Technical Standards on Requirements for Information Systems of Securities Market Entities

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That Article 2, second paragraph, of the Law on Supervision and Regulation of the Financial System establishes that the proper functioning of the Financial Supervision and Regulation System requires, from the members of the financial system and other supervised entities, compliance with current regulations and the adoption of the highest standards of conduct in the development of their business, acts, and operations, in accordance with the provisions of the aforementioned Law, other applicable laws, regulations, and technical standards issued for such effect.

II. That Article 3, letter b), of the Law on Supervision and Regulation of the Financial System establishes that it is the competence of the Superintendence of the Financial System to authorize the constitution, functioning, start of operations, suspension of operations, modification, revocation of authorization, closure, and other acts of the members of the financial system, in accordance with the legal, regulatory, or technical normative provisions established regarding the matter. In the case of closure, it will coordinate the actions established by the laws with other involved institutions.

III. That Article 15, letter d), of the Law on Supervision and Regulation of the Financial System establishes that it is the faculty of the Superintendence of the Financial System to authorize the public promotion, constitution, functioning, start of operations, modification of social agreements and statutes, if applicable, merger, and other acts of similar nature of the members of the financial system, in accordance with the legal, regulatory, or technical normative provisions established regarding the matter.

IV. That Article 35, letter g), of the Law on Supervision and Regulation of the Financial System establishes that the members of the financial system are obligated to comply and ensure that the institution complies with the efficient functioning of the systems for recording, processing, storage, transmission, production, security, and control of information flows.

V. That Article 37 of the Law on Supervision and Regulation of the Financial System establishes that supervised entities must facilitate, upon request of the Superintendence, by the means it considers convenient, without opposing confidentiality or reserve, the examination of their business, acts, operations, assets, books, accounts, files, documents, correspondence, databases, and information systems, in all matters pertinent to the supervision activity.

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

THEREFORE,

by virtue of the normative powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System,

AGREES to issue the following:

TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object
Art. 1.- These Standards aim to establish the minimum requirements that the information system or systems acquired or developed by entities operating in the securities market must comply with, for the authorization of the start of their operations by the Superintendence of the Financial System.

Subjects
Art. 2.- The subjects obligated to comply with the provisions established in these Standards are:
a) Specialized Agents in Securities Valuation; b) General Warehouses of Deposit; c) Exchanges of Products and Services; d) Securities Exchanges; e) Brokerage Houses; f) Societies specialized in the Deposit and Custody of Securities; and g) Securitization entities and the funds they administer.

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Application, program, or computer system: any software used by the entity for the collection, storage, processing, visualization, or transmission of information related to the financial products or services that the entity offers to its clients; b) Central Bank: Central Bank of Reserve of El Salvador; c) Entity/entities: Subjects obligated to comply with these Standards, detailed in Article 2 thereof; and d) Superintendence: Superintendence of the Financial System.

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

CHAPTER II
ON THE REQUIREMENTS OF INFORMATION SYSTEMS

Information Systems
Art. 4.- In cases where the Laws and applicable Technical Standards for each of the entities require the use of information systems, to start their operations, they must include in their application the detail and description of such systems that substitute or simplify manual processes, as well as their improvements, all of this in order to guarantee the efficiency and transparency of systematized operations, without prejudice to other requirements that must be met before the Superintendence.

Art. 5.- The entity must have an inventory and description of the computer systems and databases that it develops or acquires and uses in the execution of its operations, as well as the description of the computer platform on which they have been developed, presenting, in addition, the backup procedures manual and description of security policies and controls applied to the computer systems and databases in accordance with Annex No. 1 of these Standards.

Outsourcing of application development or computer developments Art. 6.- In case entities decide to carry out the development of information systems or applications referred to in Article 5 of these Standards to be approved by the Central Bank through its Committee of Standards, to the extent applicable. The quality of contracted services is the responsibility of the entity, which will be liable to third parties as if it had performed them. For these purposes, the entity must have policies and procedures regarding the contracting of services.

CHAPTER III
OTHER PROVISIONS AND VALIDITY

Art. 7.- Entities that, at the time of entry into force of these Standards, already have authorization from the Superintendence to start operations, do not need to present their information systems again.

Sanctions
Art. 8.- Non-compliance with the provisions contained in these Standards will be sanctioned in accordance with what is established in the Law on Supervision and Regulation of the Financial System.

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

Repeal
Art. 9.- These Standards repeal the Guide of Requirements for the Approval of Information Systems (RS-MV.0010/98) approved on June 24, 1998, by the Securities Superintendence, whose Organic Law was repealed by Legislative Decree No. 592 containing the Law on Supervision and Regulation of the Financial System, published in the Official Journal No. 23, Volume No. 390, dated February 2, 2011.

Transitory
Art. 10.- Applications submitted in accordance with what is established in the Guide of Requirements for the Approval of Information Systems (RS-MV.0010/98) and that were in process at the time these Standards entered into force, will continue and conclude in accordance with said Guide.

Unforeseen Aspects
Art. 11.- Aspects not provided for in terms of regulation in these Standards will be resolved by the Central Bank through its Committee of Standards.

Validity
Art. 12.- These Standards will enter into force from July 14, two thousand twenty-three.

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

Annex No. 1

INFORMATION SYSTEMS

STAGE I
Generalities
Financial institutions interested in obtaining authorization to begin operating in the Securities Market must present the computer system or systems with which they expect to manage the service. They must also inform about any subsequent changes verified in said system.

Information Systems Area a) General description of the application:
i. Generalities; and
ii. Objectives.
b) Data dictionary, when applicable; c) Online or batch process and justification; d) Security measures; e) Estimated frequency and volume of operations; f) Analyst manual (in the case of internal developments and outsourcing maintenance, when applicable): guide for system (application) maintenance, which includes aspects such as: standards used in the coding of the referenced system, definitions or conventions of the data structure; g) User manual of the application; h) Work plan for the application implementation stage:
i. Timelines; and
ii. Activities.
i) Detail of main modules, including:
i. Module name;
ii. Objective;
iii. Main functions; and
iv. Flowchart of processing and data capture of critical processes.
j) Description of reports issued by the system, including:
i. Report name;
ii. Objective;
iii. Issuance periodicity; and
iv. Printed copy of the report.

Communications Area a) Basic diagram of the communications equipment; b) Graphic scheme of the application distribution method; c) Specification of the main and contingency communications provider; d) Indicate the type of link available; e) Security and controls to be implemented during online processes with remote users; and f) Access to the database used in the exchange of information with the Superintendence.

CNBCR-04/2023
NDMC-24
TECHNICAL STANDARDS ON REQUIREMENTS FOR INFORMATION SYSTEMS OF SECURITIES MARKET ENTITIES Approval: 28/06/2023 Validity: 14/07/2023

Annex No. 1

Information Resources Area
Presentation of Technological Platform a) Servers: basic description of the server where the application will reside; b) Details of client equipment (antivirus, antimalware, if the equipment is within the Administrator Institution's domain); c) Description of data backup procedures for the application; d) Description of the database software used; e) Description of development tools used, when they are internal developments; and f) Description of the server operating system, the database it uses, and client equipment.

Application Testing
It is essential that before the start of operations or execution of the various applications, the functionality and accuracy of information processing are verified. It is the responsibility of the financial institution to prepare a workspace that simulates real execution conditions, including decentralized modules to work online. The points to evaluate are:
a) Inputs; b) Outputs; c) Processes; d) Data specifications; e) Process specifications; f) Access methods; g) Operations; h) Data manipulation (before and after the electronic data processing); i) Reports generated by the application; j) File identification, field and record sizes; k) Online process or batch processes to feed information to generate reports and their justification; l) Frequency and volumes of operation to generate reports; m) Security systems; n) User access levels (roles); o) Control systems; p) Responsible parties; q) Number of registered users in the application; r) Review of the user training plan; s) Review of the application implementation plan; and t) Calculation routine tests.

STAGE II
Generalities
This stage allows verifying the real functioning of the application, as it reviews the functionality and efficiency of systematized processes. It consists of making a visit to the company and validating the information based on the specifications and controls established in the application. Unlike the previous stage, the creation of a test area is not requested, as the review of inputs and outputs is performed with real data. The points to evaluate are:
a) Transfer and integration of Information, for decentralized applications; b) Operations; c) Data integrity and consistency; d) System acceptance by users (user interviews); e) Security system; f) Control systems; and g) Data manipulation.