Technical Standards on Obligations of Risk Rating Agencies

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 21/03/2013 Validity: 02/05/2013

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR, CONSIDERING:

I. That Article 93, second paragraph, of the Securities Market Law, establishes that entities providing classification services must update and make public their classifications.

II. That Article 95-A, first paragraph, of the Securities Market Law, establishes that risk rating agencies must continuously review the classifications they issue, in accordance with the information provided by the issuer or available to the public.

III. That Article 95-E of the Securities Market Law, establishes that persons and entities participating in risk ratings must exercise care and diligence in the performance of their functions.

IV. That Article 95-F of the Securities Market Law and Article 7, letter f), of the Law on Supervision and Regulation of the Financial System, establish that risk rating agencies are subject to the supervision of the Superintendence of the Financial System, which may request information or background related to the compliance of their functions.

V. That Article 88 of the Investment Funds Law, establishes that the Central Bank of Reserve of El Salvador will issue technical standards on minimum legal and financial aspects that risk rating agencies must consider in their reports on the classification of Investment Funds, as well as the frequency with which such classifications will be updated. (1)

VI. That Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System, establishes that the proper functioning of the Financial Supervision and Regulation System requires the adoption of the highest standards of conduct in the development of their business, acts, and operations by the members of the financial system, in accordance with the provisions of the aforementioned Law.

VII. That Article 35, first paragraph, letter b), of the Law on Supervision and Regulation of the Financial System, establishes that directors, managers, and other officials holding positions of direction or administration in the members of the financial system must conduct their business, acts, and operations in compliance with the highest ethical standards of conduct and acting with the due diligence of a good merchant in their own business, being obligated to comply and ensure that legal, regulatory, and normative provisions regulating the activity of the members of the financial system are fulfilled in the institution they direct or work for.

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 21/03/2013 Validity: 02/05/2013

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following:

TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- These Standards aim to establish provisions on the manner in which rating agencies, registered with the Superintendence, must provide their services for the risk classification of securities subject to public offering and Investment Funds, in compliance with applicable regulations and standards of conduct in the development of their business, acts, and operations. (1)

Subjects
Art. 2.- The subjects obligated to comply with these Standards are the risk rating agencies authorized by the Superintendence of the Financial System.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Classification Council: Risk Classification Council; b) Fund: Investment Fund, those constituted in El Salvador and registered with the Superintendence of the Financial System. (1) (2) c) Manager: Investment Fund Management Company. (1) d) Market Law: Securities Market Law; e) Participant: Investor in an Investment Fund. (1) f) Registry: Public Stock Registry of the Superintendence of the Financial System; g) Rating Agency: Risk Rating Agency; and h) Superintendence: Superintendence of the Financial System.

CHAPTER II
CLASSIFICATION METHODOLOGIES AND CATEGORIES

Classification Methodologies
Art. 4.- Rating agencies, to provide the service of assigning risk classifications to issuers, securities issuances, and Funds registered in the Superintendence's Registry, must do so based on classification methodologies that guarantee the obtaining of classifications that clearly reveal the risks assumed by the issuer, its issuances, and the Fund, through an objective and independent evaluation and analysis, and that comply with the minimum provisions defined in these Standards. (1)

Fund risk classifications must reflect, according to the investment object of the Fund in question, the risks of the assets comprising said Fund and the operations it carries out, as well as the quality of administration of the respective Manager. (1)

Art. 5.- The methodologies used by rating agencies must comply, among others, with the following aspects:
a) Be contained in procedure manuals, which incorporate rigorously and systematically the description of the qualitative and quantitative aspects upon which the analysis performed according to the approved methodology is based, for each type of security, entity, or Fund; (1) b) Be approved by the Classification Council; c) Contain parameters related to each of the risk categories according to the Market Law and these Standards. In the case of Funds, the provisions established in the second paragraph of Article 8 of these Standards shall be considered; (1) d) Be submitted to an internal validation process; which considers historical experience, when information is available, by comparing the estimates made with those actually observed in previous periods; and e) Be subject to an internal review and update process, with a minimum frequency of two years, regarding the methods, theoretical, mathematical, or statistical models applied, as well as the suitability of their application for the analysis of new financial products or entities.

The Superintendence may at all times make observations on the documents referred to in this article, in case the provisions of the Market Law and these Standards are not met.

Modifications to Methodologies
Art. 6.- Modifications to the methodologies, models, and criteria used for granting a classification must:
a) Be approved by the Classification Council; b) Be disclosed prior to their implementation, through the same medium in which the original methodology is available; and c) Identify and disclose on their websites clearly the classifications granted that will be affected by the approved modifications and those that are under review.

Art. 7.- When, for technical reasons, there are modifications to the methodologies used, rating agencies must review the current classifications granted based on such changes, issuing the corresponding update reports in the following period, based on the modified methodology.

Risk Classification Categories
Art. 8.- The risk categories for debt-representative securities will be applied based on those established in Article 95-B, and for participation securities, those established in Article 95-C, both of the Market Law.

For the classification of Funds, rating agencies will establish their own classification categories, including in their classification reports the definition of the same, which must be communicated to the Superintendence. The categories cannot be used for other purposes and will refer only to the classification of Funds registered with the Superintendence. (1)

For the classification of entities that are subject to classification, the following categories must be applied:

CATEGORY MEANING OF THE CATEGORY
EAAA Corresponds to those entities that have the highest capacity to pay their obligations on the terms and deadlines agreed, which would not be affected by possible changes in the entity, in the industry to which it belongs, or in the economy. Risk factors are insignificant.
EAA Corresponds to those entities that have a very high capacity to pay their obligations on the terms and deadlines agreed, which would not be affected by possible changes in the entity, in the industry to which it belongs, or in the economy. Protection factors are strong, risk is modest. EA Corresponds to those entities that have a good capacity to pay their obligations on the terms and deadlines agreed, but this is susceptible to slight deterioration in the event of possible changes in the entity, in the industry to which it belongs, or in the economy. Protection factors are satisfactory. EBBB Corresponds to those entities that have sufficient capacity to pay their obligations on the terms and deadlines agreed, but this is susceptible to weakening in the event of possible changes in the entity, in the industry to which it belongs, or in the economy. Protection factors are sufficient. EBB Corresponds to those entities that have the capacity to pay their obligations on the terms and deadlines agreed, but this is variable and susceptible to deterioration in the event of possible changes in the entity, in the industry to which it belongs, or in the economy, potentially incurring delays in the payment of their obligations. Protection factors vary widely with economic conditions and/or the acquisition of new obligations. EB Corresponds to those entities that have the minimum capacity to pay their obligations on the terms and deadlines agreed, but this is very variable and susceptible to deterioration in the event of possible changes in the entity, in the industry to which it belongs, or in the economy, potentially incurring loss of their obligations. Protection factors vary very widely with economic conditions. EC Corresponds to those entities that do not have sufficient capacity to pay their obligations on the terms and deadlines agreed, with a high risk of loss of these. There is a substantial risk that contractual obligations will not be paid on time. ED Corresponds to those entities that do not have the capacity to pay their obligations on the terms and deadlines agreed, and that present effective default of these, or request for dissolution, liquidation, or bankruptcy in progress. EE Corresponds to those entities that do not have sufficient information or this is not representative, which does not allow issuing an opinion on their risk.

Art. 9.- Within a classification scale, the signs “+” and “-” may be used to differentiate instruments with higher or lower risk within their category. The “+” sign indicates a lower risk level, while the “-” sign indicates a higher risk level.

Art. 10.- Rating agencies may incorporate in the categories mentioned, any other information that allows for better identification of the entity being classified or the country's initials, using parentheses or any other form of identification, expressing its meaning in the footnote. The mentioned initials must be of smaller size than those assigned in the classification category.

Art. 11.- Foreign rating agencies authorized to operate in the country must harmonize their methodology and risk classification opinions using the nomenclature and guidelines established in Articles 95-B and 95-C of the Market Law and these Standards.

CHAPTER III
CLASSIFICATION REPORTS

Minimum Content of the Report on Risk Classification Art. 12.- The report on the risk classification of issuances and entities will contain, at least, the following:
a) Generalities of the risk classification:
i) Name of the issuer or entity, with its mnemonic code, if applicable; ii) Date of the Classification Council meeting that gave rise to the agreement; iii) Current and previous classification, if the latter is available; iv) Perspective; v) Reference to the closing period of the financial statements that served as the basis for the analysis, indicating whether they are audited or not; vi) Description of the meaning of the assigned risk category, according to Articles 95-B, 95-C of the Market Law and these Standards; and vii) In the case of issuances, detail the main characteristics such as: denomination, type of security, currency, amounts, deadlines, guarantees, series or tranches. b) Names of the analysts who participated in the preparation of the risk classification analyses; c) Synthesis of the basis that served to assign the classification and the perspective; d) General background of the issuer; e) Comprehensive financial and economic analysis of the issuer, including the evaluation of relevant financial ratios and, when applicable, analysis of the flows that will serve to fulfill the commitments of the issuance; f) Analysis of the general economic and sectoral environment, including when applicable, among other aspects: economic risk, industry risk, short-term perspectives, and market position; g) Analysis of relevant qualitative factors of the issuer, among others, management quality, organizational structure and functions, policies and mechanisms for risk management, strategic planning, internal controls, and good corporate governance practices; h) Analysis of the structure, characteristics, and conditions of the issuance; and i) Identification of the sources of information used for the analysis, indicating prominently whether the rating agency considers the quality of the existing information about the entity or financial product analyzed to be satisfactory and to what extent they have verified the information provided by said entity or third parties.

In any case, the report and its updates must clearly incorporate the elements or aspects that are considered key to directly or indirectly influence the classification granted. However, when the Superintendence has knowledge that informative elements that could influence the risk classification have not been included, it may request the risk rating agency to communicate the reasons why they have not been included or updated; it may require the rating agency to initiate a review of the opinion.

Classification of Asset-Backed Securities Funds Art. 13.- When it comes to risk classification reports for issuances by Asset-Backed Securities Funds, in addition to what is established in Article 12 of these Standards, the following aspects must be analyzed:
a) The quality of the securitized assets in terms of factors such as: credit quality, diversification, ability to generate periodic flows, concentration or atomization, origination methods, administration, and collection; b) The risks stated in the securitization contract project, including those derived from the originator; and c) The collateral or coverage backing the issuances by the Fund.

The report must indicate whether the rating agency has conducted an evaluation of the structuring and underlying assets directly or if it has relied on the analysis of a third party, and will indicate how the result of that analysis influences the classification.

Classification of Investment Funds
Art. 13-A.- The preparation of the report on the risk classification of Funds, in addition to considering, where applicable, what is established in Article 12 of these Standards, must take into consideration as a minimum the following aspects: (1) a) Fiduciary risk of the Manager, that is, the evaluation of the administration, the operational management of the Fund, and the degree of adherence to the investment policies defined by the Manager, in accordance with what is established in Article 13-B of these Standards; (1) b) Evaluation of the Fund's portfolio, that is, the evaluation of the assets constituting the Fund, diversification, level of protection of the investment portfolio against losses associated with credit risk and market risk, in accordance with what is established in Article 13-C of these Standards; and (1) c) In the case of Closed Real Estate Funds, the evaluation of the geographic area, the situation, and perspective of both the real estate sector and the type of properties where the Fund invests. When applicable, the singular conditions of the assets maintained by the Fund must be included, among others. (1)

For Funds that are in the stages of constitution and start of operations, the analysis will focus on the Manager's management capacity, the clarity and precision of the objectives, documents contained in the Fund's regulations and prospectus; investment policies, among others, that the rating agency deems necessary to consider and that allow it to issue an appropriate opinion regarding the risk and class of assets that the Fund will incorporate once its investment process begins. (1)

Art. 13-B.- Rating agencies, in order to classify the quality of the Manager's administration, must consider as a minimum the following aspects: (1) a) Structural considerations of the entity such as its organization, financial solvency, market presence, technological capacity, internal control systems, corporate governance analysis, and contingency plans; (1) b) Track record and experience of officials holding key positions in the entity; (1) c) Degree of independence and segregation of functions between different areas, as well as the administration of conflicts of interest and transparency policies; (1) d) Mechanisms that guarantee the independence of decisions regarding the Fund in relation to the conglomerate or business group; (1) e) Existence of policies and procedures for investment management, identification and administration of risks, and valuation of the investment portfolio; (1) f) Evaluation of the different areas involved in the formulation of policies, procedures, and control, with emphasis on their composition, frequency of analysis, reports produced, and level of responsibilities; (1) g) Financial statements that served as the basis for the analysis, indicating whether they are audited or not; and (1) h) Compliance with policies and regulation applicable to the Manager. (1)

Art. 13-C.- Rating agencies, in order to classify the risks of the Fund and its constituent assets, must consider as a minimum the following aspects: (1) a) Amount of assets managed by the Fund and number of participants; (1) b) Quality, diversification, degree of liquidity, and valuation of the asset portfolio; (1) c) Clarity of the investment process and information provided to participants; (1) d) Historical performance of returns and risk indicators according to the type of Fund and assets; (1) e) Compliance with the objective, strategy, policy, and investment limits; (1) f) Evaluation of risks and the management thereof; (1) g) Financial statements that served as the basis for the analysis, indicating whether they are audited or not; and (1) h) Level of Fund indebtedness. (1)

Rating agencies must take into consideration market risk, that is, the relative sensitivity of the Fund to changes in market conditions. The analysis of market risk must consider aspects such as interest rate risk, liquidity risk, currency risk; the use of derivative instruments for hedging, and the evaluation of the Fund's indebtedness. (1)

Additionally, the level of protection of the investment portfolio against losses associated with credit risk must be evaluated, based on the probability of default of counterparties and the risk diversification of the portfolio, the sufficiency of the Fund's liquidity, and the skills and management policies to generate profits and limit exposure to losses. (1)

Classification of Securities Destined for the Financing of Infrastructure Works with State Participation (2) Art. 13-D.- Rating agencies, in order to classify the risks of securities destined for the financing of infrastructure works that have the participation of the State through any dependency of the Central Government, autonomous institutions, municipalities, or in accordance with the Special Law on Public-Private Partnerships, must consider, in addition to what is established in Article 12 of these Standards, the specific requirements of Articles 13, 13-A, and 13-C of these Standards, according to the type of security in question, the following:
a) Characteristics of the security and its structuring; (2) b) Guarantees associated with the issuance of the securities; (2) c) Analysis of the economic environment; and (2)

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013

d) Management of risks associated with the development of infrastructure projects, such as: legal, operational, and other risks associated with project development. (2)

Responsibility for Analyzed Information
Art. 14.- Risk rating agencies must require securities issuers and Managers who request their risk rating services to provide the necessary information for their analysis based on the terms and deadlines defined in the contract and in accordance with the requirements established by the Market Law for registration purposes. (1)

Art. 15.- The rating agency must have internal mechanisms that ensure that the ratings granted are obtained based on the information provided by the issuer and the Manager, as well as information obtained from its own sources or third parties, clearly identifiable and properly documented. (1)

Responsibility for the Opinion of the Risk Classification Council Art. 16.- Risk rating agencies must include in their reports what is stipulated in the second paragraph of Article 92 of the Market Law, regarding the responsibility for the opinion issued by the Classification Council.

Minimum Content of the Classification Minutes
Art. 17.- The decisions of the Classification Council must be recorded in a minutes book in accordance with Article 89-A of the Market Law, which must contain at minimum the following:
a) Date of the meeting and sequential number of the session held; b) Place where the meeting is held; c) Specify whether the session is ordinary or extraordinary; d) Deliberations and decisions taken; e) Name of the technical personnel who participated in determining the risk classification; f) Reference to the classification criteria and models considered as important components in the methodology approved for determining the risk classification, and in case of a difference between the classification resulting from the application of the classification criteria and models corresponding to the methodology and the final classification granted, include arguments justifying the same; g) Reference to the technical documents that served as the basis for the decision; and h) Name and signature of the members of the Classification Council who were present.

Unregistered Entity
Art. 18.- In the event that a risk rating agency performs a risk classification on an entity not listed in the Registry, the respective risk classification report must legibly state, at the bottom of each page forming part of the risk classification report, the following phrase: UNREGISTERED ENTITY IN THE REGISTRY OF THE SUPERINTENDENCE OF THE FINANCIAL SYSTEM. Additionally, the rated entity, if it publicly uses such classification, must include the aforementioned phrase in its advertising.

Risk Classification Report
Art. 19.- Risk rating agencies are obligated to update the risk classification of issuers, securities offerings, and Funds, semiannually, and must submit to the Superintendence the risk classification report in electronic and physical format no later than April 30 and October 31, based on the financial statements of December 31 and June 30, respectively. (1)

Risk rating agencies that issue risk classifications on foreign issuers are obligated to update the classification semiannually, and must submit to the Superintendence the classification report in electronic and physical format no later than sixty days after the date on which the issuers have their audited financial statements, updating the assigned classification and issuing a new classification report six months after the dates of the classification assignment and issuance of the aforementioned report, based on available financial statements.

The risk classification report to be issued by the rating agency by April 30 must be based on audited financial statements as of December.

Risk rating agencies must send the classification report to the respective stock exchange, within the same deadlines defined in this article by the means it requires.

Current Classifications and Updates
Art. 20.- Risk rating agencies must disclose no later than the last business day of the months of June and December, the risk classifications for issuers, public offering securities, and Funds current as of those dates, through their website and communicated electronically to the market and the Superintendence simultaneously. (1)

The foregoing is without prejudice to necessary updates resulting from constant monitoring of entities, their issuances, and Funds, and which are approved in extraordinary meetings of the Classification Council; therefore, when the risk rating agency has knowledge of events that by their nature could alter the foundations of the granted classification, it must initiate a review process and inform the Superintendence the next business day after the review process has begun, regarding the entities, products, or securities and Funds being analyzed and the estimated date by which an agreement on the review is expected to be taken. (1)

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013

CHAPTER IV
SUBMISSION AND DISCLOSURE OF INFORMATION

Disclosure Deadline for Granted Classifications Art. 21.- The rating agency must disclose electronically the classifications granted by the Classification Council, within a maximum period of three business days following the corresponding agreement.

Submission of Reports and Classifications
Art. 22.- The reports and disclosure of classifications referred to in Articles 19 and 20 of these Standards must be published by the rating agency, through its website, within the same timeframe as they are submitted to the Superintendence. (1)

Minimum Information Available on Websites
Art. 23.- Risk rating agencies must make available to the public on their websites, at minimum, the following information:
a) Information on classifications granted to issuers, public offering securities, and Funds, while the same remains valid. The available information must incorporate historical information on the classifications granted, so that the investing public can understand the historical behavior of each and its variations over time, and must indicate at minimum: name of the issuer or designation of the issuance, name of the Manager and the Fund, initial classification granted and its updates including approval dates, perspectives, and observation periods of the classification; (1) b) Sufficient information on their procedures, methodologies, and assumptions so that third parties can understand how the rating agency made the decision on the assigned classification; they may also publish educational material on the service provided; c) Information on the classification categories used, so that the meaning of each can be clearly understood; d) Information on internal procedures and code of conduct approved by the Board of Directors of the company; e) Information on the human resources participating in risk classification analyses, including at minimum academic training and professional experience of each, and the country in which they reside, for companies with offices abroad; and f) Information on suspension or cancellation of a risk classification service contract for the issuer, public offering securities, or the Fund. The aforementioned communication must include the classification and date of its last update, as well as the reasons why the classification service is suspended. (1)

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013

Update of the Registry
Art. 24.- The information required for the Registry of the rating agency, administrators, members of the Classification Council, permanent representatives, must be kept updated, informing any changes occurred to the Superintendence, electronically within a maximum period of three business days following the occurrence of the event that generated the change, and must submit the formal documentation within a maximum of five business days following.

Art. 25.- Risk rating agencies must submit their financial statements to the Superintendence quarterly, within thirty days following the closing date. The annual audited financial statements must be sent within sixty days following the closing date of the accounting period.

CHAPTER V
QUALITY OF CLASSIFICATION PROCESSES

Quality and Integrity of Classification Processes Art. 26.- For the purpose of guaranteeing the quality and integrity of the classifications granted, the directors and administrators of risk rating agencies will be responsible for:
a) Adopting procedures, methodologies, or classification criteria that guarantee the obtaining of objective and independent classifications, based on the appropriate and technical analysis of all relevant information for the classification process; including the procedure for periodic review of the same, with the objective of evaluating the appropriateness of their application for the analysis of new financial products or entities; b) Implementing procedures for the issuance and disclosure of risk classifications, as well as internal mechanisms that allow continuous and permanent monitoring of the financial variables of the entity, the environment, or the Fund, as well as other foundations that were considered for the granting of risk classifications, such that, if the result of their review causes a change in the granted risk classification, it is capable of issuing a timely update of the same and informing the market and the Superintendence, in accordance with the deadlines and means defined in these Standards; (1) c) Ensuring that they have human resources with integrity, knowledge, and appropriate experience for issuing classification opinions by type of entity, instrument, and Fund, for which they must have hiring and training policies and procedures, in which the integrity and quality or technical or professional capacity of the persons they hire is verified, in accordance with the requirements defined in the Market Law and the minimum knowledge and experience established by the rating agency itself, regarding the operation and functioning of the entity, or of the functions to be performed. (1) The entity must retain documentation related to hiring, including that which demonstrates the experience and suitability of the hired person, or in the absence of these, include a reasoned opinion signed by the General Manager, indicating how they ensured the capacity or technical quality of the corresponding person; d) Ensuring the rigorous and consistent use of the classification methodologies approved by the Classification Council, as well as continuity in the criterion applied for granting the same, avoiding discrepancies in the classifications issued, for which they must have procedures to prepare a work file for each classification, such that it is complete, detailed, and referenced with the methodology and models used, to provide a comprehensive understanding of the analysis and the reference between this file and the final report of the Classification Council; e) Providing sufficient information to investors and participants on the classifications issued by the company and the quality of the service provided. The level of detail of the information must be sufficient, so that it allows investors and participants to understand the objective and purpose of a granted classification and make their investment decisions; (1) f) Maintaining as part of their internal records, a register of the classifications granted, whether private or public, in
which all actions taken are shown, including the information indicated in Article 23 letter a) of these Standards; g) Permanently maintaining in the Republic of El Salvador, at least one representative with broad and sufficient powers in administrative and technical matters, to perform all acts and contracts that must be celebrated and have effects within the national territory; the power granted to the representative must clearly and precisely express that the represented entity obligates itself to respond unlimitedly within and outside the country for the acts celebrated and contracts signed in El Salvador; and h) Having adequate facilities and that the offices have a domicile in the country.

Art. 27.- Internal procedures for the issuance of classifications must include all stages and activities to be performed, with their respective participants and responsible parties, as well as the dissemination stage. In this process, a stage must be considered that allows the issuer, the Fund, and the Manager to know in advance the classification to be issued and, if necessary, provide complementary information for the analysis and final granting of classification. (1)

Additionally, they must have an internal procedure to monitor assigned classifications quarterly, for which they must adequately document such review and, if necessary, perform the corresponding updates.

Art. 28.- Risk rating agencies must include a procedure for handling inquiries received regarding classification reports, in which the official means of reception is established, whether electronic or physical; which may not exceed five business days, or the delay must be justified in case of exceeding the deadlines defined by the rating agency itself. In any case, such procedure must incorporate internal controls on the inquiries attended and responses provided.

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Validity: 05/02/2013

CHAPTER VI
INDEPENDENCE AND MANAGEMENT OF CONFLICT OF INTEREST

Internal Policies to Ensure Independence and Management of Conflict of Interest Art. 29.- Risk rating agencies must have procedures, controls, and internal policies that safeguard independence and the management of conflicts of interest during the classification process, such as:
a) Administrative procedures that clearly define the organizational structures, and assign functions and responsibilities to ensure that the commercial interests of the company do not affect the accuracy of the risk classifications issued, and that also allow, operationally separating, the activities performed in the classification procedure and the analysts involved in the same, from any other service provided by the rating agency; b) Policy of rotation of analysts assigned to the classification process with the same rated entity; c) Internal control procedures that ensure compliance with decisions and procedures at all levels; d) Procedures for the adequate management of conflicts of interest at internal and external levels, that guarantee that the classifications granted are not affected by conflicts of interest, whether real or potential, and that include the timely dissemination to the market and the Superintendence of the emergence of the same, as well as the internal control of significant threats identified to the independence of the opinions to be issued; and e) Risk management procedures, including control mechanisms that ensure continuity and regularity in the performance of their functions, and provide security to the information processing systems.

Art. 30.- Risk rating agencies, their directors, members of the Classification Council, or Managers, may not acquire securities from issuances or participation quotas of Funds from companies in which they have any type of interest, in accordance with what is stated in Article 95 of the Market Law. (1)

Art. 31.- Directors, administrators, shareholders, and members of the Classification Council, as well as technical personnel or analysts of risk rating agencies, must inform the Superintendence about their direct or indirect participation in the share ownership of any Salvadoran company, within a maximum period of three business days following the occurrence of such circumstance.

Art. 32.- Risk rating agencies must submit to the Superintendence, along with the update reports, a sworn declaration in which they manifest whether or not there are persons with interest in any of the entities to which they provide the risk classification service, in accordance with what is specified in Article 95 of the Market Law. In any case, the administration must adopt measures so that such conflicts of interest do not affect the classification to be granted.

CHAPTER VII
CODE OF CONDUCT

Handling of Confidential Information
Art. 33.- Risk rating agencies must adopt procedures for the handling of confidential information, ensuring the exclusive use of information in aspects related to analysis for classifications and avoiding fraudulent use of the same, such as price manipulation and abuse of insider information, among others. Such policies must be consistent with the guidelines established in the company's code of conduct.

Code of Conduct
Art. 34.- Risk rating agencies must have a code of conduct that will govern the conduct of the rating agency and the members of the board of directors and other executives or technical personnel involved in the granting of risk classifications, so that these activities and relations are conducted in an equitable, honest manner, and in adherence to sound market practices. Such code must provide behavioral rules, at minimum, for the following aspects:
a) Standards of integrity of employees and directors of rating companies, to guarantee fair and honest treatment with market participants and the public and avoid coercive or abusive practices, such as the following:
i) Conditioning the risk classification opinion to the contracting of any other service or product of the same entity or related entity; ii) Altering the classification granting process, in order to issue a higher or lower credit classification to punish or favor other interests; and iii) Issuing classification reports containing ambiguous or imprecise information about an entity, Funds, products, or securities, which may induce error or confusion among investors or participants. (1) b) Prohibited behaviors of employees, directors, and shareholders that may produce conflicts of interest, and affect the independence and objectivity of the analyses and opinions issued, such as the following:
i) Acquisition of securities from rated entities; ii) Acquisition of participation quotas of classified Funds; (1) iii) Acceptance of any type of favors or gifts from entities subject to classification; iv) Providing opinion or making decisions on classifications granted, based on the effect on investors or other market participants; v) Linking personnel remuneration with the economic results of the company;

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013

vi) Share confidential information about rated entities and Funds with internal or external personnel of the agency; outside the corresponding analysis process; (1) vii) Fail to timely disclose personal, professional, or other relationships with rated entities; viii) Participate in the analysis and determination of ratings for an issuer, issuance, or Fund, in which they have a personal or business interest; (1) and ix) Provide consulting, advisory, proposal, recommendation, or other services to a client of the rating agency.

c) Transparency practices in activities carried out by the agency, such as:
i) Timely and complete disclosure of ratings granted, and their updates; ii) Periodically evaluate compliance with the policies and methodologies used for issuing ratings; and iii) Maintain complete control and backup of the documentation used to issue opinions and the analysis and decision-making process thereof.

d) Employee conduct that ensures the protection of information and records in the agency's possession against fraud, theft, or misuse; whether information about entities, instruments, or Funds analyzed at the time or in the past. (1)

e) Principles of conduct and disclosure for employees regarding acceptance of employment with entities that have been the subject of rating or entities related to them.

Art. 35.- The code of conduct must also include a clear procedure that allows for the reporting of illegal conduct or violations of the code's provisions, whether by employees or third parties, without reprisals for those who file a report in good faith.

The aforementioned code must be approved by the Board of Directors of the agency and be available to the public on their websites, and if any aspect is not implemented, the reasons for non-implementation must be disclosed through the same medium.

CHAPTER VIII
CONTRACTING OF THE SERVICE
Contracting of the rating service

Art. 36.- Rating agencies will communicate to the Superintendence about a new rating contract, as well as the modification or termination of an existing one, within five business days following the date on which any of these circumstances are finalized.

The communication must indicate the following:
a) Name of the entity that will hire the rating agency or that settles its contract; b) Type of rating: Fund, entity, security, or both; (1) c) Amount of the issuance; d) Amount of the contract; e) Use of requested rating: public or private;

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013

f) Date of celebration of the contract; and (1) g) Date from which the service will begin and end. (1)

Art. 37.- For the celebration of a new contract, the rating agency must ensure that it has suitable human and technical resources to provide the rating service for the issuer, issuance, or Fund being contracted, in accordance with the quality and integrity characteristics required in these Standards. (1)

Art. 38.- Contracts that rating agencies enter into with their clients must consider the following aspects:
a) The purpose for which the rating is obtained; b) Clear provisions on the private or public use that the applicant will give to the rating granted, defining the conditions under which a rating requested as private can be used as a public rating; c) The client's commitment to provide, in a timely manner, the information requested by the rating agency, so that the latter is in a position to grant and update the rating granted; d) The rating agency's authority to request information from the client about ratings previously granted by other rating agencies when it concerns the same issuance, same issuer, or same Fund for which it is being contracted; and (1) e) Conditions to terminate the contractual relationship.

Art. 39.- When the contract to provide a rating for an issuer, public offering securities issuance, or Fund is terminated before the established term, regardless of its causes, the rating agency must disclose the rating that the Classification Council determines on the date of termination. This communication will be carried out within the timeframes and means established in Article 21 of these Standards. (1)

Under no circumstances can the cancellation of the contract to provide a rating for an issuer, public offering securities issuance, or Fund with a rating agency be used to avoid a modification in the rating. The rating must be modified and communicated if necessary, within a maximum period of three business days following the moment of withdrawal. (1)

CHAPTER IX
OTHER PROVISIONS AND EFFECTIVE DATE
Drafting of information in Spanish

Art. 40.- Without exception, information that is disclosed to the public in accordance with the provisions of these Standards must be drafted in Spanish, including definitions of financial terms referenced in another language.

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013

Information Retention

Art. 41.- The Superintendence may request at any time, reports on the risk rating of a securities issuance, an entity, or a Fund, summaries thereof, or any information and/or documentation indicated in these Standards, so that agencies must retain all documentation corresponding to records and processes for a minimum of ten years, as established in the Commercial Code. When the documentation and/or information presented is not sufficient to prove the facts or information intended to be accredited, the Superintendence may require expansion or additional information. (1)

Review of the rating process

Art. 42.- The Superintendence may order the rating agency to review the rating process used, in the case where there are indications or it is determined that there is a deviation in the application of the methodology, or a non-compliance with what is established in internal procedures and the code of conduct, which could or have caused inconsistencies in the assignment of the rating. The foregoing does not exclude the opening of corresponding sanctioning processes.

Compliance with regulatory framework

Art. 43.- Rating agencies registered in the Registry maintained by the Superintendence, their administrators, members of the Classification Council, shareholders, permanent representatives, and employees, must permanently comply with what is provided in the Market Law and these Standards.

Sanctions

Art. 44.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law of Supervision and Regulation of the Financial System.

Transitory

Art. 45.- Risk rating agencies that, at the effective date of these Standards, do not have a permanent representative or attorney-in-fact, as required in Article 26 letter g) of these Standards, will have a period of thirty business days for compliance; they must present to the Superintendence the documents that accredit said compliance.

Art. 46.- The institutional email account or accounts for the submission of information requested in Articles 19, 20, 21, 24, and 31 of these Standards, will be communicated by the Superintendence, within a maximum period of five days after the entry into force of these Standards.

Unforeseen Aspects

Art. 47.- Aspects not provided for in regulatory matters in these Standards will be resolved by the Standards Committee of the Central Reserve Bank of El Salvador.

CNBCR-04/2013 NRP-07
TECHNICAL STANDARDS ON OBLIGATIONS OF RISK RATING AGENCIES Approval: 03/21/2013 Effective Date: 05/02/2013

Repeal

Art. 48.- These Standards repeal Resolution RCTG-14/2008 Standard on obligations of risk rating agencies, approved in Session CD-23 on June 17, 2008, of the Securities Superintendence and its modifications, whose Organic Law was repealed by Legislative Decree number 592 containing the Law of Supervision and Regulation of the Financial System, published in Official Gazette number 23 Volume 390 on February 2, 2011.

Effective Date

Art. 49.- These Standards will enter into force starting from May 2, 2013.

MODIFICATIONS:
(1) Modifications approved by the Standards Committee of the Central Reserve Bank of El Salvador, in Session No. CN-16/2015, dated November 18, 2015, with effect from December 11, 2015.
(2) Modification of letter b) of Article 3 and addition of Article 13-D approved by the Central Bank through its Standards Committee in Session No. CN-05/2019 dated March 22, 2019, with effect from April 10, 2019.