Technical Standards for the Integral Risk Management of Pension Entities — BCR — SV

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR, CONSIDERING:

I. That Article 3, first paragraph and literal c) of the Law on Supervision and Regulation of the Financial System, establishes that it is the responsibility of the Financial System Superintendence to proactively monitor the risks of the members of the financial system and the manner in which they manage them, ensuring the prudent maintenance of their solvency and liquidity.

II. That Article 7 of the Law on Supervision and Regulation of the Financial System, establishes that the members of the Financial System are the Pension Fund Administrators, the National Institute of Pensions for Public Employees, the Salvadoran Institute of Social Security, the latter with respect to the Public Pension System, the Professional Risks Regime and health technical reserves, and the Social Prevision Institute of the Armed Forces.

III. That by Legislative Decree No. 615, of December 20, 2022, published in Official Diary No. 241, Volume No. 437 of the 21st of the same month and year, the Law on the Creation of the Salvadoran Institute of Pensions was approved, which is established as a public law institution, which, among others, will respond for the obligations previously acquired and which currently correspond to the National Institute of Pensions for Public Employees, as well as the competencies and attributions, rights and obligations, assets, liabilities and equity of the latter. (3)

IV. That Article 2 of the Law on the Creation of the Salvadoran Institute of Pensions establishes in its third paragraph that the aforementioned Institute shall be governed, among others, by what is provided in the Law on Supervision and Regulation of the Financial System, as well as by the regulations issued for such effect by the Committee of Standards of the Central Reserve Bank of El Salvador. (3)

V. That Article 3 of the Law on the Creation of the Salvadoran Institute of Pensions establishes in its second paragraph that the Central Reserve Bank of El Salvador, through its Committee of Standards, shall establish the aspects that the aforementioned Institute must include in its risk management policies. (3)

VI. That Article 48 of the Comprehensive Law of the Pension System establishes that without prejudice to the regulations and intervention of the competent entities, Pension Administrators must elaborate internal prudential control policies that allow them to adequately manage their financial, regulatory and operational risks and must submit them for approval to the respective boards of directors, for which they must, in any case, adhere to international prudential control standards and the corresponding regulations. (3)

VII. That Article 35 literal d) of the Law on Supervision and Regulation of the Financial System, stipulates that directors, managers and other officials who hold positions of direction or administration of the members of the financial system, must conduct their business, acts and operations complying with the highest ethical standards of conduct, acting with the due diligence of a good merchant in their own business, being obliged to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management is complied with, being obliged, among other actions, to identify, evaluate, mitigate and reveal them in accordance with international best practices. (3)

VIII. That Article 99 literal a) of the Law on Supervision and Regulation of the Financial System, stipulates that it will correspond to the Committee of Standards the approval of technical standards, instructions and provisions that the laws regulating the supervised establish must be issued to facilitate their application including aspects inherent to risk management by the supervised. (3)

IX. That among the activities developed by the Pension Fund Administrators are the administration of Pension Funds, among them the individual savings accounts for pensions, the investments with the resources of said funds and the granting of benefits to affiliates of the Pension System, which requires management and control mechanisms that allow establishing that they are carried out in accordance with the Comprehensive Law of the Pension System and the current legal framework. (3)

X. That among the activities developed by the Pension Institutes is the granting and control of benefits to affiliates of the Public Pension System, administration of funds for the payment of pensions, which requires management and control mechanisms that allow establishing that they are carried out in accordance with the Comprehensive Law of the Pension System and the current legal framework. (3)

XI. That Pension Entities must know the risks to which Pension Funds are exposed and manage them adequately in the best interest of affiliates and pensioners. In this sense, entities must implement solid risk management mechanisms that allow them to optimize the control of their operations and minimize risks and their impacts, in such a way that a correct administration of the resources of the Funds is made. (3)

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES, to issue the following:

TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES

CHAPTER I
OBJECT, SUBJECTS AND TERMS

Object
Art. 1.- These Standards have as their object to establish prudential provisions of a general nature to strengthen the integral management of the risks that obliged subjects must observe in accordance with applicable laws and international standards in the matter, in accordance with the nature and scale of their activities. These Standards complement the current general regulatory framework, of which it is part -17), approved by the Central Bank through its Committee of Standards.

Subjects
Art. 2.- The subjects obliged to comply with the provisions established in these Standards are:
a) The Pension Fund Administrators; (3) b) Social Prevision Institute of the Armed Forces; c) The Salvadoran Institute of Pensions; and (3) d) The Salvadoran Institute of Social Security, with respect to the Public Pension System, the Professional Risks Regime and health technical reserves.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: The Executive President, Executive Director, General Director, General Manager or whoever acts in their place and the executive positions that report to them, as well as the holders of entities that do not have the figure of executive president; b) Risk Appetite: The level and types of risks that an entity is willing to assume in relation to its activities, to achieve its strategic objectives and business plan; c) Business Area: It is a specialization of the business that groups processes

aimed at generating products and services to serve a target market segment; d) Central Bank: Central Reserve Bank of El Salvador; e) Client or Users: Natural or legal person who maintains a contractual relationship with the entity for the provision of services or financial products that it offers, which in these Standards may refer to: contributors, affiliates, pensioners, participants, beneficiaries, among others; f) Conflict of Interest: Any situation in which it can be perceived that a personal benefit or interest of a third party can influence the judgment or professional decision of a member of the entity regarding the fulfillment of its obligations; g) Integral risk management culture: Norms, attitudes and behavior of an entity related to risk and decisions on how to manage and control them; h) Operational risk event: It is an event or series of events of internal or external origin, which may or may not result in financial losses for the entity; i) Pension Entities or entities: For the purposes of these Standards, Pension Fund Administrators, the Social Prevision Institute of the Armed Forces, the Salvadoran Institute of Pensions and the Salvadoran Institute of Social Security are considered Pension Entities; (3) j) Fund(s): Pension Funds and Voluntary Pension Savings Fund; k) Risk factors: Represent those variables that entities must consider for adequate identification and mitigation of the risks to which they are exposed; l) Operational risk factor: It is the primary cause or origin of an operational event; m) Pension Institutes: For the purposes of these Standards, the following will be considered Pension Institutes: Social Prevision Institute of the Armed Forces, Salvadoran Institute of Pensions and the Salvadoran Institute of Social Security; (3) n) Mitigation measures: Set of actions implemented by pension entities to technically manage risks, so that potential losses derived from their materialization are minimized; (3) o) Risk Map: It is a tool that allows presenting an overview of the risks to which the entity is exposed; regardless of the form of its presentation, in which the areas/activities/assets (processes) that could be affected during the occurrence of an adverse event are identified and located. It allows seeing the threats and measuring the magnitude of each risk (probability and economic impact). They are a graphical instrument for risk management that allows comparing risks by their relative importance, as well as together, allowing the entity to establish acceptable levels of risk; p) Board of Directors: Collegiate body or equivalent body in charge of the administration of the entity, with supervisory, direction and control functions;

q) Risk Profile: Evaluation at a given moment in time of the exposure to risk; r) Action Plans: Consists of a set of corrective measures proposed by the entity. These action plans contain activities, responsible parties and completion dates; s) Process: It is the set of activities that transform inputs into products or services with value for the user, whether internal or external; t) Stress tests: Scenarios used to evaluate and measure the resistance, vulnerability and stability of an entity or financial system against the occurrence of possible extreme adverse events, and their impact on equity and/or the financial results of an entity; u) Inherent risk: Level of risk inherent to the activity, without taking into account the effect of controls; v) Residual risk: Level resulting from risk after applying controls. It is the risk that remains, once the appropriate controls for its treatment have been implemented. In any case, it requires permanent monitoring to observe its evolution; (3) w) Superintendence: Financial System Superintendence; and (3) x) Risk tolerance: Acceptable levels of risk-taking to achieve a specific objective or manage a category of risk. Risk tolerance represents the practical application of risk appetite and, in general, is aligned with risk categories, such as; strategy, finance, people or reputation. (3)

CHAPTER II
ON INTEGRAL RISK MANAGEMENT

Integral risk management
Art. 4.- Pension Entities must establish an integral risk management system, which shall be understood as an integral process carried out by the entire entity, through which they identify, measure, control, mitigate, monitor and communicate the different types of risks to which they are exposed, considering the funds administered and the interrelationships that arise between them for the achievement of their objectives. Such management must be in accordance with its risk profile, volume and complexity of its activities, business areas, own and third-party resources, as well as the funds administered in such a way as to promote the implementation of measures in accordance with best practices for the transparent, efficient and orderly functioning of the market. The integral process for risk management must be duly documented and periodically reviewed, based on the changes that occur in the entity's risk profile and in the market. The policies, procedures and manuals issued by the entities must be in Spanish.

Stages of the integral risk management process Art. 5.- Entities must have a continuous and documented process for the integral management of their risks and the funds they administer, which must contain at least the following stages:
a) Identification: It is the stage in which existing risks are recognized and understood in each operation, product, service and processes that the entity develops for the administration of funds. In this stage, the risk factors are identified, which are variables and whose movements can generate changes in the equity of the entity or in that of the funds it administers; b) Measurement: It is the stage in which risks must be measured quantitatively or qualitatively, in order to determine compliance or adequacy of policies, established limits and measure the possible economic impact on the financial results of the entity, as well as the Funds it administers. The methodologies and tools to measure risks must be in accordance with the size and nature of their operations and the levels of risks assumed; c) Control and mitigation: This stage refers to the coverage and control actions or mechanisms implemented by the entity that allow permanent follow-up of risk factors with the aim of preventing, transferring or reducing negative effects on the funds it administers, in case the adverse events that are triggers for the identified and managed risks materialize; and d) Monitoring and communication: It is the stage in which systematic and permanent follow-up is given to risk exposures and the results of adopted actions. The computer systems or tools used must ensure a periodic and objective review of risk positions and the generation of sufficient information, to support decision-making processes and allow communicating the results of risk management in a timely manner.

Functional and communication structure
Art. 6.- Entities must establish an organizational structure, in accordance with their business model and duly segregated, which delimits their hierarchical levels, functions and responsibilities, levels of dependence and interrelationship that correspond to each of the business areas, operational support and control that participate in the risk management process to which they are exposed. All in accordance with the size, nature of their operations and funds administered; said structure must be designed considering that there are adequate communication channels in the organization, in its functional and transversal form.

Entities will establish and apply the methodologies they consider appropriate for the risk management model, without prejudice to the norms and minimum requirements established by the Central Bank through its Committee of Standards.

Functions of the Board of Directors or Equivalent Management Body Art. 7.- The Board of Directors or equivalent management body, is responsible for ensuring adequate integral management of the entity's risks and the funds administered by it, having among its functions at least the following:
a) Define and approve the entity's risk appetite and tolerance, approve the exposure limits of each particular risk in accordance with its profile, it must establish the respective controls for exceptions and deviations to said limits; b) Approve the internal organizational or functional structure in accordance with its business model, with their respective organization and segregation of functions manuals, assigning the necessary resources to implement and maintain adequate risk management, in an effective and efficient manner, including training programs; c) Approve the policies and manuals for the management of risks assumed by the entity, ensuring that they are implemented; d) Create the Risk Committee in accordance with what is estab -17) approved by the Central Bank, through its Committee of Standards, establishing the appointment and removal of its members, when applicable and ensuring their independence; e) Create the Risk Unit and appoint the person in charge of it, ensuring its independence from business and operational areas in order to avoid conflicts of interest and ensure adequate separation of functions and responsibilities, as well as providing it with the resources, tools, materials and adequate technical training; f) Know and understand all the risks inherent to the business that the entity develops and to which the entity is exposed, its evolution and its effects, especially at the equity levels; as well as the methodologies and tools for risk management; g) Approve the entity's incursion into new products, services, operations and activities; and ensure that they adhere to the entity's business strategies and management policies; h) Ensure that an organizational culture of risk management is implemented within the entity; i) Ensure that internal audit verifies the existence and compliance of the entity's risk management scheme. The policies and manuals for risk management approved by the Board of Directors must be sent to the Superintendence for its knowledge within the first ten business days following their approval or respective modification. The period between reviews and/or updates on Policies or Manuals must not exceed two years.

In no case can the functions established in this article contradict the obligations contained in the applicable legal framework for pension institutes.

Risk Committee
Art. 8.- Entities must have a Risk Committee which shall observe what is established in these Standards and in the (NRP-17) approved by the Central Bank, through its Committee of Standards.

Functions of the Risk Committee
Art. 9.- The functions of the Risk Committee shall include, at minimum, the following activities:
a) Approve the following:
i. The methodologies to manage the different types of risks to which the entity is exposed and the funds it administers, as well as their eventual modifications, ensuring that the same considers the critical risks of the activities it performs;
ii. The mechanisms for the implementation of corrective actions; and
iii. The corrective actions proposed by the Risk Unit and the areas involved in case there is deviation with respect to the assumed exposure levels or limits.
b) Evaluate, endorse and propose for approval by the Board of Directors, at least the following:
i. The strategies, policies, manuals and methodologies for integral risk management, as well as the eventual modifications made to them;
ii. The tolerance limits for the exposure of the different types of risks identified by the entity; in accordance with its risk appetite; and
iii. The cases or special circumstances in which the exposure limits may be exceeded, as well as the special controls on said circumstances.
c) Require and follow up on action plans to normalize non-compliance with exposure limits or reported deficiencies; d) Inform the Board of Directors about the exposures, deviations and exceptions of the risks that are managed in the entity; e) Inform the Board of Directors about the risks assumed by the entity, its evolution, its effects, especially at the equity levels, and the additional mitigation needs, as well as its associated action plans; f) Inform the Board of Directors of the execution of the approved policies, according to the periodicity established in each of them, ensuring that the entity's operations comply with the policies and procedures defined for the integral management of risks; and g) Inform the Board of Directors about the result of the reports prepared by the

Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020 Risk Unit.
In the case of Pension Institutes that do not have a Risk Committee within their organizational structure, the functions corresponding to said Committee may be carried out by the Board of Directors or equivalent Management Body, by a Supervisory Board or other Control Body, provided that they comply with the provisions established in these Standards.

Functions of Senior Management
Art. 10.- Senior Management is responsible for the implementation of management for each particular risk applicable to the entity and the funds administered, and must report to the Board of Directors, adopting and ensuring compliance with at least the following measures:
a) Establish conditions at the organizational level to foster an environment that promotes the development of the integral risk management process; b) Ensure that mechanisms exist to guarantee adequate flow, quality, and timeliness of information, among Business Units, operational support areas, and the Risk Unit, so that the latter appropriately performs its function; c) Ensure the establishment of mechanisms for disseminating the culture of integral risk management, at all levels of the organizational structure; and d) Ensure the execution of training and updating programs for the entity's risk management.

Risk Unit
Art. 11.- Entities must have a specialized unit to facilitate the evaluation of integral risk management, and may additionally designate units to supervise and manage specific risks. Its size and scope of action must be related to the size, structure, and risk profile of the entity. Its objective must be to identify, measure, control, monitor, and report the risks faced in the development of their operations, and in the funds they administer. What is stated in the previous paragraph does not limit the role of the different units of the institution in the identification, measurement, control, monitoring, and communication of the risks faced by the entity. The head of the Risk Unit must possess a profile appropriate to the functions to be performed, as well as knowledge and experience in risk management; for this, the Board of Directors must consider, for their appointment, their academic training, experience, and training in risk management; in addition, their hierarchical position within the entity must allow them unrestricted or unlimited access to the information necessary for the performance of their functions.

Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020 The Risk Unit or head must prepare an annual work plan, which must be reviewed and validated by the Risk Committee and approved by the Board of Directors or Board of Trustees, in order to adequately fulfill risk management functions. In the case of Pension Institutes, they may designate entity personnel to perform the functions of the Risk Unit in accordance with what is established in Article 12 of these Standards. Provided that these are assumed by areas that are not linked to business, operations, or finance areas.

Functions and responsibilities of the Risk Unit Art. 12.- The Risk Unit must fulfill at least the following functions:
a) Identify, measure, control, monitor, and communicate the risks to which the entity and the funds it administers are exposed, and their effects on the solvency of the institution's equity and the administered funds, together with the various units of the entities; b) Prepare the annual work plan of the Unit and submit it for approval by the Risk Committee; c) Design and propose to the Risk Committee, for the approval of the Board of Directors, the policies, procedures, and respective manuals for integral risk management and for each of the specific risks identified, as well as their modifications; d) Propose to the Risk Committee the methodologies, models, and parameters for the integral management of each of the risks to which the Pension Entity and the administered funds are exposed; defining the periodicity of their execution and verification of their predictive capacity; e) Periodically inform the Risk Committee, as well as Senior Management, about the evolution of the main risks assumed by the entity, including details of changes in applicable risk factors and the historical evolution of the risks assumed by the same; f) Issue an opinion on the possible risks involved in the establishment of new products, channels, services, operations, and activities prior to their start; as well as regarding important changes in the business, operational, and technological environment of the entity and the funds it administers, documenting the analysis performed and the conclusions and recommendations to issue their opinion; g) Follow up on compliance with risk exposure limits, their tolerance limits by type of risk, the measurement methodologies, tools, and models established for each type of risk, as well as inform the results of the measurements, and propose mitigation mechanisms for exposures and inform the Risk Committee; h) Follow up on the action plans presented by the units for the improvement of integral risk management, which must be made known to the Risk Committee and Senior Management; i) Perform periodic monitoring of the results of the application of methodologies, tools, models, compliance with tolerance limits; and j) Prepare and propose to the Risk Committee stress tests that allow managing the risks considered pertinent and evaluate the resilience and stability of the entity or the administered funds in adverse situations.

Training programs
Art. 13.- Because integral risk management is a dynamic process, Senior Management must ensure that the Board of Directors; as well as executives and employees directly involved in risk management are trained in these topics, developing for this an annual training plan, which may be incorporated into the entity's general annual training plan, in which the personnel to be trained, topics to be developed, and their scheduling are included. Likewise, since this management involves the entire organization, a permanent dissemination program must be established that generates an organizational risk culture in all employees, levels of the organization, and in the induction programs for new personnel. The training plan may be reviewed every six months in order to make the pertinent updates, which address the needs of the entity, the availability of topics to be developed, or the number of personnel to be trained.

CHAPTER III
RISK MANAGEMENT FRAMEWORK

Policies for risk management
Art. 14.- Entities must approve and develop policies to define the management framework for each of the types of risks to which they are exposed, and the funds administered, with the purpose of reducing their vulnerability and losses due to such risks and promoting at the organizational level the culture of prevention and risk management. The policies, manuals, and procedures for integral risk management must consider, among other aspects, the functions and responsibilities in management, as well as the criteria and mechanisms for the identification, measurement, control, mitigation, monitoring, and communication of the risks to which the entity and the funds administered are exposed. The entity's policies, manuals, and procedures must be consistent with its structure, nature, size, complexity of its activities, operations, business area, type of clients it serves, and with the obligations applicable to its activity.

Content of risk management policies (3)
Art. 14-A.- For the preparation of risk management policies, entities must include, at least, the following: (3) a) Objectives; (3) b) Scope; (3) c) Guiding principles of risk management policies; (3) d) Definition of roles and responsibilities for the execution of risk management policies; (3) e) Legal and regulatory framework of reference on which risk management policies are based; (3) f) Guidelines and key actions on which the risk management policy is structured; (3) g) In the identification stage, consider at minimum, the description of the following aspects: (3)
i. Recognition and prioritization of the entity's critical processes; (3)
ii. Endogenous and exogenous risk factors, as well as their interrelation; (3)
iii. Causes and events associated with risk factors; (3)
iv. Strengths, weaknesses, opportunities, and threats; (3)
v. Human, technological, monetary resources, management tools, etc. that are available for risk mitigation; (3)
vi. Changes in the environment that may increase the risk factors detected by the entity; (3)
vii. Factors that potentially increase the sources of risk over time; (3)
viii. Emerging risk indicators; and (3)
ix. Nature and value of the entity's assets. (3)
h) Regarding the measurement stage, include at least, the description of the following aspects: (3)
i. Criteria for defining acceptable levels of risk appetite for each type defined by the entity; (3)
ii. Levels and limits of risks assumed by the entity; (3)
iii. Qualitative and quantitative criteria that will be considered for the analysis and evaluation of risks; (3)
iv. Potential scenarios for the realization of risk factors to be evaluated; (3)
v. Probability of occurrence of potential scenarios and criteria for quantifying the impact that the realization of risks would cause in the entity, highlighting the confidence levels to be used and the corresponding action mechanisms; (3)
vi. Consequences and potential impacts for the entity in case of realization of identified risks; and (3)
vii. Periodicity of risk evaluation. (3)
i) Regarding the control and mitigation of risks, consider at minimum, the description of the following aspects: (3)
i. Mechanisms or tools that will be implemented by the entity for the control of risks; (3)
ii. Mitigation measures that will be adopted; and (3)
iii. Action plans that will be executed. (3)
j) With respect to the monitoring and communication of their risks, the entity must observe at minimum, the description of the following aspects: (3)
i. Mechanisms, computer systems, or tools through which the evolution of risks will be followed as well as its respective periodicity; (3)
ii. Information generation mechanisms that will support the entity's decision-making, in terms of risk management; (3)
iii. Identification of the areas responsible for communicating alerts that are generated in situations or threats that affect the normal course of the entity's operations; and (3)
iv. Procedure for the effective and timely communication of risk situations or threats faced by the entity. (3)
k) Periodicity of review and update of risk management policies; and (3) l) Change control table for risk management policies. (3)

Risk management manual (3)
Art. 15.- Without prejudice to what is established in Article 14-A of these Standards, the Institute must have a risk management manual or manuals that, based on the policies, group for the management of each of the risks faced by the Institute, at minimum, the following aspects: (3) a) Associated processes; (3) b) The functions and responsibilities of the involved areas, indicating the segregation of functions of key positions susceptible to risks; (3) c) The methodology for measuring risk detailing variables, criteria, tools used; and (3) d) The periodicity with which information must be provided on exposure to each of the types of risks to the Board of Directors and to those areas that by their hierarchical level or criticality of their functions, play a relevant role in risk management. (3) For the development of the risk management manual, the Institute must consider the implementation of prudential measures and best practices related to the matter. (3)

CHAPTER IV
MANAGEMENT BY TYPES OF RISKS

Types of risks
Art. 16.- For the purposes of these Standards, entities must manage, according to their structures, size, businesses, and resources, at minimum the following risks:
a) Credit Risk: Credit risk is understood as the possibility of loss due to the default of contractual payment obligations assumed by a debt issuer or third-party obligors; the management of this risk must consider, in accordance with each entity's policies, the observance or not of socio-environmental responsibility principles in the activities and resources to be financed; b) Counterparty Risk: Counterparty risk is understood as the possibility of loss that may occur due to the default of contractual obligations assumed by a party for the settlement of an operation due to situations of illiquidity, insolvency, operational capacity, or improper actions; c) Custody Risk: Custody risk is understood as the possibility of loss affecting the values held in custody due to the insolvency, negligence, fraud, poor administration, or inadequate maintenance of records by a custodian. d) Liquidity Risk: Liquidity risk is understood as the possibility that the administered funds do not have sufficient liquid resources to meet financial obligations when and as expected, such as the payment of affiliates' benefits. e) Market Risk: Market risk is understood as the possibility of loss, resulting from movements in market prices that generate a deterioration in the value of the entity's positions or the funds it administers; f) Operational Risk: Operational risk is understood as the possibility that the administrator incurs losses, due to failures in processes, people, information systems, and due to external events. It refers to both operations performed directly by the supervised entity as well as those performed through external providers contracted by it. It includes the loss of sensitive information and other contingencies generated by failures in information and communications technologies; operational risk includes the management of information security, business continuity, and legal risk. Legal risk is understood as the possibility of occurrence of losses due to failures in the execution of contracts or agreements, non-compliance with regulations, as well as external factors such as regulatory changes, judicial processes, among others; (3) g) Reputational Risk: Reputational risk is understood as the risk associated with changes in the perception of the entity, or of the brands that integrate it, by stakeholder groups (clients, affiliates, shareholders, employees, etc.). Legal, credit, market, and operational risk can generate reputational risk. With reference to the management of money laundering and asset risk and financing risk Technical Standards for the Management of Money Laundering and Asset Risk, Terrorism Financing, and the Financing of the Proliferation of Weapons of Mass Destruction -36) approved by the Central Bank, through its Standards Committee. (3)

CHAPTER V
OPERATIONAL RISK MANAGEMENT

Art. 17.- Entities must manage the different factors generating operational risk, being these the following:
a) Processes: It is the set of interrelations of activities for the transformation of input elements into products or services, to satisfy a need. In order to guarantee the optimization of resources and the standardization of activities, entities must have documented, defined, and periodically updated processes according to the entity's policies, which can be grouped into types of processes according to what is established by the entity. Entities must appropriately manage the risks associated with said processes, with emphasis on the failures or weaknesses they present, since these may have as a consequence the poor development of operations; b) People: It is the set of collaborators directly or indirectly linked to the execution of the entity's processes. Entities must establish policies, processes, and procedures that ensure adequate planning and administration of human capital, which include: the hiring, retention, and separation process of personnel. Likewise, they must establish preventive mechanisms that allow identifying and managing failures, insufficiencies, negligence, sabotage, theft, inadequate training, misappropriation of information, among others, associated with personnel directly or indirectly linked to the entity; in such a way that the possibility of economic losses is minimized. Direct linkage is that based on a labor contract, according to the respective labor legislation. Indirect linkage refers to those people who have a legal relationship with the entity for the provision of certain services, different from that originating from a labor contract; c) Information Technology: It is the set of technological tools used to support the entity's processes. Entities must manage the risks associated with information technology, among others, those related to failures in the security and operational continuity of computer systems, errors in the development and implementation of said systems, and the compatibility and integration of the same, as well as the quality of information and adequate investment in technology; and d) External Events: Events associated with nature or caused by third parties, which escape in terms of cause and origin from the control of the entity. Entities must manage the risks associated with external events beyond the entity's control that could alter the normal development of their activities, related to failures in critical services provided by third parties, legal contingencies, the occurrence of natural disasters, attacks, and criminal acts, among other factors. Regarding the management of information technology factors, the entity must apply what is established in the Technical Standards for the Management of Information Security - Technical Standards for the Business Continuity Management System -24), approved by the Central Bank through its Standards Committee. (3)

Operational Risk Management
Art. 18.- Operational risk management must consider the following aspects:
a) Identify operational risk events of the entity and the managed funds, grouping them according to Annex No. 1 of these Standards, in such a way as to allow them to establish their operational risk map. The subjects to whom these Standards apply must identify the events grouped according to the business areas that the entity maintains, as established in Annex No. 2 of these Standards; b) Entities must estimate or quantify operational risk considering the probability of occurrence and the economic impact on the results of the entity and the managed funds. This quantification is essential for the entity because control and mitigation measures aimed at minimizing losses from this risk are established based on them; the methodologies and tools for estimating or quantifying operational risk must be in accordance with the size, the nature of the levels of risk assumed by the entity, and the volume of its operations; c) Identify and explicitly link the key controls that mitigate the identified material operational risks, taking into account that controls are mechanisms established to avoid, detect, or limit operational risk events. The actions or coverage and control mechanisms implemented by the entity with the aim of preventing or reducing the negative effects in the event that adverse operational risk events materialize must be established. When identified risk events exist, an action plan must be established to implement measures aimed at mitigating the identified risk events. This plan must detail the actions to be implemented, the estimated execution time, and the direct responsible parties for such execution;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020 d) Entities must provide systematic and timely follow-up to materialized operational risk events, as well as to the results of the actions adopted. The follow-up must ensure a periodic review and the generation of sufficient information to support decision-making processes; e) Entities must perform periodic monitoring of their risk map and exposure to operational risk losses, complying with at least the following aspects:
i. Develop effective and periodic follow-up processes that allow for the rapid detection and correction of deficiencies;
ii. Establish indicators that evidence potential operational risks;
iii. Ensure that the established internal controls are functioning effectively and efficiently; and
iv. Ensure that residual risks are within the tolerance level established by each entity.
f) Entities must form a centralized database that allows registering, ordering, classifying, and making available information about materialized operational risk events of the administrator and the managed funds. These must be classified by factors, determining the frequency of the event and the effect produced, and must contain at least the fields detailed in Annex No. 3 of these Standards and send them to the Superintendence in accordance with what is established in these Standards; and g) Analyze and prioritize identified risks, classifying them according to the impact and probability on institutional objectives.

Art. 19.- Entities must send to the Superintendence, annually by January 31 of each year, Operational Risk electronic reports or in the manner that the Superintendence determines.

CHAPTER VI
INFORMATION AND CONTROL SYSTEMS

Managerial information systems
Art. 20.- The entity must have managerial information and statistical databases that enable the generation of timely, reliable, consistent, and homogeneous information that allows preparing periodic reports for the Board of Directors, the Risk Committee, and Senior Management, as well as for other interested parties responsible for decision-making in risk management.

Internal control system
Art. 21.- The internal control system includes integral risk management, which allows verifying compliance with the policies, limits, processes, and procedures established during the execution of the entity's operations. For this purpose, entities must establish the necessary controls in accordance with international standards on the matter.

Role of internal audit
Art. 22.- The Internal Audit Unit must support the entity in evaluating and improving the quality and efficiency of risk management processes, observing what is established in the -15), approved by the Central Bank through its Standards Committee.

Of External Auditors
Art. 23.- The entity's external auditors must include in their periodic evaluation the review of risk management functions, and their results must be incorporated into the respective reports they issue in accordance with what is established in the -18), issued by the Central Bank through its Standards Committee.

CHAPTER VII
INFORMATION TRANSPARENCY

Annual report
Art. 24.- Entities must send to the Superintendence, within the first one hundred twenty days following the end of the reported accounting year, the approval of the Board of Directors, which must contain at least the following:
a) The organizational structure for integral risk management; b) Detail of the main risks to which the entity and the managed funds are exposed, by their activities; c) List of updated policies, manuals, and procedures for integral risk management, including the date of the last modification; d) Description of the methodologies, systems, and tools used, as well as the latest results thereof for the measurement of each of the risks; e) Results of the evaluations conducted on integral risk management, of Members of the S -15), approved by the Central Bank through its Standards Committee; f) Projects associated with risk management to be developed in the year following the reported one; g) Execution of the training plan related to integral risk management established in article 13 of these Standards; and

Disclosure on integral risk management
Art. 25.- Entities must disclose in summary form in a section of their website, within the first ninety days of each year, the general information regarding the policies, manuals, and other relevant measures adopted for the management of each type of risk. Entities must disclose in summary form in the notes to the annual closing financial statements how they manage risks and comply with their policies.

CHAPTER VIII
OTHER PROVISIONS AND VALIDITY

Additional information
Art. 26.- The Superintendence may require entities to provide any additional information it considers necessary for the adequate supervision of integral risk management and of each of the specific risks to which the entity in question is exposed. Entities must always have available to the Superintendence all documents, records, and files, in physical, electronic, or any other medium, referred to in these Standards, as well as the information from audits or reviews conducted by their holding companies, in the case of entities whose holding company is located outside the country. The information referred to in the preceding paragraph must be safeguarded for a minimum period of five years, from the time of its generation; after this period has elapsed, entities may destroy the information once they have the corresponding digital backup, provided there is no legal obligation to maintain it physically.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020 Technical details of information submission Art. 27.- The Superintendence will send to the entities, within a maximum period of one hundred eighty days following the date of entry into force of these Standards, with a copy to the Central Bank, the technical details related to the submission of the required information. The information requests will be limited to the collection of information as regulated in these Standards. (1)

Entities must implement the necessary mechanisms for the submission of the aforementioned information within a maximum period of one hundred twenty days after receiving the communication from the preceding paragraph, in accordance with the technical details sent by the Superintendence.

Sanctions
Art. 28.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Transitory
Art. 29.- Entities, to comply with the provisions established in these Standards, must submit to the Superintendence an adaptation plan, within one hundred fifty days following the validity of these Standards. Once the plan is submitted, entities must implement it within a maximum period of nine months counted from its submission. (1)

Art. 29-A.- To adapt and approve policies in accordance with what is established in article 14-A of these Standards, entities will have a period of 30 business days counted from December 30, 2022, and must submit them to the Superintendence ten business days after their approval, in accordance with the second paragraph of article 7 of these Standards. (3)

Unforeseen aspects
Art. 30.- Aspects not foreseen in the regulatory matter of these Standards will be resolved by the Central Bank through its Standards Committee.

Validity
Art. 31.- These Standards will enter into force as of April 1, 2020.

TYPES OF EVENTS BY OPERATIONAL RISK

Event Type (Level 1)
Definition
Event Type (Level 2)
Examples
Internal Fraud
Losses derived from any type of action aimed at defrauding, misappropriating assets, or evading regulations, laws, or corporate policies in which at least one member of the entity is involved. Unauthorized activities Unrevealed operations (intentional), unauthorized operations (with economic losses), erroneous valuation of positions (intentional). Theft and fraud Theft, embezzlement, forgery, bribery, misappropriation of accounts, smuggling, intentional tax evasion. External Fraud Losses derived from any type of action aimed at defrauding, misappropriating assets, or evading legislation, by a third party. Theft and fraud Theft, forgery. System Security Damages from cyberattacks, theft of information. Labor relations and workplace safety Losses derived from actions incompatible with labor legislation or agreements, regarding hygiene or workplace safety, regarding the payment of claims for personal damages, or regarding cases related to diversity or discrimination. Labor relations Issues regarding remuneration, social benefits, termination of contracts. Workplace hygiene and safety Cases related to workplace hygiene and safety standards; compensation to workers. Diversity and discrimination Any type of discrimination.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020
Annex No. 1
Event Type (Level 1)
Definition
Event Type (Level 2)
Examples
Clients, Products, and Business Practices
Losses derived from the involuntary or negligent breach of a corporate obligation towards specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, information disclosure, and trust Abuse of trust/breach of guidelines, suitability/information disclosure aspects, violating client information privacy, abuse of confidential information. Improper business or market practices Restrictive competition practices, improper commercial/market practices, unauthorized securities intermediation, fictitious transactions, transactions to artificially fix or vary prices, market manipulation, abuse of insider information (in favor of the entity), money laundering. Defective services Service defects (unauthorized, etc.), error in contract models, error in service or provision provided to the affiliate. Selection, sponsorship, and risks Absence of client investigation according to guidelines, excess of risk limits towards clients. Advisory activities Misadvisory regarding the benefits an affiliate may opt for according to the Pension Savings System Law. Litigation on the results of advisory activities.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador.
Tel. (503) 2281-8000 www.bcr.gob.sv
CNBCR-03/2020
NRP-21
TECHNICAL STANDARDS FOR THE INTEGRAL RISK MANAGEMENT OF PENSION ENTITIES Approval: 02/26/2020 Validity: 04/01/2020
Annex No. 1
Event Type (Level 1)
Definition
Event Type (Level 2)
Examples
Damage to tangible assets
Losses derived from damages or harm to tangible assets as a consequence of natural disasters or other events.
Disasters and other events
Natural disasters, losses caused by external persons (terrorism, vandalism).
Business interruption and system failures
Losses derived from business interruptions and system failures.
Systems
Deficiencies in information or telecommunications systems; power failures.
Execution, delivery, and process management
Losses derived from errors in the processing of operations or in process management, as well as from relationships with commercial counterparties and suppliers.
Reception, execution, and maintenance of operations Data entry errors, collection and crediting processes, benefit payment, benefit calculation, calculation of components of the Individual Pension Savings Account, in establishing the value of assets or quotas, in receiving orders issued by the client, in handling guarantees, breach of deadlines or responsibilities, erroneous execution of models or systems, accounting errors. Errors in the process of transferring securities, compensating securities, and settling cash. Reporting and submission of reports Breach of the obligation to report, inaccuracy of external reports (generating losses). Client acceptance and documentation Absence of authorizations or rejections of clients, non-existent or incomplete legal documents.

Level 1
Level 2
Risk-Generating Activity Groups
Investments of Managed Funds (2)
Securities Trading (2)

Investment strategies. (2)
Asset allocation. (2)
Execution of investments. (2)
Disinvestment processes: (2)
Fixed income (2)
Variable income (2)
Currencies (2)
Repo operations. (2)
Fund Positions (2)
Investment registration. (2)
Portfolio analysis. (2)
Registration and custody of assets. (2)
Calculation of price vectors. (2)
Treasury (2)
Settlement of Operations. (2)
Securities Custody (2)
Withdrawal. (2)
Deposit. (2)
Transfer of securities. (2)
Documentation of movements. (2)
Exercise of property rights (2)
Receipt of cash (2)
Receipt of periodic interest from issuances. (2)
Receipt of dividends (2)
Receipt of redemption of securities. (2)
Maturity of securities. (2)
Accounting System (2)
Pension Funds (2)
Registration of operations. (2)
Bank account reconciliation. (2)
Accounting of economic events with incorrect quota value: day, month, year. (2)
Breach of accounting closing deadlines. (2)
Breach due to misapplication of regulations. (2)
Abuse of insider information. (2)
Money laundering operations, affecting accounting records. (2)
Lack of account reconciliation. (2)
Generation of financial statements (2)
Of the entity (2)
Registration of operations. (2)
Bank account reconciliation. (2)
Breach of accounting closing deadlines. (2)
Breach due to misapplication of regulations. (2)
Abuse of insider information. (2)
Money laundering operations affecting accounting records. (2)
Lack of account reconciliation. (2)
Generation of financial statements. (2)

Registration of operations. (2)
Asset valuation methodology and quota calculation. (2)
Presentation of the managed fund's performance. (2)
Preparation of information directed to participants.
Collection and crediting of contributions (2)
Collection (2)
Collection of contributions. (2)
Collection reconciliation. (2)
Data processing. (2)
Determination of errors (excesses, deficiencies). (2)
Transfer of funds. (2)
Compensation of resources between funds. (2)
Crediting (2)
Crediting of contributions. (2)
Determination of backlogs. (2)
Determination of Declarations and Non-Payment (DNP). (2)
Determination of Omissions and Inconsistencies. (2)
Homonym contributions. (2)
Documentation of operations. (2)
Transfer of funds. (2)
Compensation of funds. (2)
Breach of crediting deadlines. (2)
Determination of contributions from multiple employers. (2)
Fund settlement. (2)
Pension arrears (2)
Registration of DNPs. (2)
Registration of Omissions and Inconsistencies. (2)
Notification of debts to employers. (2)
Administrative Collection Management. (2)
Judicial Collection Management. (2)
Follow-up on affiliate complaints. (2)
Purging of presumed arrears. (2)
Calculation of lost profitability. (2)
Debt annulment. (2)
Debt conversion. (2)
Documentation of collection efforts. (2)
Backlogs (2)
Identification of backlogs. (2)
Identification of duplicate backlogs. (2)
Purging of backlogs. (2)
Compensation of backlogs. (2)
Affiliation and benefits (2)
Affiliation and Transfers (2)
Inconsistencies in the affiliation process. (2)
Lack of update of affiliate information. (2)
Benefits Advisory (2)
Inconsistencies in the registration of recorded contributions. (2)
Incorrect determination of the right.

Level 1
Processes
Level 2
Subprocess
Risk-generating Activity Groups
Benefit Calculation (2)

Error in benefit calculation. (2)
Incorrect identification of the funding source. (2)
Incorrect authorization of the benefit to be granted. (2)
Benefit Payment (2)
Notification of the benefit. (2)
Financing and payment of pensions. (2)
Survival verification. (2)
Voluntary Funds (2)
Asset Management (2)
Investment registration. (2)
Investment strategies according to the internal regulations of the managed fund. (2)
Portfolio analysis. (2)
Disinvestment process. (2)
Registration and custody of assets. (2)
Subscription and Redemption of Participation Units (2)
Plan offerings. (2)
Registration of contributions. (2)
Calculation of profitability factors. (2)
Computation of number of units. (2)
Contribution validity control. (2)
Information provided to participants. (2)
Linkage and Transfers (2)
Inconsistencies in the linkage or transfer process. (2)
Lack of update of participant information. (2)
Operational Management of the Administrator (2) Information Systems (2)
Processing and registration of operations. (2)
Disruption of information systems and applications. (2)
Online systems. (2)
Information safeguarding. (2)
Human Resources Management (2)
Staff suitability. (2)
Segregation of duties. (2)
Human errors. (2)
Conflict of interest. (2)
External Events (2)
Natural disasters. (2)
Damage to facilities. (2)
Public policies. (2)
Others. (2)

Annex No. 3

TABLE OF CONTENT OF THE OPERATIONAL RISK EVENT REGISTRATION DATABASE

No. Field Name Description
1 Reference Internal code that identifies the event sequentially.
2 Operational Risk Factor According to Article 17 of these Standards.
3 Loss Event Type Identifies the type of loss, according to the classification in Annex No. 1.
4 Business Areas Identification of the operational business lines or areas that originated the event, detailed in Annex No. 2.
5 Event Description Detailed description of the event.

Service channel,
Geographic zone.
6 Event Start Date Date when the event begins: day, month, and year.
7 Event End Date Date when the event ends: day, month, and year.
8 Discovery Date Date when the event is discovered: day, month, and year.
9 Accounting Date Date when the economic loss from the event is registered in accounting: day, month, and year. When applicable. Otherwise, include the reason why there was no accounting record. (2) 10 Amount The amount of the loss, economic quantification of the occurrence of the operational risk event and the expenses derived from its handling, when applicable. 11 Currency Foreign currency in which the event materializes. 12 Affected Accounts Identifies the accounts in the Chart of Accounts affected economically, when applicable. 13 Process Identifies the affected process. 14 Total Recovered Value The total value recovered by the entity's direct action. Includes amounts recovered through insurance, when applicable. 15 Value Recovered by Insurance Corresponds to the value recovered through insurance coverage, when applicable. 16 Affected Product or Service Identifies the product or service affected by the operational risk event. 17 Quantification of Damage Severity Amount of the loss (net of any mitigant or recovery). When applicable. (2)

For the creation of the operational risk event registration, entities may use, in addition to the fields described above, others that are considered relevant.

Entities that consider that their operational risk event databases are insufficient to quantify operational risk may opt for the use of external source databases, provided that such databases are normalized and adequate to the entity's internal databases.

Similar documents from other regulators