Technical Standards for the Integral Risk Management of Financial Entities

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That in accordance with article 3, letter c) of the Law on Supervision and Regulation of the Financial System, it is the responsibility of the Superintendence of the Financial System to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.

II. That article 7 of the Law on Supervision and Regulation of the Financial System establishes that members of the financial system include banks incorporated in El Salvador, their offices abroad and their subsidiaries; the branches and offices of foreign banks established in the country; insurance companies, their branches abroad and the branches of foreign insurance companies established in the country; cooperative banks, savings and credit societies and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; the Social Housing Fund and the National Popular Housing Fund; the Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador.

III. That in accordance with article 35, letter d) of the Law on Supervision and Regulation of the Financial System, it is stipulated that directors, managers and other officials holding positions of direction or administration of the members of the financial system must conduct their business, acts and operations in compliance with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management are fulfilled, and among other actions, to identify, evaluate, mitigate and disclose them in accordance with international best practices.

IV. That article 99, letter a) of the Law on Supervision and Regulation of the Financial System, stipulates that it will be the responsibility of the Standards Committee to approve technical standards, instructions and provisions that the laws regulating the supervised establish must be issued to facilitate their application, including aspects inherent to risk management by the supervised.

V. That in accordance with international standards, it is necessary to have a solid risk management framework, which allows for the integral management of risks according to the profile, magnitude of activities, business, resources of the entity and best practices, in such a way as to promote the implementation of prudential measures for the transparent, efficient and orderly functioning of the market.

THEREFORE,

by virtue of the regulatory powers conferred by article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF FINANCIAL ENTITIES

CHAPTER I
OBJECT, SUBJECTS AND TERMS

Object
Art. 1.- These Standards have as their objective to establish the minimum provisions that entities must observe for the integral management of risks in accordance with applicable laws and international standards in the matter, in accordance with the nature and scale of their activities.

These Standards complement the current general regulatory framework, of which the “Technical Standards for Corporate Governance” (NRP-17), approved by the Central Bank through its Standards Committee, is also part.

Subjects
Art. 2.- The subjects obliged to comply with the provisions established in these Standards are:
a) Banks incorporated in El Salvador, their offices abroad and their subsidiaries; b) The branches and offices of foreign banks established in the country, insofar as pertinent; c) Insurance companies, their branches abroad and cooperative insurance associations incorporated in the country, insofar as it does not contradict their creation laws; d) The branches of foreign insurance companies established in the country, insofar as pertinent; e) Cooperative banks, savings and credit societies and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; f) The Mortgage Bank of El Salvador, S.A.; g) The Social Housing Fund and the National Popular Housing Fund, insofar as it does not contradict their creation laws, nor what is provided by the Court of Accounts; h) The Agricultural Development Bank, insofar as it does not contradict its creation law, nor what is provided by the Court of Accounts;

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020

i) The Development Bank of the Republic of El Salvador, insofar as it does not contradict its creation law nor what is provided by the Court of Accounts; (2) j) Legal entities that carry out operations of sending or receiving money systematically or substantially, by any means, at the national and international level. It will be understood that operations of sending or receiving money are carried out systematically or substantially when such activity is carried out habitually or constitutes an important activity within the business operations of the entity; (2) k) Reciprocal Guarantee Societies and their local guarantors; (2) l) Administrators or Operators of Payment Systems and Securities Settlement Societies; (2) m) Foreign Currency Exchange Houses; and (2) n) Societies that offer complementary services to the financial services of the members of the financial system, particularly those in which they participate as investors. (2)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: The President, Executive President, Executive Director, General Manager or whoever acts in their place and the executive positions that report to them. For the case of the Development Bank of El Salvador, the President; b) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plans; c) Central Bank: Central Bank of Reserve of El Salvador; d) Client: Natural or legal person who maintains a contractual relationship with the entity for the provision of financial services or products that it offers, which in these Standards may refer to: depositors, investors, insured, debtors, co-debtors, beneficiaries, among others; e) Conflict of Interest: Any situation in which it may be perceived that a personal benefit or interest of a third party may influence the professional judgment or decision of a member of the entity regarding the fulfillment of their obligations; f) Financial Conglomerate: In accordance with article 113 of the Banks Law, it is the set of societies characterized by the fact that more than fifty percent of their respective share capital is owned by a controlling society, which is also a member of the conglomerate. The controlling society of the conglomerate may be a society of exclusive purpose or a bank incorporated in the country; g) Integral risk management culture: Standards, attitudes, knowledge and behavior of an entity related to risk and decisions on how to manage and control it; h) Entity: Subject obliged to comply with the provisions established in these Standards; i) Risk factors: Represent those variables that entities must consider for adequate identification and mitigation of the risks to which they are exposed; j) Board of Directors: Collegiate body or equivalent body responsible for the administration of the entity, with supervision, direction and control functions; for the case of Cooperative Associations, it will be the Board of Directors or as defined in its Creation Law; k) Stress tests: Scenarios used to evaluate and measure the resistance, vulnerability and stability of an entity or financial system in the event of possible extreme adverse events, and their impact on equity and/or the financial results of an entity; l) Superintendence: Superintendence of the Financial System; and m) Risk Tolerance: Levels of risk-taking acceptable to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and, in general, is aligned with categories of risk, such as strategy, finance, people or reputation.

CHAPTER II
ON INTEGRAL RISK MANAGEMENT

Integral risk management
Art. 4.- Entities must establish an integral risk management system, which must be understood as a strategic process carried out by the entire entity, through which they identify, measure, control, mitigate, monitor and communicate the different types of risks to which they are exposed and the interrelationships that arise between them, to achieve their objectives. This management must be in accordance with its nature, risk profile, volume and complexity of its activities, business lines, own and third-party resources, in such a way as to promote the implementation of measures in accordance with best practices for the transparent, efficient and orderly functioning of the market.

The integral process for risk management must be duly documented and reviewed periodically based on changes that occur in the entity's risk profile and in the market. The policies, procedures and manuals issued by entities must be in the Spanish language.

Stages of the integral risk management process Art. 5.- Entities must have a documented continuous process for the integral management of their risks, which must contain at least the following stages:
a) Identification: This is the stage in which existing risks are recognized and understood in each operation, product, service, process and business line that the entity develops and those that may occur in new business lines. In this stage, the risk factors that can generate changes in the entity's equity or in the funds or resources it administers are identified, in accordance with the operations that their special laws authorize; b) Measurement: This is the stage in which risks must be quantified in order to determine compliance or adequacy of policies, established limits and measure the possible economic impact on the financial results of the entity. The methodologies and tools to measure each type of risk must be in accordance with the size, nature of its operations and the levels of risks assumed by the entity; c) Control and mitigation: This is the stage that seeks to ensure that the policies, limits and procedures established for the treatment and mitigation of risks are appropriately taken and executed; and d) Monitoring and communication: This is the stage that gives systematic and permanent follow-up to risk exposures and the results of actions adopted. These information systems must ensure a periodic and objective review of risk positions and the generation of sufficient information, to support decision-making processes and allow communicating the results of risk management in a timely manner.

Types of risks
Art. 6.- For the purposes of these Standards, entities must manage, in accordance with their structures, size, businesses and resources, at least the following risks:
a) Credit risk: The possibility of loss, due to the non-compliance of contractual obligations assumed by a counterparty, understood as a borrower or a debt issuer, a reinsurer or a guarantor. Without prejudice to what is established in the “Standards for the Management of Credit Risk and Credit Concentration” (NPB4-49), the management of this risk must consider, in accordance with the policies of each entity, the observance or not of socio-environmental responsibility principles in the activities and resources to be financed; b) Market risk: The possibility of loss, resulting from movements in market prices that generate a deterioration in value in positions inside and outside the balance sheet or in the financial results of the entity; c) Liquidity risk: The possibility of incurring losses due to not having sufficient resources to fulfill assumed obligations, incurring excessive costs and not being able to develop the business under the conditions foreseen; d) Operational risk: Possibility of incurring losses due to failures in processes, people, information systems and due to external events; it includes legal risk consisting of the possibility of occurrence of losses due to failures in the execution of contracts or agreements, non-compliance with regulations, as well as external factors such as regulatory changes, judicial processes, among others; (3) e) Reputational risk: The possibility of incurring losses, resulting from the deterioration of the entity's image, due to non-compliance with laws, internal regulations, corporate governance codes, codes of conduct, money laundering, terrorism financing and financing of the proliferation of weapons of mass destruction, among others; and (3) f) Technical risk: The possibility of losses generated by unexpected increases in claims and expenses, due to inadequate technical or actuarial bases used to: establish the pure risk rate for each line of insurance, determine the commercial rate or premiums, the evaluation and acceptance of insured risks or underwriting policies, reinsurance coverage and the calculation of technical reserves.

With reference to the management of money laundering, terrorism financing and financing of the proliferation of weapons of mass destruction risks, entities must apply what is established in the “Technical Standards for the Management of Money Laundering, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction Risks” (NRP-36) approved by the Central Bank, through its Standards Committee. (3)

CHAPTER III
ENVIRONMENT FOR INTEGRAL RISK MANAGEMENT

Organizational system
Art. 7.- Entities must establish an organizational structure that allows for adequate integral risk management, with the due segregation of functions and hierarchical levels of operational support, business and control areas that participate in the process, as well as levels of dependence, in accordance with the risk profile, the size and nature of their operations.

Entities will establish and apply the methodologies they consider appropriate for the risk management model, without prejudice to the standards and minimum requirements established by the Central Bank through its Standards Committee.

Functions of the Board of Directors or Equivalent Management Body Art. 8.- The Board of Directors or equivalent management body is responsible for ensuring adequate integral risk management, having among its functions at least the following:
a) Define and approve the entity's risk appetite and tolerance, as well as exposure limits for each risk in particular according to its profile; likewise, it must establish the respective controls for exceptions and deviations from these limits;

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020

b) Approve the internal organizational or functional structure according to its business model, with respective organization manuals and segregation of functions, assigning the necessary resources to implement and maintain adequate risk management, effectively and efficiently; c) Approve the policies and manuals for the management of risks assumed by the entity, ensuring that they are implemented; d) Create the Risk Committee, in accordance with what is established in the “Technical Standards for Corporate Governance” (NRP-17) approved by the Central Bank, through its Standards Committee, approving the designation and removal of its members, when applicable and ensuring its independence; e) Create the Risk Unit and appoint the person in charge of it, ensuring its independence from the entity's business and operational areas in order to avoid conflicts of interest, as well as the separation of functions and corresponding responsibilities, and providing it with the resources, tools, materials and adequate technical training; f) Know and understand all risks inherent to the businesses developed by the entity and to which it is exposed, their evolution and effects, especially at the equity levels; as well as the methodologies and tools for risk management; g) Approve the entity's involvement in new products, services, business lines and operations, and ensure that they adhere to its business strategies and policies for risk management; h) Ensure that an organizational culture of risk management is implemented within the entity; and i) Ensure that Internal Audit verifies the existence and compliance of the entity's integral risk management scheme.

The policies and manuals for risk management approved by the Board of Directors must be sent to the Superintendence for its knowledge, within the first ten business days following their approval or respective modification. The period between reviews and/or updates on policies or manuals must not exceed two years.

Risk Committee
Art. 9.- Entities must have a Risk Committee which must observe what is established in these Standards and in the “Technical Standards for Corporate Governance” (NRP-17) approved by the Central Bank, through its Standards Committee.

Functions of the Risk Committee
Art. 10.- The functions of the Risk Committee will include, at a minimum, the following activities:
a) Approve the following:

i. The methodologies for managing the different types of risks to which the entity is exposed, as well as their possible modifications, ensuring that it considers the relevant risks of the activities it performs; and
ii. The corrective actions proposed by the Risk Unit and the involved areas, as well as the mechanisms for implementing them, in the event that there is a deviation with respect to the assumed exposure levels or limits.
b) Require and follow up on corrective plans to normalize non-compliance with exposure limits or reported deficiencies; c) Evaluate, endorse and propose for approval by the Board of Directors, at least the following:
i. The strategies, policies and manuals for integral risk management, as well as any modifications made to them;
ii. The tolerance limits for exposure to the different types of risks identified by the entity, in accordance with its risk appetite; and
iii. Cases or special circumstances in which exposure limits may be exceeded, as well as special controls on such circumstances.
d) Inform the Board of Directors about the risks assumed by the entity, their evolution, their effects, especially at the equity levels and additional mitigation needs, as well as their corrective actions; e) Inform the Board of Directors about the exposures, deviations and exceptions of the risks that are managed in the entity; and f) Inform the Board of Directors about the results of the reports prepared by the Risk Unit.

Functions of Senior Management
Art. 11.- Senior Management is responsible for the establishment and execution of the structural framework of the risk management system and must report to the Board of Directors, adopting and ensuring compliance, at a minimum, with the following measures:
a) Establish the necessary conditions at the entire organizational level to promote an environment that seeks the development of the integral risk management process; b) Ensure that mechanisms exist that ensure adequate flow, quality and timeliness of information, between Business Units, operational support areas and the Risk Unit, so that the latter appropriately develops its function; c) Ensure the establishment of mechanisms for disseminating the culture of integral risk management, at all levels of the organizational structure; and d) Ensure the execution of training and updating programs for the entity's risk management.

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020

Risk Unit
Art. 12.- Entities must have a specialized unit to facilitate the evaluation of integral risk management, and may also designate additional units to supervise and manage specific risks, such as those referred to in article 6 of these Standards. Its size and scope of action must be related to the size, structure and risk profile of the entity. Its objective must be to identify, measure, control, monitor and inform about the risks they face in the development of their operations, whether these affect assets and liabilities inside or outside the balance sheet, including, where applicable, the risks of the member societies of the financial conglomerate.

This unit must be independent of the entity's business units and operational areas, in order to avoid conflicts of interest and ensure adequate separation of functions and responsibilities, and its hierarchical position must allow it access to the necessary information for the performance of its functions and ensure that its reports are known by the Board of Directors or by the instance it delegates.

The Head of the Risk Unit must possess a profile appropriate to the functions to be performed; for this purpose, the entity must consider their academic background, experience, and training in risk management. The Risk Unit must prepare an annual work plan, which must be approved by the Risk Committee and made known to the Board of Directors, in order to adequately fulfill risk management functions.

The entities listed in letters j), k), l), m) and n) of Article 2 of these Standards may designate personnel to perform the functions of the Risk Unit referred to in Article 13 of these Standards; provided that such personnel correspond to areas that are not linked to the business, operations, or finance areas of the same entity. (2)

Functions and responsibilities of the Risk Unit Art. 13.- The Risk Unit must fulfill at least the following minimum functions:
a) Identify, measure, control, monitor, and communicate the risks incurred by the entity and their effects on its solvency; b) Prepare the annual work plan of the Unit and submit it for approval by the Risk Committee; c) Design and propose to the Risk Committee for approval by the Board of Directors the respective strategies, policies, manuals, and procedures for integrated risk management and for each of the specific risks identified, as well as their modifications; d) Propose for approval the methodologies, models, and parameters for the management of the different types of risks to which the entity is exposed;

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020 e) Periodically inform the Risk Committee, as well as Senior Management, about the evolution of the main risks assumed by the entity, including details of changes in applicable risk factors and the historical evolution of the risks assumed by it; f) Issue an opinion on the possible risks involved in the establishment of new products, services, operations, and activities prior to their start; as well as regarding significant changes in the business environment, documenting the analysis performed to issue its opinion; g) Periodically follow up on corrective actions presented by units for the improvement of integrated risk management, which must be made known to the Risk Committee and Senior Management; h) Follow up on compliance with risk exposure limits, their tolerance levels by type of risk, and propose mitigation mechanisms for exposures and inform the Risk Committee; i) Perform periodic monitoring of the results of the application of methodologies, tools, models, compliance with tolerance limits; and j) Prepare and propose to the Risk Committee stress tests that allow managing each of the risks to which such tests are applicable, in particular, and evaluate the resistance and stability of the entity in adverse situations.

Training programs
Art. 14.- Due to the fact that integrated risk management is a dynamic process, Senior Management must ensure that the Board of Directors, employees, and executives directly involved in risk management are trained in these topics, developing for this purpose an annual training plan, which may be incorporated into the entity's general annual training plan, in which personnel to be trained, topics to be developed, and their scheduling are included. Likewise, since this management involves the entire organization, a dissemination program must be established that generates an organizational risk culture in all employees, levels of the organization, and in the induction programs for new personnel. The Training Plan may be reviewed every six months in order to make pertinent updates, to respond to the entity's needs, availability of topics to be developed, and the amount of personnel to be trained.

CHAPTER IV
RISK MANAGEMENT FRAMEWORK

Policies for risk management
Art. 15.- Entities must approve and develop policies to define the management framework for each of the types of risks to which they are exposed, as well as for third-party resources they administer, which allow them to reduce their vulnerability and losses from such risks and promote at the level of the entire organization the culture of prevention and risk management.

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020
Policies, manuals, and procedures for integrated risk management must consider, among other aspects, the functions and responsibilities in such management; as well as the criteria and mechanisms for the identification, measurement, control, mitigation, monitoring, and communication of the risks to which the entity is exposed. The entity's policies, manuals, and procedures must be consistent with its structure, nature, size, complexity of its activities, operations, business lines, type of clients it serves, and with the obligations applicable to its activity. These policies, manuals, and procedures must also be in accordance with the operations authorized according to its object and applicable legal regime.

Risk management manual
Art. 16.- Entities must have a risk management manual or manuals that, based on policies, group at minimum, for the management of each of the risks faced by the entity: the associated processes; the functions and responsibilities of the involved areas, indicating the segregation of functions of key positions susceptible to risks; the methodology for measuring risk detailing variables, criteria, tools used, and the periodicity with which information must be reported on exposure to each of the types of risks to the Risk Committee, the Board of Directors, and Senior Management. For the development of the risk management manual, entities must consider the implementation of prudential measures and best practices referred to risk management.
CHAPTER V
INFORMATION AND CONTROL SYSTEMS

Managerial information systems
Art. 17.- The entity must have a managerial information system and statistical databases, which enable the generation of timely, reliable, consistent, and homogeneous information that allows preparing periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other interested parties responsible for decision-making in risk management.

Internal control system
Art. 18.- The internal control system includes integrated risk management, which allows verifying compliance with policies, limits, processes, and procedures established during the execution of the entity's operations.
For this purpose, entities must establish the necessary administrative, financial, accounting, and technological controls, in accordance with international standards on the matter and applicable laws.

Role of Internal Audit
Art. 19.- The Internal Audit Unit must support the entity in evaluating and improving the quality and efficiency of risk management processes, for which it must observe what is established in the "Technical Standards for Internal Audit for Members of the Financial System" (NRP-15), approved by the Central Bank through its Standards Committee.

Of External Auditors
Art. 20.- The entity's external auditors must include in their periodic evaluation the review of risk management functions, and their results must be incorporated into the respective reports they issue in accordance with what is established in the "Technical Standards for the Provision of External Audit Services" (NRP-18), issued by the Central Bank through its Standards Committee. (3)

Annual report
Art. 21.- Entities must submit to the Superintendence, within the first one hundred twenty days following the end of the reported fiscal year, the "Technical Evaluation Report of Integrated Risk Management", prior approval by the Board of Directors, which must contain at minimum the following:
a) The organizational structure for integrated risk management; b) Details of the main risks assumed by the entity's activities; c) List of policies, manuals, and procedures for integrated risk management, including the date of the last modification; d) Description of the methodologies, systems, and tools used for each of the risks; e) The results of the evaluations carried out on integrated risk management, in accordance with what is established in the "Technical Standards for Internal Audit for Members of the Financial System" (NRP-15), approved by the Central Bank through its Standards Committee; f) The execution of the training plan related to integrated risk management established in Article 14 of these Standards; g) Projects associated with risk management to be developed in the year following the reported one; and h) General conclusions on the entity's risk management.

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020
Notwithstanding the above, the Board of Directors must immediately inform the Superintendence upon becoming aware of relevant aspects related to risk exposure that may negatively impact the entity either qualitatively or quantitatively.

Disclosure on integrated risk management
Art. 22.- Entities must summarize in a section of their Website, within the first ninety calendar days of each year, information related to policies, methodologies, and other relevant measures adopted for the management of each type of risk.
Entities must summarize in the notes to the annual closing financial statements the manner in which they manage risks and compliance with their policies.

Additional information
Art. 23.- The Superintendence may require entities to provide additional information it considers necessary for the adequate supervision of integrated risk management and of each of the specific risks to which the entity in question is exposed.
Entities must always have available to the Superintendence all documents, records, files, in physical, electronic, or any other medium, referred to in these Standards, as well as the information from audits or reviews conducted by their holding companies, in the case of entities whose holding company is located outside the country. The information referred to in the preceding paragraph must be safeguarded for a minimum period of five years, from its generation; after this period has elapsed, entities may destroy the information once they have the corresponding digital backup, provided there is no legal obligation to keep it physically.
CHAPTER VI
OTHER PROVISIONS AND VALIDITY
Voluntary Pension Savings
Art. 24.- Entities authorized for the administration and marketing of Voluntary Pension Savings Funds will apply, for the management of risks of said Funds, what is established in these Standards and what relates to Investment Funds in the "Technical Standards for the Integrated Risk Management of Entities of the Stock Markets" (NRP-11), approved by the Central Bank, through its Standards Committee, insofar as applicable.

Sanctions
Art. 25.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

NRP-20
FINANCIAL ENTITIES
Approval: 26/02/2020
Validity: 01/04/2020
Repeal
Art. 26.- These Standards repeal the "Standards for the Integrated Risk Management of Financial Entities" (NPB4-47), approved in Board of Directors Session No. CD-05/2011 on February 8, 2011, by the Board of Directors of the Superintendence of the Financial System, whose Organic Law was repealed by Legislative Decree No. 592 containing the Law on Supervision and Regulation of the Financial System, published in Official Diary No. 23, Volume No. 390, dated February 2, 2011.

Transitory
Art. 27.- For the purpose of complying with the provisions established in these Standards, entities must submit to the Superintendence an adaptation plan, within one hundred fifty days following the validity of these Standards. Once the plan is submitted, entities must implement it within a maximum period of nine months counted from its submission. (1)

Unforeseen aspects
Art. 28.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Central Bank through its Standards Committee.

Validity
Art. 29.- These Standards will enter into force from April 1, 2020.
MODIFICATIONS:
(1) Modification to Article 27 approved by the Central Bank through its Standards Committee, in Session No. CN-10/2020 dated June 18, 2020, with validity from June 23, 2020.
(2) Modifications in Articles 2 and 12 approved by the Central Bank through its Standards Committee, in Session CN-02/2022, of February 21, 2022, with validity from March 8, 2022.
(3) Modifications in Articles 6 and 20 approved by the Central Bank through its Standards Committee, in Session CN-05/2026, of June 30, 2026, with validity from July 15, 2026.