Technical Standards for the Opening, Operation, and Closure of Inquiry Points and Complaint Resolution Centers of Data Information Agencies

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

THE STANDARDS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That by Legislative Decree No. 128, dated August 17, 2021, published in the Official Gazette No. 166, Volume No. 432, of September 1 of the same year, the Law on the Regulation of Services on Credit History Information of Persons was reformed.

II. That subsection a) of Article 8 of Legislative Decree No. 128 establishes that data information agencies must have an inquiry point in each department of the country, as well as a complaint resolution center in three zones or regions of the country.

III. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes that the Superintendency of the Financial System is responsible for the supervision of specialized companies providing credit information services operating in El Salvador.

IV. That Article 78, subsection l) of the Law on Supervision and Regulation of the Financial System establishes that the Superintendency of the Financial System will organize and keep updated the records of companies and persons providing services related to information and credit history.

V. That Article 24 of Legislative Decree No. 128 establishes that the Standards Committee of the Central Reserve Bank will issue the corresponding regulations within a period of two months from the entry into force of said Decree.

THEREFORE,

by virtue of the regulatory powers conferred upon it by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

Object Art. 1.- These Standards aim to establish the provisions that must be complied with by legal persons, public or private, that are authorized by the Superintendency of the Financial System to operate as Data Information Agencies, for the opening, operation, and closure of Inquiry Points and Complaint Resolution Centers.

Subjects Art. 2.- The subjects obliged to comply with the provisions established in these Standards are the Data Information Agencies authorized by the Superintendency of the Financial System.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Data Information Agency or DIA: Any legal person, public or private, excluding the Superintendency of the Financial System, that is dedicated to collecting, storing, preserving, organizing, communicating, transferring, or transmitting data on the credit history of consumers or clients, through automated or non-automated technical procedures; b) Economic Agents or EA: Natural or legal persons, providers of goods and services that register, supply, and obtain information from a database; c) Central Bank: Central Reserve Bank of El Salvador; d) Complaint Resolution Center: Administrative offices enabled by Data Information Agencies for the resolution of concerns, handling of complaints, and other procedures contemplated in the Law on the Regulation of Services on Credit History Information of Persons, by consumers or clients; e) Consumer or client: Any natural or legal person who acquires, uses, or enjoys goods or services provided by an economic agent, regardless of whether the producers, marketers, facilitators, suppliers, or issuers are public or private, individual or collective; f) Credit History: Data of consumers or clients, duly incorporated into a database, that reflect economic, commercial, financial, or banking transactions payable in installments; g) Credit History Law: Law on the Regulation of Services on Credit History Information of Persons; h) Inquiry Points: Kiosks or offices enabled by Data Information Agencies so that consumers or clients can access their credit history information, and for the handling of concerns or inquiries regarding the same; and i) Superintendency: Superintendency of the Financial System.

CHAPTER II PROCEDURE FOR OPENING AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS

On Inquiry Points and Complaint Resolution Centers Art. 4.- The DIAs must have an Inquiry Point in each department of the country, in central and easily accessible locations for consumers or clients, with seven days a week service. Likewise, they must enable a Complaint Resolution Center in each zone or region of the country with service on business days.

For the purposes established in the preceding paragraph, zone or region of the country shall be understood as the three geographic zones or regions into which El Salvador is territorially divided: western, central, and eastern.

The DIAs may opt for an Inquiry Point and a Complaint Resolution Center to function jointly in a corresponding region. In these cases, service to consumers or clients may be provided in differentiated schedules, in accordance with what is established in the first paragraph of this article.

On the Opening of Inquiry Points and/or Complaint Resolution Centers Art. 5.- The DIA must request authorization from the Superintendency, through the physical or electronic means it enables for such purposes, attaching the following documentation: a) Copy of the minute of the meeting in which the agreement taken by the Board of Directors of the DIA for the opening of an Inquiry Point and/or Complaint Resolution Center is recorded; b) Exact address and location of the place where the Inquiry Point and/or Complaint Resolution Center will be installed, as well as a sketch of the corresponding location in central and easily accessible places for the consumer or client; c) Amount of investment to be made or detail of the financing for its opening; d) Copy of the lease contract, where applicable; e) Sworn declaration signed by the Legal Representative or attorney-in-fact of the DIA, in which compliance with the security measures referred to in Article 12 of these Standards is recorded, as well as having evaluated the potential risks that could affect operations and the service to consumers or clients, in the place where the Inquiry Point and/or Complaint Resolution Center will be installed;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

f) Contingency plans that allow preserving the capacity to operate constantly and to minimize risks in cases of contingent or fortuitous events that require temporarily interrupting their activities, as established in Article 12 of these Standards.

Additionally, the DIAs must detail the human, technological, and operational resources they will have for the service to consumers or clients.

The Superintendency must verify the information detailed in this article, as well as the geographic distribution of the Inquiry Points and/or Complaint Resolution Centers as established in the Credit History Law.

Authorization Procedure for Opening Art. 6.- Upon receiving the information in accordance with what is established in Article 5 of these Standards, the Superintendency will proceed to verify compliance with the requirements contemplated in the Credit History Law and these Standards, having a period of no more than thirty days to authorize or deny the corresponding opening.

In those cases where the authorization request is not accompanied by complete and proper information, as detailed in Article 5 of these Standards, the Superintendency, due to the lack of necessary requirements, will require the applicants to, within a period of ten business days counted from the day following the respective notification, present the missing documents. This period may be extended, at the request of the interested party, justifying in writing and attaching the elements that prove their request.

The Superintendency, in the same notice, will indicate to the applicant that, if the information is not presented complete within the aforementioned period, the request will be archived without further procedure, without prejudice to their right to present the request again.

If from the analysis of the documentation presented, in accordance with what is established in Article 5 of these Standards, the Superintendency has observations, or if the documentation or information presented is not sufficient to establish the facts or the situation intended to be accredited, it will notify the DIA once, to remedy the deficiencies notified or present additional documentation or information requested.

The DIA will have a maximum period of ten business days counted from the day following the respective notification, to remedy the observations or present the additional information requested.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 5 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

The Superintendency may, through a reasoned and founded resolution, extend by up to another ten business days the period indicated in the preceding paragraph, when the nature of the observations or deficiencies notified so requires.

Extension Period Art. 7.- The DIA may present to the Superintendency a request for extension of the period indicated in the fifth paragraph of Article 6 of these Standards, before the expiration of said period, must express the reasons on which it bases its request, proposing and attaching, if applicable, the relevant proof.

The extension period may not exceed ten business days and will begin to count from the next business day after the expiration date of the original period.

Suspension of Period Art. 8.- The thirty-day period indicated in the first paragraph of Article 6 of these Standards, will be suspended for the days that elapse between the notification of the request to complete information or documentation referred to in the second and fifth paragraphs of Article 6 of these Standards, and the date on which the interested parties present the writing in which they remedy the observations required by the Superintendency.

Once the complete documentation is presented and in proper form, the Superintendency will proceed without further procedure to respond to the request for authorization to open the corresponding Inquiry Point and/or Complaint Resolution Center, within a maximum period of three business days counted from its approval date.

Period for Opening Art. 9.- In case the resolution is favorable, the DIAs will have a maximum period of up to sixty days to open the Inquiry Point and/or Complaint Resolution Center, counted from the day following the notification of the resolution authorizing the opening.

In cases where the opening of an Inquiry Point and/or Complaint Resolution Center is due to a change of location, the period referred to in the preceding paragraph will be a maximum of up to sixty days counted from the day following the notification of the resolution authorizing its opening.

Appeal against an Objection Art. 10.- When the Superintendency objects to the opening of an Inquiry Point and/or Complaint Resolution Center, the DIAs will have a period of ten days counted from the day following the notification, to file an appeal for reconsideration, in accordance with what is stipulated in Article 133 of the Law on Administrative Procedures.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 6 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

On Closure Art. 11.- For the closure of an Inquiry Point and/or Complaint Resolution Center, the DIA must inform in writing, which may be sent through physical or electronic means enabled for such purposes by the Superintendency, the following aspects: a) Copy of the minute taken by the Board of Directors of the DIA in which the agreement to close an Inquiry Point and/or Complaint Resolution Center is recorded; b) Date on which service to consumers or clients will cease (closure); c) Documentation justifying the decision to close that is intended to be carried out; and d) Detail of the measures adopted to inform consumers or clients about service at other locations.

Likewise, the DIA must inform the general public about the closure of the Inquiry Point and/or Complaint Resolution Center, at least thirty days in advance, through official electronic means or channels. Such publication must indicate the alternatives for service to consumers or clients at other locations.

In situations of force majeure or fortuitous event, such as those mentioned in Article 14 of these Standards or other exceptional circumstances duly valued by the Superintendency, the closure of Inquiry Points and/or Complaint Resolution Centers may be carried out in a shorter period of advance notice than the days indicated in the preceding paragraph.

When the DIA decides to close an Inquiry Point and/or Complaint Resolution Center and move it to a different premises, the same procedure established for opening in accordance with Article 5 of these Standards will be followed.

In all cases, the DIAs must guarantee the geographic distribution of their Inquiry Points and/or Complaint Resolution Centers in accordance with what is established in the Credit History Law.

CHAPTER III ON OPERATION

Security Measures Art. 12.- The Inquiry Points and/or Complaint Resolution Centers must meet the minimum necessary security conditions, for the service to consumers or clients, in accordance with the security and protection policies approved by the Board of Directors of the DIA, such as: emergency exits, sanitary protocols, evacuation protocols, physical security, protection and maintenance of furniture, among others.

On Service Art. 13.- The Inquiry Points must provide service to consumers or clients seven days a week, and the Complaint Resolution Centers on business days.

In all cases, they must communicate the service schedule through visible signs at the physical locations, as well as in the mechanisms and technological developments of the DIAs, such as: web applications, mobile applications, among others.

Consumers or clients may access their credit history information, as well as resolve concerns and inquiries about it at the enabled Inquiry Points, and in cases where any concern, claim, or complaint arises, they may present it at the Complaint Resolution Centers, which will have a maximum period of three business days to provide a resolution to the presented claim.

For identification purposes when providing service at the Inquiry Points and/or Complaint Resolution Centers, the DIA may request the consumer or client for the following basic information: a) Full name; b) Unique Identity Document Number; c) Email address; and d) Phone number.

In those cases where the consumer or client expressly manifests to the DIA their consent to receive notifications by email or instant messaging and this does not have the information referred to in subsections c) and d) of the preceding paragraph collected through the EAs, the consumer or client must sign a request for such purposes before the DIA, so that it can carry out said notification.

In all cases, such information will be treated confidentially and will only serve for the DIA to provide a fast, efficient, and timely service to the consumer or client regarding the inquiry of the credit history and the resolution of concerns, complaints, or others. The obtaining of the information must be stored separately and independently from the database containing the credit history information, exclusively for the purposes of identity verification and notification processes.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 8 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

Contingency Plans Art. 14.- The DIAs must have a detailed and tested contingency plan, which allows them to preserve the continuity of their operations at the Inquiry Points and/or Complaint Resolution Centers.

In the event that contingent events occur, due to fortuitous event or force majeure that require the temporary or definitive closure of their operations, the DIAs must immediately notify the Superintendency of the suspension of services, and communicate to consumers or clients the Inquiry Points and/or Complaint Resolution Centers where they will continue to provide service.

The following will be considered as contingent situations, due to fortuitous event or force majeure, among others: a) Earthquakes; b) Tsunamis; c) Floods; d) Fires; e) Hurricanes; f) Riots; g) Robberies; h) Seizures of premises or buildings; i) Sanitary emergencies derived from Pandemic; and j) Suspensions of energy or any other essential service.

The DIAs must review their contingency plans at least every two years, in order to verify that such plans are coherent with the nature and volume of activities of the Inquiry Point and/or Complaint Resolution Center that may be affected.

Identification Art. 15.- The Inquiry Points and/or Complaint Resolution Centers must be fully identified with the name of the DIA to which they belong.

Outsourcing Art. 16.- The DIAs may provide service to consumers or clients at the Inquiry Points and/or Complaint Resolution Centers through an outsourced service, for the

Authorization, Registration, and Operation of Data Information Agencies and of Services on Credit History Information of Persons (NRP-30), approved by the Central Bank through its Standards Committee.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 9 of 9 CNBCR-16/2021 NRP-31

TECHNICAL STANDARDS FOR THE OPENING, OPERATION, AND CLOSURE OF INQUIRY POINTS AND COMPLAINT RESOLUTION CENTERS OF DATA INFORMATION AGENCIES

Approval: 06/11/2021 Validity: 23/11/2021

CHAPTER IV OTHER PROVISIONS AND VALIDITY

Transitory Art. 17.- The DIAs will have a period of one hundred and five days counted from the entry into force of these Standards, to adapt to the provisions established therein.

Sanctions Art. 18.- Non-compliance with the provisions contained in these Standards, will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Unforeseen Aspects Art. 19.- The unforeseen aspects in regulatory matters in these Standards, will be resolved by the Standards Committee of the Central Bank.

Validity Art. 20.- These Standards will enter into force from the twenty-third day of November of two thousand twenty-one.