilities, and providing it with adequate material resources and technical training;

f) Know and understand all the risks inherent to the businesses developed by the entity and to which it is exposed, their evolution and effects, especially at the equity levels; as well as the methodologies and tools for risk management;

g) Ensure that an organizational culture of risk management is implemented within the entity; and

h) Ensure that Internal Audit verifies the existence and compliance of the entity's integral risk management scheme.

The policies and manuals for risk management approved by the Board of Directors must be sent to the Superintendence for its knowledge within the first ten business days following their approval or respective modification. The period between reviews and/or updates on Policies or Manuals must not exceed two years.

Risk Committee
Art. 8.- Entities must have a Risk Committee which will observe what is established in these Standards and in the "Technical Standards of Corporate Governance" (NRP-17) approved by the Central Bank, through its Standards Committee.

Functions of the Risk Committee
Art. 9.- The functions of the Risk Committee or its equivalent will comprise, at minimum, the following activities:

a) Approve the following:
i. The methodologies to manage the different types of risks to which the entity is exposed, as well as their eventual modifications, ensuring that it considers the relevant risks of the activities it performs;
ii. The mechanisms for the implementation of corrective actions; and
iii. The corrective actions proposed by the Risk Unit and the areas involved in case there is deviation with respect to the assumed exposure levels or limits.

b) Require and follow up on corrective plans to normalize non-compliance with exposure limits or reported deficiencies;

c) Evaluate, endorse, and propose for approval by the Board of Directors, at least the following:
i. The strategies, policies, and manuals for integral risk management, as well as the eventual modifications made to them;
ii. The tolerance limits for the exposure of the different types of risks identified by the entity, consistent with its risk appetite; and
iii. The cases or special circumstances in which exposure limits may be exceeded, as well as the special controls on said circumstances.

d) Inform the Board of Directors about the exposures, deviations, and exceptions of the risks managed in the entity, their evolution, effects, especially at the equity levels, and additional mitigation needs, as well as their corrective actions;

e) Inform the Board of Directors about the execution of approved policies, according to the periodicity established in each of them, ensuring that the entity's operations adjust to the policies and procedures defined for risk management; and

f) Inform the Board of Directors about the results of the reports prepared by the Risk Unit or whoever acts in its place.

Meetings and Agreements of the Risk Committee
Art. 10.- The Risk Committee or whoever acts in its place, must meet with the necessary frequency to perform its functions effectively, at least once every three months. The persons in charge of the different areas involved in the operations that generate risks may participate in the sessions, with the right to speak but without the right to vote.

Functions of Senior Management
Art. 11.- Senior Management is responsible for the establishment and execution of the structural framework of the risk management system and will report to the Board of Directors, having to adopt and ensure compliance with, at minimum, the following measures:

a) Establish the necessary conditions at the level of the entire organization to foster an environment that promotes the development of the integral risk management process;

b) Ensure that mechanisms exist that guarantee adequate flow, quality, and timeliness of information, between the Business Units and the Risk Unit or whoever acts in its place, so that the latter appropriately develops its function;

c) Ensure the establishment of mechanisms for the dissemination of the integral risk management culture, at all levels of the organizational structure; and

d) Ensure the execution of training and updating programs for the entity's risk management.

Risk Unit
Art. 12.- Entities must have a specialized unit to facilitate the evaluation of integral risk management, and may also designate additional units to supervise and manage specific risks. The Board of Directors of each entity will create said unit and in turn appoint its responsible person; its size and scope must be related to the size, structure, and risk profile of the entity. Its object must be to identify, measure, control, monitor, and report the risks it faces in the development of its operations, whether they affect assets and liabilities within or outside the balance sheet.

This unit must be independent of the business units, or any other operational or support area, in order to avoid conflicts of interest and ensure adequate separation of functions and responsibilities, and its hierarchical position must allow it access to the necessary information for the performance of its functions and ensure that its reports are known by the Board of Directors or by the instance it delegates.

The Risk Unit or person in charge must prepare an annual work plan, which must be approved by the Risk Committee, for the purposes of adequately fulfilling risk management functions.

The person in charge of the Risk Unit must have a profile consistent with the functions to be performed; for this, the entity must consider their academic background, experience, and training in risk management.

Functions and Responsibilities of the Risk Unit Art. 13.- The Risk Unit or the corresponding person in charge must fulfill at least the following functions:

a) Identify, measure, control, monitor, and communicate the risks incurred by the entity within its various business units and their effects on the entity's solvency;

b) Prepare the annual work plan of the Unit and submit it for approval by the Risk Committee;

c) Design and propose to the Risk Committee for approval by the Board of Directors the strategies, policies, procedures, and respective manuals for the integral management of risks and of each of the specific risks identified, as well as their modifications;

d) Propose for approval the methodologies, models, and parameters for the management of the different types of risks to which the entity is exposed;

e) Periodically inform the Risk Committee or whoever acts in its place, as well as Senior Management, about the evolution of the main risks assumed by the entity, including the detail of changes in applicable risk factors and the historical evolution of the risks assumed by it;

f) Periodically follow up on the corrective actions presented by the units for the improvement of integral risk management, which must be made known to the Risk Committee and Senior Management;

g) Follow up on the compliance of risk exposure limits, their quantifiable tolerance levels by type of risk, and propose mitigation mechanisms for exposures and inform the Risk Committee; and

h) Perform periodic monitoring of the results of the application of methodologies, tools, models, and compliance with tolerance limits.

Training Programs
Art. 14.- Due to the fact that integral risk management is a dynamic process, Senior Management must guarantee that the Board of Directors, employees, and executives directly involved in risk management are trained in these topics, developing for this purpose an annual training plan, which may be incorporated into the entity's general annual training plan, in which personnel to be trained, topics to be developed, and their scheduling are included. Likewise, since this management involves the entire organization, a program must be established

CHAPTER IV
RISK MANAGEMENT FRAMEWORK
Risk Management Policies
Art. 15.- Entities must approve and develop policies to define the management framework for each type of risk to which they are exposed, allowing them to reduce their vulnerability and losses from such risks and to promote a culture of prevention and risk management throughout the organization.

Policies, manuals, and procedures for integral risk management must consider, among other aspects, the functions and responsibilities in such management, as well as the criteria and mechanisms for the identification, measurement, control, mitigation, monitoring, and communication of the risks presented by the entity. The entity's policies, manuals, and procedures must be consistent with its structure, nature, size, complexity of its activities, operations, business lines, type of clients it serves, and with the obligations applicable to its activity. These policies, manuals, and procedures must also conform to the authorized operations according to its object and applicable legal regime.

Risk Management Manual
Art. 16.- Entities must have a risk management manual or manuals that, based on the policies, group for the management of each of the risks the entity faces, at minimum: the associated processes, the functions and responsibilities of the involved areas, indicating the segregation of functions of key positions susceptible to risks; the methodology for measuring risk detailing variables, criteria, tools used, and the periodicity with which information on exposure to each type of risk must be reported to the Risk Committee or its equivalent, the Board of Directors, and Senior Management.

For the development of the risk management manual, entities must consider the implementation of prudential measures and best practices referred to risk management.

CHAPTER V
MANAGEMENT BY TYPE OF RISK
Types of Risks
Art. 17.- For the purposes of these Standards, entities must manage, according to their structures, size, businesses, and resources, at minimum the following risks:
a) Liquidity Risk: The possibility of incurring losses due to not having sufficient resources to meet assumed obligations, incurring excessive costs, and being unable to develop the business under the planned conditions; b) Operational Risk: The possibility of incurring losses due to failures in processes, personnel, information systems, and due to external events; it includes the management of information security, business continuity, and legal risk; c) Reputational Risk: The possibility of incurring losses, resulting from the deterioration of the entity's image, due to non-compliance with laws, internal norms, corporate governance codes, codes of conduct, money laundering, among others.

With reference to the management of money and asset laundering risks, and terrorism financing risks, entities must apply what is established in the "Technical Standards for the Management of Money and Asset Laundering Risks, and Terrorism Financing Risks" (NRP-08), approved by the Central Bank, through its Standards Committee.

CHAPTER VI
OPERATIONAL RISK MANAGEMENT
Art. 18.- Entities must manage the different factors generating operational risk, which are the following:
a) Processes: In order to guarantee the optimization of resources and the standardization of activities, entities must have documented, defined, and periodically updated processes according to the entity's policies, which can be grouped into types of processes according to what is established by the entity. Entities must appropriately manage the risks associated with said processes, with emphasis on failures or weaknesses they present, since these can result in deficient development of operations; b) People: Entities must establish policies, processes, and procedures that ensure adequate planning and administration of human capital, which include the hiring, retention, and separation processes of personnel. Likewise, they must establish preventive mechanisms that allow identifying and managing failures, insufficiencies, negligence, sabotage, theft, inadequate training, misappropriation of information, among others,

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-22
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF ELECTRONIC MONEY PROVIDER COMPANIES Approval: 02/26/2020 Validity: 04/01/2020 associated with personnel directly or indirectly linked to the entity; in such a way that the possibility of economic losses is minimized. Direct linkage is that which is based on an individual employment contract, according to the respective labor legislation. Indirect linkage refers to those persons who have a legal relationship with the entity for the provision of specific services, different from that originating from an internal employment contract; c) Information Technology: Entities must manage risks associated with information technology, among others, those related to failures in the security and operational continuity of computer systems, errors in the development and implementation of said systems, and their compatibility and integration, as well as the quality of information and adequate investment in technology; and d) External Events: Entities must manage risks associated with external events beyond the entity's control that could alter the normal development of their activities, related to failures in critical services provided by third parties, legal contingencies, the occurrence of natural disasters, attacks, and criminal acts, among other factors.

With reference to the management of information technology factors, the entity must apply what is established in the Technical Standards issued by the Central Bank through its Standards Committee regarding Information Security and Business Continuity.

Operational Risk Management
Art. 19.- Operational risk management must consider the following aspects:
a) Identify operational risk events grouping them according to Annex No. 1 of these Standards, in such a way that it allows establishing its operational risk map. The subjects subject to these Standards must identify the events grouping them according to the business lines the entity maintains, as established in Annex No. 2 of these Standards; b) The entity must estimate or quantify operational risk considering the probability of occurrence and the economic impact on the entity's results. This quantification is essential for the entity because, based on them, control and mitigation measures are established that seek to minimize losses from this risk. The methodologies and tools to estimate or quantify operational risk must conform to the size, nature of the risk levels assumed by the entity, and volume of its operations; c) Implement controls to avoid, detect, or prevent operational risk events. Actions or coverage and control mechanisms implemented by the entity must be established with the purpose of preventing or reducing negative effects in case adverse operational risk events materialize. An action plan must be established to implement measures that seek to mitigate identified risk events. This plan must detail the

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-22
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF ELECTRONIC MONEY PROVIDER COMPANIES Approval: 02/26/2020 Validity: 04/01/2020 actions to be implemented, the estimated execution time, and the direct responsible parties for said execution; d) Entities must give systematic and timely follow-up to materialized operational risk events, as well as to the results of adopted actions. Follow-up must ensure periodic review and the generation of sufficient information to support decision-making processes; e) Entities must perform periodic monitoring of their risk map and exposure to operational risk losses, complying at minimum with the following aspects:
i. Develop effective and periodic follow-up processes that allow rapid detection and correction of deficiencies;
ii. Establish indicators that evidence potential operational risks;
iii. Ensure that established internal controls are functioning effectively and efficiently; and
iv. Ensure that residual risks are below the tolerance level established by each entity.
f) Entities must form a centralized database that allows recording, ordering, classifying, and having information on materialized operational risk events. These must be classified by factors, determining the frequency of the event and the effect produced, and must contain at minimum the fields detailed in Annex No. 3 of these Standards and send them to the Superintendence in accordance with what is established in these Standards; and g) Analyze and prioritize identified risks, classifying them according to impact and probability on institutional objectives. Art. 20.- Entities must send to the Superintendence, annually and no later than January 31 of each year, the events contained in the "Event Recording Databases" of Annex No. 3 referenced in these Standards, starting with the database for the year 2020, sending them electronically or in the manner determined by the Superintendence.

CHAPTER VII
INFORMATION AND CONTROL SYSTEMS
Managerial Information Systems
Art. 21.- The entity must have a managerial information system and statistical databases, which enable the generation of timely, reliable, consistent, and homogeneous information that allows preparing periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other interested parties responsible for decision-making in risk management.

Internal Control System
Art. 22.- The internal control system includes integral risk management, which allows verifying compliance with policies, limits, processes, and procedures established during the execution of the entity's operations. For this purpose, entities must establish the necessary administrative, financial, accounting, and technological controls, in accordance with international standards on the matter and applicable laws.

Role of Internal Audit
Art. 23.- The Internal Audit Unit must support the entity in meeting its objectives by providing a systematic and disciplined approach to evaluate and improve the quality, effectiveness, and efficiency of risk management, control, and corporate governance processes, in accordance with what is established in the "Technical Standards of Internal Audit for Members of the Financial System" (NRP-15), issued by the Central Bank through its Standards Committee.

Of External Auditors
Art. 24.- The entity's external auditors must include in their periodic evaluation the review of risk management functions, and their results must be incorporated into the respective reports they issue in accordance with what is established in the "Technical Standards for the Provision of External Audit Services to Members of the Financial System" (NRP-18), issued by the Central Bank through its Standards Committee.

Annual Report
Art. 25.- Entities must send to the Superintendence, within the first one hundred twenty days following the end of the reported fiscal year, the "Technical Evaluation Report of Integral Risk Management", prior to approval by the Board of Directors, which must contain at minimum the following:
a) The organizational structure for integral risk management; b) Detail of the main risks assumed by the entity's activities; c) List of policies, manuals, and procedures for integral risk management, including the date of the last modification; d) Description of the methodologies, systems, and tools used for each of the risks; e) The results of evaluations carried out on integral risk management, in accordance with what is established in the "Technical Standards of Internal Audit for Members of the Financial System" (NRP-15), approved by the Central Bank through its Standards Committee; f) The execution of the training plan related to integral risk management established in Article 14 of these Standards;

Notwithstanding the foregoing, the Board of Directors must immediately inform the Superintendence upon becoming aware of any aspect related to risk exposure that could impact the entity qualitatively or quantitatively.

Disclosure on Integral Risk Management
Art. 26.- Entities must disclose in a summarized manner in a section of their Website, within the first ninety calendar days of each year, information relative to the policies, methodologies, and other relevant measures adopted for the management of each type of risk. Entities must disclose in a summarized manner in the notes to the annual closing financial statements the way in which they manage risks and compliance with their policies.

Additional Information
Art. 27.- The Superintendence may require entities any additional information it considers necessary for the adequate supervision of integral risk management and of each of the specific risks to which the entity in question is exposed. Entities must have at all times available to the Superintendence all documents, records, files, in physical, electronic, or any other medium, referred to in these Standards. The information referred to in the preceding paragraph must be safeguarded for a minimum period of five years, from its generation; after said period, entities may destroy the information once they have the corresponding digital backup, provided there is no legal obligation to maintain it physically.

CHAPTER VIII
OTHER PROVISIONS AND VALIDITY
Sanctions
Art. 28.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Technical Details of Information Submission
Art. 29.- The Superintendence will send to entities, within a maximum period of ninety days following the date of entry into force of these Standards, with a copy to the Central Bank, the technical details related to the submission of the required information. The information requirements will be limited to the collection of information as regulated in these Standards. Entities must implement the necessary mechanisms for the submission of the aforementioned information within a maximum period of one hundred twenty days after receiving the communication of the preceding paragraph, in accordance with the technical details sent by the Superintendence.

Transitory
Art. 30.- Entities, to comply with the provisions established in these Standards, must present to the Superintendence an adaptation plan, within one hundred fifty days following the validity of these Standards. Once the plan is presented, entities must implement it within a maximum period of nine months counted from its presentation. (1)

Unforeseen Aspects
Art. 31.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Central Bank through its Standards Committee.

Validity
Art. 32.- These Standards will enter into force starting from April 1, 2020.

(1) Modification to Article 30 approved by the Central Bank through its Standards Committee, in Session No. CN-10/2020 dated June 18, 2020, with validity starting from June 23, 2020.

Annex No. 1
TYPES OF EVENTS BY OPERATIONAL RISK
Event Type
(Level 1)
Definition
Event Type
(Level 2)
Examples
Internal Fraud
Losses derived from any type of action aimed at defrauding, improperly appropriating assets, or evading regulations, laws, or corporate policies in which at least one member of the entity is involved. Unauthorized Activities Unrevealed operations (intentionally), unauthorized operations (with economic losses), erroneous valuation of positions (intentional). Theft and Fraud Theft, embezzlement, forgery, bribery, improper appropriation of accounts, smuggling, tax evasion (intentional). External Fraud Losses derived from any type of action aimed at defrauding, improperly appropriating assets, or evading legislation, by a third party. Theft and Fraud Theft, forgery. Systems Security Damage from cyberattacks, theft of information. Labor Relations and Workplace Safety Losses derived from actions incompatible with legislation or labor agreements, on hygiene or work safety, on payment of claims for personal damages, or on cases related to diversity or discrimination. Labor Relations Issues related to remuneration, social benefits, termination of contracts. Workplace Hygiene and Safety Cases related to workplace hygiene and safety standards; compensation to workers. Diversity and Discrimination Any type of discrimination.

Annex No. 1
Event Type
(Level 1)
Definition
Event Type
(Level 2)
Examples
Clients, Products and
Business Practices
Losses derived from involuntary or negligent non-compliance with a corporate obligation towards specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, Information Disclosure and Trust Breach of trust/non-compliance with guidelines, suitability aspects/information disclosure, infringing client information privacy, abuse of confidential information. Improper Business or Market Practices Restrictive competition practices, improper commercial/market practices, fictitious transactions, market manipulation, abuse of insider information (in favor of the entity), money laundering. Defective Services Service defects (unauthorized, etc.), error in contract models, error in service or provision provided to the client. Selection, Sponsorship and Risks Absence of client investigation according to guidelines, excess of risk limits towards clients. Damage to Tangible Assets Losses derived from damage or harm to tangible assets as a consequence of natural disasters or other events. Disasters and Other Events Natural disasters, losses caused by external persons (terrorism, vandalism). Business Interruption and System Failures Losses derived from business interruptions and system failures. Systems Deficiencies in information or telecommunications systems; power outages.

Annex No. 1

Type of Event (Level 1)	Definition	Type of Event (Level 2)	Examples
Execution, delivery and management of processes	Losses derived from errors in the processing of operations or in the management of processes, as well as from relationships with commercial counterparties and suppliers.	Receipt, execution and maintenance of operations	Data entry errors.
		Tracking and reporting	Failure to report, inaccuracy of external reports (with generation of losses).
		Client acceptance and documentation	Absence of client authorizations or rejections, non-existent or incomplete legal documents.
		Commercial counterparties	Failures by counterparties other than clients, other litigation with counterparties other than clients.
		Services with third parties, distributors and suppliers	Subcontracting, failure to comply with stipulated obligations (with generation of losses), litigation with suppliers.

Annex No. 2

DETAIL OF BUSINESS LINES

Level 1	Level 2	Activity Groups
Electronic Money Provision.	Electronic Money Records.	Linking of participants and record holders.
Mobile Payment Means.	Payments, fund transfers and settlement.
Money Receipt.	Receipt of money from abroad.
	Conversion of electronic money to cash.
	Conversion of electronic money records to cash.

Annex No. 3

TABLE OF CONTENT OF THE EVENT REGISTRATION DATABASE

No.	Name	Description
1	Reference	Internal code that identifies the event sequentially.
2	Operational risk factor	According to article 18 of these Standards.
3	Loss event type	Identifies the type of loss, according to the classification of Annex No. 1.
4	Business lines	Identification of the business line that originated the event, detailed in Annex No. 2.
5	Event description	Detailed description of the event. Service channel or customer attention (when applicable). Geographic zone.
6	Event start date	Date on which the event begins: day, month and year.
7	Event end date	Date on which the event ends: day, month and year.
8	Discovery date	Date on which the event is discovered: day, month and year.
9	Accounting date	Date on which the economic loss from the event is registered: day, month and year.
10	Amount	The amount of the loss, economic quantification of the occurrence of the operational risk event and the expenses derived from its handling.
11	Currency	Foreign currency in which the event materializes.
12	Affected accounts	Identifies the accounts of the Chart of Accounts affected.
13	Process	Identifies the affected process.
14	Total value recovered	The total value recovered by the direct action of the entity. Includes amounts recovered by insurance.
15	Value recovered by insurance	Corresponds to the value recovered through coverage by an insurance policy.
16	Affected product or service	Identifies the product or service affected by the operational risk event.
17	Quantification of damage severity	Amount of the loss (net of any mitigant or recovery).

For the creation of the operational risk event registration, entities may use, in addition to the fields described above, others that are considered relevant.

Entities that consider that the operational risk event databases are insufficient to quantify operational risk may opt for the use of databases from external sources, provided that such databases are normalized and adequate to the entity's internal databases.

Technical Standards for the Integral Risk Management of Electronic Money Provider Companies

Lineage: In force

Similar documents from other regulators