General Resolution 638-2022 - Corporate Governance Regulation for Supervised Institutions of the National Banking and Insurance Commission

PURPOSE This Regulation aims to establish the guidelines to be implemented by Supervised Institutions and Financial Groups authorized by the National Banking and Insurance Commission, with respect to the structuring, functioning, and implementation of their Corporate Governance, in order to promote best practices in their internal control, in the management of their risks, and in internal policies, in accordance with international standards and principles and the legal framework in force in the country.

SCOPE This Regulation shall be applicable to Supervised Institutions, based on their size, nature, complexity, and risk profile, as well as to the Financial Groups of which they are a part. In the case of those Supervised Institutions whose special laws establish particular provisions regarding the composition and functioning of their Corporate Governance, they must comply in a supplementary manner with the principles and best practices of Corporate Governance established in this Regulation, considering international standards applicable to each supervised sector. The Board of Directors, Directive Board, or its equivalent, is responsible for the administration and proper management of the institutions. The National Banking and Insurance Commission shall conduct the relevant supervision when it deems appropriate, and may also require the measures or adjustments it deems convenient for compliance. Risk Rating or Classification Societies constituted abroad that operate in the country shall be subject to this Regulation in all respects that apply to them.

COMPLIANCE WITH APPLICABLE LEGISLATION AND REGULATIONS ON CORPORATE GOVERNANCE Supervised Institutions and Financial Groups must ensure compliance with this Regulation, being proactive in the adoption of international principles and best practices of Corporate Governance; which includes the establishment of adequate mechanisms to achieve this purpose.

CONCEPT OF CORPORATE GOVERNANCE Corporate Governance shall be understood as the set of norms and principles that regulate internal relations among the Shareholders' Assembly, the Board of Directors, Directive Board, or its equivalent to the foregoing, Financial Group, the Supervisory Body, Senior Management, and employees, who provide the structure to establish the Institution's objectives, the manner and means for achieving them, as well as the monitoring mechanisms for their compliance. This concept also encompasses the relations of Supervised Institutions with the general public and other stakeholder groups. Corporate Governance defines the manner in which authority is granted or established and corporate decisions are made.

INCORPORATION OF CORPORATE GOVERNANCE PRINCIPLES IN THE BYLAWS AND POLICIES OF SUPERVISED INSTITUTIONS The Bylaws of Supervised Institutions and the policies of institutions governed by their own Law must contain principles relating to Corporate Governance, such as:

• 1)

  The maximization of value in the interest of shareholders or their equivalent, affiliates or contributors, or the Assembly of Governors as applicable;

• 2)

  The essential role of the Board of Directors, Directive Board, Assembly of Participants and Contributors, or Directive Council in the direction, administration, and oversight of the Institution as applicable;

• 3)

  The organizational structure;

• 4)

  Informational transparency in relations with shareholders, investors, affiliates or contributors, employees, users, and other stakeholder groups; and,

• 5)

  The administration of the various risks to which they are exposed.

DEFINITIONS For the purposes of this Regulation, the following shall be understood as: 1. Shareholders or Their Equivalent: Refers to the natural or legal person who holds the status of owner, partner, or contributor in accordance with the applicable Supervised Institution. 2. Senior Management: Group of persons responsible for the daily, sound, and prudent management of the Supervised Institution to the Board of Directors, Directive Board, or equivalent body, in accordance with the organizational structure of each institution. It shall be the responsibility of each Institution to identify them. 3. Risk Appetite: The aggregate level and types of risk that a Supervised Institution is willing to assume within its risk capacity to achieve its strategic objectives and business plan. It can also be understood as the amount of risk that a Supervised Institution decides to take within its risk capacity. 4. Risk Capacity: The maximum level of risk that a Supervised Institution can assume given its current level of resources before exceeding the restrictions determined by regulatory capital and liquidity needs, the operating environment, such as technical infrastructure, capacity for risk management, and expert knowledge. 5. Capital: Financial resource that protects Supervised Institutions from unexpected losses and must be aligned with the risks assumed; being an indispensable element for the stability and solvency of the Institution. For purposes of the pension sector, the term Capital in this Regulation is equivalent to Solvency. 6. Commission or CNBS: National Banking and Insurance Commission. 7. Senior Management Committees: Committees created in support of Senior Management's work for the operation of Supervised Institutions, which may be composed of the members that Senior Management determines. 8. Administration or Directive Body Committees: Committees constituted for the purpose of supporting the direction and oversight activities of the Board of Directors, Directive Board, or its equivalent, with the purpose of increasing effectiveness and deepening in certain areas. 9. Conflict of Interest: When a person in the exercise of their functions within a Supervised Institution experiences a conflict between their own interest or that of their related parties and institutional interest. 10. Independent Counsel or Director: Member of the Board of Directors, Directive Board, or its equivalent, without operational management responsibilities in the Supervised Institution and Financial Group who is not under any internal or external, political, or ownership influence that prevents them from pronouncing themselves objectively on a matter. 11. Common Control: When in two or more companies, natural or legal persons, directly or indirectly, own the majority of the shares, partnership interests, or have significant influence to control the election of Counselors or Directors or direct the policies of said companies with a particular interest. 12. Risk Culture: Norms, attitudes, and behaviors of a Supervised Institution related to risk and decisions on how to manage and control them; in such a way that contributes to the creation and protection of institutional value driven by communication, collaboration, and cooperation. 13. Risk Appetite Declaration: Document in which the Supervised Institution establishes the aggregate level of types of risks it is willing to accept or avoid to achieve its business objectives. It includes qualitative statements, as well as quantitative measures formulated regarding profits, capital, risk measures, liquidity, and other relevant measures as necessary. It must also address risks that are more difficult to quantify, such as reputational risks, as well as risks of asset laundering and terrorism financing, and unethical practices; which must be made available to the Supervisory Entity. 14. Oversight Functions: Those responsible for providing comprehensive and independent oversight at the institutional level, as well as control and monitoring of operational management, such as: Internal Audit, Risk Management, Actuarial Analysis, Financial Analysis, Regulatory Compliance, Senior Management, Board of Directors, Directive Board, or its equivalent, among others according to the nature, size, scope, complexity, and risk profile of the Supervised Institution in accordance with the Comprehensive Framework for Risk-Based Supervision. 15. General Manager or Its Equivalent: Responsible for executing the provisions of the Board of Directors, Directive Board, or its equivalent. 16. Related Economic Group: Legal persons that maintain between themselves a direct or indirect relationship of ownership or executive management with a Supervised Institution. 17. Financial Group: One constituted by one or more institutions of the financial system. In addition, it may be composed of one or more of the following institutions: currency exchange houses, general warehouses for deposits, insurance institutions, reinsurance institutions, credit card issuers and/or administrators, leasing companies, stock brokers, centralized custody, compensation, and liquidation of securities deposits, pension fund administrators, remittance companies, investment fund management companies, mutual fund management companies, companies dedicated to the discounting of documents, and others with similar financial purposes and activities that the Commission approves. 18. Stakeholder Groups: Involves all areas and persons over which the Supervised Institution or Financial Group has influence, such as: shareholders, officials or executives and employees, users, competitors, control and oversight regulatory bodies, community, and providers of goods and services as applicable. 19. Suitability: Qualities relating to technical, financial, and moral capacity defined by the Supervised Institution to hold a position at the level of Board of Directors, Directive Board, or its equivalent, as well as members of Senior Management and employees, in accordance with best practices. 20. Financial Suitability: Relative to solvency in the payment of obligations, level of indebtedness, and patrimonial statement, defined by the Supervised Institution for the performance of the position of Counselor, Director, or its equivalent, as well as members of Senior Management. It shall be the responsibility of each Institution to define the parameters for compliance with Financial Suitability. 21. Moral Suitability: Concerning ethical conduct, honesty, diligence, independence, and recognized honorability, defined by the Supervised Institution for the performance of the position of Counselor, Director, or its equivalent, as well as members of Senior Management and employees. It shall be the responsibility of each Institution to define the parameters for compliance with Moral Suitability. 22. Technical Suitability: Professional ability and capacity, intellectual development, knowledge and experience in the business, defined by the Supervised Institution for the performance of the position of Counselor, Director, or its equivalent, as well as members of Senior Management and employees. It shall be the responsibility of each Institution to define the parameters for compliance with Technical Suitability. 23. Significant Influence: That exercised by natural persons in the decision-making of financial or operational policy in one or more legal persons, without necessarily having control of said policies by majority of votes, nor common control. It can be exercised in various ways, generally through representation on the Board of Directors, Directive Board, or its equivalent, but also through participation in the policy-setting process, significant transactions between members of the same economic group, exchange of Counselors or Directors, or technological dependency. Significant influence can be obtained, among other ways, through participation in ownership, by legal right, or by agreement. 24. Law: Laws applicable to each Supervised Institution. 25. Risk Limits: Quantitative measures based on forward-looking assumptions that determine the declaration of appetite for the Institution's aggregate risk, such as the measurement of losses or negative events for lines of business, subsidiaries, specific categories of risk, and concentrations. 26. Lines of Defense: Areas or organizational functions that contribute to the management and control of the risks of Supervised Institutions. These are divided into three: a) First Line of Defense: Responsible for the daily management of risks, focused on identifying, assessing, and reporting each exposure, taking into consideration the approved risk appetite and its policies, procedures, and controls. It is generally associated with lines of business or significant activities of the Supervised Institution. Lines of business or operational management have ownership over risk, so they must recognize and manage the risk they assume in the exercise of their activities; b) Second Line of Defense: Complements the first through monitoring and reporting to the respective authorities. It generally includes the risk management function, the regulatory compliance function, including matters relating to the prevention of asset laundering and terrorism financing, or other oversight functions as established by the Commission; and, c) Third Line of Defense: Consists of an independent and effective Internal Audit function that provides the Board of Directors, Directive Board, or its equivalent, with information on the quality of the risk management process. Additionally, it is responsible for conducting general and risk-based reviews to assure the Board of Directors, Directive Board, or its equivalent, that the Corporate Governance Framework, including the Risk Governance Framework, is effective and that policies and processes exist and are consistently applied. 27. Risk Appetite Framework: Overall approach that includes the policies, processes, controls, and systems through which risk appetite is established, communicated, and monitored. 28. Corporate Governance Framework: Set of laws, norms, regulations, policies, manuals, and responsible and transparent ethical practices, which must be aligned with international principles and best practices. 29. Risk Governance Framework: Component of the corporate governance framework, through which the Board of Directors, Directive Board, or its equivalent, and Senior Management establish and make decisions on risk strategy and methodology, articulate and monitor compliance with risk appetite and limits according to their strategy, as well as their identification, measurement, management, and control of risks. 30. Administration or Directive Body: Refers to the Board of Directors, Directive Board, Assembly of Participants and Contributors, or its equivalent to the foregoing. 31. Supervisory Body: Refers to the Oversight Board defined in the Law of Private Organizations for Financial Development (OPDF). 32. Related Party: Related parties are considered to be:

• a)

  Natural or legal person that maintains a relationship with Supervised Institutions by direct or indirect ownership or by executive management;

• b)

  Natural persons who have bonds by conjugal relationship or kinship up to the second degree of consanguinity and first degree of affinity with the partners or administrators of Supervised Institutions; and,

• c)

  Natural or legal persons who exercise or may exercise control or significant influence, directly or indirectly, on Supervised Institutions. 33. Risk Profile: Assessment over time of the risk exposures of the Supervised Institution, after taking into account the mitigants. 34. Financial Group Responsible Company: One constituted in Honduras, authorized by the Commission that exercises representation of the Financial Group, including member companies of the same domiciled abroad. 35. Risk Tolerance: The level of variation in the deviation from risk appetite that a Supervised Institution is willing to accept to achieve its institutional objectives. It refers to what the Institution can afford when managing risks and that, if it appears, it must be capable of supporting. It also serves as an alert to avoid reaching risk capacity. 36. Users: Natural or legal persons with which a relationship of a financial, economic, or commercial nature is established; such as Clients, Insured Persons, Contributors, Affiliates, and Beneficiaries of the products and services offered by Supervised Institutions by the National Banking and Insurance Commission.

BASIC RIGHTS OF SHAREHOLDERS OR THEIR EQUIVALENT The Corporate Governance framework of the Supervised Institution must ensure the greatest added value for shareholders or their equivalent, including transparency, protection of their rights, and equal treatment of the same, whether majority, minority, national, or foreign, as well as the elimination of impediments for cross-border voting, including the protection of their personal, political, social, administrative, and property rights, within the framework of what is established by the Commercial Code, other applicable laws, Bylaws, and international principles, with the Institution having policies and norms that determine adequate Corporate Governance management.

RIGHT TO INFORMATION Shareholders or their equivalent have the right to participate and be sufficiently informed about decisions that entail fundamental changes in the Supervised Institution, such as:

• 1)

  Reforms to the Bylaws or to the deeds of incorporation;

• 2)

  Amendments to the laws applicable to supervised institutions governed by their own Law;

• 3)

  Authorization for the issuance of new shares;

• 4)

  Transactions and performance of extraordinary operations that represent a change in operations, in common control, or significant influence of the Supervised Institution; and,

• 5)

  Any other transaction that derives or may derive in the sale of the Supervised Institution or its withdrawal from the system to which it belongs.

RIGHT TO BE INFORMED ABOUT CAPITAL AGREEMENTS The Shareholders' General Assembly or its equivalent must be made aware of capital agreements that allow one or more shareholders or their equivalent to exercise control given their shareholding. Likewise, such information shall be understood to be disclosed to potential buyers of shares through public or private offering.

LOYALTY POLICIES The Administration or Directive Body shall promote the loyalty of shareholders, establishing special prudential policies for transactions carried out between them and the institution, within the applicable legal norms.

OBSERVANCE OF THE LEGAL FRAMEWORK TO PROTECT THE RIGHTS OF SHAREHOLDERS Stock markets, as well as information related to their acquisition and extraordinary transactions shall be governed by the provisions contained in the Commercial Code, the Law on securities markets and its current regulations, in particular, the provisions established in the public offering of securities and public information regulations, in order to ensure that investors understand their rights; and that transactions are carried out at transparent and efficient prices, as well as under fair and equitable conditions in order to protect the rights of all shareholders in accordance with their class.

PROHIBITION ON THE ADOPTION OF PROTECTIVE MEASURES AGAINST PUBLIC ACQUISITION OFFERS The Administration or Directive Body of the issuing Institution must act with neutrality and shall not adopt protective measures against Public Acquisition Offers, except if it has express authorization from the General Assembly. In the event of a Public Acquisition Offer, shareholders of the Institution must have the right to participate in the offer, provided that the negotiation is conducted on equal terms as those offered by third parties and in accordance with the provisions of the Law on securities markets and its current regulations.

TRANSFER OF CONTROL BY PUBLIC ACQUISITION OFFER The transfer of control must include adequate disclosure of the valuation criteria that support the public offer. For this purpose, the Administration or Directive Body of the issuing Institution must establish mechanisms that allow the holders of shares or other securities, susceptible to subscription or acquisition, to become aware of the Public Acquisition Offer and the conditions proposed by the offeror and to make an adequately reasoned decision in accordance with the provisions of the Law on securities markets and its current regulations.

RESOLUTION OF CONFLICT OF INTEREST The conflict of interest that arises among shareholders or their equivalent must be resolved through the conflict resolution mechanisms established in the legal framework of Supervised Institutions and the internal regulations issued by them. Supervised Institutions must establish general guidelines for implementing policies and procedures to resolve conflicts of interest; as well as matters relating to their disclosure in an effective, timely, and accurate manner to Stakeholder Groups.

LIMIT ON THE ISSUANCE OF PREFERRED SHARES When authorized by the Corporate Deed, Supervised Institutions may issue preferred shares or with restrictions on voting rights, without exceeding the limits established in the applicable law in force. The Supervised Institution that decides to issue preferred shares must contemplate within its Bylaws the possibility that the holders of said shares or securities may exchange them for ordinary shares with voting rights. These exchange processes must be carried out observing compliance with the conditions agreed upon and the obligation to respect the rights of the other shareholders of the company, regardless of their class.

MISUSE OF PRIVILEGED INFORMATION Shareholders or their equivalent, Board of Administration or Management and Senior Management must not conduct transactions on their own account or on behalf of third parties, making improper use of information, capacity, or privileged position to the detriment of the Supervised Institution, users, or other investors. CHAPTER III RISK GOVERNANCE

RISK GOVERNANCE The Board of Administration or Management and its committees are responsible for overseeing, strengthening, and promoting risk governance in Supervised Institutions, which must include a solid risk culture, a well-developed and articulated risk appetite through a Risk Appetite Framework, defined responsibilities for risk management in particular and control functions in general. The greater emphasis on risk and its corresponding Governance Framework includes identifying the responsibilities of the different parts of the organization to address and manage risk, through the three lines of defense. Supervised Institutions that, by their size and operational complexity, warrant it, must have a specific area to oversee and ensure the Regulatory Compliance Function; when the Supervised Institution is part of a financial group, this function may be exercised by the Institution responsible for the group; however, in those institutions whose organizational structure does not allow them to designate personnel to perform this function, it may be assumed by Senior Management or another Oversight Function, taking into account that the Board of Administration or Management must oversee and monitor the assigned responsibilities.

CIRCULAR CNBS No.015 Page No.13

RISK APPETITE FRAMEWORK The Board of Administration or Management must establish, approve, and monitor the Risk Appetite Framework; it must also ensure that it is aligned with the strategy, business plan, capital, and compensation and incentive practices of the Supervised Institution. This Framework shall comprise the risk appetite statement, risk limits, and a scheme of the roles and responsibilities of those who oversee implementation and monitoring. Additionally, this Framework must provide a common reference and comparable measures throughout the Supervised Institution so that Senior Management and the Board of Administration or Management can communicate, understand, and evaluate the types and levels of risk they are willing to accept.

RISK APPETITE STATEMENT The Board of Administration or Management must oversee that Risk Appetite be communicated to the entire institution through a Risk Appetite Statement, which must be understood by the Oversight Functions and other employees of the institution, and must be used as a tool to promote robust dialogue on risk and as a basis upon which recommendations and decisions can be discussed and effectively questioned.

RISK LIMITS The Board of Administration or Management must ensure that quantitative measures are established based on assumptions that determine tolerance levels to limit risk-taking within the risk appetite, taking into account the public interest and the protection of users and shareholders of the Institution, as well as capital, risks, and concentrations, by line of business as required and expressed in general form with respect to earnings, capital, and liquidity, according to their relevance or other needs. These tolerance levels must be monitored regularly, but must not be complicated, ambiguous, or subjective in comparison to peers or to a failure to meet regulatory limits. For non-quantifiable risks, limits must be measurable through qualitative assessments.

ROLES AND RESPONSIBILITIES The Risk Appetite Framework must be clear and establish the responsibilities of each area of the Supervised Institution. The relationships between the Board of Administration or Management, Senior Management, the Risk Officer, the Finance Officer, business lines, and internal audit must be solid as they play an important role in the effectiveness of the Risk Appetite Framework. They must have defined mandates and responsibilities for each of these governance levels. Supervised Institutions must assign precise roles and responsibilities in accordance with their organizational structure, size, and complexity.

CIRCULAR CNBS No.015 Page No.14

BODY RESPONSIBLE FOR ADMINISTRATION The Board of Administration or Management of a Supervised Institution must maintain an appropriate structure in terms of the number and composition of its members, according to the nature, size, scope, complexity, and risk profile of the Supervised Institution, and in the case of those governed by their own Law or Regulation, according to what they establish. Likewise, it must include suitable persons with a balance of skills, experience, competence, and knowledge that, individually and collectively, possess the necessary aptitudes to manage the Institution. Members of the Board of Administration or Management of Supervised Institutions cannot hold another position within the same, except in the case of the General Manager, Executive President, or their equivalent, who may not serve as Presidents of the Board of Administration or Management, except in highly qualified cases that, in accordance with applicable laws, the Commission authorizes. Nor can employees and advisors of the Supervised Institution be members of the Board of Administration or Management. Officials or executives and employees may be present at meetings of the Board of Administration or Management, at the request of the latter, exclusively to submit reports and answer questions from such Board.

ADMINISTRATION OF FOREIGN SUPERVISED INSTITUTIONS The branches of foreign Supervised Institutions must conduct their Administration in compliance with the provisions of this Regulation, to the extent applicable, and in any other aspect requested by the Commission in matters of Corporate Governance, and must maintain information demonstrating the management of Corporate Governance, without prejudice to the provisions approved by their Parent Company for the local or regional Institution. For the composition of Committees, they may be integrated by officials or executives of the Parent Company or Branches in another country; however, at least one member of the Committees must have their official domicile in Honduras, which must be established through a Point in the Minutes of the Board of Administration or Management to which the foreign branch reports or depends, as well as the respective functions of the Committee and each of its members, which must be available to the Commission when requested.

CIRCULAR CNBS No.015 Page No.15 Likewise, the Foreign Branch must have the organizational structure that indicates its hierarchical and functional dependence on the Parent Company, for review by the Commission when it so requires.

TERM FOR THE EXERCISE OF FUNCTIONS The Board of Administration or Management shall exercise its functions for the term for which it was appointed, and in the case of supervised institutions governed by their own Law or Regulation, the term shall correspond to what is established in the same.

SUPPORT COMMITTEES TO THE BOARD OF ADMINISTRATION OR MANAGEMENT The Board of Administration or Management must structure at least the following committees:

• 1)

  Internal Audit Committee;

• 2)

  Human Resources Committee;

• 3)

  Corporate Governance Committee;

• 4)

  Risk Committee;

• 5)

  Others as required by the Commission or applicable legal framework; and,

• 6)

  Others that the Board of Administration or Management may constitute, which must be congruent and consistent with the nature, size, scope, complexity, and risk profile of the Supervised Institution. These Committees must be composed of one or more members of the Board of Administration or Management, with one of them assuming the presidency, and may include officials or executives and employees of the Supervised Institution that the Board of Administration or Management determines. In the particular case of Risk and Internal Audit Committees, these must be chaired by a mandatory Independent Councilor or Director; who may not chair both Committees. However, if the Supervised Institution has only one Independent Councilor or Director, this person may chair both committees. To the extent possible, the President of the remaining committees should be an Independent Councilor or Director. The foregoing does not apply to Supervised Institutions governed by their own Law or Regulation and in which the figure of Independent Director is not contemplated. Supervised Institutions must define policies and guidelines on the constitution, functioning, and responsibilities of such Committees, within which aspects related to the rotation period and mechanisms for evaluating their members and the committee as a whole, as well as the holding of sessions with the necessary frequency, must be considered; this must be established through internal regulations approved by the Board of Administration or Management of the Supervised Institution. With respect to agreements, deliberations, and conclusions of sessions, these must be recorded through Minutes.

  CIRCULAR CNBS No.015 Page No.16 When the Supervised Institution is part of a Financial Group, it may establish Committees at the Group level, which must be composed of executives from each of the Institutions that form part of the Financial Group, which must be established through a Point in the Minutes of the Board of Administration or Management, as well as the approval of the Committee's functions and each of its members, which must be available to the Commission when requested. The matters discussed in Committees formed by executives of the Financial Group must be documented independently from other institutional committees through minutes, of which each Institution that makes up the Group must maintain a documentary or electronic copy. Supervised Institutions shall establish the Committee required by the Law and Regulation in force on money laundering and terrorist financing.

SELECTION, EVALUATION, AND REMOVAL OF MEMBERS OF THE BOARD OF ADMINISTRATION OR MANAGEMENT The Board of Administration or Management of a Supervised Institution must have a clear and rigorous process for the selection, evaluation, and removal of its members, and must also have succession plans. Members of the Board of Administration or Management must be selected according to the following criteria:

• 1)

  Technical Fitness;

• 2)

  Financial Fitness; and,

• 3)

  Moral Fitness. The requirements listed in this Article are complementary to those established in the applicable Law for each type of Supervised Institution, when applicable. Regarding the selection and removal of members of the Board of Administration or Management of Supervised Institutions governed by their own Law, these must be framed in what is stated therein, and concerning the evaluation of such bodies, this must be incorporated into their Internal Regulations. The Board of Administration or Management is responsible for the overall interests of the Supervised Institution. The General Assembly of Shareholders or its equivalent must ensure that members of the Board of Administration or Management comply at all times with the assigned responsibilities, and the General Assembly of Shareholders, or its equivalent, must take the measures or actions it deems appropriate when it verifies that any of them does not comply with their

  CIRCULAR CNBS No.015 Page No.17 responsibilities or requirements, and must notify the Commission of the measure or action taken no later than the next business day after it was adopted. Members of the Board of Administration or Management of Supervised Institutions must not be within the prohibitions indicated by each of the special laws; in case these do not establish any provision of this type, the prohibitions indicated in the Financial System Law shall apply supplementarily. For effective management of corporate governance practices, the Board of Administration or Management of Supervised Institutions, according to the nature, size, scope, complexity, and risk profile, must:

  • 1)

    Establish policies and methodologies for the selection, evaluation, training, and succession of members of the Board of Administration or Management, approved by their General Assembly of Shareholders or equivalent, that ensure that members of the Board of Administration or Management are qualified and have no conflict of interest to develop their functions objectively and independently within such body;

  • 2)

    Define appropriate procedures and practices that ensure that members of the Board of Administration or Management satisfactorily fulfill all assigned functions and responsibilities;

  • 3)

    Establish, by the Board of Administration or Management, policies and practices for periodic evaluation of the effectiveness of its management, that of its Committees and its members; as well as actions to be taken in case there are reservations or doubts about the performance of some of its members, and these evaluations may be conducted with the help of external experts; and, 4. Establish any other mechanism that the Supervised Institution considers appropriate. The Commission may require a Supervised Institution to establish additional requirements to those described above for members of the Board of Administration or Management, considering for this the nature, size, scope, complexity, and risk profile of the Institution.

RESPONSIBILITIES OF THE BOARD OF ADMINISTRATION OR MANAGEMENT The Articles of Incorporation and Social Statutes must contain provisions relating to the internal regime and functioning of the Board of Administration or Management, and in the case of those Supervised Institutions whose own legal framework of

CIRCULAR CNBS No.015 Page No.18 incorporation does not determine the responsibilities of the Board of Administration or Management, they must establish internal regulations where the provisions referenced in this Article are defined. Such provisions must indicate, among others, the obligations dictated in this Regulation, as well as the non-delegable character with which such Body must assume at least the following responsibilities:

• 1)

  Approve the general strategies of the Supervised Institution, organizational structure, budget, business plan, and other policies, which must be communicated at the institutional level; likewise, monitor the execution and compliance of these strategies and determine objectives regarding results;

• 2)

  Act with independence and exercise good practices to ensure the right and equitable treatment of shareholders or their equivalent;

• 3)

  Provide and have access to accurate, relevant, and timely information for decision-making on all relevant aspects of the Institution;

• 4)

  Ensure that duties and responsibilities are transmitted to new members of the Board of Administration or Management; and update them on decisions adopted up to the time of their appointment, the financial situation of the Institution, policies, processes, standards, procedures, manuals, or others on Corporate Governance;

• 5)

  Hold meetings and document the deliberations and decisions of each meeting in the corresponding Minutes; providing sufficient advance information to members of the Board of Administration or Management prior to holding sessions. The Minutes must be available to the Commission when requested;

• 6)

  Approve policies that promote the establishment of ethics culture and corporate values, ensuring that they are applied permanently throughout the Institution;

• 7)

  Establish procedures to follow for the separation or disqualification of Councilors or Directors of the Board of Administration or Management when these do not fully perform their functions or responsibilities, as well as when they lose their fitness by being within the prohibitions established in the Law, this regulation, or others defined by the Institution;

• 8)

  Approve documents or guidelines containing information on personnel selection, induction, and continuous training policies, financial and administrative incentives offered to Senior Management and other employees. These incentives must be aligned with the Risk Appetite Framework and the business strategy of the Institution;

• 9)

  Approve policies for the selection, evaluation, appointment, removal, and succession of Senior Management, managers of the Risk Management Unit, Internal Audit Unit, Regulatory Compliance Unit, Committees, and others performing oversight functions;

• 10)

  Ensure that the knowledge and experience of Senior Management are appropriate to the nature of the business and the risk profile of the Institution;

• 11)

  Promptly make known to the Commission and to the Assembly of Shareholders or its equivalent, when this has been legally convened or notified, about situations, events, or problems that affect or could significantly affect the Institution, as well as the concrete actions to address or remedy identified deficiencies or weaknesses, establishing in its internal policies the guidelines for compliance with what is described in this item;

• 12)

  Approve mechanisms for identifying, monitoring, verification, and control of risk exposures under good practices, including relationships with Related Parties or Economic Groups, shareholders, Senior Management, or other authorized officials or executives and employees in decision-making in accordance with the Risk Appetite Statement;

• 13)

  Know and understand the main risks to which the Institution is exposed, as well as know the stress tests, their results, and issue the instructions necessary to carry out the corresponding actions;

• 14)

  Review and monitor the risk profile of the Institution;

• 15)

  Approve the mechanisms required for deviations from the risk management strategy or those taken in excess with respect to the established Risk Appetite;

• 16)

  Approve and supervise the implementation of institutional risk self-assessment processes and the internal control system through the corresponding body;

• 17)

  Prevent the manipulation, dissemination, or use for the benefit of itself or others of privileged or confidential information for internal use to which it has access, as well as assets to which it has access in the exercise of its position, committing to handle them prudently;

• 18)

  Establish appropriate systems of supervision and control among the different hierarchical levels of the administrative structure of the Institution and Financial Group;

• 19)

  Approve the hiring and compensation of the External Audit Firm;

• 20)

  Know the reports on the institution issued by the Commission, external audit, or other regulatory control and oversight bodies, as well as by the oversight functions, and instruct on their adoption, correction, and periodic monitoring, and must be informed of the progress;

• 21)

  Establish mechanisms for access for officials or executives and employees of the Institution to report possible illicit or irregular acts that may affect it economically, or the image and reputation thereof;

• 22)

  Manage conflict of interest situations, whether permanent or temporary, that may arise between the Institution, shareholders, members of the Board of Administration or Management, and Senior Management;

• 23)

  Authorize transactions between the Institution, majority shareholders, controllers, and members of the Board of Administration or Management, Financial Group, or Related Parties, in accordance with the provisions of the applicable legal framework;

• 24)

  Approve the contracting of services with third parties when applicable;

• 25)

  Approve preventive recovery and resolution plans; and, 26. Other responsibilities inherent to the performance of its activities or that have been required by the Assembly of Shareholders or its equivalent or that the Commission may require in accordance with good practices and international standards.

FUNCTIONING OF THE CORPORATE GOVERNANCE FRAMEWORK The Board of Administration or Management must ensure that the Supervised Institution has adopted principles and good practices that allow it to have adequate functioning of the Corporate Governance Framework, as well as its

CIRCULAR CNBS No.015 Page No.21 interaction with the different Committees. For these purposes, it must formulate, approve, and ensure the application of policies and essential documentation, organizational rules, codes of conduct, Committee mandates, procedures, contingency and business continuity plans, compliance program, among others, which must be disseminated effectively, as well as their updates, depending on their confidentiality; in the case of institutions governed by their own Law, they must comply with what is established in such Law or in the Regulation that governs their activity. The Board of Administration or Management is responsible for the oversight of Oversight Functions, and Senior Management for operational areas.

DILIGENCE AND LOYALTY OF MEMBERS OF THE BOARD OF ADMINISTRATION OR MANAGEMENT Members of the Board of Administration or Management must act with diligence and loyalty toward the Supervised Institution, and must comply with the duties established by laws, regulations, normative provisions, and the Social Statutes. The Board of Administration or Management has responsibility for third-party resources that it administers and acts taking into account the legitimate interests of the Stakeholder Groups. A key element for those institutions that are part of the structure of a Financial Group is that, although the Institution is controlled by another, the duty of diligence and loyalty of the Board of Administration or Management is toward the former and not toward the one controlling the Financial Group.

PRESIDENT OF THE BOARD OF ADMINISTRATION OR MANAGEMENT The President of the Board of Administration or Management plays a fundamental role in the functioning of this body, providing leadership and responsibility for its proper functioning; furthermore, it is essential for maintaining independence and its capacity to effectively execute its mandate. Likewise, this person must have experience, competencies, personal and professional qualities, and the time to assume their functions.

FUNCTIONS OF THE PRESIDENT OF THE ADMINISTRATIVE OR MANAGEMENT BODY AND OF THE GENERAL MANAGER OR EQUIVALENT The functions of the President of the Administrative or Management Body and General Manager or equivalent must be clearly defined in the Bylaws, Laws or Regulations that govern their activity or in the internal regulations of the Supervised Institution. Likewise, this person must maintain permanent dialogue with the other members of the Administrative or Management Body, access to information of the Supervised Institution and of the officials or executives and employees, promoting permanent communication with the Commission or other regulatory control and supervision bodies.

SUPERVISION OF SENIOR MANAGEMENT The Administrative or Management Body must supervise the work of Senior Management in adherence to the values, risk appetite and risk culture of the Supervised Institution, and must take appropriate actions when the acts or consequences thereof are not aligned with the performance expectations of the Administrative or Management Body, considering at least the following:

• 1)

  Ensure that the actions of Senior Management are consistent with the strategy and policies approved by the Administrative or Management Body, in order to request clarification and critically review the explanations and information provided by Senior Management;

• 2)

  Hold meetings with Senior Management to monitor the management of the Institution;

• 3)

  Establish career and succession plans for Senior Management positions through the appropriate body; and, 4. Maintain regular interaction with any Committee that it has established, as well as other key functions and proactively request information from them and request clarification and critically review the information when necessary.

COMPENSATION POLICIES The Administrative or Management Body must approve compensation policies, whether fixed or variable according to the needs of the Supervised Institution or Financial Group, which do not incentivize excessive risk-taking and which in all cases must be coherent and aligned with the Risk Appetite Framework. Additionally, they must incorporate measures to prevent conflicts of interest. Similarly, the Administrative or Management Body must approve extraordinary bonuses when granted to officials or executives in an appropriate time horizon. In the case of Supervised Institutions governed by their own Law, they may receive extraordinary bonuses provided that their legal framework permits it. The compensation plan or policy for members of the Administrative or Management Body must be approved by the General Assembly of Shareholders or equivalent and shall be related to the time dedicated and performance in fulfilling their responsibilities within the Supervised Institution, the financial situation thereof and participation in Committees. Remuneration must reflect risk exposure and its results. Compensation practices must be established based on performance and possible future benefits, and in case there is uncertainty regarding their achievement, these must be evaluated through qualitative and quantitative indicators, in coherence with the ethics policy and professional standards. The remuneration framework must allow for adjustment of variable remuneration in order to contemplate all risks, including deviations from the limits of the Risk Appetite Framework, internal procedures or legal requirements. Compensation policies must extend, to the extent possible, to the subsidiaries of the Supervised Institution.

SUITABILITY OF SENIOR MANAGEMENT In order to fulfill their responsibilities, members of Senior Management must possess the financial, moral and technical suitability to manage and supervise the businesses and activities under their charge. Members of Senior Management must update their knowledge through continuous training to maintain and improve their competencies related to their areas of responsibility.

FUNCTIONS AND RESPONSIBILITIES OF THE GENERAL MANAGER OR EQUIVALENT The General Manager or equivalent is responsible for directing and supervising the effective management of the Supervised Institution in accordance with the powers delegated by the Administrative or Management Body, and must comply with applicable laws and regulations. The functions and responsibilities of the General Manager or equivalent must be oriented at least to the following:

• 1)

  Implement the strategies of the Supervised Institution, the risk appetite framework, the organizational structure and the policies of the Institution;

• 2)

  Have sufficient autonomy to carry out the daily operations of the Supervised Institution effectively and in accordance with the ethical culture, in accordance with the interests and long-term viability of the Institution;

• 3)

  Act under the same principles of diligence, loyalty and confidentiality applicable to members of the Administrative or Management Body;

• 4)

  Formulate and provide adequate and timely information to the Administrative or Management Body that allows it to carry out its duties and functions, including the monitoring and review of performance and risk exposures of the Institution, as well as the performance of Senior Management members, without prejudice to the responsibilities established in the Bylaws and in the case of Supervised Institutions governed by their own Law or Regulation what these establish, as well as other matters that the Commission may require;

• 5)

  Implement and promote a comprehensive risk management system, ensuring that all members of Senior Management make decisions consistent with it, and effectively communicate the risk appetite to all officials or executives and employees of the Institution;

• 6)

  Ensure that business lines have a process to identify, measure, monitor and report timely on the risk profile and identify deviations from the limits and significant exposures in a timely manner;

• 7)

  Promote regulatory compliance and fair treatment toward the Institution's Stakeholder Groups;

• 8)

  Inform the Administrative or Management Body about situations of conflict of interest that may affect them and about matters or transactions of the Supervised Institution in which they have a personal interest;

• 9)

  Implement timely the recommendations and correct the deficiencies found by internal and external auditors, the Commission and other regulatory control and supervision bodies; and, 10. Other functions and responsibilities inherent to the performance of their activities or that have been required by the Administrative or Management Body or at the request of the Commission or other control and supervision bodies.

IMPEDIMENTS TO ACT AS AN INDEPENDENT COUNSELOR OR DIRECTOR In addition to the impediments set forth in the applicable Law for Counselors, Directors or equivalent, the Independent Counselor or Director must not be comprised in the following conditions:

• 1)

  Be a shareholder of the Supervised Institution;

• 2)

  Be an advisor to the Supervised Institution, partner or employee of firms acting as consultants to the Institution or its affiliates and whose income depends on this contractual relationship;

• 3)

  Be an important supplier or debtor, as defined by the Supervised Institution;

• 4)

  Be an employee of a foundation, university, association or civil society that receives or grants important donations from the Supervised Institution;

• 5)

  Be a General Manager or equivalent, official or high-level executive of the Supervised Institution or of institutions of the same Financial Group, its parent company or Related Economic Group national or foreign;

• 6)

  Have a link by marital relationship or kinship within the fourth degree of consanguinity and second degree of affinity with the shareholders or administrators of the Supervised Institution; as well as with the other persons mentioned in the previous numerals of this Article; and, 7. Simultaneously hold another position on the Board of Administration, Board of Directors or equivalent. For purposes of numeral 3) of this Article, it shall be the responsibility of the Supervised Institution to incorporate as part of its internal policies the criteria that will be considered to define an important supplier or debtor. Notwithstanding, the Commission may make the corresponding observations according to its evaluations.

PARTICIPATION OF INDEPENDENT COUNSELORS OR DIRECTORS IN THE ADMINISTRATIVE OR MANAGEMENT BODY The composition of the Administrative or Management Body must be such that it facilitates the execution of its responsibilities. For this purpose, it must include Independent Counselors or Directors, in accordance with its size, scope, complexity and risk profile. Likewise, the provisions set forth in the Law or Regulation that governs its activity shall apply to them. Independent Counselors or Directors must attend and participate in the sessions of the Administrative or Management Body of the Supervised Institution, with voice and vote, which must appear in the corresponding minutes. No Independent Counselor or Director may hold any other position in the Administrative or Management Body, in the same or another Supervised Institution engaged in the same line of business whether national or foreign. Notwithstanding, an Independent Director may hold a similar position in the Administrative or Management Body of other institutions that are part of the financial group. For Supervised Institutions governed by their own Law or Regulation, the appointment of the Independent Director shall correspond when these so indicate.

ON THE POSITION OF COMMISSIONER The appointment of the Commissioner shall correspond to Supervised Institutions when the Commercial Code, their Law or Regulation so establishes. The person designated as Commissioner in a Supervised Institution must comply with the requirements demanded of members of the Administrative or Management Body. Likewise, the impediments set forth in the Financial System Law or its applicable Law shall apply to them.

POWERS AND OBLIGATIONS OF THE COMMISSIONER In addition to the powers and obligations set forth in the Commercial Code, Bylaws, Law or Regulation that applies to the Commissioner, it shall correspond to the Commissioner at least the following:

• 1)

  Prepare reports of the Supervised Institution to be presented to the Assembly of Shareholders or equivalent, related to comprehensive risk management, corporate governance, financial and equity situation, as well as any other relevant aspect;

• 2)

  Sign the minutes of the sessions of the Assembly of Shareholders or equivalent and those corresponding to the Administrative or Management Body;

• 3)

  Present in the sessions of the Administrative or Management Body the recommendations that it deems necessary for the strengthening of the management of the Supervised Institution; and, 4. Other powers and obligations inherent to the performance of their activities or that have been required by the Administrative or Management Body or at the request of the Commission or other control and supervision bodies.

MINIMUM GUIDELINES APPLICABLE TO THE COMMISSIONER Supervised Institutions must have minimum guidelines applicable to the processes and methodologies for the selection, remuneration, evaluation, training and replacement of the Commissioner, as well as the functions and responsibilities assigned to the Commissioner.

SYSTEM OF INTERNAL CONTROL Supervised Institutions must have a system of internal control as a mechanism of support to the Administrative or Management Body. This system encompasses all personnel, policies, processes, limits, ethical culture and other aspects that support the achievement of the Institution's objectives, including processes for reporting reliable, timely and relevant information; likewise, the functions of risk management, Ethics and Compliance and Internal Audit. Furthermore, it must include policies and procedures that facilitate the efficiency of operations, that contribute to effective risk management, compliance with applicable laws and regulations, administration of computer systems that guarantee their proper functioning, security measures and contingency plans that comply with standards of confidentiality and integrity of information transmitted or stored in databases. All of this strengthens the capacity of the Supervised Institution to respond to business opportunities and challenges it faces. The system of internal control must also include processes through which the Administrative or Management Body, its support Committees, Senior Management, other officials or executives and the areas within the scope of their competence, verify compliance with the Institution's goals and objectives, as well as the reliability of financial and administrative reports for internal use, of the Commission, other regulatory and supervision bodies, or for purposes of disclosure of information to Stakeholder Groups. The system of internal control must be adequate to the nature, size, complexity and risk profile of the business and must be reviewed periodically in order to adapt it to changes and needs of the Institution's environment.

DOCUMENTATION OF THE SYSTEM OF INTERNAL CONTROL The system of internal control must be properly documented in manuals, policies and procedures for risk management and control, as well as in other standards of similar nature established by the Supervised Institution.

COMMITTEES For greater efficiency and depth in the analysis of matters within their competence and considering the size, nature, complexity and risk profile of the Supervised Institution, the Administrative or Management Body must establish Committees, in accordance with the responsibility set forth in Article 25 of this Regulation. The Administrative or Management Body must consider periodic rotation of Committee members to avoid excessive concentration of power and promote new perspectives. This rotation must take into account the competencies and experience of the nominated members.

REPORTS, RESOLUTIONS OR MINUTES OF THE COMMITTEES The results of the documents analyzed and the conclusions derived from the functions developed by the different Committees must appear in a report, resolution or minutes as appropriate, which must be brought to the attention of the Administrative or Management Body by the President of the respective Committee, with the frequency that the Supervised Institution deems appropriate. The content of the report, resolution or minutes as appropriate, which must disclose all important aspects addressed in each Committee, must be supported under a structure of information content in a clear, precise, reliable, objective, relevant and sufficient manner for decision-making. The accuracy and reasonableness of the information contained in the reports, resolutions or minutes as appropriate is the responsibility of the Committee members of the Institution and must be available at the request of the Commission.

ON THE RISK COMMITTEE The Risk Committee is responsible for ensuring sound risk management of the Supervised Institution, and it corresponds to the Administrative or Management Body to form it, ensuring that all its members have experience in risk management topics and practices, by virtue that this Committee must oversee and support the work of the Risk Unit, communicating to the Administrative or Management Body the relevant aspects determined and proposing, where appropriate, the corrective measures. This Committee shall have at least the following functions and responsibilities:

• 1)

  Propose to the Administrative or Management Body for approval, manuals, policies, procedures and plans for comprehensive risk administration;

• 2)

  Advise and inform the Administrative or Management Body on the current and future risk profile, monitoring the implementation of the Risk Appetite Framework and reporting the state of risk culture;

• 3)

  Propose to the Administrative or Management Body the statement of risk appetite and risk limits of the Supervised Institution;

• 4)

  Maintain periodic and fluid communication with other Committees of the Institution to facilitate the exchange of relevant information in relation to the functions of the Risk Committee;

• 5)

  Establish the risk exposures that involve significant variations in the risk profile of the Institution, which must be approved by the Administrative or Management Body;

• 6)

  Verify and monitor the implementation of necessary corrective actions, in case there are deviations with respect to risk tolerance levels and the degrees of assumed exposure;

• 7)

  Review, with the appropriate frequency, the efficiency of mechanisms related to methodologies, tools and procedures to identify, assess, mitigate, monitor and communicate the different types of risks to which the Institution is exposed;

• 8)

  Monitor liquidity and solvency management strategies to ensure they are coherent with risk appetite;

• 9)

  Evaluate and review the stress tests conducted by the Risk Management Unit, their results and the actions implemented derived from these; and,

• 10)

  Analyze the reports submitted by the Risk Management Unit. Without prejudice to the foregoing, this Committee may exercise other functions and responsibilities inherent to the performance of its activities that are deemed appropriate at the request of the Administrative or Management Body or the Commission.

COMPOSITION OF THE RISK MANAGEMENT UNIT AND REQUIREMENTS FOR ITS MEMBERS. Supervised Institutions must establish in their organizational structure an effective Risk Management Unit that is independent from business lines, in accordance with their structure, size, nature, complexity of operations, and risk profile. This Unit shall be responsible for the comprehensive risk administration system, which must contain strategies and processes that allow for the management of risks through the identification, evaluation, mitigation, monitoring, and communication of the different risks faced by the Supervised Institution, as well as their interrelations and potential impact on the business. Likewise, the Supervised Institution may contract specialists in specific risks. The Risk Management Unit shall not perform, process, or approve transactions. This Unit must possess sufficient personnel with technical suitability that enables the proper performance of its functions, and must participate in the design and ongoing adaptation of the Risk Appetite Framework, risk management manual, and other internal policies intended to define the responsibilities of business units and their officers or executives in the risk management of the Supervised Institution. The head of the Risk Management Unit must have independence with respect to business units and authority to report directly to the Governing Body or Board of Directors and Risk Committee. Likewise, it must have unrestricted access to information and personnel necessary to perform its functions.

FUNCTIONS AND RESPONSIBILITIES OF THE RISK MANAGEMENT UNIT. Supervised Institutions must establish for the Risk Management Unit functions and responsibilities that include at least the following:

• 1)

  Propose to the Governing Body or Board of Directors in collaboration with the General Manager and Financial Manager or their equivalents, a prudent and congruent risk appetite and limits consistent with the Supervised Institution's risk appetite statement and monitor its implementation;

• 2)

  Effectively monitor risks, associating risks with the business model and relating them to the strategic plan and risk appetite of the Supervised Institution, and must report periodically to the Governing Body or Board of Directors, Risk Committee, Senior Management, and corresponding areas or units regarding risks, the degree of exposure, limits, and their administration;

• 3)

  Prepare reports detailing existing, emerging, and potential risks;

• 4)

  Establish a process to report on risk and the alignment of appetite and risk profile with the risk culture of the Supervised Institution;

• 5)

  Communicate to the Governing Body or Board of Directors, Risk Committee, and General Manager or equivalent, non-compliance with the Risk Appetite Framework and action plans required for its correction, especially any violation of risk limits that threaten the Supervised Institution and especially its financial condition;

• 6)

  Conduct stress tests that allow understanding potential risks;

• 7)

  Propose to the Risk Committee the risk management policies; and,

• 8)

  Other functions and responsibilities assigned by the Risk Committee, the Governing Body or Board of Directors, or as required by the Commission or other supervisory and control bodies.

ADMINISTRATION OF TECHNOLOGY RISK AND INFORMATION SECURITY. Supervised Institutions must ensure compliance with policies and procedures related to operational and technological risks that include, among others, the privacy of user information in general or those who have been users, as well as those acts, operations, and services; in order to manage risks and dangers arising from vulnerabilities in computer systems and information security. Likewise, they must comply with the regulations issued by the Commission to fulfill what is established in this Article.

INTERNAL AUDIT COMMITTEE. The Supervised Institution must establish an Internal Audit Committee, which must comply at minimum with the provisions in good practices, international auditing standards, or other regulations or guidelines applicable as issued by the Commission, supervisory and control bodies. The composition of the Internal Audit Committee must guarantee the exercise of objective and independent judgment. All its members must possess technical suitability in the handling and understanding of business operations and financial information, as well as in matters of risk management, internal control, accounting, and auditing. The Internal Audit Committee shall have at least the following functions and responsibilities:

• 1)

  Ensure compliance with the agreements of the Governing Body or Board of Directors, as well as the provisions of the Commission or other supervisory and control body;

• 2)

  Provide independent assurance of the effectiveness of the Risk Governance Framework, supporting the Governing Body or Board of Directors and Senior Management in promoting effective Governance;

• 3)

  Report to the Governing Body or Board of Directors and provide timely follow-up to recommendations formulated in internal and external audit reports, the Commission, and other supervisory and control bodies, and ensure that corrections of identified findings are made;

• 4)

  Review evaluations and opinions of third parties on the design and effectiveness of risk governance and internal control and issue corresponding reports;

• 5)

  Review and approve the Annual Internal Audit Plan to ensure it is adequate prior to approval by the Governing Body or Board of Directors, and that it is designed in accordance with comprehensive risk management and its risk appetite;

• 6)

  Evaluate the quality and scope of the work of the Internal Audit Unit, as well as compliance with its work plan;

• 7)

  Evaluate that the accounting, financial, actuarial (if applicable) information processes, risk management systems, and internal control of the Supervised Institution are adequate, for which the Internal Audit Committee may have access to external expert advice, such that information is presented in compliance with the applicable accounting framework and current prudential regulations issued by the Commission, prior to presentation to the Governing Body or Board of Directors;

• 8)

  Evaluate and propose to the Governing Body or Board of Directors the conditions for contracting and revocation of the external audit firm, in accordance with the skills of personnel (quantity and type), independence, internal policies, and quality control practices of the internal policies and regulations of the Supervised Institution and the Commission that are applicable;

• 9)

  Evaluate the quality, scope, and frequency of External Audit, as well as the work plan and its compliance;

• 10)

  Review and discuss with the Governing Body or Board of Directors the external audit and Commission report, other related documents and reports, quality of financial statements, and observations raised;

• 11)

  Review that periodic and year-end financial information is prepared in compliance with applicable accounting frameworks and prudential regulations; and,

• 12)

  Other functions and responsibilities inherent to the performance of its activities or that have been required by the Governing Body or Board of Directors, the Commission, or other supervisory and control bodies.

COMPOSITION OF THE INTERNAL AUDIT UNIT AND REQUIREMENTS FOR ITS MEMBERS. Supervised Institutions must establish in their organizational structure an Internal Audit Unit, in accordance with their structure, size, nature, complexity of operations, and risk profile of the Supervised Institution, which must have a clear mandate, which must be known at the institutional level, that allows authority and unrestricted access to all types of information and personnel, be independent of operational functions, and report directly to the Governing Body or Board of Directors and Internal Audit Committee. The Internal Audit Unit must provide independent assurance to the Governing Body or Board of Directors and Senior Management in promoting effective Corporate Governance and maintaining the long-term soundness of the Supervised Institution; verifying Corporate Governance systems and processes, internal control, and risk management, helping these to protect their organization and reputation. The Unit must have personnel with experience, competencies, personal qualities, and sufficient resources that enable the proper performance of its functions. Likewise, it must have the authority to meet with the Governing Body or Board of Directors without the presence of the General Manager or equivalent, as well as other Senior Management officials, when required.

FUNCTIONS AND RESPONSIBILITIES OF THE INTERNAL AUDIT UNIT. The functions and responsibilities of the Internal Audit Unit must include at least the following:

• 1)

  Formulate and implement a risk-based Annual Audit Plan for which there must be interaction with the risk area and provide the corresponding follow-up for its effective compliance;

• 2)

  Generate reports on the evaluations performed and present them periodically to the Governing Body or Board of Directors and Internal Audit Committee, subsequently communicating to the General Manager or equivalent; and provide follow-up to the findings and recommendations to be implemented;

• 3)

  Establish evaluation methodologies that align with international best practices and have quality controls that guarantee their application; and,

• 4)

  Other functions and responsibilities inherent to the performance of its activities or that have been required by the Audit Committee, Governing Body or Board of Directors, the Commission, or other supervisory and control bodies.

HUMAN RESOURCES COMMITTEE. Supervised Institutions must establish a Human Resources Committee which must ensure that the Governing Body or Board of Directors is not dominated by a single individual or a small group in a manner that harms the interests of the Supervised Institution as a whole. It may participate in evaluating the effectiveness of the Governing Body or Board of Directors and Senior Management, and must support the same in monitoring the human resources policies of the Supervised Institution. All its members must possess technical suitability in the handling and understanding of the functions and responsibilities in their charge. Likewise, it must be constituted in a manner that allows it to establish jointly with the Risk Committee policies, compensation practices, and incentives aligned to the risks assumed in relation to capital and liquidity. This Committee shall have at least the following functions and responsibilities:

• 1)

  Present recommendations to the Governing Body or Board of Directors regarding members of Senior Management and analyze their role and responsibilities, as well as the knowledge, experience, and competence required for the function;

• 2)

  Supervise the design and functioning of the compensation and incentive system, which must include measures to avoid conflicts of interest in the Supervised Institution and be consistent with strategy, ethical culture, risk appetite framework, business horizon, and long-term interests;

• 3)

  Evaluate, monitor, and follow up on conflicts of interest that have arisen in the Institution related to officers and employees until their resolution;

• 4)

  Propose to the Governing Body or Board of Directors for its approval a human resources policy and ensure its compliance, which must address at least the following:

  • a)

    Personnel selection, promotion, and removal policies;

  • b)

    Methodology for the preparation of succession plans and career development of members of the Governing Body or Board of Directors, key officers or executives, and employees of the Supervised Institution;

  • c)

    System of remuneration, incentives, and compensation;

  • d)

    Incentives for employees in supervisory functions, such that they are not aligned to business line results and performance evaluation criteria in accordance with their objectives, preserving their independence;

  • e)

    Performance evaluation criteria, job profiles for selection and hiring; likewise, guidelines focused on professional development of officers, executives, and employees of the Institution; and, f. Measures that minimize professional risks of officers, executives, and employees of the Supervised Institution. Notwithstanding the foregoing, this Committee may perform other functions and responsibilities inherent to the performance of its activities as required by the Governing Body or Board of Directors or the Commission.

CORPORATE GOVERNANCE COMMITTEE. Supervised Institutions must establish a Corporate Governance Committee, whose main objective is to recommend and ensure compliance, follow-up, and good corporate governance practices, and must also monitor results regarding compliance with internal rules, applicable laws and regulations, ensuring an effective framework that guarantees users' rights and equitable treatment. The rules of good corporate governance comprise the establishment of principles and international best practices, which will strengthen the commitment of Supervised Institutions to strengthen their structure.

COMPOSITION OF THE REGULATORY COMPLIANCE UNIT AND REQUIREMENTS FOR ITS MEMBERS. The Supervised Institution must have a Regulatory Compliance Unit, which as a second line of defense is responsible for supervising that the institution fully complies with the laws, norms, and regulations issued by the Commission and other supervisory and control bodies, as well as with its policies, codes, and other internal regulations. This Unit must be established in Supervised Institutions according to their size, nature, complexity, and risk profile, or at the requirement of the Commission. However, those institutions whose organizational structure does not allow them to assign personnel to perform this function may have it assumed by Senior Management or another Supervisory Function, taking into account that the Governing Body or Board of Directors must monitor and oversee the responsibilities assigned. The Unit must have personnel with experience, competencies, personal qualities, and sufficient resources that enable the proper performance of its functions. Likewise, it must have the authority to report and meet with the Corporate Governance Committee or, failing that, with the Governing Body or Board of Directors without the presence of the General Manager or equivalent, as established in its policies. The Regulatory Compliance Unit must conduct independent oversight and must have unrestricted access to information and personnel necessary to perform its functions.

FUNCTIONS AND RESPONSIBILITIES OF THE REGULATORY COMPLIANCE UNIT. The Regulatory Compliance Unit shall have at least the following functions and responsibilities:

• 1)

  Ensure compliance with applicable legislation and regulations, procedures, processes, and internal policies applicable to the Supervised Institution; likewise, evaluate and analyze the associated compliance risk;

• 2)

  Keep Senior Management and the Corporate Governance Committee, as appropriate, updated on the results of its management;

• 3)

  Prepare a work plan that addresses strategies, policies, and procedures for compliance with applicable legislation and regulations;

• 4)

  Advise the Governing Body or Board of Directors and Senior Management on compliance matters and applicable international principles for the Supervised Institution which contribute to improving its effectiveness, when appropriate;

• 5)

  Create communication and training strategies to raise awareness among Institution personnel about the importance of compliance with the legal framework applicable to the Institution, internal policies, and ethics;

• 6)

  Prepare periodic reports for the Corporate Governance Committee and Senior Management regarding its functioning, as well as specific issues or detected non-compliance;

• 7)

  Establish effective communication with operational units to address queries on regulatory compliance matters; and,

• 8)

  Other functions and responsibilities inherent to the performance of its activities or that have been required by the Governing Body or Board of Directors, the Commission, or other supervisory and control bodies.

ACTUARIAL ANALYSIS FUNCTION. Actuarial Analysis is an independent function, applicable to supervised Insurance institutions, with responsibilities distinct from operational actuarial work. Supervised Insurance Institutions that have an actuarial analysis function must be: effective, with resources adequate to the nature, structure, size, risk profile, business model, and complexity of the Institution's activities, and shall have access to the Governing Body or Board of Directors. This shall have at least the following functions and responsibilities:

• 1)

  Evaluate the design, pricing, and valuation of insurance products offered by the insurance company;

• 2)

  Evaluate the reasonableness of technical reserves constituted, and the adequacy of the process followed, including verification of quality and sufficiency of information necessary for their establishment;

• 3)

  Review models to determine exposures, and also the adequacy of reinsurance programs to mitigate such exposures;

• 4)

  Evaluate internal risk models and underwriting policies;

• 5)

  Analyze the results of stress tests and the process applied to establish the adequacy and planning of capital under adverse conditions; and,

• 6)

  Other functions and responsibilities assigned by the Governing Body or Board of Directors, or as required by the Commission or other supervisory and control bodies, as well as international best practices.

FINANCIAL ANALYSIS. The Financial Analysis Function is an independent function, with responsibilities over the analysis of financial and operational results of the Supervised Institution, and likewise must report timely to the Governing Body or Board of Directors and Senior Management. Supervised Institutions that have a financial analysis function in the development of these must be: effective, with resources adequate to the nature, structure, size, risk profile, business model, and complexity of the Institution's activities, and shall have access to the Governing Body or Board of Directors, performing at least the following functions and responsibilities:

• 1)

  Evaluate that the generation of financial information is timely, complete, and accurate;

• 2)

  Evaluate that the analysis of financial results and operations is comprehensive and serves as input for decision-making;

• 3)

  Analyze the performance of the main business lines;

• 4)

  Manage the management information system of the Supervised Institution; and,

• 5)

  Other functions and responsibilities assigned by the Governing Body or Board of Directors, or as required by the Commission or other supervisory and control bodies, as well as international best practices.

RESPONSIBILITIES OF THE GOVERNING BODY OR BOARD OF DIRECTORS AND SENIOR MANAGEMENT. The Governing Body or Board of Directors and Senior Management must have understanding of the businesses, operations, and associated risks of the Financial Group to which they belong, and especially be prepared for any risk of contagion from the Group to the Institution. Monitoring and risk management systems must be maintained in order to identify and mitigate promptly and independently contagion risks arising from the Financial Group, Economic Group, and Related Parties. The relationship of the Supervised Institution with the entities that make up its Financial Group, whether domestic or foreign, must be transparent and disclosed, both at the internal level (Governing Body or Board of Directors, Senior Management, executives, and employees) and at the external level (users, competitors, risk rating agencies, supervisory and control regulatory bodies, providers of goods and services to the Institution, and the general public). The Entity responsible for the Financial Group must ensure sound Corporate Governance, so that it applies best practices in accordance with the structure, nature, size, complexity, strategy, and risk profile of the institutions belonging to the Group. The Governing Body or Board of Directors and Senior Management shall be responsible for ensuring that their functions and responsibilities with the Supervised Institution are not affected by the relationship with the Financial Group, Economic Group, and Related Parties, and must comply at all times with the provisions contained in current regulations and applicable international principles.

MINIMUM DISCLOSURE OF CORPORATE GOVERNANCE AND RELEVANT INFORMATION. Supervised institutions must ensure that information regarding all topics related to the institution is truthful, appropriate, complete, reliable, coherent, periodic, timely, and accessible for proper decision-making, and must be disclosed insofar as it concerns each group of interest, through any easily accessible mechanism, including its website, when appropriate, in accordance with its Corporate Governance Framework and applicable legal regulations. The information to be disclosed includes, but is not limited to the following:

• 1)

  The objectives of the Supervised Institution;

• 2)

  Unaudited financial statements for interim periods and audited statements;

• 3)

  Majority shareholder participation and voting rights;

• 4)

  Information on the main products and services of the Supervised Institution;

• 5)

  Organizational structure of the Supervised Institution and of the Financial Group, when applicable, including business lines and legal structure;

• 6)

  Structure of the Governing Body or Board of Directors, size, composition, competencies and experience, management positions held in other companies or Supervised Institutions, selection processes, and identification of independent members;

• 7)

  Information regarding Committees of the Governing Body or Board of Directors and Senior Management Committees;

• 8)

  Structure of Senior Management (responsibilities, hierarchical lines, competencies, and experience);

• 9)

  Risks administered, emerging risks, and actions taken to reduce their impact; in addition to situations that threaten the stability and solvency of the Supervised Institution, regarding unusual facts that by their relevance affect operations or responsibilities with Interest Groups;

• 10)

  The Corporate Governance Framework and control measures established by the Supervised Institution to accredit compliance with its internal control system;

• 11)

  Reports on the management of the Supervised Institution to Interest Groups;

• 12)

  Detail of Related Parties, Economic Groups, and members of the Financial Group of the Supervised Institution and their Operations or business with these;

• 13)

  Compensation policy applied to the Governing Body or Board of Directors and Senior Management;

• 14)

  Mechanisms used for disclosure of information to Interest Groups;

• 15)

  Policies and procedures for promotion of financial culture and handling of complaints filed by users;

• 16)

  Transactions involving related parties or members of the Governing Body or Board of Directors and Senior Management; and,

• 17)

  Any other information or clarification related to its Corporate Governance practices to the extent that they are relevant to the understanding of Interest Groups.

CHANNELS FOR DISCLOSURE OF INFORMATION. Supervised Institutions must create and maintain disclosure channels that allow transparent, fair, and periodic access for Interest Groups, taking into account that:

• 1)

  All shareholders or their equivalent must have equal access to information;

• 2)

  Adequate mechanisms are available for addressing particular information requirements or requests; and,

• 3)

  The Governing Body or Board of Directors establish the criteria to be used to classify information as confidential or non-confidential for the Institution; however, the Commission may require evaluation of these criteria, as well as make additional requests on topics it considers pertinent.

RIGHTS OF STAKEHOLDER GROUPS Corporate Governance policies must recognize the rights of Stakeholder Groups, promoting cooperation between the Supervised Institution and the Stakeholder Groups, in order to generate, among others, added value and the financial viability of the Institution. In relation to the Stakeholder Groups in each case, it shall be understood that they shall have the following rights in the Supervised Institution:

• 1)

  To have mechanisms that allow Stakeholder Groups to express concerns, complaints and reports that must be addressed effectively and promptly; as well as to receive information in a transparent, complete and truthful manner for the purpose of increasing the participation of Stakeholder Groups and obtaining diligent and respectful treatment by personnel;

• 2)

  To communicate to the Administrative or Management Body and to the competent public authorities their concern regarding illegal practices or those contrary to ethics without this putting their rights at risk;

• 3)

  To receive quality products and services;

• 4)

  To know the mechanisms provided to the regulatory control and oversight bodies for the verification of compliance with the norms that regulate their economic activity;

• 5)

  To have sufficient knowledge of the mechanisms used by the Institution to promote and exercise free competition, as well as the use of privileged information in favor of the members of the Stakeholder Group or of third parties; and,

• 6)

  Other rights conferred upon them by laws, Social Bylaws, norms, policies, regulations or other applicable provisions to the Stakeholder Groups or that are requested by the Commission. CHAPTER X FINAL PROVISIONS

ADDITIONAL OVERSIGHT FUNCTIONS Supervised Institutions, in accordance with their structure, size, nature, complexity and risk profile, may establish oversight functions in addition to those mentioned in this Regulation, which shall be subject to evaluation by the Commission.

EVALUATION The Commission shall evaluate the characteristics and performance in the exercise of the responsibilities of the Supervised Institution, in order to verify the quality of Corporate Governance practices, seeking to ensure the confidence of the Stakeholder Groups.

SANCTIONS The determination and application of sanctions for non-compliance with the provisions established in this Regulation shall be carried out in accordance with what is established in the Sanctions Regulation, the applicable laws and current regulations.

INFORMATION AND COLLABORATION WITH THE COMMISSION AND OTHER REGULATORY CONTROL AND OVERSIGHT BODIES To verify compliance with what is established in this Regulation, Supervised Institutions must keep at the disposal of the Commission, when it requests it, all information related to the state and functioning of its Corporate Governance. Supervised Institutions must apply the same principle of collaboration with other regulatory control and oversight bodies, regarding the information that these request for purposes of supervision or evaluation, as well as compliance with the requirements and directives made.

CONFIDENTIALITY OF INFORMATION The members of the Administrative or Management Body and the Oversight Functions of the Supervised Institutions are subject to what is indicated in the applicable laws, related to the confidentiality of information.

ADAPTATION PERIOD Supervised Institutions shall have a period of eight (8) months counted from the effective date of this Regulation, in order to adopt and implement the new regulatory provisions.

UNFORESEEN CASES The Commission through the Superintendencies shall resolve unforeseen cases, in accordance with what is established in the applicable legislation, best practices and international standards. The foregoing, without prejudice to the discretion they shall have to refer to the Commission those cases they deem appropriate to be resolved through Resolution.

REPEAL As of the effective date of this Regulation, Resolution GE No. 1432/30-07-2013 and Resolution GE No. 545/13-07-2016, containing the "Corporate Governance Norms for Insurance Institutions" and the "Corporate Governance Regulation for Supervised Institutions" respectively, shall be null and void.

EFFECTIVE DATE This Regulation shall enter into effect as of the date of its publication in the Official Journal "La Gaceta". 2. Communicate this Resolution to the Supervised Institutions, for the corresponding legal effects and to the Superintendency of Banks and Other Financial Institutions, Superintendency of Insurance, Superintendency of Pensions and Securities, Risk Management and Legal Management, for their knowledge. 3. This Resolution shall enter into effect as of the day of its publication in the Official Journal La Gaceta. … It is approved unanimously. … F) MARCIO GIOVANNY SIERRA DISCUA, President; ALBA LUZ VALLADARES OCONNOR, Titular Commissioner; ESDRAS JOSIEL SÁNCHEZ BARAHONA, Titular Commissioner; ANA GABRIELA AGUILAR PINEDA, General Secretary". . ANA GABRIELA AGUILAR PINEDA General Secretary