Technical Standards on Obligations of Risk Rating Agencies

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 19

THE STANDARDS COMMITTEE OF THE CENTRAL RESERVE BANK OF EL SALVADOR, CONSIDERING: I. That Article 93, second paragraph, of the Securities Market Law, establishes that entities providing rating services must update and make public their ratings. II. That Article 95-A, first paragraph, of the Securities Market Law, establishes that risk rating agencies must continuously review the ratings they issue, in accordance with the information provided by the issuer or available to the public. III. That Article 95-E of the Securities Market Law, establishes that persons and entities participating in risk ratings must exercise care and diligence in the performance of their duties. IV. That Article 95-F of the Securities Market Law and Article 7, letter f), of the Law on Supervision and Regulation of the Financial System, establish that risk rating agencies are subject to the supervision of the Superintendency of the Financial System, which may request information or background related to the compliance of their functions. V. That Article 88 of the Investment Funds Law, establishes that the Central Reserve Bank of El Salvador will issue technical standards on the minimum legal and financial aspects that risk rating agencies must consider in their investment fund classification reports, as well as the frequency with which such ratings will be updated. (1) VI. That Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System, establishes that the proper functioning of the Financial Supervision and Regulation System requires members of the financial system to adopt the highest standards of conduct in the development of their business, acts, and operations, in accordance with what is established in said Law. VII. That Article 35, first paragraph, letter b), of the Law on Supervision and Regulation of the Financial System, establishes that directors, managers, and other officials holding positions of direction or administration in members of the financial system must conduct their business, acts, and operations complying with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply and ensure that legal, regulatory, and normative provisions regulating the activity of members of the financial system are fulfilled in the institution they direct or work for.

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 19

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following:

TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object Art. 1.- These Standards aim to establish provisions on the manner in which rating agencies, registered with the Superintendency, must provide their services for the risk classification of securities subject to public offering and Investment Funds, in compliance with applicable regulation and standards of conduct in the development of their business, acts, and operations. (1)

Subjects Art. 2.- The subjects obliged to comply with these Standards are risk rating agencies authorized by the Superintendency of the Financial System.

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Rating Council: Risk Rating Council; b) Fund: Investment Fund, those constituted in El Salvador and registered with the Superintendency of the Financial System; (1) (2) c) Manager: Investment Fund Management Company; (1) d) Market Law: Securities Market Law; e) Participant: Investor in an Investment Fund; (1) f) Registry: Public Stock Registry of the Superintendency of the Financial System; g) Rating Agency: Risk Rating Agency; and h) Superintendency: Superintendency of the Financial System.

CHAPTER II CLASSIFICATION METHODOLOGIES AND CATEGORIES

Classification Methodologies Art. 4.- Rating agencies, to provide the service of assigning risk ratings to issuers, securities issues, and Funds registered in the Superintendency's Registry, must do so based on classification methodologies that guarantee the obtaining of ratings that clearly reveal the risks assumed by the issuer, its issues, and the Fund, through an objective and independent evaluation and analysis, and that comply with the minimum provisions defined in these Standards. (1) Fund risk ratings must reflect, according to the investment object of the Fund in question, the risks of the assets comprising said Fund and the operations it carries out, as well as the quality of administration of the respective Manager. (1)

Art. 5.- The methodologies used by rating agencies must comply, among other things, with the following aspects: a) Be documented in procedure manuals, in which the description of the qualitative and quantitative aspects on which the analysis performed according to the approved methodology is based, for each type of security, entity, or Fund, is incorporated rigorously and systematically; (1) b) Be approved by the Rating Council; c) Contain parameters relative to each of the risk categories according to the Market Law and these Standards. In the case of Funds, the provisions established in the second paragraph of Article 8 of these Standards shall be considered; (1) d) Be submitted to an internal validation process; which considers historical experience, when information is available for this purpose, by comparing the estimates made with those actually observed in previous periods; and e) Be subject to an internal review and update process, with a minimum frequency of two years, on the methods, theoretical, mathematical, or statistical models applied, as well as the suitability of their application for the analysis of new financial products or entities. The Superintendency may at any time make observations on the documents referred to in this article, in case the provisions of the Market Law and these Standards are not met.

Modifications to Methodologies Art. 6.- Modifications to the methodologies, models, and criteria used for granting a rating must: a) Be approved by the Rating Council; b) Be disclosed prior to their implementation, through the same medium in which the original methodology is available; and c) Identify and clearly disclose on their websites the ratings granted that will be affected by the approved modifications and those that are under review.

Art. 7.- When, for technical reasons, there are modifications to the methodologies used, rating agencies must review the current ratings granted based on such changes, issuing the corresponding update reports in the following period, based on the modified methodology.

Risk Classification Categories Art. 8.- The risk categories for debt securities shall apply based on those established in Article 95-B, and for participation securities, those established in Article 95-C, both of the Market Law. For the classification of Funds, rating agencies shall establish their own classification categories, including in their classification reports the definition thereof, which must be communicated to the Superintendency. The categories cannot be used for other purposes and shall refer only to the classification of Funds registered with the Superintendency. (1) For the classification of entities that are the subject of classification, the following categories must be applied:

CATEGORY	MEANING OF THE CATEGORY
EAAA	Corresponds to entities that have the highest capacity to pay their obligations on the agreed terms and deadlines, which would not be affected by possible changes in the entity, the industry to which it belongs, or the economy. Risk factors are insignificant.
EAA	Corresponds to entities that have a very high capacity to pay their obligations on the agreed terms and deadlines, which would not be affected by possible changes in the entity, the industry to which it belongs, or the economy. Protection factors are strong, risk is modest.
EA	Corresponds to entities that have a good capacity to pay their obligations on the agreed terms and deadlines, but this is susceptible to slight deterioration in the event of possible changes in the entity, the industry to which it belongs, or the economy. Protection factors are satisfactory.
EBBB	Corresponds to entities that have a sufficient capacity to pay their obligations on the agreed terms and deadlines, but this is susceptible to weakening in the event of possible changes in the entity, the industry to which it belongs, or the economy. Protection factors are sufficient.
EBB	Corresponds to entities that have the capacity to pay their obligations on the agreed terms and deadlines, but this is variable and susceptible to deterioration in the event of possible changes in the entity, the industry to which it belongs, or the economy, potentially incurring delays in the payment of their obligations. Protection factors vary widely with economic conditions and/or the acquisition of new obligations.
EB	Corresponds to entities that have the minimum capacity to pay their obligations on the agreed terms and deadlines, but this is very variable and susceptible to deterioration in the event of possible changes in the entity, the industry to which it belongs, or the economy, potentially incurring loss of their obligations. Protection factors vary very widely with economic conditions.
EC	Corresponds to entities that do not have sufficient capacity to pay their obligations on the agreed terms and deadlines, with a high risk of loss thereof. There is a substantial risk that contractual obligations will not be paid on time.
ED	Corresponds to entities that do not have the capacity to pay their obligations on the agreed terms and deadlines, and that present effective default thereof, or request for dissolution, liquidation, or bankruptcy in progress.
EE	Corresponds to entities that do not have sufficient information or that it is not representative, which does not allow issuing an opinion on their risk.

Art. 9.- Within a classification scale, the signs “+” and “-” may be used to differentiate instruments with higher or lower risk within their category. The “+” sign indicates a lower risk level, while the “-” sign indicates a higher risk level.

Art. 10.- Rating agencies may incorporate in the categories indicated any other information that allows for better identification of the entity being rated or the country abbreviations corresponding, using parentheses or any other form of identification, expressing their meaning in the footnote. The aforementioned abbreviations must be of smaller size than those assigned in the classification category.

Art. 11.- Foreign rating agencies authorized to operate in the country must harmonize their methodology and risk rating opinions using the nomenclature and guidelines established in Articles 95-B and 95-C of the Market Law and these Standards.

CHAPTER III CLASSIFICATION REPORTS

Minimum Content of the Risk Classification Report Art. 12.- The risk classification report for issues and entities shall contain, at least, the following: a) Generalities of the risk classification: i) Name of the issuer or entity, with its mnemonic code, if any; ii) Date of the Rating Council meeting that gave rise to the agreement; iii) Current and previous classification, if the latter is available; iv) Outlook; v) Reference to the closing period of the financial statements that served as the basis for the analysis, indicating whether they are audited or not; vi) Description of the meaning of the assigned risk category, in accordance with Articles 95-B, 95-C of the Market Law and these Standards; and vii) In the case of issues, detail the main characteristics such as: denomination, type of security, currency, amounts, deadlines, guarantees, series or tranches. b) Names of the analysts who participated in the preparation of the risk classification analysis; c) Synthesis of the basis that served to assign the classification and the outlook; d) General background of the issuer; e) Comprehensive financial and economic analysis of the issuer, including the evaluation of relevant financial ratios and, when applicable, analysis of the flows that will serve for the fulfillment of the issue's commitments; f) Analysis of the general economic and sectoral environment, including when applicable, among other aspects: economic risk, industry risk, short-term perspectives, and market position; g) Analysis of relevant qualitative factors of the issuer, among others, management quality, organizational structure and functions, policies and mechanisms for risk management, strategic planning, internal controls, and good corporate governance practices; h) Analysis of the structure, characteristics, and conditions of the issue; and i) Identification of the sources of information used for the analysis, indicating in a prominent manner whether the rating agency considers the quality of the existing information on the entity or financial product analyzed to be satisfactory and to what extent they have verified the information facilitated by said entity or third parties. In any case, the report and its updates must clearly incorporate the elements or aspects that are considered key to directly or indirectly influence the rating granted. However, when the Superintendency has knowledge that informative elements that could influence the risk classification have not been included, it may request the risk rating agency to communicate the reasons why they have not been included or the update performed; it may require the rating agency to initiate a review of the opinion.

Classification of Asset-Backed Securities Funds Art. 13.- When it comes to risk classification reports for issues issued by Asset-Backed Securities Funds, in addition to what is established in Article 12 of these Standards, the following aspects must be analyzed additionally: a) The quality of the securitized assets in terms of factors such as: credit quality, diversification, capacity to generate periodic flows, concentration or atomization, origination methods, administration, and collection; b) The risks stated in the draft securitization contract, including those derived from the originator; and c) The collateral or coverages that back the issues issued by the Fund.

The report must indicate whether the rating agency has carried out an evaluation of the structuring and the underlying assets directly or if it has relied on the analysis of a third party, and indicate how the result of that analysis influences the classification.

Classification of Investment Funds Art. 13-A.- The preparation of the risk classification report for Funds, in addition to considering, where applicable, what is established in Article 12 of these Standards, must take into consideration as a minimum the following aspects: (1) a) Fiduciary risk of the Manager, that is, the evaluation of the administration, the operational management of the Fund, and the degree of adherence to the investment policies defined by the Manager, in accordance with what is established in Article 13-B of these Standards; (1) b) Evaluation of the Fund's portfolio, that is, the evaluation of the assets comprising the Fund, diversification, level of protection of the investment portfolio against losses associated with credit risk and market risk, in accordance with what is established in Article 13-C of these Standards; and (1) c) In the case of Closed Real Estate Funds, the evaluation of the geographic area, the situation and perspective of both the real estate sector and the type of properties where the Fund invests. When applicable, the singular conditions of the assets held by the Fund must be included, among others. (1) For Funds that are in the stages of constitution and start of operations, the analysis will focus on the Manager's management capacity, the clarity and precision of the objectives, documents contained in the Fund's regulations and prospectus; investment policies, among others that the rating agency deems necessary to consider and that allow it to issue an appropriate opinion regarding the risk and type of assets that the Fund will incorporate once its investment process begins. (1)

Art. 13-B.- Rating agencies, in order to classify the quality of the Manager's administration, must contemplate as a minimum the following aspects: (1) a) Structural considerations of the entity such as its organization, financial solvency, market presence, technological capacity, internal control systems, corporate governance analysis, and contingency plans; (1) b) Track record and experience of officials holding key positions in the entity; (1) c) Degree of independence and segregation of functions between different areas, as well as the administration of conflicts of interest and transparency policies; (1) d) Mechanisms that guarantee the independence of decisions regarding the Fund in relation to the conglomerate or business group; (1) e) Existence of policies and procedures for investment management, identification and administration of risks, and valuation of the investment portfolio; (1)

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 8 of 19

f) Evaluation of the different areas involved in the formulation of policies, procedures, and control, with emphasis on their composition, frequency of analysis, reports produced, and level of responsibilities; (1) g) Financial statements used as the basis for the analysis, indicating whether they are audited or not; and (1) h) Compliance with policies and regulation applicable to the Manager. (1)

Art. 13-C.- Risk rating agencies, in order to classify the risks of the Fund and its constituent assets, must consider at a minimum the following aspects: (1) a) Amount of assets managed by the Fund and number of participants; (1) b) Quality, diversification, degree of liquidity, and valuation of the asset portfolio; (1) c) Clarity of the investment process and information provided to participants; (1) d) Historical performance of returns and risk indicators according to the type of Fund and assets; (1) e) Compliance with the objective, strategy, policy, and investment limits; (1) f) Evaluation of risks and the management thereof; (1) g) Financial statements used as the basis for the analysis, indicating whether they are audited or not; and (1) h) Level of indebtedness of the Fund. (1)

Risk rating agencies must take into account market risk, that is, the relative sensitivity of the Fund to changes in market conditions. The analysis of market risk must consider aspects such as interest rate risk, liquidity risk, currency risk; the use of derivative instruments for hedging, and the evaluation of the Fund's indebtedness. (1)

Additionally, the level of protection of the investment portfolio against losses associated with credit risk must be evaluated, based on the probability of counterparty default and the risk diversification of the portfolio, the sufficiency of the Fund's liquidity, and the skills and management policies to generate profits and limit exposure to losses. (1)

Classification of securities intended for the financing of infrastructure works with State participation (2)

Art. 13-D.- Risk rating agencies, in order to classify the risks of securities intended for the financing of infrastructure works that have the participation of the State through any dependency of the Central Government, autonomous institutions, municipalities, or in accordance with the Special Law on Public-Private Partnerships, must consider, in addition to what is established in Article 12 of these Standards, the specific requirements of Articles 13, 13-A, and 13-C of these Standards, in accordance with the type of security involved, the following: a) Characteristics of the security and its structuring; (2) b) Guarantees associated with the issuance of the securities; (2) c) Analysis of the economic environment; and (2)

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 9 of 19

d) Management of risks associated with the development of the infrastructure work, such as: legal risks, operational risks, and other risks associated with the development of the project. (2)

Responsibility for analyzed information

Art. 14.- Risk rating agencies must require issuers of securities and Managers who request their risk rating services to provide the necessary information for their analysis based on the terms and deadlines defined in the contract and in accordance with the requirements established by the Market Law for registration purposes. (1)

Art. 15.- The rating agency must have internal mechanisms that ensure that the ratings granted are obtained based on the information provided by the issuer and the Manager, as well as information obtained from own sources or third parties, clearly identifiable and duly documented. (1)

Responsibility of the Risk Classification Council's opinion

Art. 16.- Risk rating agencies must incorporate into their reports what is stipulated in the second paragraph of Article 92 of the Market Law, regarding the responsibility of the opinion issued by the Classification Council.

Minimum content of the classification minutes

Art. 17.- The agreements of the Classification Council must be recorded in a minutes book in accordance with what is established in Article 89-A of the Market Law, which must contain at a minimum the following: a) Date of the meeting and serial number of the session held; b) Place where the meeting is held; c) Specify whether the session is ordinary or extraordinary; d) Deliberations and agreements taken; e) Name of the technical personnel who participated in the determination of the risk classification; f) Reference to the classification criteria and models that are considered as important components in the methodology approved for the determination of the risk classification, and in case there is a difference between the classification resulting from the application of the classification criteria and models corresponding to the methodology with the final classification granted, include arguments for the corresponding justification; g) Reference to the technical documents that served as the basis for the decision; and h) Name and signature of the members of the Classification Council who were present.

Unregistered entity

Art. 18.- In the case that a risk rating agency performs a risk classification on an entity not registered in the Registry, the respective risk classification report must legibly express, at the bottom of the page on each of the sheets that form part of the classification report, the following phrase: UNREGISTERED ENTITY IN THE REGISTRY OF THE SUPERINTENDENCE OF THE FINANCIAL SYSTEM. Additionally, the classified entity, in case of publicly using such classification, must include the aforementioned phrase in its advertising.

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 10 of 19

Risk classification report

Art. 19.- Risk rating agencies are obligated to update the risk classification of issuers, securities issuances, and Funds, on a semi-annual basis, and must send the risk classification report in electronic and physical format to the Superintendence no later than April 30 and October 31, based on the financial statements of December 31 and June 30, respectively. (1)

Risk rating agencies that issue risk classifications on foreign issuers are obligated to update the classification semi-annually, and must send the classification report in electronic and physical format to the Superintendence no later than sixty days after the date on which the issuers have their audited financial statements, updating the assigned classification and issuing a new classification report six months after the dates of the assignment of the classification and issuance of the referred report, based on the available financial statements.

The risk classification report to be issued by the rating agency on April 30 must be based on audited financial statements as of December.

Risk rating agencies must send the classification report to the respective stock exchange, within the same deadlines defined in this article by the means it requires.

Current classifications and updates

Art. 20.- Risk rating agencies must disclose no later than the last business day of the months of June and December, the risk classifications for issuers, public offering securities issuances, and Funds current as of those dates, through their website and be communicated electronically to the market and the Superintendence simultaneously. (1)

The foregoing is without prejudice to the updates that may be necessary, as a result of the constant monitoring of entities, their issuances, and Funds, and that are approved in extraordinary meetings of the Classification Council; therefore, when the risk rating agency has knowledge of facts that could, by their nature, alter the foundations of the classification granted, it must initiate a review process and inform the Superintendence on the next business day of the initiation of the review process, regarding the entities, products, or values, and Funds being analyzed and the estimated date on which an agreement on the review is expected to be taken. (1)

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 11 of 19

CHAPTER IV SUBMISSION AND DISCLOSURE OF INFORMATION

Disclosure deadline for ratings granted

Art. 21.- The rating agency must electronically disclose the ratings granted by the Classification Council, within a maximum period of three business days following the corresponding agreement.

Submission of reports and classifications

Art. 22.- The reports and disclosure of classifications referred to in Articles 19 and 20 of these Standards must be published by the rating agency, through its website; within the same deadline as they are sent to the Superintendence. (1)

Minimum information available on websites

Art. 23.- Risk rating agencies must make the following information available to the public on their websites at a minimum: a) Information on the ratings granted to issuers, public offering securities issuances, and Funds, while the same remains valid. The available information must incorporate historical information on the ratings granted, so that the investing public can understand the historical behavior of each and its variations over time, and must indicate at a minimum: name of the issuer or designation of the issuance, name of the Manager and the Fund, initial classification granted and its updates including approval dates, perspectives, and observation periods of the classification; (1) b) Sufficient information about their procedures, methodologies, and assumptions so that third parties can understand how the rating agency took the decision of the classification assigned; it may also publish educational material about the service provided; c) Information on the classification categories used, so that the meaning of each of them can be clearly understood; d) Information on the internal procedures and code of conduct approved by the Board of Directors of the company; e) Information on the human resources participating in the risk classification analyses, including at a minimum academic training and professional experience of each of them and the country in which they reside, in the case of companies with offices abroad; and f) Information on the suspension or cancellation of a classification service contract of the issuer, public offering securities issuance, or the Fund. The referred communication must include the classification and date of its last update, as well as the reasons why the classification service is suspended. (1)

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 12 of 19

Update of the registry

Art. 24.- The information required for the Registry of the rating agency, administrators, members of the Classification Council, permanent representatives, must be kept updated, informing any change that occurred to the Superintendence, electronically within a maximum period of three business days following the occurrence of the event that generated the change, and must present the formal documentation within a maximum of five business days following.

Art. 25.- Risk rating agencies must send their financial statements to the Superintendence quarterly, within thirty days following the closing date. The annual audited financial statements must be sent within sixty days following the closing date of the accounting period.

CHAPTER V QUALITY OF CLASSIFICATION PROCESSES

Quality and integrity of classification processes

Art. 26.- For the purpose of guaranteeing the quality and integrity of the ratings granted, the directors and administrators of rating agencies will be responsible for: a) Adopting procedures, methodologies, or classification criteria that guarantee the obtaining of objective and independent classifications, based on the adequate and technical analysis of all relevant information for the classification process; including the procedure for the periodic review of the same, with the object of evaluating the suitability of their application for the analysis of new financial products or entities; b) Implementing procedures for the issuance and disclosure of risk classifications, as well as internal mechanisms that allow continuous and permanent monitoring of the financial variables of the entity, the environment, or the Fund, as well as other foundations that were considered for the granting of the risk classifications, such that, if the result of their review causes a change in the granted risk classification, it is capable of issuing a timely update of the same and informing the market and the Superintendence, in accordance with the deadlines and means defined in these Standards; (1) c) Ensuring that they have human resources with integrity, knowledge, and appropriate experience for the issuance of classification opinions by type of entity, instrument, and Fund, for which they must have hiring and training policies and procedures, in which the integrity and quality or technical or professional capacity of the people they hire is verified, in accordance with the requirements defined in the Market Law and the minimum knowledge and experience established by the rating agency itself, in matters of operation and functioning of the entity, or of the functions to be performed. (1) The entity must conserve the documentation related to hiring, including that which demonstrates the experience and suitability of the hired person, or in the absence of these, include a reasoned opinion signed by the General Manager, in which the manner in which they ensured the capacity or technical quality of the corresponding person is indicated; d) Ensuring the rigorous and consistent use of the classification methodologies approved by the Classification Council as well as the continuity in the criterion applied for the granting of

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 13 of 19

the same, avoiding discrepancies in the classifications issued, for which they must have procedures to prepare a work file for each classification, so that it is complete, detailed, and referenced with the methodology and models used, to provide a comprehensive understanding of the analysis and the reference between this file and the final report of the Classification Council; e) Providing sufficient information to investors and participants about the classifications issued by the company and the quality of the service provided. The level of detail of the information must be sufficient, so as to allow investors and participants to understand the objective and purposes of a classification granted and to make their investment decisions; (1) f) Maintaining as part of their internal records, a register of the ratings granted, whether private or public, in which all actions taken are also shown, including the information indicated in Article 23 letter a) of these Standards; g) Permanently maintaining in the Republic of El Salvador, at least one representative with broad and sufficient powers in administrative and technical matters, to perform all acts and contracts that must be celebrated and take effect in the national territory; the power granted to the representative must clearly and precisely express that the represented entity obligates itself to respond unlimitedly inside and outside the country for the acts that are celebrated and contracts that are signed in El Salvador; and h) Having adequate facilities and that the offices have a domicile in the country.

Art. 27.- The internal procedures for the issuance of classifications must include all stages and activities to be carried out, with their respective participants and responsible parties, as well as the dissemination stage. In the referred process, a stage must be considered that allows the issuer, the Fund, and the Manager to know in advance the classification to be issued and that, if necessary, can provide complementary information for the analysis and final granting of classification. (1)

Additionally, they must have an internal procedure to monitor the assigned classifications quarterly, for which they must adequately document such review and, if necessary, carry out the corresponding updates.

Art. 28.- Risk rating agencies must include a procedure for handling inquiries received regarding classification reports, in which the official means of receipt of the same is established, whether electronic or physical; which may not exceed five business days, or the delay must be justified in case of exceeding the deadlines defined by the rating agency itself. In any case, such procedure must incorporate internal controls on the inquiries attended and responses provided.

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 14 of 19

CHAPTER VI INDEPENDENCE AND MANAGEMENT OF CONFLICT OF INTEREST

Internal policies to ensure independence and management of conflict of interest

Art. 29.- Risk rating agencies must have procedures, controls, and internal policies that ensure independence and the management of conflicts of interest during the classification process, such as: a) Administrative procedures in which the organizational structures are clearly defined, and functions and responsibilities are assigned to ensure that the commercial interests of the company do not affect the accuracy of the risk classifications issued, and that also allow, operationally separating, the activities carried out in the classification procedure and the analysts involved in the same, from any other service provided by the rating agency; b) Policy of rotation of analysts assigned to the classification process with the same classified entity; c) Internal control procedures that ensure compliance with decisions and procedures at all levels; d) Procedures for the adequate management of conflicts of interest at internal and external levels, that guarantee that the ratings granted are not affected by conflicts of interest, whether real or potential, and that include the timely dissemination to the market and the Superintendence of the emergence of the same, as well as the internal control of significant threats identified to the independence of the opinions to be issued; and e) Risk management procedures, including control mechanisms that ensure continuity and regularity in the performance of their functions, and provide security to the information processing systems.

Art. 30.- Risk rating agencies, their directors, members of the Classification Council, or Managers, may not acquire securities from issuances or participation quotas of Funds from companies in which they have any type of interest, in accordance with what is stated in Article 95 of the Market Law. (1)

Art. 31.- The directors, administrators, shareholders, and members of the Classification Council, as well as the technical personnel or analyst of the risk rating agencies, must inform the Superintendence about their direct or indirect participation in the share ownership of any Salvadoran company, within a maximum period of three business days following the occurrence of such circumstance.

Art. 32.- Risk rating agencies must send to the Superintendence, together with the update reports, a sworn declaration in which they manifest whether or not there are persons with interest in any of the entities to which they provide the classification service, in accordance with what is specified in

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 15 of 19

Article 95 of the Market Law. In any case, the administration must adopt measures to ensure that such conflicts of interest do not affect the rating to be granted.

CHAPTER VII CODE OF CONDUCT Handling of Confidential Information Art. 33.- Risk rating agencies must adopt procedures for the handling of confidential information, which ensure the exclusive use of information in aspects related to analysis for ratings and avoid the fraudulent use of such information, such as price manipulation and insider trading abuse, among others. Such policies must be consistent with the guidelines established in the agency's code of conduct.

Code of Conduct Art. 34.- Risk rating agencies must have a code of conduct that will govern the actions of the risk rating agency and the members of the board of directors and other executives or technical personnel involved in the granting of risk ratings, in order for such activities and relationships to be conducted in an equitable, honest manner and in compliance with sound market practices. This code must provide behavioral rules, at a minimum, for the following aspects:

a) Integrity standards for employees and directors of rating agencies, to guarantee fair and honest treatment with market participants and the public and to avoid coercive or abusive practices, such as the following:

i) Conditioning the risk rating opinion to the contracting of any other service or product of the same entity or related entity; ii) Altering the rating granting process, in order to issue a higher or lower credit rating to punish or favor other interests; and iii) Issuing rating reports containing ambiguous or imprecise information about an entity, Funds, products, or securities, which may mislead or confuse investors or participants. (1)

b) Prohibited behaviors of employees, directors, and shareholders that could produce conflicts of interest and affect the independence and objectivity of analyses and opinions issued, such as the following:

i) Acquisition of securities of rated entities; ii) Acquisition of participation shares of rated Funds; (1) iii) Acceptance of any type of gifts or favors from entities subject to rating; iv) Providing opinions or making decisions on ratings granted, based on the effect on investors or other market participants; v) Linking staff remuneration to the economic results of the agency;

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 16 of 19

vi) Sharing confidential information about rated entities and Funds with internal or external personnel of the agency; outside the corresponding analysis process; (1) vii) Failing to timely disclose personal, professional, or other relationships with rated entities; viii) Participating in the analysis and determination of ratings of an issuer, issuance, or Fund, of which they have any personal or business interest; (1) and ix) Providing consulting, advisory, proposal, recommendation, or other services to a client of the risk rating agency.

c) Transparency practices in activities carried out by the agency, such as:

i) Timely and complete disclosure of ratings granted, and their updates; ii) Periodically evaluate compliance with the policies and methodologies used for the issuance of ratings; and iii) Maintain complete control and backup of the documentation used to issue opinions and the analysis and decision-making process thereof.

d) Employee behaviors that ensure the protection of information and records in possession of the agency from fraud, theft, or misuse; whether information about entities, instruments, or Funds analyzed at the time or in the past. (1)

e) Principles of conduct and disclosure, for employees regarding acceptance of employment with entities that have been the subject of rating or entities related to them.

Art. 35.- The code of conduct must also include a clear procedure that allows for the reporting of illegal conduct or violations of the code's provisions, either by employees or third parties, without retaliation for those who, in good faith, file a report.

The aforementioned code must be approved by the Board of Directors of the agency and be available to the public on their websites, and if any of the aspects is not implemented, the reasons why it has not been implemented must be disclosed through the same medium.

CHAPTER VIII SERVICE CONTRACTING PROVISIONS Contracting of Rating Services Art. 36.- Risk rating agencies will communicate to the Superintendence about a new rating contract, as well as the modification or termination of an existing one, within five business days following the date on which any of these circumstances are finalized.

The communication must indicate the following:

a) Name of the entity that will contract the risk rating agency or that settles its contract; b) Type of rating: Fund, entity, security, or both; (1) c) Amount of the issuance; d) Amount of the contract; e) Use of requested rating: public or private;

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 17 of 19

f) Date of celebration of the contract; and (1) g) Date from which the service will begin and end. (1)

Art. 37.- For the celebration of a new contract, the risk rating agency must ensure that it has suitable human and technical resources to provide the rating service for the issuer, issuance, or Fund on which the contract is being made, in accordance with the quality and integrity characteristics required in these Standards. (1)

Art. 38.- Contracts that risk rating agencies enter into with their clients must consider the following aspects:

a) The purpose for which the rating is obtained; b) Clear provisions on the private or public use that the applicant will give to the rating granted, defining the conditions for a rating requested as private to be used as a public rating; c) The client's commitment to provide, in a timely manner, the information requested by the risk rating agency, so that the latter is in a position to grant and update the rating granted; d) The authority of the risk rating agency to request information from the client about ratings previously granted by other risk rating agencies when it concerns the same issuance, same issuer, or same Fund, for which it is being contracted; and (1) e) Conditions to terminate the contractual relationship.

Art. 39.- When the contract to grant a rating of an issuer, public offering securities issuance, or Fund is cancelled before the established term, regardless of its causes, the risk rating agency must disclose the rating that the Rating Council determines on the date of termination. This communication will be made within the timeframes and means established in Article 21 of these Standards. (1)

Under no circumstances can the cancellation of the contract to grant a rating of an issuer, public offering securities issuance, or Fund, with a risk rating agency, be used to avoid a modification in the rating. The rating must be modified and communicated if necessary, within a maximum period of three business days following the moment of withdrawal. (1)

CHAPTER IX OTHER PROVISIONS AND EFFECTIVE DATE Drafting of Information in Spanish Art. 40.- Without exception, information that is disclosed to the public in accordance with the provisions of these Standards must be drafted in Spanish, including definitions of financial terms referred to in another language.

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 18 of 19

Information Retention Art. 41.- The Superintendence may request at any time, reports on the risk rating of a securities issuance, an entity, or a Fund, the syntheses thereof, or any information and/or documentation indicated in these Standards, so agencies must retain all documentation corresponding to records and processes, for a minimum of ten years, as established in the Commercial Code. When the documentation and/or information that has been presented is not sufficient to prove the facts or information intended to be accredited, the Superintendence may require expansion or additional information. (1)

Review of the Rating Process Art. 42.- The Superintendence may order the risk rating agency to review the rating process used, in the case where there are indications or it is determined a deviation in the application of the methodology, or a non-compliance with what is established in internal procedures and the code of conduct, which could or have caused inconsistencies in the assignment of the rating. The foregoing does not exclude the opening of corresponding sanctioning processes.

Compliance with Regulatory Framework Art. 43.- Risk rating agencies registered in the Registry maintained by the Superintendence, their administrators, members of the Rating Council, shareholders, permanent representatives, and employees, must permanently comply with what is provided in the Market Law and in these Standards.

Sanctions Art. 44.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

Transitory Art. 45.- Risk rating agencies that, at the effective date of these Standards, do not have a permanent representative or attorney-in-fact, as required in Article 26 letter g) of these Standards, will have a period of thirty business days for compliance; having to present to the Superintendence the documents that accredit said compliance.

Art. 46.- The institutional email account or accounts, for the submission of the information requested in Articles 19, 20, 21, 24, and 31 of these Standards, will be communicated by the Superintendence, within a maximum period of five days following the entry into force of these Standards.

Unforeseen Aspects Art. 47.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Standards Committee of the Central Reserve Bank of El Salvador.

CNBCR-04/2013 NRP-07 TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013 Alameda Juan Pablo II, between 15 and 17 Av. Norte, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 19 of 19

Repeal Art. 48.- These Standards repeal Resolution RCTG-14/2008 Standard on obligations of risk rating agencies, approved in Session CD-23 on June 17, 2008, of the Superintendence of Securities and its modifications, whose Organic Law was repealed by Legislative Decree number 592 containing the Law on Supervision and Regulation of the Financial System, published in Official Diary number 23 Volume 390 on February 2, 2011.

Effective Date Art. 49.- These Standards will enter into force as of May 2, 2013.

MODIFICATIONS: (1) Modifications approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-16/2015, on November 18, 2015, with effect from December 11, 2015. (2) Modification of letter b) of Article 3 and addition of Article 13-D approved by the Central Bank through its Standards Committee in Session No. CN-05/2019 on March 22, 2019, with effect from April 10, 2019.