Technical Standards for the Start of Operations and Functioning of Electronic Money Providers

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR, CONSIDERING: I. That Article 3, letter b) of the Law on Supervision and Regulation of the Financial System, establishes that it is the competence of the Superintendence of the Financial System to authorize the constitution, functioning, start of operations, suspension of operations, modification, revocation of authorization, closure, and other acts of the members of the financial system, in accordance with the legal, regulatory, or technical standards established regarding the matter. II. That Article 35 of the Law on Supervision and Regulation of the Financial System, establishes that without prejudice to other obligations that may correspond to them, the directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply with and ensure that in the institution they direct or work in, the adoption and updating of policies and mechanisms for risk management are fulfilled. III. That Article 78 of the Law on Supervision and Regulation of the Financial System, establishes that the Superintendence of the Financial System will organize and keep updated the records that the laws entrust to it and those relative to the members of the financial system and their shareholders, which must provide the necessary information to the Superintendence of the Financial System, as well as any change that affects the aforementioned information within the timeframe provided in the respective Law or, in its absence, within thirty days subsequent to the event that motivates it. IV. That Article 2, third paragraph of the Law to Facilitate Financial Inclusion, establishes that the Superintendence of the Financial System will authorize the constitution and start of operations of Electronic Money Provider Societies, in accordance with the requirements and procedures established in the technical standards for such effect issued by the Central Bank of Reserve of El Salvador, through its Committee of Standards. V. That Article 2, seventh paragraph of the Law to Facilitate Financial Inclusion, establishes that the aforementioned societies will be obligated to have, among others, manuals, procedures, policies, internal controls, and business continuity plans that guarantee adequate functioning to offer the services regulated in said law, all in conformity with the current legal framework and the

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 technical standards that are issued for such effect. VI. That Article 2, eighth paragraph of the Law to Facilitate Financial Inclusion, empowers banks, cooperative banks, and savings and credit societies to provide electronic money, for which they must comply with the provisions of said Law applicable to them, establishing in said paragraph that the Superintendence of the Financial System will verify compliance with legal and regulatory provisions prior to the provision of the service.

VII. That Article 10, second paragraph of the Law to Facilitate Financial Inclusion, establishes that when the payment obligations of the Electronic Money Provider decrease, it may request that the amount of the guarantee be adjusted to the equivalent of the new amount of its obligations with them, in accordance with the technical standards issued for such effect. VIII. That Article 22 of the Consumer Protection Law, establishes that financial service providers will deposit the forms in the institution responsible for their supervision and surveillance, which will verify jointly with the Consumer Ombudsman that they comply with the corresponding consumer rights. IX. That the Law against Money Laundering and of Assets, has as its objective to prevent, detect, sanction, and eradicate the crime of money laundering and of assets, as well as its concealment, for which any natural or legal person must demonstrate the lawful origin of their transactions. X. That through Legislative Decree No. 464 dated October 31, 2019, the Legislative Assembly approved reforms to the Law to Facilitate Financial Inclusion, with the purpose of allowing participants of Electronic Money Providers to have transaction and balance limits different from those established for end users, that is, natural persons.

THEREFORE,

by virtue of the normative powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following:

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object Art. 1.- These Standards have as their objective to regulate the requirements and the process for the authorization of start of operations and registration of Electronic Money Providers, as well as provisions applicable to their operation within the national territory, in accordance with the Law to Facilitate Financial Inclusion.

Subjects Art. 2.- The subjects obliged to comply with these Standards are: a) Electronic Money Provider Societies, constituted in accordance with what is established in the Law to Facilitate Financial Inclusion; b) Banks constituted or created by Law in El Salvador interested in providing electronic money; c) Cooperative banks interested in providing electronic money; and d) Savings and credit societies interested in providing electronic money.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Central Bank: Central Bank of Reserve of El Salvador; b) Client: Natural person holder of an electronic money registry; c) Affiliated Commerce: Natural or legal persons with whom Electronic Money Providers have signed a contract, in which payment operations through electronic money will be carried out; d) Financial Correspondents: For the purposes of these Standards, this term is considered in accordance with what is established in Technical Standards to carry out Operations and provide Services through Financial Correspondents and Administrators of Financial Correspondents (NASF-03); e) Electronic money: Monetary value registered in favor of a holder or client, which constitutes a payable obligation to its Electronic Money Provider, which is accepted by other actors who have agreed to receive or provide this service, as a means of payment in an amount equivalent to the cash delivered, and is stored in an electronic medium; f) Mobile device: Payment instrument that allows the client to perform operations with electronic money and administer registries of the latter, these can be: cell phones, prepaid cards, computing terminals, and terminals at service points, to instruct the payment and collection of products and services. It will also be understood as a mobile device any other instrument that exists or is created in the future, feasible to be credited with electronic money and that will allow the client to access the services regulated in these Standards; g) Distributor: Natural or legal person holder of an electronic registry that will facilitate the provision of the services offered by Electronic Money Providers, acting as an intermediary between them and the service points; h) Entity or Entities: Banks, cooperative banks, and savings and credit societies interested in providing electronic money; i) Inclusion Law: Law to Facilitate Financial Inclusion; j) Supervision Law: Law on Supervision and Regulation of the Financial System; k) Operations: Payments and collections, crediting of electronic money registries, conversion of electronic money to cash, and any type of electronic money transfer carried out through mobile devices; they may also generate electronic money registries to fulfill or make effective operations of receiving money from legal persons from abroad that, meeting the requirements of their country of origin, provide the service of sending and receiving money, for which they must comply, where pertinent, with what is regulated in the technical standards issued by the Committee of Standards of the Central Bank. Likewise, they may generate electronic money registries for natural persons, legal persons, or government departments that make payments or transfers with electronic money; l) Participants: Natural or legal persons who intervene in the process of electronic money provision, such as agents, financial correspondents, affiliated commerce, distributors, among others. The scope of their participation will depend on the business model defined by each Electronic Money Provider, they will have a special electronic money registry and may have transaction and balance limits different from those established for end users or clients, that is, natural persons; m) Electronic Platform: Set of hardware and software components, in which information is collected, processed, transmitted, and stored, used to administer all the electronic money enabled by the Electronic Money Provider; n) Electronic Money Providers or Providers: Provider Societies, banks, cooperative banks, and savings and credit societies authorized to provide electronic money; o) Service Points: Natural or legal persons who attend to clients for the performance of operations with electronic money, which may also be understood as Agents; p) Electronic Registry: Recording of a set of data that belongs to the same natural person, legal person, or government departments and that are stored

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 in a database; q) Electronic Money Registry for end users or clients: Recording of a set of data regarding Electronic Money that belongs to the same natural person, for which electronic money providers must comply with the balance and transaction limits defined by the Central Bank, through its Committee of Standards applicable to end users or clients; r) Special Electronic Money Registry: Recording of a set of data regarding Electronic Money that belongs to the same natural person, legal person, or government department identified by electronic money providers as participants, who may have transaction and balance limits different from those established for end users or clients, that is, natural persons; s) Information Security: Set of measures that allow safeguarding and protecting information complying with the properties of confidentiality, integrity, and availability of the same, in order that it is not vulnerable to threats; t) Provider Society: Electronic Money Provider Society; and u) Superintendence: Superintendence of the Financial System.

CHAPTER II AUTHORIZATION OF THE START OF OPERATIONS OF ELECTRONIC MONEY PROVIDER SOCIETIES

Authorization for the start of operations and registration of the Provider Society Art. 4.- Once inscribed in the Commerce Registry the public deed of constitution, the Provider Society will request the Superintendence the authorization of start of operations, for which it must present: a) Note signed by the legal representative of the Provider Society, in which it requests the Superintendence the authorization of the start of operations and its corresponding Entry in the Registry; b) Legible copy of the deed of constitution in which the appointment of the persons who will occupy positions of administration is stated or the certification of the Minute of the General Shareholders' Meeting in which the election of the Board of Directors is stated; c) Legible copy of the Certification of the Minute of the General Shareholders' Meeting or of the Board of Directors, duly inscribed in the Commerce Registry, by virtue of which the appointment of the General Manager or Executive Director has been made; d) Legible copy of the Tax Identification Number and the Taxpayer Registry Number of the Provider Society; e) Organizational chart of the Provider Society with indication of the position and name of the administrators and directors, specifying the position to be performed with respect to support staff;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 5 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 f) Legible copy, notarially certified, of the agreement of appointment of the external auditor registered in the Superintendence, in the case that it has not been appointed in the constitutive act, which must be previously inscribed in the Commerce Registry; g) Certification of Agreement of the Board of Directors of the Provider Society, in which the electronic money balance with which it expects to start operations is indicated, for the purpose of constituting the corresponding backing; h) Operational business model of the Provider Society, in accordance with Article 5 of these Standards; i) Accounting system of the Provider Society and the description of the computer system on which it has been developed and which will support its operation and functioning, description of its information systems, description of information backups, contingency and recovery plans, as well as the description of security and controls in the systems. The accounting systems must be presented in accordance with the applicable legal and regulatory provisions; j) Signed contract for the opening of a Deposit Account, in which the guarantee that will serve as cash backing referred to in Article 10 of the Inclusion Law will be constituted; k) Certification issued by the Central Bank of the correct functioning of the interface that will allow the interconnection between it and the Provider Society, which must comply with what the Board of Directors of said Bank establishes; l) Internal policies of the Provider Society, in accordance with what is established in Article 35 of the Supervision Law, among which can be mentioned: i. Corporate governance policies in accordance with what is established in the [NRP-17], approved by the Central Bank through its Committee of Standards; ii. Policies on ethical standards of conduct; iii. Policies and mechanisms for risk management in accordance with what is established in the Technical Standards for the Integral Risk Management of Electronic Money Provider Societies [NRP-22] approved by the Central Bank, through its Committee of Standards; and iv. Information security and business continuity policies [NRP-24] approved by the Central Bank, through its Committee of Standards; m) Internal control manuals for the functioning in each of the operational processes of the Provider Society; n) Manual for the management of the risk of Prevention of Money Laundering and of Assets and of Terrorism Financing; and o) Integral risk management system, as established in the Technical

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 6 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 Standards for the Integral Risk Management of Electronic Money Provider Societies (NRP-22), approved by the Central Bank through its Committee of Standards. (1) Art. 5.- The operational business model must contain at least the following: a) Business volume and electronic money that is expected to handle for a minimum period of three years, attaching the corresponding supporting documentation (sources of information, justification of assumptions, criteria used, among others); b) General technical description of the type of technology to be used with its participants; c) Description of the mechanism for identification, subscription, and registration of client information to the services, as well as the activation, blocking, deactivation of the same, the reversal of operations, and the delivery of security keys, as well as the causes for rejection of operations and the procedure for notifying the client of the respective rejection; (1) d) Description of the registration system of the operations of all participants, in accordance with what is established in Article 7, final paragraph, of these Standards; e) Maximum balance limit and maximum amount per transactions realizable by clients, in accordance with what is established in the Inclusion Law, as well as description of the mechanisms to ensure its compliance; f) Profile of natural or legal persons with whom the Provider Society will have a contractual relationship to develop operations as a distributor or service point; g) Type of operations that the client can perform, accompanied by the respective operational scheme that includes the role of the Provider Society and other participants, the phases considered in the provision of the service, and the measures to ensure the confidentiality, availability, integrity, and functionality of the operations with electronic money; h) Technical description of the electronic platform that will support the service through mobile devices, in accordance with what is established in Article 7 of these Standards, as well as of the mechanisms and computer systems for control and monitoring of the services on the electronic platform; i) Description of mechanism to guarantee the linkage of an electronic money registry to a single natural person, provided that it does not have an active registry with the same Provider; (1) j) List of telephone operators or entities that will provide the communication channel for the provision of the service, if applicable; k) Maximum balance limit and maximum amount per transactions realizable by the participants, observing at all times the limits established by the Provider Society, according to its business model, as well as the description of the mechanisms to ensure its compliance;

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 7 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 l) List of potential participants depending on the established operational business model; m) Description of mechanisms, procedures, and instances within the Provider Society for the resolution of differences that may arise with the participants; (1) n) Description of mechanisms, procedures, and instances within the Provider Society to avoid the prescription of balances in the electronic money registries of its participants and clients; and (1) o) Description of mechanisms, procedures, and instances within the Provider Society for the attention of complaints or claims from its participants and clients. (1). The description of mechanisms or systems established in letters c), d), h), i), m), n) and o) of this article, must be developed for the process of verification of start of operations by the Superintendence. (1)

On Information Security and Business Continuity Art. 6.- The Provider Society must manage information security and business continuity [NRP-24] approved by the Central Bank, through its Committee of Standards.

On the Electronic Platform of Provider Societies Art. 7.- With regard to the electronic platform that will support the service through mobile devices, the Provider Society must present the following: a) Description of the hardware and software for the connection of the Provider Societies with the participants that intervene in its business scheme; b) The technical diagram of the sending and receiving of information between the electronic platform of the Provider Society, and the mobile devices of the clients, which include the role of the participants that are defined according to the operational business model; and c) Technical manual of the computer system that supports the operations carried out with electronic money that includes at least the Entity-Relationship diagram of the system and a detailed description of the database objects (Data Dictionary). The electronic platform must allow timely and immediate access to all information related to electronic money operations performed, that is requested by the holder, the Provider Society, by the Central Bank or the Superintendence, the General Directorate of Internal Taxes when they require it

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 8 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020 for the exercise of their functions and to the respective authorities for the clarification of crimes, providing it by the means q

Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 9 of 30 NBCR-13/2020 NASF-07 TECHNICAL STANDARDS FOR THE START OF OPERATIONS AND FUNCTIONING OF ELECTRONIC MONEY PROVIDERS Approval: 08/19/2020 Validity: 09/07/2020