Technical Standards for the Management of Money Laundering, Terrorism Financing and Proliferation Financing Risks

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Article 1 of the Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction establishes that its objective is to prevent, detect, monitor, investigate and sanction money laundering, terrorism financing and proliferation financing of weapons of mass destruction; as well as the identification and evaluation of related risks, in order to implement adequate policies and procedures for the application of a risk-based approach. (3)

II. That Article 9 of the Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction establishes that, the obligated subjects established in Article 7 of the aforementioned law, must comply with the applicable provisions contained in it and other regulations issued for the development of the aforementioned law, in order to effectively implement an integral system for the prevention of money laundering, terrorism financing and proliferation financing of weapons of mass destruction according to the identified risk level. (3)

III. That Article 29 of the Special Law against Acts of Terrorism typifies the financing of acts of terrorism as a crime, so effective measures must be taken, among others, such as the prevention of acts of terrorism, including their financing.

IV. That Article 4 letter j) of the Law on Supervision and Regulation of the Financial System establishes that the Superintendence of the Financial System must report to the Attorney General's Office of the Republic, any fact that is allegedly constitutive of a crime, of which it has knowledge in the exercise of its functions.

V. That Article 35 letter d) of the Law on Supervision and Regulation of the Financial System establishes that supervised entities must comply with the adoption and updating of policies and mechanisms for risk management, having among other actions, to identify, evaluate, mitigate and reveal them in accordance with international best practices.

VI. That both international standards issued by supervisory bodies of the different financial markets and by the Financial Action Task Force, require the supervisor to ensure that entities have adequate policies and processes, including due diligence rules with clients, to promote high-level ethical and professional standards in the financial sector and prevent entities from being used, intentionally or not, for criminal purposes.

VII. That the measures established in these Standards intend to generate technical guidelines for the safe promotion of business, of an eminently preventive nature and of self-interest, with minimum requirements to be followed; corresponding to each entity, in accordance with a risk management and the risk appetite defined by it, to adjust and strengthen internal controls in accordance with the changing activities of its industry and as part of its corporate responsibility, in order to achieve a sound, prudent, adequate and efficient management of the prevention of money laundering, terrorism financing and proliferation financing of weapons of mass destruction risks, and in that way, prevent funds that have their origin in illicit activities or that attempt to finance them, from being channeled through the financial system. (3)

VIII. That through Agreement Number 380, the Attorney General of the Republic issued the new Instruction for the Prevention, Detection and Control of Money and Asset Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction, published in the Official Diary No. 205, Volume 433 dated October 27, 2021, by the Attorney General's Office of the Republic. Therefore, it is necessary to adapt the regulations issued by the Committee of Standards of the Central Reserve Bank of El Salvador for the purpose that the corresponding entities have an updated regulatory framework in this matter.

IX. That it is necessary to have a regulatory framework with a risk-based approach that adjusts to international development and trends, with the purpose of promoting greater effectiveness in the prevention of money laundering, terrorism financing and proliferation financing of weapons of mass destruction risks. (3)

THEREFORE,

in virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES, to issue the following:

TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING AND PROLIFERATION FINANCING RISKS (3)

CHAPTER I
OBJECT, SUBJECTS AND TERMS

Object
Art. 1.- These Standards aim to provide minimum guidelines for the adequate management of money laundering, terrorism financing and proliferation financing of weapons of mass destruction risks, in order for the entities that are part of the financial system to prevent the aforementioned risks, detect unusual operations and report operations related to said risks, in a timely manner. (3) The adoption of policies and procedures related to the development of methodologies for the management of money laundering, terrorism financing and proliferation financing of weapons of mass destruction risks must be in accordance with the entity's risk profile, the nature, size, types of products, services, clients and distribution channels. (3)

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Commercial or state banks constituted in El Salvador, their offices abroad and their subsidiaries; (3) b) Investment banks; (3) c) Companies that, in accordance with the law, make up financial conglomerates; (3) d) Institutions administering pension savings funds; (3) e) Insurance companies, their branches abroad and the branches of foreign insurance companies established in the country; (3) f) Stock exchanges, brokerage houses, companies specialized in the deposit and custody of securities, institutions that provide auxiliary services to the stock market, and specialized agents in the valuation of securities; (3) g) Banks and savings and credit societies, regulated in Legislative Decree number 849, dated February 16, 2000, published in Official Diary number 65, Volume 346, of March 31, 2000, and its reforms; (3) h) Companies that offer complementary services to the financial services of the members of the financial system; (3) i) Administrators or operators of payment systems and securities settlement societies; (3) j) The Social Housing Fund and the National Popular Housing Fund; k) Foreign currency exchange houses; (3) l) Legal entities that carry out money sending or receiving operations systematically, by any means, at the national and international level; (3) m) Electronic Money Provider Companies; (3) n) Securitization companies; and (3) o) Investment Fund Managers. (3)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Senior Management: Senior Management shall be understood as the Chief Executive President, General Manager or those who act on their behalf and the executive positions that report to them. In the case of the Development Bank of the Republic of El Salvador, the President; b) APNFD: Designated Non-Financial Activities and Professions; c) Client: Any natural or legal person who has maintained or maintains a contractual, occasional or habitual relationship with the entities; d) Entities: Subjects obligated to comply with these Standards, in accordance with Article 2 thereof; e) Risk Factors: Internal and/or external agents generating money laundering, terrorism financing and proliferation financing of weapons of mass destruction risks, such as the following: clients, counterparties, employees, users, products and services, distribution channels and geographic zone; (3) f) Proliferation Financing of Weapons of Mass Destruction: is any act that provides funds or uses financial services, in whole or in part, for the manufacture, acquisition, possession, development, export, transit of material, fractionation, transport, transfer, deposit or use of nuclear, chemical or biological weapons, their launch means and other related materials (including technologies and dual-use goods for illegitimate purposes) in contravention of national laws or international obligations, when the latter is applicable; (3) g) Terrorism Financing: Mechanism by which a person or persons, any organization or legal entity, directly or indirectly provides, collects, transports, or provides funds or has them in their possession, or will try to provide or collect them, dispenses or tries to dispense financial services or other services with the intention that they be used totally or partially to commit any of the criminal conduct contemplated in the Special Law against Acts of Terrorism, as well as that which directly or indirectly places funds, financial or material resources or financial or related services of any other kind, at the disposal of a person or entity that they designate for the commission of any of the crimes provided for in the aforementioned Law; (3) h) FATF: Financial Action Task Force. An intergovernmental institution that establishes international standards whose objective is to prevent money laundering, terrorism and the financing of proliferation of weapons; (3) i) Financial Investigation Unit Instruction: Instruction for the Prevention, Detection and Control of Money and Asset Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction, of the Financial Investigation Unit of the Attorney General's Office of the Republic; j) Repealed; (3)

k) Law: Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction; (3) l) ML/TF/PF: Money Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction; (3) m) Compliance Officer: Is the official designated by the Board of Directors or equivalent body. The Compliance Officer shall hold at least a managerial position, enjoy independence and autonomy, having the power to make decisions regarding the exercise of their functions and obligations, in order to manage ML/TF/PF risks, in accordance with what is established in the Special Law for the Prevention, Control and Sanction of Money Laundering, Terrorism Financing and Proliferation Financing of Weapons of Mass Destruction; its Regulations and the UIF Instruction; (3) n) Compliance Office: Unit of the entity whose fundamental objective is to coordinate activities related to the prevention of ML/TF/PF and provide routine follow-up to the due compliance of policies and procedures for the prevention of ML/TF/PF, with a risk-based approach; o) PEPs: Politically Exposed Persons; p) Probability of occurrence: Is the level of certainty that an event will occur, or the ratio between the number of times the event occurred and the number of repetitions of occurrence; q) Risks associated with ML/TF/PF: Are those through which ML/TF/PF risks are materialized, these are: reputational, legal, operational and contagion; r) Money laundering, terrorism financing and proliferation financing of weapons of mass destruction risk: is the possibility of loss or damage that the entity may suffer due to its propensity or vulnerability to being used directly or indirectly or through its operations as an instrument for money laundering, channeling resources towards the carrying out of terrorist activities, terrorism financing and the financing of the proliferation of weapons of mass destruction; (3) s) Inherent risk: Level of risk inherent to the activity, without taking into account the effect of controls; t) Sub-agent: Is the natural or legal person that has a contractual relationship with one or more agents or administrators, to make available to the orderers and beneficiaries the infrastructure and means necessary to provide the money sending or receiving service, referring to the establishment or main office, agencies and service points of the Sub-agent; ATMs, financial kiosks, financial services provided via internet or mobile devices and other applicable means or infrastructure in accordance with the applicable regulatory framework are also included; u) Superintendence: Superintendence of the Financial System;

v) Transactions: Any operation or act carried out within the ordinary course of business or activity in the entities, by their clients; w) Transfers: Is the transaction carried out by a natural or legal person called the orderer, through an entity authorized in the respective jurisdiction to carry out international or local transfers, through electronic movements, in order for a sum of money to be made available to a natural or legal person called the beneficiary, in another entity or agency authorized to carry out this type of operation. The orderer and the beneficiary can be the same person; x) UIF: Financial Investigation Unit of the Attorney General's Office of the Republic; and y) Users: Any natural or legal person who operates with the entities or makes use of the services that they provide to the general public, without any contractual relationship with the entity.

CHAPTER II
ENVIRONMENT FOR THE MANAGEMENT OF ML/TF/PF RISKS

Applicable legal framework for entities
Art. 4.- The aspects related to the powers of the Compliance Office, as well as training programs, internal and external audit, simplified, standard and enhanced due diligence, unusual operations, identification and knowledge of clients and counterparties, ultimate beneficiary, politically exposed persons, monitoring and control of alert signals, shall be governed by what is established in the UIF Instruction. The foregoing, without prejudice to other aspects that must be observed by the entities from said Instruction.

Organizational structure
Art. 5.- Entities must establish an organizational or functional structure adequate to their business model and appropriately segregated, which clearly delimits functions and responsibilities, as well as the levels of dependence and interrelation that correspond to each of the areas involved in the management of ML/TF/PF risks, for such purposes, they must comply with what is established in Title III of the UIF Instruction.

Board of Directors or Equivalent Body Functions Art. 6.- The Board of Directors or equivalent body must fulfill the functions established in the UIF Instruction.
ML/TF/PF Prevention Committee
Art. 7.- The Prevention Committee must comply at least with the provisions established in the UIF Instruction.
Senior Management Functions
Art. 8.- Senior Management is responsible for ensuring that the risk management system for the prevention of ML/TF/PF approved by the Board of Directors or equivalent body is implemented and adequately complied with, in addition it will have among other the following functions:
a) Ensure that all business activities that are concluded by the entity's personnel with clients and users are carried out in accordance with the laws, norms and ethical standards established in order to prevent ML/TF/PF risks; b) Ensure that the regulatory framework, as well as the manual of policies and procedures on ML/TF/PF prevention approved by the Board of Directors or equivalent body of the entity, is known to all entity personnel, facilitating their access for consultation through existing technological means or others they consider pertinent, as well as ensuring the execution of the annual training plan on ML/TF/PF approved by the Board of Directors or equivalent body of the entity; c) Create or establish communication channels that facilitate entity personnel to report to the Compliance Office any irregularity that puts the entity at risk and that is considered as contrary to the applicable legal provisions in matters of ML/TF/PF prevention; and d) Ensure that the Compliance Office reports to the Board of Directors or equivalent body of the entity, the results of its evaluations related to ML/TF/PF prevention, at least quarterly, depending on the risk level of each entity. The report must be presented to the Board of Directors or equivalent body within three months following the reported period.

Submission of information to the Superintendence Art. 9.- The entity must send to the Superintendence the following information:
a) The Organizational Structure of the Compliance Office, appointment of the Compliance Officer and Alternate Compliance Officer; b) Annual training plan on ML/TF/PF prevention; c) Compliance Office report presented to the Board of Directors or equivalent body, related to the management carried out for the compliance of policies and procedures for the prevention of ML/TF/PF; d) Results of the internal audit evaluation presented to the Board of Directors or equivalent body on the compliance and effectiveness of the norms applicable to the policies and procedures for the prevention of ML/TF/PF in accordance with what is established in Article 8 of the UIF Instruction; and e) Policies, Manuals and/or regulations and Procedures related to the prevention of ML/TF/PF.

The information detailed in the aforementioned letters shall be sent by the means established by the Superintendence, within a period not exceeding ten business days after being approved or known by the Board of Directors or equivalent body, with the exception of letter "a)" which shall be sent within the period established in the UIF Instruction.

CHAPTER III
MANAGEMENT OF ML/TF/PF RISKS

Stages of the ML/TF/PF risk management process Art. 10.- For the management of ML/TF/PF risks, entities must have a continuous and documented process in order to establish a methodology designed to identify, measure, control, monitor and communicate potential ML/TF/PF risk events that may affect them, with the purpose of preventing, detecting and mitigating them in a timely manner, in accordance with the risk management system approved by the Board of Directors or equivalent body. Likewise, entities to carry out a risk-based management must apply a methodology in the identification and treatment of ML/TF/PF risks derived from business activities and that offers guarantees that the risk is being managed within the level of risk appetite defined by it. The Compliance Office must carry out periodic reviews of the due compliance of the policies, procedures and risk management measures for ML/TF/PF established by the entity, based on the results of its risk assessment in response to the current legal framework. Identification of ML/TF/PF risks Art. 11.- Entities must identify the inherent ML/TF/PF risks to the activity they carry out, taking into consideration as a minimum the risk factors defined by the entity, as well as the risks associated with them. Furthermore, entities must identify ML/TF/PF risks in the following specific cases:
a) In the proposal of a new product, as well as in the update, modification or use of any product, the use of new business practices, including new channels for service provision, and the use of new technologies or technologies in development for new or existing products; b) The application of the commercial business in a new market; and c) The initiation of operations in new jurisdictions. Entities must document the identification of ML/TF/PF risk through a list of risk events to be managed by the entity, supported by matrices

CNBCR-08/2022
NRP-36
TECHNICAL STANDARDS FOR THE MANAGEMENT OF MONEY LAUNDERING, TERRORISM FINANCING, AND PROLIFERATION FINANCING RISKS (3) Approval: 23/09/2022 Validity: 10/10/2022

of risks and segmented risk factors, which will form, among other things, the entity's risk management documentation.

In general, entities must consider any other aspect indicated by regulation in the matter of preventing ML/TF/PF risks, which serves as input to determine said risks, in each of the identified risk factors.

Likewise, for the purpose of identifying ML/TF/PF risks, entities must previously determine the basic conditions to begin managing said risks, analyzing the entity's context, preparing a diagnosis of the ML/TF/PF risk management, and defining the methodologies, techniques, tools, and information sources for the design and adoption of a system for ML/TF/PF risk management.

Entities must take into consideration the context in which they operate, taking into account relevant external and internal parameters, such as the following:
i. Applicable local and international regulations in the matter of preventing ML/TF/PF;
ii. Entity's objectives and strategies;
iii. Organizational structure;
iv. Market characteristics in which the economic activity is developed; and
v. Background of the ML/TF/PF risks to be evaluated and the gaps identified in past evaluations, if applicable; among other aspects.

Entities must establish the methodology to be used to implement the ML/TF/PF risk management system, in which must be defined at minimum the objectives and scope of the evaluation, the material, human, and financial resources available, and the records to be used in the ML/TF/PF risk management process, as well as roles and responsibilities.

Measurement of ML/TF/PF Risks
Art. 12.- Measurement is carried out to determine the probability of occurrence of the ML/TF/PF risk and its impact if materialized against each of the risk factors and associated risks. These measurements may be qualitative or quantitative without prejudice to any other criterion established by the entity.

The methodologies and tools to estimate or quantify ML/TF/PF risk must be in conformity with the entity's risk profile.

Within their methodologies, they must develop risk matrices, risk maps, reports, or information related to risk identification based on the entity's profile, in which at minimum the risk factors are previously identified and include assigning ratings according to the categorization methodology adopted and authorized by the Board of Directors or equivalent body.

Entities must define the periodicity to evaluate the level of risk within themselves, through their ML/TF/PF risk matrices, and submit to the Superintendency of the Financial System the results report of the ML/TF/PF Risk Management presented to the Board of Directors or equivalent body, in compliance with article 4, fifth paragraph of the UIF Instruction, and in conformity with article 9 of these Standards.

Control and Mitigation of ML/TF/PF Risks
Art. 13.- In this stage, the entity must take measures to control and mitigate the occurrence of activities that materialize the ML/TF/PF risk.

To control ML/TF/PF risk, entities must perform at minimum the following:
a) Design and execute programs, policies, standards, procedures, and internal controls according to the operational activity developed by the entity, applying a risk-based approach and in concordance with what is established in the Law, its Regulation, and the UIF Instruction; and b) Establish and apply a methodology that allows periodically evaluating the design and effectiveness of control measures (existing programs, policies, standards, procedures, and internal controls), taking into account, at minimum, their characteristics, frequency, and functioning. In case that control measures are not effective and efficient, they must be strengthened, corrected, and if necessary, new ones implemented, in order to reduce the probability and impact that may be generated when the ML/TF/PF risk materializes.

Monitoring and Communication of ML/TF/PF Risks Art. 14.- Entities must give systematic and timely follow-up to ML/TF/PF risk factors, through permanent monitoring activities, make a follow-up that allows determining if implemented controls include all sources of potential ML/TF/PF risk events and if these function in a timely, effective, and efficient manner; likewise, based on segmentation, entities may perform calibrations to their monitoring system to give follow-up and monitor client, counterparty, employee, product, and service operations, distribution channels, among others, with the effect of identifying risks related to ML/TF/PF, and must analyze unusual or suspicious transactions with the objective of strengthening the adopted, developed, and executed internal procedures, policies, and controls, and if necessary, make regulatory reports.

For the purpose of communicating ML/TF/PF risks, entities must have a system of physical or electronic documents and records, where the information of each of the risk management stages is condensed to have immediate availability of data, improvement opportunities, and reliability, and to establish an effective, efficient, and timely reporting system, both internal and external, that guarantees the functioning of the entity's procedures and the requirements of competent authorities.

Entities must develop an effective information and communication process regarding aspects related to ML/TF/PF risk and the process to manage it within the entity, the foregoing, to ensure that the units or areas in charge of implementing risk management and the Board of Directors or equivalent body understand the basis on which decisions are taken and why it is required to execute particular actions.

In this sense, information must be identified, collected, and communicated in a way that allows people to carry out their responsibilities timely.

Likewise, the communication of information on ML/TF/PF risks must be fluid, from operational levels to management and highest authority levels of the entity.

On the other hand, the entity must adopt and apply effective communication processes with competent authorities in the matter of preventing ML/TF/PF crimes, which guarantee the sending of regulatory reports according to the mechanisms enabled by authorities to receive respective communications, as well as the timely attention of information requests they ask for; to the UIF regarding the timely sending of regulatory reports, suspicious transaction reports, and information requests that said entity asks for in the investigation of the ML/TF/PF crime, and to the Superintendency regarding the supervision it exercises over the subjects of application of these Standards. (3)

Segmentation of ML/TF/PF Risk Factors
Art. 15.- Entities must establish methodologies to segment risk factors and identify the forms and typologies through which ML/TF/PF risk may present itself. Additionally, they must take into consideration the information collected during the application of customer due diligence procedures, have an understanding of the inherent risks of their processes, of the functions or activities of their employees, nature of their products and services, and the exposure of distribution channels to be used for ML/TF/PF crimes, the risk of the geographic zones where they operate or where their clients operate, among other aspects that contribute to determining the common individual characteristics of each of them.

Without prejudice to any other criterion established by the entity, for the application of segmentation in risk factors, it must be considered to collect data and analyze them, at minimum, the following variables:
a) Clients: economic activity; volume or frequency of their transactions; source of funds/equity; type of person (natural or legal); b) Employees: nature of the work area and position according to assigned functions; c) Products and services: nature, market characteristics, recipients; d) Distribution channels: nature, information registration; and e) Geographic zone: location, countries of higher risk contained in FATF lists of non-cooperative countries, high-risk jurisdictions.

Entities must document the activities carried out for the segmentation of risk factors.

Through segmentation and starting from the usual characteristics of transactions developed, entities must establish and apply a quantitative or qualitative analysis that allows detecting unusual and suspicious transactions.

Segmentation by Risk Factors
Art. 16.- Entities, to determine ML/TF/PF risk, must take into consideration at minimum, the following aspects:
a) Client:
For the purpose of determining client risk, entities must consider at minimum, aspects related to economic activity, products, services, and channels used, as well as the behavior of operations performed, according to the following:

Elements related to the client's economic activity:
i. Manufacturers, merchants, and intermediaries of weapons;
ii. Embassies and Consulates of other countries;
iii. Value transport companies;
iv. Clients who by their economic activity and nature of their operations mobilize cash intensively;
v. Clients identified as PEPs;
vi. Clients categorized as DNFBPs; and
vii. Clients or persons (natural and/or legal) related to the client, through their shareholding structure, board of directors or equivalent body, senior management, business associates or others, who are included in lists issued by international organizations indicating persons on whom there are suspicions of criminal activity.

Elements related to the products and services used by the client:
i. International banking correspondent services involving transactions such as international payments to persons who are not habitual clients and package delivery activities;
ii. Services involving the marketing and delivery of checks and precious metals;
iii. Services that can easily cross borders, such as: Online banking, international transfers, private investment companies, trusts;
iv. Safe deposit boxes;
v. Electronic transfers;
vi. Stock market operations on behalf of clients;
vii. Internal and external remittances;
viii. Carrying out international operations, such as, buying and selling currencies and/or sending and receiving remittances; and
ix. Buying or selling monetary instruments.

Elements related to the distribution channels used by the client:
i. Use of intermediaries or sub-agents; Financial Correspondents; digital channels, Regional Banking; and Insurance Banking.

Elements related to the operations performed by the client:
i. Frequent and inexplicable movements of accounts to different persons;
ii. Frequent and inexplicable movements of funds between persons from several geographic locations;
iii. Advance payments of loans or sudden payments of overdue loans or under judicial collection;
iv. Accounts maintained by third parties;
v. Investment operations in negotiable securities for unusual amounts that do not correspond to the declared activity or to the client's patrimonial/financial situation;
vi. Operations agreed at prices that do not relate to market conditions;
vii. Buying or selling negotiable securities in the spot market at prices notably higher or lower than the quotes being negotiated;
viii. Buying or selling the underlying asset, by exercise of the option, at prices that do not bear a convenient relation to the exercise price;
ix. Buying or selling forward contracts at prices considerably higher or lower than the quotes being negotiated;
x. Buying negotiable securities for amounts above the client's profile;
xi. Dubious origin of insured goods when there is no apparent reason for the client to possess or hold them;
xii. Plurality of policies with a single beneficiary;
xiii. Insuring multiple policies by the same person for very significant amounts, whether with one or different insurers;
xiv. Clients who send or receive operations to countries or territories that have been subject to sanctions, embargoes, or similar measures, by international organizations combating the ML/TF/PF crime;
xv. Clients who send or receive operations to countries or territories identified by the FATF as high-risk;
xvi. Clients who send or receive operations to countries or territories that provide financing or support terrorism;
xvii. Clients who send or receive operations to countries or territories that have significant levels of corruption or other criminal activity; and
xviii. Clients who send or receive operations to countries or territories with low or no fiscal taxation.

b) Products and services:
Entities must perform the risk analysis of the products and services they offer to their clients, taking into consideration at minimum the following aspects:
i. Capacity to transfer funds (both national and international level);
ii. Speed of fund transfer;
iii. Lack or difficulty to audit;
iv. Lack or difficulty to have an aggregated view of multiple transactions;
v. Lack of face-to-face contact;
vi. Ease to omit identification means, or if they exist, they are not verified;
vii. Capacity to load/reload with cash;
viii. Possibility to withdraw cash;
ix. Capacity to load/transfer from alternative financing sources; and
x. Ease to generate anonymity.

Entities, in addition to evaluating the ML/TF/PF risks of existing products, must also evaluate the ML/TF/PF risks of products and services planned to be offered to their clients.

c) Distribution channels:
The minimum aspects to determine the risk of own distribution channels are the following:
i. Ease to omit identification means, or if it enables them, but they are not verified;
ii. Difficulty to register and document the necessary information to prevent ML/TF/PF crimes; and
iii. Difficulty to determine the traceability of operations.

Entities, in addition to evaluating the risks of existing channels, must also perform the ML/TF/PF risk analysis of distribution channels projected to launch soon and in the future that they want to design to offer to clients or prospective clients.

d) Employees:
The aspects to determine risk in the employee factor are at minimum the following:
i. Performance of positions related to decision-making regarding their business or commercial activity;
ii. Handling of clients or counterparties;
iii. Receipt of money and information control;
iv. Intervention in the handling, receipt, custody, or disbursement of funds or securities; and
v. If they exercise functions directly related to ML/TF/PF prevention controls.

In general, entities must consider any other aspect indicated by regulation in the matter of preventing ML/TF/PF risks, which serves as input to determine these risks, in each of the identified risk factors.

Electronic Financial Transactions
Art. 17.- The entity offering electronic banking service must keep an access and use log of the system that allows recording and tracking the transactions performed by the client. Electronic financial transactions comprise those operations carried out through ATMs, Internet, telephone transactions, or any other service that can be carried out by electronic means.

Complementary Reports
Art. 17-A.- Regarding international and local electronic transfers, entities must comply with obtaining the information of said transfers, in conformity with what is established in article 52 of the UIF Instruction; executing those that meet the required information.

Bitcoin Service Providers
Art. 17-B.- For the case of bitcoin service providers, in the matter of prevention, control, and sanction of money laundering, terrorism financing, and proliferation financing of weapons of mass destruction, said entities will comply with the applicable legal framework regarding the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction, the Regulation of the Bitcoin Law, and the UIF Instruction. (3)

CHAPTER IV
OTHER PROVISIONS AND VALIDITY

Sanctions
Art. 18.- Non-compliance with the provisions contained in these Standards will be sanctioned in conformity with what is established in the Law of Supervision and Regulation of the Financial System.

Transitory
Art. 19.- Administrative procedures and resources that were in process at the date of validity of these Standards will continue and conclude in conformity with the regulation with which they began.

Technical Details of Information Submission
Art. 20.- The Superintendency will send to entities, within a maximum period of thirty days after the date of entry into force of these Standards, with a copy to the Central Reserve Bank of El Salvador, the technical details related to the sending of the information referred to in article 9 of these Standards. The information requests will be limited to the collection of information as regulated in these Standards.

Entities will have up to thirty business days from the communication of the technical details by the Superintendency to implement the necessary mechanisms and comply with the information submission established in article 9 of these Standards.

Unforeseen Aspects
Art. 21.- Aspects not provided for in the matter of regulation in these Standards will be resolved by the Central Reserve Bank of El Salvador through its Standards Committee.

Validity
Art. 22.- These Standards will enter into force from the tenth of October two thousand twenty-two.

MODIFICATIONS:

(1) Modification made, incorporating article 17-A, approved by the Central Bank through its Standards Committee, in Session No. CN-10/2023 of date November 28, two thousand twenty-three, with validity from December 13, two thousand twenty-three.
(2) Modifications in article 2 approved by the Central Bank through its Standards Committee, in Session No. CN-08/2025, of September 30, two thousand twenty-five, with validity from October 15, two thousand twenty-five.
(3) Modifications in Preambles I, II, VII, and IX, in the denomination of the Standards, and in articles 1, 2, 3, and 14 and incorporation of article 17-B, approved by the Central Bank through its Standards Committee, in Session No. CN-05/2026, of June 30, two thousand twenty-six, with validity from July 15, two thousand twenty-six.