Technical Standards for the Provision of External Audit Services

Alameda Juan Pablo II, between 15 and 17 1st Avenue North, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 25 CNBCR-06/2019 NRP-18 TECHNICAL STANDARDS FOR THE PROVISION OF EXTERNAL AUDIT SERVICES Approval: 03/27/2019 Validity: 05/02/2019

THE STANDARDS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Article 7, third clause, of the Law on Supervision and Regulation of the Financial System establishes that the Superintendency shall also supervise external auditors, whether natural or legal persons, specifically regarding the performance of their functions and provision of services to members of the Financial System.

II. That Article 35, letter f), of the Law on Supervision and Regulation of the Financial System establishes that adequate accounting disclosure of the economic and financial reality must be backed by both internal and external audits.

III. That Article 36, first clause, of the Law on Supervision and Regulation of the Financial System establishes that external auditors must provide an opinion to the General Shareholders' Meeting or highest administrative body and to the Board of Directors or governing body of the respective financial system member regarding the integrity, adequacy, and effectiveness of internal control systems.

IV. That Article 36, second clause, of the Law on Supervision and Regulation of the Financial System establishes that the external auditor is one of the obligated subjects to report to the Superintendency of the Financial System operations that it has requested, particularly those carried out or previously carried out between a financial system member and its shareholders or administrators, and those related to the financial conglomerate to which it belongs, if applicable.

V. That Article 40, third clause, of the Law on Supervision and Regulation of the Financial System establishes that external auditors are, among others, obligated subjects to inform the Superintendency of the Financial System of all events of which they have knowledge in the performance of their functions that suggest the existence of facts or circumstances that could be considered illegal or that could put at risk the stability and functioning of the entity that is a member of the financial system.

VI. That Article 46, third clause, of the General Law of the Pension System establishes that the minimum audit requirements that external auditors must meet regarding independent audits performed on Administrators will be established in the Technical Standards issued by the Central Reserve Bank through its Standards Committee. The Superintendency will have the authority to verify compliance with these minimum requirements. (1)

Alameda Juan Pablo II, between 15 and 17 1st Avenue North, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 25 CNBCR-06/2019 NRP-18 TECHNICAL STANDARDS FOR THE PROVISION OF EXTERNAL AUDIT SERVICES Approval: 03/27/2019 Validity: 05/02/2019

VII. That Article 99, letter f), of the Law on Supervision and Regulation of the Financial System establishes that it is the responsibility of the Standards Committee of the Central Reserve Bank to issue requirements applicable to internal and external auditors as well as to the Audit Committees of the members of the financial system.

VIII. That Article 63 of the Banks Law and Article 44 of the Investment Banks Law establish that external auditors must inform the Superintendency about the compliance with internal control policies and systems that banks must implement to manage their financial and operational risks; as well as those that allow them to know their clients in a reliable manner. (1)

IX. That according to Article 119 of the Banks Law, the financial statements of member companies of a conglomerate, as well as the consolidated statements of the holding company, must be audited by the same external auditor registered with the Superintendency of the Financial System, and member companies of a conglomerate located abroad must be audited by associated firms or correspondents of the holding company's auditors, and if this is not possible, by internationally recognized audit firms.

X. That Article 226, second clause, of the Banks Law and Article 59 of the Investment Banks Law establish obligations and functions of the external auditor when performing this function in banks and investment banks. (1)

XI. That Article 87, third clause, of the Insurance Companies Law establishes that external auditors regarding independent audits performed on insurance companies must comply with the minimum requirements established by the Superintendency of the Financial System, a power that, in accordance with Article 101 of the Law on Supervision and Regulation of the Financial System, was transferred to the Central Bank through its Standards Committee.

XII. That Article 9, letter c), of the Securities Market Law establishes as one of the requirements to be presented to be registered as an issuer in the Public Stock Exchange Register the audited financial statements of the issuer, duly audited by external auditors registered in the Public Stock Exchange Register of the Superintendency.

XIII. That Article 83, third clause, of the Securities Market Law and Articles 29 and 62 of the Asset Securitization Law empower the Securities Superintendency to establish the minimum audit requirements that external auditors of entities subject to its control, inspection, surveillance, and oversight must meet, a power that, in accordance with Article 101 of the Law on Supervision and Regulation of the Financial System, was transferred to the Central Bank through its Standards Committee.

Alameda Juan Pablo II, between 15 and 17 1st Avenue North, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 25 CNBCR-06/2019 NRP-18 TECHNICAL STANDARDS FOR THE PROVISION OF EXTERNAL AUDIT SERVICES Approval: 03/27/2019 Validity: 05/02/2019

XIV. That it is necessary to harmonize and update the foundations required for the exercise of the external audit function for members of the financial system supervised by the Superintendency of the Financial System, towards a risk-based audit approach in accordance with current laws and standards, and standards or norms adopted or issued by the Supervisory Council.

XV. That Article 9, second clause, number 11, of the Special Law for the Prevention, Control, and Sanction of Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction regulates that obligated subjects must have external or specialized risk management audit to evaluate and issue reports on the evaluation of the prevention system management. (2)

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE PROVISION OF EXTERNAL AUDIT SERVICES

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object Art. 1.- These standards aim to establish the minimum provisions regulating the professional external audit services provided by external audit firms of natural or legal persons to members of the financial system and securities issuers. (2) Additional services that the external auditor provides to members of the financial system and that are legally compatible or permitted in accordance with the Code of Ethics, issued or adopted by the Supervisory Council of the Public Accounting and Audit Profession, will not be subject to these Standards.

Subjects Art. 2.- The subjects obligated to comply with the provisions established in these Standards are external audit firms of natural or legal persons that are registered in the Registry of the Superintendency of the Financial System and that provide their professional external audit services to the following entities:

a) Banks constituted in El Salvador, their offices abroad, their subsidiaries, and the branches of foreign banks established in the country; b) Companies that, in accordance with the law, form financial conglomerates or that the Superintendency declares as such, which includes both their holding companies and their member companies; c) Pension Fund Administrators (AFPs) and the funds they administer; d) Insurance companies, their branches abroad, and the branches of foreign insurance companies established in the country; e) Stock exchanges, brokerage houses, companies specialized in the deposit and custody of securities, risk rating agencies, institutions providing auxiliary services to the stock market, specialized agents in securities valuation, and general warehouses; f) Cooperative banks, savings and credit societies, and federations regulated by the Law on Cooperative Banks and Savings and Credit Societies; g) Mutual guarantee societies and their local reinsurance providers; h) Companies that offer complementary services to the financial services of members of the financial system, particularly those in which they participate as investors; i) Administrator or operator companies of payment systems and securities settlement systems; j) The Social Housing Fund and the National Popular Housing Fund; k) The Salvadoran Institute of Pensions (ISP) and the Salvadoran Institute of Social Security (ISSS), the latter regarding the Public Pension System, the Professional Risks Regime, and technical health reserves, insofar as it does not contradict what is provided by the Comptroller General of the Republic; (1) l) The Social Welfare Institute of the Armed Forces, insofar as it does not contradict what is provided by the Comptroller General of the Republic; m) The Agricultural Development Bank, the Mortgage Bank of El Salvador, S.A., and the Development Bank of El Salvador, insofar as it does not contradict their creation laws nor what is provided by the Comptroller General of the Republic; n) The Salvadoran Investment Corporation; o) Foreign currency exchange houses; p) Securitizers and the funds they administer; q) The Deposit Guarantee Institute and the Financial Sanitation and Strengthening Fund in all matters concerning their laws and regulations; r) Product and services exchanges; s) Investment fund managers and the funds they administer; t) Money transfer companies and agents whose country of origin is El Salvador in accordance with the "Technical Standards for the Registration, Obligations, and Operation of Entities that Carry Out Money Sending or Receiving Operations through Subagents or Administrators of Subagents" (NRP-19); (1) u) Electronic money provider companies; (1) v) Securities issuers, in accordance with Articles 9 and 20 of the Securities Market Law; and (1) w) Investment Banks constituted in El Salvador, their offices abroad, and their subsidiaries. (1)

The entities mentioned in the letters of this article will be responsible for complying with the provisions established in Articles 5, 6, 9, and 10 of these Standards.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: (2)

a) Shareholder: Direct owners of the shares of entities subject to the application of these Standards; the term will also serve to refer to the members of cooperative associations subject to the application of these Standards; b) External Auditors: External audit firms of natural or legal persons that are registered in the Registry of the Superintendency of the Financial System; c) AFP: Pension Fund Administrator; (1) d) Central Bank: Central Reserve Bank of El Salvador; e) Supervisory Council: Supervisory Council of the Public Accounting and Audit Profession; f) Internal Control: The process designed, implemented, and maintained by the entity's governance responsible parties, management, and other personnel, with the aim of providing reasonable assurance regarding the achievement of the entity's objectives related to the reliability of financial information, the effectiveness and efficiency of operations, as well as compliance with applicable legal and regulatory provisions; g) Fund(s): In matters of the securities market, to securitization funds or investment funds; in matters of pensions, to Pension Funds; h) Fraud: Intentional act carried out by directors, managers, and other officials holding management or administrative positions responsible for the governance of the audited entity, employees, or third parties, which involves the use of deception to obtain an unjust or illegal advantage; i) ISSS: Salvadoran Institute of Social Security; j) Non-compliance: Actions or omissions of the entity, intentional or not, that are contrary to current legal and regulatory provisions; k) ISP: Salvadoran Institute of Pensions; (1) l) Professional Judgment: Application of relevant practical training, knowledge, and experience, in the context of auditing, accounting, and ethics standards, to make informed decisions about the appropriate course of action based on the circumstances of the audit work; m) Board of Directors: Collegiate body responsible for the administration of the entity, with supervisory and control functions; in the case of Cooperative Associations, it will be the Board of Administration; n) General Meeting: General Shareholders' Meeting, General Assembly of Partners, or its equivalent; o) LCP: Public Procurement Law; (1) p) AML/CFT/CPF: Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction; (1) (2) q) SP Law: General Law of the Pension System; (1) r) ISA: International Standards on Auditing issued by the International Federation of Accountants (IFAC); (1) s) Working Papers: Audit documentation, physical and/or electronic, in accordance with current legislation, which includes the record of audit procedures applied, relevant audit evidence obtained, and conclusions reached by the auditor; (1) t) SP: Pension System; (1) u) SPP: Public Pension System, constituted by the ISSS and the ISP; (1) v) Superintendency: Superintendency of the Financial System; and (1) w) UIF: Financial Investigation Unit of the Attorney General's Office. (1)

CHAPTER II ON EXTERNAL AUDIT, APPOINTMENT, AND SEPARATION OF EXTERNAL AUDITORS

Preliminary Provisions Art. 4.- For the purposes of these Standards, external audit will be understood as the independent professional service provided by an external audit firm, which consists of the inspection and/or verification of the accounting of the entities mentioned in Article 2 of these Standards, in order to verify whether their accounts adequately reveal or do not reveal the equity, financial situation, and results obtained, in accordance with the legal, regulatory, and financial framework applicable to each entity. The external auditor will carry out their work complying with these Standards, the applicable legal framework, the ethical and technical standards approved and/or adopted by the Supervisory Council, the International Standards on Auditing, from which, as a result, they can issue an independent opinion on whether the financial statements have been prepared, in all material aspects, in accordance with the legal, regulatory, and financial framework applicable to each entity, providing reasonable assurance to users thereof, that they do not contain material errors or omissions. The execution of the external audit must correspond to the business nature, equity strength, volume of operations, and legal and special provisions in the matter in which they carry out their operations.

Appointment of the Auditor Art. 5.- The appointment of the external auditor of the entities mentioned in Article 2 of these Standards will be the responsibility of the General Meeting or the administrative body that, by legal provision, has this attribution, who may also appoint the substitute external auditor. The appointment will be made on the date of the Ordinary General Shareholders' Meeting or on the date established in the legal provisions applicable to the members of the financial system. The appointed external auditor must be independent of the financial system member that hires them, be registered in the Registry kept for such purposes by the Superintendency, and issue a sworn declaration certifying that the partners, directors, administrators, and persons in charge of directing auditors and who sign audit reports during the period of their appointment are not in any of the circumstances that prevent them from providing external audit services, established in the legal framework applicable to their clients, as well as in the circumstances of loss of independence of judgment established in the Professional Code of Ethics for Auditors and Accountants, issued or adopted by the Supervisory Council. In the case of banks, the limit of these entities audited by the same external auditor will be three. The same condition will apply to Savings and Credit Societies. In the case of Investment Banks, the limit of these entities audited by the same audit firm will be three, in accordance with Article 61 of the Investment Banks Law. (1) For the foregoing, in the case of the ISSS, ISP, Social Housing Fund, National Popular Housing Fund, Social Welfare Institute of the Armed Forces, Development Bank of El Salvador, Financial Sanitation and Strengthening Fund, Salvadoran Investment Corporation, and Agricultural Development Bank, the contracting and appointment process will be carried out in accordance with the provisions established in the special legislation applicable to each, the LCP, and its Regulations. (1) The appointment will be for one year, prior to the technical opinion of the Audit Committee or the Evaluation Commission appointed for such purpose, as provided in the LCP. (1)

Communication of the Appointment of External Auditor to the Superintendency Art. 6.- The entities listed in all the letters of Article 2 of these Standards must communicate to the Superintendency, no later than ten business days after the date of appointment, the name of the selected external auditor, attaching the certification of the minute point of the General Meeting or its equivalent where it was approved, and the certified copy of the contract signed between the parties, which must contain the obligations of each of them, in accordance with the minimum requirements established in these Standards.

Access to Working Papers Art. 7.- The external auditor must allow the Superintendency to know at all times the execution of the audit and to access the working papers, providing it with the information it requests through the means and form it defines, considering at least what is indicated and the deadlines established in Article 23 of these Standards.

Rotation of External Audit Managers Art. 8.- In order to strengthen the independence of external auditors, the manager, supervisor, and personnel responsible for the assigned audit must be rotated after five years of auditing the same entity.

Separation or Resignation of the External Auditor Art. 9.- The external auditor must notify in writing, explaining to the Superintendency the reasons for resignation from their position, the intention to do so, or the extinction of their contract with the entity that hired them, notification that must be made no later than three business days after the event occurred. In case of extinction, the entities mentioned in Article 2 of these Standards must notify the Superintendency in writing of the reasons for the extinction of the contract with the external auditor and from what date it occurred, indicating at the same time the name of the substitute and the date from which the latter will begin their functions. In these cases, notifications must be made no later than three business days after their appointment.

Art. 10.- The General Meeting or the administrative body that, by legal provision, has this attribution may accept the resignation of external auditors or separate them from their function, within the validity of the contract, in case they fail to comply with the contract or when the Superintendency, in accordance with its legal powers, sanctions external auditors with suspension or cancellation in the respective registry.

CHAPTER III PLANNING OF THE EXTERNAL AUDITOR'S WORK

General Aspects Art. 11.- External auditors subject to these Standards must submit the audit plan to the Superintendency no later than