Technical Standards on Cybersecurity Measures in Digital Channels

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:
I. That Article 2, second paragraph of the Law on Supervision and Regulation of the Financial System, establishes that for the proper functioning of the Financial Supervision and Regulation System, it is required that the members of the financial system and other supervised entities comply with current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with what is established in the aforementioned Law, in other applicable laws, in regulations, and in the technical standards issued for such effect.

II. That Article 7 of the Law on Supervision and Regulation of the Financial System establishes the entities subject to the supervision of the Superintendence of the Financial System.

III. That Article 35, letters d) and g) of the Law on Supervision and Regulation of the Financial System, establishes that directors, managers, and other officials holding positions of direction or administration in the members of the financial system are obligated to comply and ensure that entities adopt and update policies and mechanisms for risk management, including, among other actions, identifying, evaluating, mitigating, and disclosing them in accordance with international best practices. In such policies, measures to be adopted to prevent possible non-compliance with regulatory requirements and those to be adopted in the event of having incurred in them must be included, defining in both situations the parameters that will guide the action and the responsible parties for implementing them. Likewise, they must ensure that entities comply with the efficient functioning of information flow recording, processing, storage, transmission, production, security, and control systems.

IV. That Article 56, letter l) of the Banks Law, establishes that banks may conduct operations and provide services to the public through the use of automated equipment and systems, establishing in the respective contracts the bases for determining the operations and services whose provision is agreed upon; the means of user identification and the responsibilities corresponding to their use; and the means by which the creation, transmission, modification, or extinction of rights and obligations inherent to the operations and services in question are recorded. When these operations are carried out through standard form contracts, the models of said contracts must be previously deposited with the Superintendence, which may, through a reasoned decision, within a period not greater than thirty days from the date of deposit of the model, require the necessary changes when they contain clauses that oppose the legislation or when they are considered violative of the client's rights. In any case, the Bank will be obligated to explain to the client the implications of the contract prior to its subscription.

V. That Article 63 of the Banks Law and Article 41 of the Law on Cooperative Banks and Savings and Credit Societies establish that banks and cooperative banks, respectively, must elaborate and implement policies and control systems that allow them to adequately manage their financial and operational risks.

VI. That Article 155 of the Law on Cooperative Banks and Savings and Credit Societies establishes that Savings and Credit Societies will be subject to the provisions of the Banks Law, under the terms indicated therein, with the provisions established in Article 63 of the Banks Law being applicable.

VII. That Article 99 of the Law on Supervision and Regulation of the Financial System establishes that, by virtue of said Law, the Central Bank of Reserve is the institution responsible for the approval of the technical regulatory framework that must be issued in accordance with this Law and other laws regulating the supervised entities. In the fulfillment of this responsibility, the Central Bank of Reserve must ensure that the applicable regulatory framework for the financial system is periodically reviewed, seeking its timely update.

VIII. That in order to bring financial services closer to people, it becomes necessary for banking to penetrate through digital channels, which allows for a sustained adoption of new payment schemes, which constitute a dynamic and novel means for people conducting operations in the financial system, becoming a complement to the channels that use traditional instruments.

IX. That it is necessary to have technical standards that establish the conditions and requirements that financial institutions must observe to conduct operations and provide their services through digital channels, in concordance with international best practices and the specific characteristics of the Salvadoran market.

THEREFORE, by virtue of the normative powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES, to issue the following:

TECHNICAL STANDARDS ON CYBERSECURITY MEASURES IN DIGITAL CHANNELS

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- The object of these Standards is to regulate the cybersecurity measures of financial entities, through which information of the financial products and services that said entities offer to their clients in digital channels is collected, processed, transmitted, and stored. Likewise, the terms used in these Standards will have the same meaning established in the "Technical Standards for Information Security Management" (NRP-23).

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Banks constituted in El Salvador; b) Branches of foreign banks established in El Salvador; c) Savings and credit societies; d) Cooperative banks; (2) e) Federations formed by cooperative banks and also by savings and credit societies regulated by the Law on Cooperative Banks and Savings and Credit Societies; and (2) f) Investment banks, their offices abroad, and their subsidiaries. (2)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Affiliation or subscription: incorporation of financial products and services by the client, for the purpose of conducting operations or transactions in digital channels; b) Authentication: set of technological techniques and procedures used to verify the identity of a user of digital channels (1); c) Dynamic authentication: authentication method consisting of generating a code for an electronic payment medium, different in each transaction, and signing it with its private key; d) Static authentication: method consisting of generating a code for an electronic payment medium, during its personalization phase, which is recorded in its chip and never changes. It can be validated by a terminal; e) Mobile Banking: digital channel that uses a mobile device to access financial services and transactions associated with deposit accounts, credit lines, or simplified requirement savings accounts; f) Internet Banking: digital channel associated with deposit accounts, credit lines, or simplified requirement savings accounts, which uses a transactional portal to access financial services and transactions; g) Telephone Banking: digital channel associated with deposit accounts, credit lines, or simplified requirement savings accounts, which uses a telephone device to access financial services and transactions through calls to telephone service centers; h) Digital Channel(s): medium that allows the execution of transactions, the provision of financial services, and the exchange of information, such as ATMs, point of sales (POS), telephone banking, Interactive Voice Response (IVR), internet banking, mobile banking, among others; i) Access Key (PIN): personal identification number used to access services and financial operations through digital channels; j) Dynamic keys: cryptographic one-time keys, formed through a random sequence; k) Client: natural or legal person who maintains a contractual relationship with the Entity for the provision of one or more passive or active operations; l) Password or key: protected string of characters used to authenticate the identity of a user to authorize access to the use of digital channels; m) Sensitive data: confidential data of the client or user of electronic banking, such as: account number; personal identification number; client keys; card number; card security code; n) Disaffiliation: process by which clients request entities to disassociate the products and services offered by them, through digital channels; o) Self-service devices: electronic equipment offered to clients to perform banking operations that do not involve cash, such as kiosks, POS, among others; p) Entity/entities: subjects obligated to comply with these Standards according to Article 2 thereof; q) Additional factor: is the second factor or group of authentication factors that must be required of the client; r) Authentication factor: information used to verify the identity of a service or a person; s) Base factor: is the minimum factor required to
perform the initial authentication of the client; t) Identification: validation of the client's identity for the use of digital channels, through the use of data and information known by both the entity and the client; u) Threat intelligence: Information about threats that has been added, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes; (1) v) IVR: (Interactive Voice Response) is a telephone system capable of receiving a call and interacting with the human through voice recordings and the recognition of simple responses; (1) w) Repealed; (1) x) Electronic communication medium: electronic medium used for the transmission of messages from the entity to the client, or vice versa; (1) y) Non-repudiation: security method that allows proving the participation of parties in a communication, contemplating the following 2 aspects:
i. Non-repudiation at origin: the sender cannot deny that they sent it because the recipient has proof of the sending; and
ii. Non-repudiation at destination: the receiver cannot deny that they received the message because the sender has proof of the reception.
The origin or reception of a specific message must be verifiable by a third party of trust; (1) z) Transactional profile: set of characteristics associated with the transactional behavior of a client, according to the systematic analyses performed by the entity, to protect its clients; (1) aa) Payment schedules: is the authorization by the client for automatic debit in their bank accounts or authorization of charges on their credit cards; (1) bb) Superintendence: Superintendence of the Financial System; (1) cc) Token: electronic device used to facilitate the authentication process. It can be used for the generation of one-time passwords; as well as, for storing passwords, electronic signatures, or biometric data of the person; and (1) dd) Transactions: financial services and operations carried out through digital channels. (1)

CHAPTER II
ON CYBERSECURITY IN INFORMATION SYSTEMS

Cybersecurity Measures
Art. 4.- Entities must implement or update tools and mechanisms to monitor networks and other technological infrastructure that allows timely detection of security or cybersecurity events, unusual activity or behaviors, or lateral movements. These must also include threat intelligence to strive to stay informed about threats and indicators of compromise from other reliable sources.

Vulnerability Management
Art. 5.- Entities must have processes for vulnerability management that consider the identification, evaluation, treatment, and communication of security measures in the technological infrastructure, through the execution of penetration or intrusion tests and vulnerability scans. All security gaps must be remediated or mitigated, not only those classified as critical and high risk. Likewise, a methodology must be established to remediate all security gaps and not only those classified as critical and high risk. The latter must be remediated on a priority basis, implementation plans must be established, and respective follow-up must be carried out for the rest of the vulnerabilities, all of which must be duly documented.

Patch Management
Art. 6.- Entities must have agile processes to acquire, test, and install patches for technological infrastructure components, so that they remain updated; and avoid the use of applications, operating systems, and database managers without the support of the manufacturer or provider of security updates.

Multi-factor Authentication
Art. 7.- Entities must implement the use of multi-factor authentication in any user account that accesses through the Internet, and privileged accounts, including those that have a trust relationship, so that two or more additional layers of security are added to each online platform accessed. All related to multi-factor authentication of clients in digital channels is regulated in Chapter III of these Standards.

Identity Spoofing Protection Tools
Art. 8.- Entities must have tools to prevent identity spoofing against threats based on phishing, spam, spear-phishing emails, among others, and must consider the suitability of these tools, so that they are consistent with the size of the entity. Entities must have constant training programs on this type of threat for employees, emphasizing those who perform customer service functions.

Art. 9.- Entities must carry out financial education campaigns in which clients are made aware of the cybersecurity measures they must apply in the different digital channels they access.

Art. 10.- Entities must notify their clients of the official means through which they will communicate the products or services they offer.

Antimalware Tools
Art. 11.- Entities must have antivirus or antimalware programs and review them regularly to ensure they are adequate for their purpose, and are capable of detecting new threats, as well as reviewing configuration settings to guarantee the expected level of protection.

Mobile Device Management
Art. 12.- Entities must implement mobile device management solutions to ensure that entity data is protected.

Data Loss Prevention Tools
Art. 13.- Entities must have data loss prevention tools to have visibility into such events, so as to strengthen the detection and prevention of data exfiltration.

Encryption
Art. 14.- Entities must encrypt critical information at rest or in transit, even in removable and mobile storage devices, ensuring that the protocols used are secure.

AAA Protocols (Authentication, Authorization and Accounting) Art. 15.- Entities must have in their technological infrastructure protocols that perform the functions of user authentication; authorization and use of resources or services; and logging of user activity for respective follow-up.

Asset Management
Art. 16.- Entities must keep updated the inventory of critical information assets and identify the data and associated technology to prioritize actions, in concordance with what is regulated in the "Technical Standards for Information Security Management" (NRP-23).

Logging and Follow-up
Art. 17.- Entities must adapt systems and other components of the technological infrastructure to generate the capacity to have a record of information that allows active detection and investigation of incidents, ensuring that activity logs are available for analysis when necessary, in concordance with what is regulated in the "Technical Standards for Information Security Management" (NRP-23).

Cybersecurity Incident Response
Art. 18.- Entities must have response plans to mitigate the impact in the event of a cybersecurity incident. These plans must be tested to verify response capability and identify gaps timely, in concordance with what is regulated in the "Technical Standards for Information Security Management" (NRP-23).

CHAPTER III
ON CLIENT AFFILIATION, IDENTIFICATION, AND AUTHENTICATION THROUGH DIGITAL CHANNELS

Art. 19.- Entities that conduct operations and provide financial services through digital channels must inform their clients in writing or through electronic means, at the time of activating the use of the digital channel for the first time, at least the following:
a) Services offered and responsibilities for their use; b) Procedures for affiliation, cancellation, suspension, and reactivation of the service; c) Amount and transaction limits to be carried out in determined periods; d) Commissions and fees for use, with their respective description; e) Inherent risks of its use; f) Procedure to report any irregularity or potentially unrecognized or unauthorized activity that has been detected, whether by the client or by the entity; g) Procedure for handling client inquiries and complaints; h) Assumption of responsibilities by the client and the entity in situations of fraud; and i) Advice for proper use by the client.

Art. 20.- Regarding affiliation to financial products or services through digital channels, such as internet banking and/or mobile banking, entities may implement the acceptance of electronic contracts, using authentication factor category 2 referred to in Article 21 of these Standards. The above will be considered as the confirmation and authorization of use of services in digital channels.

Art. 21.- Entities must use multiple authentication factors to verify the identity of their clients to conduct operations through digital channels. Said authentication factors will be, as a minimum, 3, within the following:

Authentication Factor Category 1: Composed of information obtained from the client's contract and the use of products, services, or operations carried out by them through various channels. This information will be used by applying questions to the client through the Telephone Banking channel or other digital medium available to the entity. For this type of factor, entities must do the following:
a) Define in advance the questionnaires that will be applied for client identification and modify the questions contained in the questionnaires at least once a year; b) Establish random generators of questionnaire questions; and c) When an operator is involved, they must not know the answers in advance for client identification, which must be validated using computer systems.

Authentication Factor Category 2: Composed of passwords that only the client knows and enters through an access mechanism or device, which must meet, at least, the following characteristics:
a) Its minimum length and composition must be according to the following:
i. Four characters, for services offered through ATMs, point of sales, Telephone Banking, and IVR service;
ii. Eight characters, for digital channels and must include a combination of uppercase and lowercase alphabetic and numeric characters; and
iii. When the client modifies their password, the entity must validate that it does not repeat, with at least, twelve of the last passwords they used for those entities that are using only one authentication factor.
For the case of entities that use two authentication factors, it must validate that passwords do not repeat, with at least, five of the last passwords they used. b) Its expiration will not exceed one hundred and eighty days for all digital channels; nevertheless, entities are obligated to offer their clients free of charge the possibility of changing passwords when they require it. Each time the client modifies their password, they must be informed through their email or other means; (1)

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022 c) In the case of passwords assigned by the entity for access to digital channels, the client must be required automatically to modify it immediately after starting the first session; d) The entity must require that the first session be carried out at most twenty-four hours after the password has been generated by the entity; otherwise, it must be automatically disabled; and e) Under no circumstances may the following information be used as a password:
i. A client identification document;
ii. The name of the entity;
iii. More than three consecutive identical numerical or alphabetical characters; and
iv. Date of birth, first and last names, and telephone number, registered by the client with the entity.
Authentication Factor Category 3: It consists of single-use dynamic keys, generated by electronic devices or any other means, which must meet at least the following characteristics:
a) Have mechanisms that prevent their duplication or alteration; b) Once the dynamic key is generated, it will have the following validity:
i. Up to one minute, in the case of those generated by Tokens;
ii. Until logout, for digital channels; and
iii. Up to two hours, for all automated teller machine services.
c) Not be known before its generation or during its use, by officials, employees, representatives or third parties of the entity; and d) Random password tables may be used as an authentication factor for this category, provided they meet the characteristics listed in this authentication factor. In the case that entities can provide their clients with mechanisms, devices or means for generating dynamic keys, they must consider the following:
a) If the authentication is static, the validation of the data must be carried out in real time on the entity's central computers; and b) If the authentication is dynamic, the validation of the data may be carried out offline.
Authentication Factor Category 4: It consists of client information, derived from their biometric characteristics.
Art. 22.- The digital channel systems of the entities must require their clients for a login factor and must require a second factor of category 3 as referred to in Article 21 of these Standards.
These factors will be applied according to the following scheme:

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022
Type of operations
Factors to use
Base Additional
Affiliation and disaffiliation of products and services. 2 3 or 4 Use of products, services and payment schedules. 2 3 or 4 Payment of services, redemption of benefits, withdrawals or cash advances, disabling of products, generation and changes of passwords, or electronic transfers to third parties. 2 3 or 4 Opening of second accounts or financial products. 2 3 or 4 Update of client file data through Internet Banking or Mobile Banking and limits for transactions to be carried out 2 N/A Inquiries. 2 N/A Transactions offered through self-service devices. 2 N/A Payments or electronic transfers between the same holder and same bank. 2 N/A The authentication scheme by operations indicated in this article may not be required by the entities, in the case that they request authentication factors category 3 or 4 for the start of the session in their digital channels, the entity must, previously create the client identifier according to what is established in letter a) and the last paragraph of article 25 of these Standards. (1) Art. 23.- For service payment, benefit redemption, withdrawal or cash advance, product deactivation, password generation and changes, or electronic transfers to third parties operations that do not require the affiliation or registration of accounts, the additional factor referred to in article 22 of these Standards must be used. Art. 24.- For the use of the Telephone Banking service, clients must authenticate through the IVR with an authentication factor of at least category 2, as referred to in article 21 of these Standards. Art. 25.- To allow clients to log in through the services offered by digital channels, entities must request and validate at least the following:
a) A client identifier of at least six characters; and b) An authentication factor of categories 2 or 3.
The client identifier must be unique and will allow entities to determine all operations carried out by the client themselves through these channels.

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022
Art. 26.- Entities must immediately disable access to the services offered by digital channels when the client presumes that the security of the financial products contracted with the entity may be affected or has been affected and communicates this directly to the entity by any means, the entity must have different means, both in-person and digital, for these purposes. (2) Art. 26-A.- For cases of user account blocks in the digital channels offered by the entities to their clients, regardless of the reason, the entity must provide the client with different digital or analog alternatives for unlocking. These alternatives may include biometric identification, messaging applications, such as Whatsapp, email and telephone number of contact both local and international of the entity, among others, which allow guaranteeing the ownership of the credentials, in such a way as to facilitate the client's reactivation of their user in the corresponding digital channel and access to their bank account in the shortest possible time, endeavoring to safeguard at all times the security of their clients' information. This provision will not be applicable in the cases referred to in letters b), c) and d) of article 35 of these Standards. (2) Art. 27.- In digital channels, when applicable, entities must provide information to the client, according to the following:
a) Elements that identify that they are on the entity's website, before entering all authentication elements. For this purpose, they must use digital certificates or other mechanisms that allow authenticating the transactional site. Additionally, they may use that information that the client knows and has provided to the entity, or that they have indicated for this purpose, such as first and last names, images, among others; and b) Once the client verifies that it is the entity's website or official digital channel and starts a secure session, the following information must be provided in a prominent and visible manner:
i. Date and time of entry to their last session; and
ii. Client's first and last name.
Art. 28.- For the use of authentication factors, entities must comply, at least, with the following:
a) They must maintain procedures that guarantee the security of their clients' information during the generation, custody, distribution, assignment and replacement or substitution of said factors; b) They are prohibited from disclosing or accessing protected information related to authentication factors; in the case of information related to the category 1 authentication factor, any query must be supported by the client's request; c) They are prohibited from requesting, partial or complete, the information established in the authentication factors of categories 2 or 3 referred to in article 21 of these Standards; and d) They must inform their clients that the entity will not require them under any means and under any condition the information about their authentication factors. Art. 29.- Entities may establish additional authentication methods to those provided in these Standards for transactions carried out on digital channels. Art. 30.- With respect to the client's session, entities must guarantee the following:
a) End the session automatically in the following cases:
i. When inactivity reaches one hundred and eighty seconds in digital channels and up to five minutes for corporate banking;
ii. When the period of inactivity reaches a maximum of thirty seconds in operations carried out through automated teller machines, kiosks and points of sale; and
iii. When simultaneous sessions are detected;
b) For the case of login through Internet Banking or Mobile Banking, a message must be sent to the client, through the electronic means available to the entity, notifying about the start of the session; and c) Entities that offer links to third-party web pages through their website must communicate to their clients that, upon entering them, their security does not depend on nor is the responsibility of said entity.

CHAPTER IV
OF TRANSACTIONS, RESPONSIBILITY AND OBLIGATIONS OF THE ENTITY

Of the registration and settlement of transactions Art. 31.- Transactions carried out through digital channels must be treated and applied under the criteria established in letters j) and l) of article 18 of the Consumer Protection Law.

Confirmation of transactions
Art. 32.- Entities must generate an immediate confirmation to the client, regarding the transactions carried out through digital channels, through text messages to their registered mobile device or other electronic means, which will serve to determine that the same has been completed, except in those cases where the client has expressly stated not wanting to receive them, which must be duly documented by the entity.

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022
Likewise, they must send via electronic notification which must include, at least the date, time, type of product, type of transaction, reference number and amount of the operation. In case the transaction is not successful, a message must be sent to the client notifying that the requested transaction was not completed. In each transaction they carry out, they must implement non-repudiation mechanisms.

Monitoring of transactions
Art. 33.- The entity must have information on the number and amount of transactions carried out by client and type of product, through digital channels, monitoring as well, the compliance with the limits and other prudential measures that have been established, depending on the product or service in question, and identifying in real time possible unusual, irregular or suspicious operations according to the client's profile and the usage habits of their financial products and services, generating the corresponding alerts on such operations. Likewise, entities must notify clients immediately of the alerts associated with operations carried out through digital channels, which deviate from the client's transactional profile, determined in a timely and automatic manner by the entity, through the means it deems appropriate for the client. The notification must be made as long as there is no notice from the client that allows reasonably relating the operations that generated the alert. The notification or message sent must describe at least the date and time of the transaction, the amount of the operation, the transaction reference number, the name and telephone number of the entity, the channel used, the type of product and operation. The transaction monitoring referred to in this article must be carried out by the entity through robust computer tools, specialized in fraud prevention. Art. 34.- Entities must ensure that IVRs, or any other electronic means facilitated by the entity, allow the client to access options to report, expeditiously, the presumed fraudulent or unrecognized transactions or operations and obtain immediate assistance to their claim, for which they must establish specific processes with properly trained personnel who provide timely attention to their clients. Art. 35.- Entities must establish automatic processes and mechanisms to preventively block access to any of the digital channels, in the following cases:

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022 a) When it is detected entering the digital channel, using incorrect authentication information. Ensure that failed access attempts do not exceed the quantity of three consecutive attempts for the block of this; b) When the monitoring systems detect unusual or irregular transactional behavior according to the client's profile; c) When the security systems detect a computer attack that compromises the data or information of the clients; and d) When there are situations that compromise the security of the information systems and the client. Art. 36.- When the technological platform that supports the digital channels does not detect fraudulent operations, as well as unsolicited or unperformed transactions by the client, and that according to the analysis carried out by the entity, said cases are not attributable to the client, the entities will be responsible for reintegrating, compensating or reversing the amounts compromised, without this including the charging of commissions or additional surcharges for this. Additionally, they must keep at the disposal of the Superintendence the reports or statistics that result from these events. Art. 37.- Entities must define monitoring and control mechanisms to ensure the proper functioning of digital channels. Customer Service Art. 38.- Entities must make available to the client a mechanism that allows the following:
a) Obtain the history of transactions carried out which will include at least the reference number, amount, date, time, type of transaction, type of product; and b) A procedure to define a new key or password.
Likewise, entities will provide their clients with a telephone number and other alternative contact means, such as email, for permanent communication with the entity, including due technical support.
The entity will establish adequate mechanisms and procedures that operate twenty-four hours a day, every day of the year, to attend to client claims regarding their transactions, specifying the official means of receiving them, having to resolve within a period that cannot exceed that established for the different products and services in the current legislation. In the case that there is no specific period in the current legislation, these must be resolved within a reasonable period, which must be established in the procedure for attending to claims. In any case, said procedure must incorporate internal controls on the attended queries and responses provided.

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022
Entities must inform their clients, through educational campaigns, about the functioning of the digital channels that they make available to them, in order to prevent acts that could result in irregular or illegal operations that affect clients or the entities themselves.

CHAPTER V
OTHER PROVISIONS AND VALIDITY
Of internal audit
Art. 39.- The Internal Audit Unit must consider in its annual work plan, the evaluation of compliance with the provisions of these Standards.
Technical details of information sending
Art. 40.- The Superintendence will send to the entities, within a maximum period of thirty days after the date of entry into force of these Standards, with a copy to the Central Bank, the technical details related to the sending of the required information. The information requirements will be limited to the collection of information as regulated in these Standards.

Sanctions
Art. 41.- Non-compliance with the provisions contained in these Standards, will be sanctioned in accordance with what is provided in the Law on Supervision and Regulation of the Financial System.
Transitory
Art. 42.- Entities obliged to comply with these Standards, will have a maximum period of thirty business days after the entry into force of the same, to comply with what is established in articles 19 and 38 of these Standards.
Art. 42-A.- To comply with the provisions established in article 26-A of these Standards, entities will have a maximum period of three months from the entry into force of said article. (2) Unforeseen aspects Art. 43.- Aspects not provided for in regulatory matters in these Standards, will be resolved by the Central Bank through its Standards Committee. Validity Art. 44.- These Standards will enter into force from the day 8 of March two thousand twenty-two.

NRP-32
DIGITAL CHANNELS
Approval:
21/02/2022
Validity: 8/03/2022
MODIFICATIONS:
(1) Modification to articles 3, 21 and 22, approved by the Central Bank through its Standards Committee, in Session No. CN-11/2022 of date 30 of December two thousand twenty-two, with validity from January 16 two thousand twenty-three. (2) Modifications in articles 2 and 26 and incorporation of articles 26-A and 42-A, approved by the Central Bank through its Standards Committee, in Session No. CN-09/2025, of November 10 two thousand twenty-five, with validity from November 25 two thousand twenty-five.