Technical Standards for the Registration of External Auditors of Financial System Members

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 21 CNBCR-06/2018 NRP-16

TECHNICAL STANDARDS FOR THE REGISTRATION OF EXTERNAL AUDITORS OF THE MEMBERS OF THE FINANCIAL SYSTEM

Approval: 15/06/2018 Validity: 06/07/2018

THE STANDARDS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Articles 78, letter h), and 106 of the Law on Supervision and Regulation of the Financial System establish that the Financial System Superintendence shall organize and keep updated the records mandated by laws, including those of external auditors of the entities that are part of the national financial system.

II. That Article 224 of the Banks Law, Article 87 of the Insurance Companies Law, Article 59 of the Cooperative Banks and Savings and Credit Companies Law, Article 48 of the Law on the Reciprocal Guarantee System for Micro, Small and Medium Rural and Urban Enterprises, Article 46 of the Pension Savings System Law, Article 29 of the Asset Securitization Law, Article 32 of the Investment Funds Law, and Article 33 of the Law on the Financial System to Promote Development establish that the financial statements of the societies and institutions regulated by these laws must be audited by external auditors registered in the Registry maintained by the Financial System Superintendence.

III. That Article 6, fourth paragraph, letter f) of the Securities Market Law establishes that the Public Stock Registry maintained by the Financial System Superintendence is composed, among other special registries, by the registry of external auditors, and that Articles 81 and following of the same Law establish the requirements, powers, and obligations that external auditors seeking to register in the Public Stock Registry must comply with.

IV. That Article 7 of the Securities Market Law establishes that the organization and functioning of the registry shall be developed in the Regulations of that Law, considering the nature of the securities market, the registry principles, and the respective inscription requirements contained in this Law. Regarding this, Article 23 of the Regulations of the Securities Market Law includes the list of information that must be contained in the registry entries of external auditors.

V. That Article 15, letter m), of the Law on Supervision and Regulation of the Financial System establishes that it is the power of the Board of Directors of the Financial System Superintendence to authorize, modify, suspend, or cancel registry entries in the registries it maintains for persons, institutions, and operations subject to such requirement, in accordance with the laws on the matter, including that of external auditors.

VI. That it is necessary to integrate and update the regulatory framework applicable to the registration of external auditors who provide their services to the members of the financial system, based on current legal provisions.

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 21 CNBCR-06/2018 NRP-16

TECHNICAL STANDARDS FOR THE REGISTRATION OF EXTERNAL AUDITORS OF THE MEMBERS OF THE FINANCIAL SYSTEM

Approval: 15/06/2018 Validity: 06/07/2018

VII. That Article 6 of the Law Regulating the Practice of Public Accounting establishes that when a public accountant intends to provide external audit services to the entities that are part of the financial system, they must request their inscription in the registry kept for such purposes by the Financial System Superintendence, in accordance with the applicable regulations, the Law on Supervision and Regulation of the Financial System, and other special laws.

VIII. That in accordance with Article 101, fourth paragraph, of the Law on Supervision and Regulation of the Financial System, the powers to approve, modify, and repeal technical norms that must be complied with by the members of the financial system and other supervised entities, which were attributed to the Superintendencies or the Boards of Directors of the Superintendencies whose organic laws were repealed with this Law, are transferred to the Central Reserve Bank of El Salvador.

THEREFORE,

by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS FOR THE REGISTRATION OF EXTERNAL AUDITORS OF THE MEMBERS OF THE FINANCIAL SYSTEM

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object Art. 1.- These Standards aim to establish the minimum requirements that external auditors must meet to be inscribed and maintain such status in the Registry of External Auditors of the Members of the Financial System. Such inscription, in accordance with the Law on Supervision and Regulation of the Financial System and other applicable Laws, authorizes and enables them to be contracted by the members of the financial system to provide external audit services and to issue opinions on their financial statements, as well as on the aspects mentioned in the Laws applicable to said members.

Subjects Art. 2.- These Standards shall apply to natural or legal persons interested in providing external audit services to the members of the financial system detailed in Article 7 of the Law on Supervision and Regulation of the Financial System, as well as external auditors of other entities that by legal provisions must comply with the registration requirement with the Financial System Superintendence.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Central Bank: Central Reserve Bank of El Salvador; b) Surveillance Council: Surveillance Council of the Public Accounting and Auditing Profession; c) Financial Conglomerates: A group of companies characterized by the fact that more than fifty percent (50%) of their respective share capital is owned by a controlling company, which is also a member of the conglomerate; d) Persons in charge of directing audits: Engagement partner according to International Standards on Auditing (ISA), is the partner or employee of the audit firm or office who is responsible for the coordination, direction, supervision, and execution of the audit work for the company that hires the firm or office, and of which they are designated as the engagement auditor; they are also responsible for signing the report issued in the name of the firm or audit office; e) Registry: Registry of External Auditors of the Members of the Financial System; f) Superintendence: Financial System Superintendence; and g) Partners: Shareholders of capital companies.

CHAPTER II REGISTRATION

Classification of the External Auditor Registry Art. 4.- The Superintendence shall maintain a registry divided into two categories: a) External Auditors for Banks and Financial Conglomerates; and b) External Auditors for other Members of the Financial System. Auditors registered in category a) may audit other members of the financial system, and those in category b) may audit members of the financial system other than banks and financial conglomerates.

Requirements to Register Art. 5.- Natural and legal persons interested in registering in the Registry must meet the following requirements:

a) Be registered in the Registry of Public Accounting Professionals maintained by the Surveillance Council, for the professional practice of auditing; b) Declare that they know and comply with the International Standards on Auditing (ISA) and the Professional Code of Ethics for Auditors and Accountants adopted or issued by the Surveillance Council; c) Prove professional experience in the practice of external auditing or similar functions, as follows: i. Of at least five (5) years for those requesting authorization in the category of external auditors for banks and financial conglomerates; and ii. Of at least three (3) years for those requesting authorization in the category of external auditors for other members of the financial system. In the case of companies, this applies to the partners responsible for signing the audit reports. Professional experience is understood as the practice of external audits or similar functions; such as internal and tax audits, accounting services, and consulting; d) That the auditor, partners, directors, administrators, persons in charge of directing audits, and those who sign the audit reports: i. Have not been convicted of crimes against property or public treasury or participated maliciously in the commission of any crime; ii. Do not have direct credits for which a reserve for regularization of fifty percent (50%) or more has been or is required, or that they hold twenty-five percent (25%) or more of the shares of companies that have credits with such a reserve for regularization; iii. Have tax solvency and keep their information updated with the Surveillance Council; iv. Are not in a state of bankruptcy, suspension of payments, or creditors' composition, or have not been judicially classified as responsible for negligent or fraudulent bankruptcy; v. Are not simultaneously directors, officials, or employees of the members of the financial system; vi. Have not been judicially proven to participate in activities related to drug trafficking and related crimes, money laundering and asset laundering, or terrorist financing; vii. Have not been administratively or judicially sanctioned for participating in serious infractions of laws and norms of a financial nature, especially the collection of public funds without authorization, the granting or receipt of loans exceeding the permitted limit, and other financial crimes; viii. Are independent of the audited entity and do not hold any shares in them, either directly, nor their spouses or relatives within the second degree of consanguinity and first degree of affinity, or through legal entities; and ix. Have not been administrators, as directors or managers, or officials of a financial system institution where it is demonstrated administratively that said institution, from the validity of the Law on the Privatization of Commercial Banks and Savings and Loan Associations, has incurred patrimonial deficiencies of twenty percent (20%) or more of the minimum required by Law, has received contributions from the State or the Deposit Guarantee Institute for its regularization, or has been intervened by the competent body. e) That the income received by external audit companies or the external auditor for the audit services provided to a member of the financial system does not exceed twenty-five percent (25%) of their total income.

Receipt of Registration and Renewal Applications Art. 6.- Applications for registration in the Registry will be received in the month of August, and renewals at least one hundred twenty (120) days before the expiration of the registration period, in accordance with Annex No. 1 of these Standards.

Application and Information to Present Art. 7.- Interested parties must submit a written application to the Superintendence, in which they must state which classification category they intend to offer their services in, and additionally attach, considering Annex No. 2 of these Standards, the following information: a) Name, Trade Name, or Denomination; b) Address, email addresses, telephone numbers; c) Copies of the Tax Identification Number (NIT) or its Graphic Representation and notarized certified copies of the Taxpayer Registration Number for the Tax on the Transfer of Movable Goods and the Provision of Services (IVA) of the applicant; (1) d) Certification issued by the Surveillance Council stating that the professional or company, as applicable, is registered in the Registry of Public Accounting Professionals, complies with continuing education requirements, data updates, and quality control; regarding the latter, they will present the certification only if they have been evaluated by the Surveillance Council; e) Copy of the public deed of incorporation and its modifications; additionally, list of partners, in the case of companies; f) Credentials of the Board of Directors of the company, which must be registered in the Commerce Registry; g) Curriculum Vitae of professionals practicing individually, of partner directors, administrators, and of persons signing reports up to the level of persons in charge of directing audits, attaching photocopies of the professional degree, photocopy of the card issued by the Surveillance Council, certified photocopy of the Unique Identity Document (DUI), and photocopy of the Tax Identification Number (NIT) or its Graphic Representation; (1) h) Description of the organization with the following content: i. Organizational chart of the firm; ii. General description of the functions of each component of the organizational chart; iii. Name of the personnel and their position; iv. Description of the computer equipment and their respective programs; v. General description of the Quality Control System; and vi. General description of their system for evaluating the quality control of audits performed by the firm. i) Name and address of the companies to which they are providing external audit services and the main ones to which they have provided such service in the last three (3) or five (5) years depending on the requested classification category, specifying the main activity of the companies and the period during which they provided the services; likewise, list of the fifteen (15) main clients and the percentage participation of the billing of each in the annual income corresponding to the last fiscal year of the audit firm. For these purposes, a financial conglomerate must be considered as a single client; j) Sworn Declaration before a notary, considering the formats attached in Annexes Nos. 3 and 4 of these Standards, depending on the type of person, natural or legal; k) Pertinent certified notarial copy of the current contract or agreement with the international audit firm or entity with which a correspondent, associated, member, or other contract has been signed. This contract or agreement, if not in Spanish, must present its translation in accordance with what is established by Article 24 of the Law on the Notarial Practice of Voluntary Jurisdiction and Other Proceedings, and must also attach the proof of being registered with the Surveillance Council. The applicant will attach to the contract or agreement a summary containing, among others, the object of the contract or agreement, the responsibilities and obligations assumed, the rights acquired by the parties, the use of the name or commercial trademarks of the firm, and its validity; l) Certification of having no criminal record, issued by the competent authority. This certification must have been issued at least within the thirty (30) days prior to the respective application made to the Superintendence. In the case of audit companies, it applies to partners and auditors who sign the audit reports; m) Certified copies of the financial statements duly audited, corresponding to the last three (3) years. When the company has been in existence for less than three (3) years, it must present the financial statements it had audited and the corresponding to the last month of operations it has at the date;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 7 of 21 CNBCR-06/2018 NRP-16

TECHNICAL STANDARDS FOR THE REGISTRATION OF EXTERNAL AUDITORS OF THE MEMBERS OF THE FINANCIAL SYSTEM

Approval: 15/06/2018 Validity: 06/07/2018

n) Certified copy of the last payroll paid to the Salvadoran Social Security Institute (ISSS) and to the Pension Fund Administration Institutions; and o) Solvency certificates in original and current, issued by the respective Pension Fund Administration Institutions, the Pension Unit of the Salvadoran Social Security Institute (UPISSS), and the payment of worker-employer contributions of the Salvadoran Social Security Institute (ISSS).

Incomplete Information Art. 8.- In the case of Registry applications whose information and documentation is not complete, the Superintendence will communicate to the interested party, within twenty (20) business days following the receipt of the application; the interested party will have a period of thirty (30) days to correct the omission. If upon expiration of the period no response has been received, it will be understood that the applicant has withdrawn their request, whereupon the procedure will be terminated and the documentation will be sent to the Superintendence's archive.

Verification of Presented Information Art. 9.- If during the process of verifying the presented information and prior to the authorization of the Registry, it is determined to be false, the Superintendence, based on the Criminal Procedure Code, will notify the Attorney General's Office (FGR) and, considering what is established in the Law Regulating the Practice of Public Accounting, may report the fact to the Surveillance Council.

Communication of the Resolution Art. 10.- Once the requirements established in these Standards are satisfied and corrected, the Superintendence will resolve the pertinent matters and communicate to the interested parties, before the end of the year in which the application was submitted. Registrations will be authorized with a validity date starting on January 1 of the year following the year of submission of the application. In the case of auditors of letter a) of Article 4 of these Standards, the validity will be two (2) years, based on Article 228 of the Banks Law. For auditors of letter b) of Article 4, the validity will be until the Superintendence, in compliance with its legal powers, issues a definitive suspension or cancellation of their registration.

CHAPTER III FACTORS TO CONSIDER AND ANALYSIS CRITERIA

Evaluation Factors Art. 11.- The factors described in Annex No. 5 of these Standards will be weighted based on the criteria described below:

FACTOR | POINTS ASSIGNED

1. Independence | 30 1.1. Economic Independence | 15 1.2. Number of Audited Companies | 15
2. Professional Training | 25 2.1. Academic Degree | 10 2.2. Technical Audit Personnel | 10 2.3. Special Studies | 5
3. Quality and Experience | 35 3.1. Time in Professional Practice | 5 3.2. Diversity of Audited Companies | 10 3.3. Experience in the Financial System | 5 3.4. Quality of Work | 15
4. Organizational Efficiency | 10 4.1. Defined Organization and Functions | 5 4.2. Computer Equipment and Programs | 5 Total | 100

The minimum score required for registry entries and their renewals in the Registry will be sixty-five (65) points. The factors described in the previous article will be weighted based on the criteria described in Annex No. 5.

CHAPTER IV SUSPENSION AND CANCELLATION OF REGISTRY ENTRY

Notification to the Surveillance Council Art. 12.- Suspensions and cancellations in firm will be made known to the Surveillance Council and to the members who have contractual relations with the cancelled or suspended auditors, and will be fully disseminated by the Superintendence on its website.

Reincorporation of Auditors Art. 13.- External auditors whose authorization and inscription of the registry entry to practice external auditing in the entities of the financial system has been cancelled by the Superintendence may request, after two (2) years from the cancellation, authorization to practice it again, sending for such purposes the documentation requested in these Standards.

CHAPTER V OTHER PROVISIONS AND VALIDITY

Deadlines to Update Information Art. 14.- To keep the information in the Registry updated, external auditors must communicate to the Superintendence any change in the information detailed in Annex No. 6 of these Standards within a maximum period of thirty (30) days following the event that motivated the change.

For the update of external auditor information, Annex No. 6 of these Standards must be used, taking into account the following aspects: a) List of shareholders when it is a legal person; b) List of entities to which audit services were or are provided during the previous and current fiscal year; c) Updated credentials of the legal representative(s); d) Sworn Declaration stating that the document of the relationship of the audit firm with firms or entities of auditing, whether local or foreign (association, agreement, representation, correspondence, use of no

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 9 of 21 CNBCR-06/2018 NRP-16

TECHNICAL STANDARDS FOR THE REGISTRATION OF EXTERNAL AUDITORS OF THE MEMBERS OF THE FINANCIAL SYSTEM

Approval: 15/06/2018 Validity: 06/07/2018

(End of provided text)