Technical Standards to Facilitate the Participation of Financial Entities in the Bitcoin Ecosystem

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 1 of 7

THE COMMITTEE OF STANDARDS OF THE CENTRAL RESERVE BANK OF EL SALVADOR,

CONSIDERING:

I. That Article 1 of the Bitcoin Law regulates Bitcoin as legal tender in the territory of El Salvador, defined by its unlimited liberatory power, with voluntary acceptance by natural or legal persons with total private participation only, in any transaction and under any title they may need to carry out. (1) II. That the approval of the Bitcoin Law makes it necessary for the entry into operation of various economic agents that allow offering agile, competitive, and inclusive financial services to the general population, considering Bitcoin transactions in the territory of El Salvador. (1) III. That the Bitcoin Law establishes in its Article 11 that it is the responsibility of the Central Bank to issue the corresponding regulations. IV. That Article 99 of the Law on Supervision and Regulation of the Financial System, in its fourth clause, establishes that it will be the responsibility of the Central Bank to approve the other resolutions that, within the scope of its competence, are necessary for the proper functioning of the Financial Supervision and Regulation System, as well as for the application of this Law and in other laws applicable to supervised entities. V. That technological advances in the financial matter allow the realization of operations and transactions effectively and immediately through various electronic and digital mechanisms, of which it becomes essential to establish rules for their operation.

THEREFORE, in virtue of the regulatory powers conferred by Article 99 of the Law on Supervision and Regulation of the Financial System, AGREES to issue the following:

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 2 of 7

TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM

CHAPTER I OBJECT, SUBJECTS, AND TERMS

Object and Subjects Art. 1.- These Standards aim to regulate the subjects that offer bitcoin-based services to their clients, whether natural or legal persons, and these services may be offered directly or through a Bitcoin Service Provider. The subjects may participate in the provision of wallet services with or without custody based on bitcoin, exchange services, payment processing, among other services, as well as offering the complete set of their banking services to a Bitcoin Service Provider. These Standards do not apply to Bitcoin Service Providers that register in accordance with what is established in Executive Decree No. 27 dated August 27, 2021, which contains the Regulation of the Bitcoin Law, unless these are considered entities under these Standards.

Subjects Art. 2.- The subjects obliged to comply with the provisions established in these Standards are the following: (2) a) Banks; (2) b) Investment Banks; (2) c) Cooperative Banks and Savings and Credit Societies; and (2) d) Electronic Money Providers. (2)

Terms Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning: a) Central Bank: Central Reserve Bank of El Salvador; (2) b) Bitcoin: In accordance with what is established in Article 1 of the Bitcoin Law; (2) c) Dollars: United States Dollars; (2) d) Entities: Subjects obliged to comply with these Standards; (1) (2) e) FATF: Financial Action Task Force; (2) f) Bitcoin Service Provider: This term has the meaning attributed to it in Executive Decree No. 27 dated August 27, 2021, which contains the Regulation of the Bitcoin Law; and (2) g) Superintendence: Superintendence of the Financial System.

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 3 of 7

CHAPTER II OBLIGATIONS OF ENTITIES

General Obligations Art. 4.- Entities must comply at all times with the provisions and principles established in the Bitcoin Law and its Regulation, as well as with the applicable regulatory framework for entities subject to these Standards according to the nature of their operations.

Establishment of Contractual Relationships Art. 5.- Before establishing a contractual relationship with a Bitcoin Service Provider, an entity will carry out due diligence of the Bitcoin Service Provider, given the nature of the services to be provided and the risk associated with said relationship according to the policies of each entity. Any entity will carry out enhanced due diligence to preserve the security, solidity, and integrity of the entity and the financial system in general. Due diligence topics, among others, include the commercial ratings of a Bitcoin Service Provider, financial condition, legal and regulatory compliance, management and risk controls, anti-money laundering and terrorist financing prevention risk systems, information security, and operational resilience. No entity is obliged to offer financial services to Bitcoin Service Providers. (1)

Regarding the Contract Art. 6.- An entity may sign a contract with a Bitcoin Service Provider, for which the entity will carry out a written contract that incorporates the results of the due diligence carried out by the entity in accordance with Article 5 and the nature of the commercial agreement. At a minimum, said contract must address: a) Nature of the service provided and description thereof; b) Contract term; c) Frequency, form, and technical specifications of the services to be provided; d) Commissions and other compensation involved in the commercial agreement; e) Any service provided by a third party on behalf of or in place of the entity; f) Representations, warranties, and covenants that the Bitcoin Service Provider complies with the Law and will operate in accordance with the Law; g) Capacity of the entity to audit and access the records of the Bitcoin Service Provider related to the services as necessary to evaluate the compliance of the Bitcoin Service Provider with the Law and the contract; h) Process for addressing customer complaints and delivery of information to customers; i) Relevant insurance coverage provided for the services;

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 4 of 7

j) Terms related to any use of the entity's facilities, equipment, systems, or employees; k) Obligation of the Bitcoin Service Provider to cooperate jointly with the entity in case there is an inspection of the entity by the Superintendence or another authority; especially regarding the Bitcoin Service Provider's knowledge of the service provided and its respective operational and accounting records; l) Responsibilities and prohibitions of each of the parties; m) Detail of the activities and functions of each of the parties in the provision of the service; n) Indemnification provisions that consider the adequate distribution of risks between the parties; and o) Other elements that are considered necessary or appropriate to address in said contract. Before signing said contract, the Entity's Board of Directors, or a delegate of the Board, will review the contract to ensure that it complies with these Standards. The Entity's Board of Directors must authorize the start of the commercial relationship with the Bitcoin Service Provider and its eventual termination for justified causes.

Limits and Liability Art. 7.- An entity must avoid providing services to a Bitcoin Service Provider that, according to reasonable determination, is not operating legally; likewise, the Service Provider, and not the entity, will be responsible at all times for its own compliance with Applicable Laws and Regulations. Similarly, an entity cannot delegate its own compliance with Applicable Laws and Regulations to a Bitcoin Service Provider. Nevertheless, at all times the parties will comply with what is established in the service contract.

Regarding Operational Capacity Art. 8.- Prior to providing services to a Bitcoin Service Provider, an entity will ensure that it has sufficient operational capacities to do so, which include personnel, equipment, systems, technological platforms, financial resources, administrative control systems, security applications, information security, and business continuity, cybersecurity policies, appropriate business plans, manuals, procedures, policies, and internal controls to ensure the correct functioning and resilience of the services and their compliance with the Bitcoin Law and its Regulation.

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 5 of 7

Supervision Art. 9.- Entities will be subject to the supervision of the Superintendence, who will review the operations, books, and records of said entity and its compliance with respect to the Bitcoin Law and its Regulation, as well as what is established in these Standards.

CHAPTER III REGISTRATION, TRACEABILITY, REPORTS, AND MAINTENANCE OF RECORDS

Registration Art. 10.- Bitcoin Service Providers or entities that provide these services must register with the Central Bank in the Bitcoin Provider Register created for such purposes, in accordance with what is established in the Regulation of the Bitcoin Law.

Traceability Art. 11.- For any fund transfer that is greater than or equal to one thousand dollars or its equivalent in Bitcoin, measured at the time of the transaction, for which an entity is involved in the payment flow, said entity must obtain the following information:

Entity Category Level of Requirement Originator Information Name Required Account Number Required Address When available Financial Institution Identification Required Amount Negotiated Required Execution Date Required Beneficiary Information Name Required Address When available Financial Institution Identification Required Account Number Required Any other beneficiary identification information When available

Entities will establish policies and procedures based on best practices, including recommendations from the FATF and the Special Law for the Prevention, Control, and

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 6 of 7

Sanction of Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction. (2)

Suspicious Transaction Report Art. 12.- Entities must report to the Financial Investigation Unit of the Attorney General's Office a Suspicious Transaction Report in accordance with laws, instructions, and current regulations related to the prevention, detection, and control of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction. The entity will maintain the confidentiality of the content of said Suspicious Transaction Report. (2)

Maintenance of Records Art. 13.- Entities must retain records related to their bitcoin-based services for a period of fifteen years from the date of the transaction.

CHAPTER IV OTHER PROVISIONS AND VALIDITY

Sanctions Art. 14.- Non-compliance with the provisions contained in these Standards will be sanctioned by the Superintendence in accordance with what is provided in the Law on Supervision and Regulation of the Financial System.

Unforeseen Aspects Art. 15.- Unforeseen aspects in regulatory matters in these Standards will be resolved by the Central Bank through its Committee of Standards.

Validity Art. 16.- These Technical Standards will enter into force as of September 7, two thousand twenty-one.

MODIFICATIONS: (1) Modifications in the considerations I and II, and in Articles 3 and 5, approved by the Central Bank through its Committee of Standards, in Session No. CN-03/2025, of May 30, two thousand twenty-five, in consistency with reforms contained in Legislative Decree No. 199 to the Bitcoin Law, with validity as of June 16, two thousand twenty-five.

CNBCR-12/2021 NRP-29 TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021 Alameda Juan Pablo II, between 15 and 17 North Avenue, San Salvador, El Salvador. Tel. (503) 2281-8000 www.bcr.gob.sv Page 7 of 7

(2) Modifications in Articles 2, 3, 11, and 12, approved by the Central Bank through its Committee of Standards, in Session No. CN-09/2025, of November 10, two thousand twenty-five, with validity as of November twenty-five, two thousand twenty-five.