Título II. Régimen administrativo preventivo de personas obligadas

For purposes of compliance with the obligations established in this Law, its regulations and other applicable provisions, the following shall be considered Obligated Persons:

a)Entities subject to the supervision and inspection of the Superintendency of Banks; in the case of insurance entities, they shall be considered Obligated Persons only in transactions involving life insurance policies that accumulate cash values in favor of the insured and in surety insurance policies.

b)Persons who, without being subject to the supervision and inspection of the Superintendency of Banks, carry out activities of a financial nature, in accordance with the provisions of the following paragraphs:

1.Individual or legal persons engaged in any of the following activities:

i.Issuance or operation of credit cards.

ii. Systematic or substantial check-cashing transactions.

iii. Issuance or operation of means of payment, such as debit cards, traveler's checks, money orders and electronic money, among others.

iv. Custody or mobilization of capital, funds or securities.

v.Purchase and sale of foreign currency.

vi. Brokerage or intermediation in the trading of securities or derivatives.

vii. Independent brokerage or intermediation of life insurance that accumulates cash values in favor of the insured and of surety insurance policies.

viii. Granting of loans under any modality and for any purpose, including on a non-exhaustive basis, personal loans, pledge loans, mortgage loans, microloans and working capital or commercial transaction financing.

ix. Discount transactions or factoring transactions.

x.Leasing transactions.

xi. Other forms of investment, administration or management of funds or money on behalf of third parties.

xii. Fund transfers or transfers of securities.

2.Cooperatives that carry out savings and loan operations, or fund transfers and transfers of securities, regardless of their type or denomination.

3.Pawnshops.

c)Persons carrying out commercial or service activities, as set forth in the following paragraphs:

1.Individual or legal persons engaged in any of the following activities:

i.Real estate promotion and intermediation or purchase and sale of immovable property.

ii. Promotion, intermediation or purchase and sale of motor vehicles, land, maritime or air vehicles.

iii. Cash trading in works of art, antiques, jewelry, precious stones or metals, in accordance with the provisions of the regulations under this Law.

iv. Armoring services or purchase and sale of armored property of any kind; or any service involving the use of armored motor vehicles.

v.Providing services, upon instructions from or on behalf of their clients or third parties, relating to any of the following activities:

a)Creation of legal persons or legal structures;

b)Acting for oneself or through third parties as holder of shares, partner, associate or founder of legal persons or as the equivalent of a trustee in a legal structure;

c)Acting for oneself or through third parties as director, member of the board of directors or board, sole administrator, secretary, attorney-in-fact or legal representative of legal persons, with the exception of those who are exclusively agents under a judicial mandate;

d)Provision of a physical address to serve as tax domicile, postal address or registered office of legal persons or legal structures.

vi. Lotteries, raffles, bingos, pools, contests or sports forecasting systems and similar activities legally authorized, regardless of the name or modality used for such purpose, in accordance with the provisions of the regulations under this Law.

vii. Virtual Asset Service Providers.

2.University professionals providing legal, economic, accounting and auditing services, individually or in association, without an employment relationship with the respective client, in those cases in which any of the following activities is prepared for a client or carried out on behalf or in representation of the client:

i.Purchase and sale, assignment, exchange, disposal, management or equivalent acts, involving immovable property or rights in rem or other rights related to immovable property;

ii. Administration of the client's money, securities or other assets;

iii. Opening and management of checking, savings or investment accounts, or of any other financial instrument;

iv. Accounting and auditing activities;

v.Organization of contributions for the creation, operation or administration of any legal person or legal structure;

vi. Creation, administration of, or operational management in, legal persons or legal structures;

vii. Custody or keeping of books or records of legal persons or legal structures;

viii. Purchase and sale or disposal of shares, contributions or other forms of participation in legal persons or legal structures, regardless of their legal form.

3.Notaries when they authorize master deeds containing acts or contracts related to the activities described in Roman numerals i, ii, iii, v, vi and viii of numeral 2 above.

The Obligated Persons described in numerals 2 and 3 above shall be subject to a special regime of obligations as established for university professionals in this Law.

The Superintendency of Banks may incorporate new activities conferring the status of Obligated Persons, provided that it has previously obtained approval from the National Council for Coordination of Efforts against Money Laundering or Other Assets, Terrorism Financing and Financing of the Proliferation of Weapons of Mass Destruction in Guatemala -CONCLAFT-. The latter shall approve or disapprove the proposal at the next ordinary or extraordinary session.

The foregoing shall be based on a report issued by the Special Verification Intendency (IVE), which forms part of the Superintendency of Banks, when the existence of activities vulnerable to money laundering or other assets and terrorism financing is established. The decision issued for such purpose by the Superintendent of Banks shall be published a single time in the Official Gazette and in another newspaper of wide circulation.

Obligated Persons shall register with the Superintendency of Banks, through the Special Verification Intendancy (IVE), providing for such purpose the information and complying with the requirements in the form and time limit established in the regulations and other provisions issued for such purpose by said Intendancy.

The aforementioned registration does not exempt Obligated Persons from obtaining the authorization, license or registration required to carry out the activities in which they engage, nor does it prejudge the lawfulness thereof.

The fact that an Obligated Person fails to comply with the obligation of registration does not exempt it from compliance with the obligations corresponding to it, in accordance with this Law, its regulations and other applicable legal provisions.

Natural or legal persons who have not requested their registration and with respect to whom the Superintendency of Banks, through the Special Verification Intendancy (IVE), as a result of the exercise of its functions and powers, receives information that they carry out the activity or activities conferring upon them the status of Obligated Person (PO), shall submit the information required by this Intendancy for their registration, in the form and within the time limit it determines. In the event that such natural or legal persons state that they do not carry out the activity or activities conferring upon them the status of Obligated Person, they shall conclusively prove it before the IVE, a matter that shall be analyzed and decided by said Intendancy which, if applicable, shall proceed with their registration.

In both cases, the Obligated Person remains subject to the administrative sanction for noncompliance, as established in this Law and its regulations.

Any person may inquire before the Special Verification Intendancy whether a natural person or legal person is registered as an Obligated Person; the foregoing, in accordance with the terms and means provided for such purpose by the regulations under this Law.

Where the inquiry is made by Obligated Persons, it shall not exempt them from conducting customer due diligence, in accordance with the provisions of this Law, its regulations and other applicable provisions.

Obligated Persons shall comply with the preventive provisions established in this Title, the regulations to this Law and other applicable provisions, under risk-based management, which shall be understood as the comprehensive process by which Obligated Persons must identify, assess and mitigate the level of LD/FT/FPADM Risk to which they are exposed, in such a way that they allocate their resources and establish suitable measures, in accordance with the identified risks.

The LD/FT/FPADM Risk management process carried out by Obligated Persons shall be proportionate to the nature, volume and complexity of their activities. Said process and its updates shall be known and approved by the senior management body of the Obligated Person or whoever acts in its stead, as well as be duly documented.

Obligated Persons shall identify the LD/FT/FPADM Risk to which they are exposed by their activities and business model, defining a methodology that allows them to establish their risk factors, considering at a minimum matters relating to the customer base, geographic location, distribution channels and the goods, products or services offered, and identify the risk variables and events in each of the established factors.

Obligated Persons shall periodically assess how the identified LD/FT/FPADM Risk may affect them, through a self-assessment of the business as a whole and the particular risk assessments of the business relationship with their clients; for such purpose, they shall analyze the information obtained, with the purpose of understanding the probability of occurrence of the risk and the possible impact on their activities, in order to measure the level of risk to which they are exposed.

Additionally, the LD/FT/FPADM Risk assessments shall consider, where applicable, the results of the national or sectoral assessments concerning risks, threats or vulnerabilities related to money laundering and terrorist financing, communicated to them by the Superintendency of Banks through the IVE.

Obligated Persons, in accordance with the assessed LD/FT/FPADM Risk, shall decide the most appropriate and effective means to mitigate and manage it, for which purpose they shall effectively implement the policies, procedures, controls and information systems that allow them to monitor, report and control the level of LD/FT/FPADM Risk to which they are exposed.

Likewise, Obligated Persons shall carry out the stages of the LD/FT/FPADM Risk management process prior to the launch of new goods, products or services or prior to the use or adoption of new technologies or commercial practices.

The matters indicated in this chapter shall be further developed in the provisions issued for such purpose by the Superintendency of Banks, through the Special Verification Intendency.

Programs for the prevention of money laundering or other assets, financing of terrorism and financing of the proliferation of weapons of mass destruction.

Obligated Persons, according to the nature, volume and complexity of their activities, shall establish programs containing policies, procedures, controls and information systems that allow them to carry out, on an ongoing basis, adequate management of LD/FT/FPADM Risk, which shall be set forth in a manual, hereinafter to be called the LD/FT/FPADM Prevention Manual, which shall contain at a minimum the following:

a)Adequate standards for the selection, hiring or appointment of personnel, directors, agents or other intermediaries and other collaborators, regardless of the legal form of their hiring, to ensure their integrity and suitability; and that they do not appear on lists issued by the United Nations Security Council; and, in no case may the Obligated Person hire or appoint those who have been convicted of the crimes of money laundering or other assets and financing of terrorism, while five years have not elapsed since completion of the penalty;

b)The development and implementation of an ongoing training plan for personnel, directors, agents or other intermediaries and other collaborators whose position or office requires understanding LD/FT/FPADM Risk, based on their responsibilities and obligations; the Obligated Person shall ensure, through suitable mechanisms, that collaborators have acquired competencies according to their position or office;

c)Matters relating to customer due diligence, monitoring of all transactions, detection of alerts for the identification and analysis of unusual and suspicious transactions;

d)Such other policies, procedures, controls and systems as, in accordance with this Law, its regulations and other applicable provisions, they must have; and,

e)Other policies, procedures, controls and systems that the Obligated Person itself considers necessary for the adequate prevention of money laundering or other assets and financing of terrorism.

The LD/FT/FPDAM Prevention Manual and its respective amendments and updates must be approved by the senior governing body of the Obligated Person or whoever acts in its stead.

The foregoing matters shall be further developed in the regulations to this Law.

Obligated Persons that form part of a Financial Group, in accordance with the provisions of the Law on Banks and Financial Groups, in order to comply with the provisions of the preceding article, may develop programs containing policies, procedures, controls and information systems and set them forth in a unified LD/FT/FPADM Prevention Manual, which shall be applicable, as appropriate, to each entity comprising it, be previously approved by the Board of Directors or superior authority of the controlling company or responsible company of the Financial Group and be effectively implemented by each of the Obligated Persons forming part thereof. The group’s LD/FT/FPADM Prevention Manual shall contain at a minimum the following:

a)The provisions set forth in subparagraphs a) to e) of the preceding article, for the Obligated Persons comprising the Financial Group; and,

b)Policies and procedures that allow at the Financial Group level the exchange of information for customer due diligence; as well as the management of LD/FT/FPADM Risk, adopting safeguards to guarantee the confidential nature and use of the exchanged information.

Obligated Persons shall ensure that their LD/FT/FPADM Prevention Programs apply to their majority-owned offices, agencies, branches or subsidiaries abroad, where the regulations of the host country require less strict LD/FT/FPADM Prevention Programs, regardless of what they are called.

If the legislation of the host country does not permit the implementation of the Obligated Person's LD/FT/FPADM Prevention Programs, such Obligated Person shall apply appropriate additional measures to manage LD/FT/FPADM Risk and inform the Special Verification Intendency.

Obligated Persons must establish procedures to annually evaluate compliance with and effectiveness of the LD/FT/FPADM prevention programs, contained in their respective manual, through their internal audit or whoever acts in its stead or the services of specialized auditors of their choice. In addition, in the case of entities subject to the supervision and inspection of the Superintendency of Banks, when they engage external audit services to issue a report and opinion on financial statements, it must be stipulated in the contract executed that the external auditors must also issue an assurance report in which a written conclusion is expressed regarding compliance with and effectiveness of the LD/FT/FPADM Prevention Programs. Obligated Persons must send a copy of the assurance report to the Special Verification Intendency, within a time limit of no more than fifteen (15) days following its receipt.

In the case of entities subject to the supervision and inspection of the Superintendency of Banks and those that form part of a Financial Group and have adopted a unified LD/FT/FPADM Prevention Manual, the procedures referred to in the preceding paragraph, relating to internal audit, must be carried out at least once per year.

The regulations to this Law shall define matters relating to the minimum content of the report to be issued by the external auditors.

The compliance officer is the officer or senior management executive or of similar nature, in charge of overseeing compliance with the LD/FT/FPADM Prevention Programs adopted by the Obligated Person, as well as compliance with the obligations established by this Law, its regulations and other applicable provisions. The compliance officer shall be the sole liaison between the Obligated Person and the Superintendency of Banks through the IVE.

The compliance officer shall be appointed by the senior management body of the Obligated Person or whoever acts in its stead, together with the appointment of their alternate, who shall serve in case of temporary absence of the principal. The compliance officer must have independence, autonomy and sufficient material and technological resources and suitable personnel to guarantee effectiveness in the performance of their functions.

The regulations under this Law shall define matters relating to the qualifications, minimum powers and conditions for the exercise of office to be met by the principal and alternate compliance officer, as well as the form and time limit for Obligated Persons to inform the Superintendency of Banks through the Special Verification Intendency, regarding the appointment, resignation, removal and replacement of the principal and alternate compliance officer.

Financial Groups may designate a group-level compliance officer, provided that it allows each Obligated Person that forms part of the Financial Group the effective fulfillment of the obligations established in this Law, its regulation and other applicable provisions. The compliance officer shall be the sole liaison between the Obligated Persons that form part of the Financial Group and the Superintendency of Banks through the IVE.

The compliance officer, principal and alternate, at the Financial Group level, shall be contracted by the senior direction body or whoever acts in its stead, of the controlling company or company responsible for the Financial Group. The compliance officer at the Financial Group level must have independence, autonomy and sufficient material, technological resources and suitable personnel, to guarantee effectiveness in the fulfillment of their functions.

Individual persons or individual merchants who have the status of Obligated Persons may carry out the functions of the compliance officer personally, without the need to designate a principal or alternate compliance officer, provided they comply with the defined regulatory conditions, based on the nature, volume and complexity of their activities.

The identity and personal information relating to the compliance officer and the persons working under their direction are confidential in nature and shall not be made known to the public, except to the Superintendency of Banks through the IVE or when there is an order of a competent judge, who shall adopt the necessary measures to protect the confidentiality of the information they receive.

The compliance officer and persons working under their direction are barred from testifying, intervening, accepting, appearing or serving as witnesses, experts, specialists or technical consultants in criminal proceedings or civil forfeiture proceedings related to the information, documentation, files and records to which they have had access by reason of compliance with this Law, its regulations and other applicable provisions; as well as those relating to suspicious transactions they have reported to the Superintendency of Banks through the IVE. The foregoing shall remain in effect even after they have ceased to hold office.

Customer due diligence measures shall be applied, by the Obligated Person, to all clients when:

a)The business relationship is initiated;

b)Transactions are carried out above the thresholds designated for the corresponding activity, as established in the regulations under this Law;

c)Unusual transactions exist;

d)If, during the business relationship, doubts arise regarding the truthfulness or sufficiency of the customer knowledge data previously obtained;

e)Additional products or services are contracted, when they alter the risk rating of the commercial relationship;

f)In the other cases or circumstances established in this Law and its regulations.

Customer due diligence measures shall consist of:

1.Identifying and verifying information on clients and those acting on their behalf and in what capacity they act, using documents, data and reliable information from independent sources;

2.Identifying the final beneficiary of the client and taking reasonable measures to verify their identity, using documents and pertinent information or data obtained through reliable sources, in accordance with the procedure established in the regulations under this Law and other applicable provisions;

3.Obtaining information that the Obligated Person deems necessary to understand the purpose of the business relationship;

4.Establishing the profile of the client and assigning thereto a risk level, identified in the assessment conducted by the Obligated Person and the monitoring of transactions; and,

5.Conducting ongoing monitoring during the business relationship, including examining transactions to ensure that they are consistent with the profile of the client, the risk level assigned thereto, the origin of the funds or assets and the normality parameters of the sector of the economic activity or activities in which the client operates.

Obligated Persons shall implement the customer due diligence measures provided for in the preceding article, determining the scope of their implementation based on the assigned LD/FT/FPADM Risk level. In all cases, Obligated Persons shall be in a position to demonstrate to the competent authorities that the measures adopted have an adequate scope in relation to the assigned LD/FT/FPADM Risk.

Verification of the information of the customer, of the person acting on behalf of the customer, or of the final beneficiary, shall be carried out at the commencement of the business relationship or when conducting transactions for occasional customers. In specific cases that are duly justified, verification of the information may be completed after the establishment of the relationship with the customer, within a reasonable time limit, which may not exceed three (3) months, counted from the commencement of the business relationship, provided that the LD/FT/FPADM Risk can be managed effectively and where it is essential in order not to interrupt the normal conduct of the activity. The cases described in this paragraph shall be addressed by the Obligated Person in the LD/FT/FPADM Prevention Manual.

Obligated Persons shall refrain from establishing business relationships or carrying out transactions when it is impossible for them to apply the customer due diligence measures provided for in this Law, its regulations, and other applicable provisions. When such impossibility arises in the course of the business relationship, Obligated Persons shall terminate such relationship, conducting an examination to determine whether a suspicious transaction report is warranted.

Obligated Persons shall define and implement policies enabling them to periodically review and update existing data and information on their customers with a high LD/FT/FPADM Risk level, at least once a year. With respect to customers at other risk levels, Obligated Persons shall determine the reasonable frequency of such review and update.

Obligated Persons may apply simplified customer due diligence measures when they have previously identified and verified that the type of customer, product, service or transaction represents a lower risk, in accordance with the documented LD/FT/FPADM Risk assessment.

Obligated Persons shall not apply customer due diligence measures in simplified form when it involves an unusual transaction or shall cease to apply them when a high level of LD/FT/FPADM Risk is identified.

The Superintendency of Banks, through the Special Verification Intendency, may define situations in which, due to the level of LD/FT/FPADM Risk they represent, Obligated Persons may not apply customer due diligence measures in simplified form.

Obligated Persons shall implement customer due diligence measures with greater rigor and thoroughness, when: i) high risks are identified in a type of client, product, service or transaction, in accordance with the documented LD/FT/FPADM Risk assessment; ii) when business relationships are established or transactions are conducted with persons from foreign countries or jurisdictions considered high-risk by the Financial Action Task Force (FATF); as well as when transactions are conducted from or to said countries and jurisdictions; or, iii) in the situations that the Superintendency of Banks may define and communicate through the Special Verification Intendency.

Obligated Persons must adopt and implement additional customer due diligence procedures and measures, in the following cases:

a)Politically Exposed Persons (PEP), as well as their relatives in the first degree of consanguinity, spouses or common-law partners; as well as their close associates including the accounts established with legal persons or legal structures and the transactions in which they are final beneficiaries.

Due diligence measures shall apply solely and exclusively while the Politically Exposed Person (PEP) holds the office conferred upon that person and during one (1) year after cessation thereof. Immediately after the year, the natural person shall cease, without any prior procedure, to be a PEP.

The entity where the Politically Exposed Person (PEP) has held prominent public offices must notify the Special Verification Intendency (IVE), within a time limit of no more than five (5) days, the name of the natural persons who left prominent public office.

b)State Contractors and State Suppliers;

c)Non-profit organizations, when they receive or administer funds from the State or from abroad;

d)The beneficiaries of life branch policies that accumulate values in favor of the insured at the time of the compensation of the policy;

e)Business relationships with natural persons, legal persons or legal structures, when none of them is domiciled in the country;

f)Private non-profit legal persons;

g)Trusts;

h)Private banking services;

i)Correspondent banking relationships;

j)Those accounts that handle values equal to or greater than the amount defined in the regulations of this Law;

k)Relationships or transactions that do not involve the physical presence of the parties, paying attention to the threats that may arise from the use of new or developing technologies, which favor the anonymity of the persons involved in the transactions, which hinder establishing the origin or destination of the funds or assets;

l)Cash transactions in national currency or any currency, when they are greater than the amount defined in the regulations of this Law;

m)The receipt, transmission or execution of transfers of funds or values, when they are greater than the amount defined in the regulations of this Law; and,

n)Other cases established in the regulations of this Law.

To comply with the provisions of this article, Obligated Persons shall observe the provisions issued for such purpose by the Superintendency of Banks through the Special Verification Intendency.

At the commencement of the business relationship, Obligated Persons belonging to a Financial Group, in accordance with the provisions of the Law on Banks and Financial Groups, Decree Number 19-2002 of the Congress of the Republic, and which have a unified Group-level LD/FT/FPADM Prevention Manual, may entrust to another Obligated Person of the same Group to which they belong the identification and verification of the client and final beneficiary, as well as the understanding of the nature of such business relationship.

The foregoing does not exempt the entrusting Obligated Person from compliance with its other obligations, in accordance with the provisions of this Law, its regulations and other applicable provisions, and therefore it shall obtain, immediately, the identification and verification information, as well as other inputs supporting these aspects.

Obligated Persons that form part of a Financial Group may in no case delegate the ongoing monitoring of the business relationship referred to in numeral 5 of Article 21 of this Law.

The aforementioned delegation is prohibited for Obligated Persons that do not form part of an authorized Financial Group.

In no case may Obligated Persons open or maintain anonymous, encrypted, fictitious-name accounts or accounts that in any way hinder, distort or prevent knowledge of the true identity of the client or final beneficiary of the account.

Obligated Persons shall establish and implement policies, procedures, controls and monitoring systems for all transactions and operations they conduct, appropriate to the volume and complexity of their activities, that generate alerts based on the LD/FT/FPADM Risk to which they are exposed and enable them to promptly identify unusual transactions.

For purposes of what is established in the preceding paragraph, Obligated Persons shall define and keep updated the alert signals, in accordance with their assessment of LD/FT/FPADM Risk and patterns of money laundering or other assets and financing of terrorism.

Once an unusual transaction, whether completed or not, has been identified, the Obligated Person shall examine it, carrying out the applicable customer due diligence measures, in order to determine whether or not it has an evident economic or legal basis. Where it is established that the unusual transaction lacks such basis, it shall be considered a suspicious transaction.

Likewise, an unusual transaction duly examined by the Obligated Person whose funds, despite having an appearance of legality, it suspects or has reasonable grounds to suspect originate from or are intended for criminal activity or are related to the financing of terrorism, shall be considered a suspicious transaction.

Obligated Persons shall promptly report all suspicious transactions, exclusively and confidentially, to the Superintendency of Banks through the IVE, through their compliance officer. For purposes of this Law, its regulations and other applicable provisions, the suspicious transaction report may be referred to as RTS.

RTSs shall enjoy a guarantee of confidentiality and shall be used exclusively by the Superintendency of Banks through the IVE for the analysis which, in accordance with its functions and powers, it is responsible for conducting; excepted from this guarantee is anything related to the exchange of the analysis of the information with Financial Intelligence Units of other countries, in accordance with the provisions of this Law.

The regulations of this Law shall define matters related to the procedures and time limits to be observed by Obligated Persons for compliance with the provisions of this chapter.

Obligated Persons shall keep and maintain a daily register of every cash transaction, whether single or structured, received from their clients, equal to or greater than ten thousand dollars (≥US$ 10,000.00) of the United States of America or its equivalent amount in national currency or any other currency. Additionally, Obligated Persons shall submit to the Superintendency of Banks through the IVE a periodic report on such transactions.

Obligated Persons shall submit other reports, whether occasional or periodic, as required by the Superintendency of Banks through the IVE, for the fulfillment of its functions and attributions.

For effective compliance with the reports established in this Law, its regulation and other applicable provisions, the Obligated Persons shall exclusively use the means and observe the procedures, conditions and time limits established for such purposes by the Superintendency of Banks through the Special Verification Intendency.

The Obligated Persons shall be liable for ensuring that the information provided to the IVE is complete and coincides with their records.

Obligated Persons shall retain all documentation, files and physical, digital or electronic records related to the transactions or operations carried out, for a minimum period of five (5) years counted from the completion thereof. Such records shall be sufficient to allow the complete reconstruction of the transactions or operations carried out with their clients.

Likewise, Obligated Persons shall retain the documentation, business correspondence, files, results of analyses or examinations conducted, as well as other records related to compliance with the obligations established in this Law, its regulations and other applicable provisions, for a minimum period of five (5) years counted from the termination of the business relationship with the client or from the carrying out of the occasional transaction.

Upon expiry of the aforementioned minimum retention period, the records shall be maintained on optical, magnetic or electronic media that guarantee their integrity, correct readability, unalterability and proper preservation, as well as their easy retrieval, so that they may be used efficiently by the Obligated Person and to meet the requirements of the competent authorities. The records shall be retained on digital or electronic media for an additional minimum period of ten (10) years, under conditions that guarantee their integrity, correct readability, unalterability and proper preservation. This additional digital retention obligation shall be applicable only to the Obligated Persons covered by subparagraphs a) and b) of Article 3 of this Law.

Obligated Persons shall ensure that their record-keeping and archiving systems guarantee proper management, safeguarding and availability of the documentation and information, both for purposes of internal control and for delivery to the Superintendency of Banks, through the Special Verification Intendancy, and other competent authorities in the framework of investigations related to money laundering or other assets and the financing of terrorism.

Obligated Persons shall provide to the Superintendency of Banks through the IVE the information, documentation, files or records that the latter requires from them for the performance of its functions and powers, observing the form and time limit established by said Intendancy.

Additionally, they shall cooperate with the Superintendency of Banks through the IVE by providing immediate and free-of-charge access to their sources, information systems, records, books, reports, contracts, documents, databases and any other information, including the vouchers supporting the operations, within the framework of its legal competences and under strict confidentiality.

Every company, enterprise or private individual that provides services to the Obligated Persons shall cooperate with the Superintendency of Banks, through the Special Verification Intendancy, when the requested information is strictly necessary, is directly related to the services provided and is indispensable for the prevention or detection of operations linked to money laundering or other assets or to the financing of terrorism. The exercise of this power does not entail a violation of provisions on confidentiality, professional secrecy or data protection, whether domestic or foreign, and shall be carried out in accordance with the principles of necessity, proportionality and reserve, so that neither the contractual relationship nor the continuity of the essential services that the providers supply to the Obligated Persons is affected.

No violation of confidentiality of any nature, imposed by another law, regulation or contract, may be invoked to avoid compliance with the obligations established in this Law, its regulation and other applicable provisions.

When the Obligated Persons are unable to provide the information, documentation, files or records within the time limit stipulated by the Superintendency of Banks through the Special Verification Intendancy, they may request an extension in writing, no later than two (2) days before the expiry of the original time limit, explaining the reasons justifying it, in order to comply with the obligation. Upon receipt of the request for extension, the corresponding authorities shall analyze and decide whether or not to grant it, partially or totally, taking into account the particularity of each case. The time limit of such extension shall be counted from the day following the expiry of the original time limit. The respective authorities must resolve the request for extension before the original time limit has expired.

Obligated Persons, their directors, managers, administrators, officers, compliance officers, legal representatives and duly authorized employees are exempt from legal liability for having provided in good faith to the competent authorities information, documentation, files and records, provided that the provisions established in this Law, its regulations and other applicable provisions are complied with, including the reporting of RTSs to the Superintendency of Banks through the IVE.

Additionally, the Obligated Persons referred to in subparagraph a) of Article 3 of this Law are exempt from legal liability for the exchange of information on their clients with foreign banks and financial institutions with which they have correspondent relationships, when the transactions are related to their clients.

Obligated Persons, their directors, managers, administrators, officers, compliance officers, legal representatives and employees shall be prohibited from revealing to third parties the fact that an RTS, information, documentation, files or records has been referred, provided or communicated to the Superintendency of Banks through the IVE or competent authority, or the fact that a transaction is being examined or an investigation is being conducted by a competent authority.

The prohibition established above shall survive even after the Obligated Person has ceased to carry out the activity conferring such status and its directors, managers, administrators, officers, compliance officers, legal representatives and employees have ceased in their functions, with the Obligated Person being required for such purpose to establish the safeguards, arrangements and measures necessary for effective observance of the prohibitions established in this article, without prejudice to any legal liability arising from their violation.

The prohibition established in this article shall not constitute an impediment for Obligated Persons that form part of the same Financial Group and have a unified LD/FT/FPADM Prevention Manual at Group level to comply with the provisions of subparagraph (b) of Article 13 of this Law.

Obligated Persons engaged in providing fund transfer or value transfer services, in addition to the customer due diligence obligations established in this Law, shall:

a)Ensure that the information on the originators and beneficiaries of fund or value transfers, in which they participate whether as originating, intermediary or beneficiary entities, remains with the transfer or message relating thereto, through the payment chain. The type and scope of the required information shall be established in the regulations to this Law and other applicable provisions;

b)That their policies, procedures and controls allow for determining: i) when to execute, reject or suspend a fund transfer lacking the required information on the originator or on the beneficiary and other relevant data relating thereto, in accordance with the provisions of the regulations to this Law and other applicable provisions; and, ii) the appropriate follow-up action, as a consequence of the provisions of numeral i) above or when there is reasonable suspicion of the existence of funds related to illicit activities;

c)Keep and maintain updated a register of their agents and subagents, transfer receivers or payers, that enables their full identification, in accordance with the regulations to this Law and other applicable provisions; as well as have and implement policies that guarantee their integrity and suitability; and,

d)Provide to the Superintendency of Banks through the IVE the information on the transfers carried out, as well as on the register referred to in the preceding literal and any other information that it may require from them.

Obligated Persons referred to in subparagraphs a) and b) of Article 3 of this Law may not open or maintain accounts for shell banks, nor establish business relationships with them or carry out transactions with them.

Obligated Persons referred to in the preceding paragraph, before initiating or in order to continue business relationships with legal persons or legal structures organized in accordance with the laws of another country or jurisdiction, shall implement reasonable measures to determine that they are not a shell bank.

For purposes of application of the foregoing, shell banks shall be deemed to be those that carry out banking or financial activities, that have no physical presence in the country in which they were incorporated or obtained their license or authorization to operate, and that are not part of a regulated Financial Group subject to consolidated supervision.

University professionals who provide legal-type services as regulated in Article 3, literal c), numeral 2 of this Law, who have the status of Obligated Persons and obtain information from their clients or related to them, shall not be obligated to report suspicious transactions or any other information related thereto, if such information was obtained to verify the legal situation of their client prior to, or within the framework of, the exercise of the right of defense or professional assistance in judicial, administrative, arbitration or mediation matters.

The Obligated Persons covered under literal c), numerals 2 and 3 of Article 3 of this Law, due to the nature, volume and complexity of their activities, shall be subject only to the obligations detailed below, observance of which delimits the risk management requirements applicable to them according to their activities:

a)Registration as an Obligated Person before the Superintendency of Banks through the IVE, in the form and within the time limit established in the regulations of this Law, as well as updating of their general information, when applicable.

b)They shall keep, for each client, a register containing at minimum the information and documentation evidencing the following:

i.For individual persons: full name, place and date of birth, nationality, gender, marital status, profession or occupation, type and number of the identification document, complete residence address and migratory status when applicable.

ii. For legal persons: type of entity, corporate name or denomination, trade name, registry registration data, tax identification number or similar if it is foreign, form and place of formation, fiscal domicile and data of the legal representative pursuant to the preceding numeral.

For both cases, detail the date and professional service provided to the client.

c)Submit a notice to the Superintendency of Banks through the Special Verification Intendency, by the electronic means determined by it, within the first fifteen (15) working days of the month following that to which the information corresponds, when one or more inconsistencies are identified between the information provided by the client and the professional service rendered to the latter, or when the professional identifies an unusual transaction.

d)For the information and documentation referred to in literals b) and c) of this Article, the provisions of Article 34 of this Law shall be complied with.

Obligated Persons shall permanently monitor and verify whether their clients or those seeking to initiate a business relationship are designated in:

a)The lists of individual or legal persons or entities associated with terrorist organizations, issued and maintained by the United Nations, pursuant to the resolutions of its Security Council S/RES/1267(1999), S/RES/1988(2011), S/RES/1989(2011), S/RES/2253(2015) and subsequent resolutions;

b)The lists of individual or legal persons or entities linked to the financing of the proliferation of weapons of mass destruction, issued and maintained by the United Nations, pursuant to the resolutions of its Security Council S/RES/1718(2006), S/RES/1737(2006), S/RES/2231(2015) and subsequent resolutions;

c)The designations of individual or legal persons or entities pursuant to United Nations Security Council resolution S/RES/1373(2001).

If there is a match between individual or juridical persons or entities and the names or identification data arising from said lists or designations, the Obligated Persons shall proceed to limit with preventive effect the disposal of the funds or assets of the client or controlled by the client, as well as the proceeds thereof, when they are under their administration or in their charge for any reason, and to communicate in writing, within a time limit not exceeding twenty-four hours, to the Public Prosecutor's Office the actions taken, attaching the corresponding documentation; which shall inform the Ministry of Foreign Affairs, so that the latter shall communicate it to the United Nations Security Council, where applicable.

For purposes of applying the foregoing, the limitation with preventive effect shall fall without definitive character on the rights of access, use, administration, disposal, management, alteration, mobilization, alienation or any other direct relationship with the property or rights subject to such act; therefore the legal holder of the affected property or right is prevented from carrying out acts of administration, disposal, management, alteration, mobilization or others with respect to said property, including therein alienations, exchanges and assignments under any title, as well as any security-related encumbrance of said property or rights. Any action by the holder, or by a third party acting on his or her behalf, with respect to said property or rights shall be deemed null and void as a matter of law.

Obligated Persons that have applied the limitation with preventive effect to the funds or assets of the client or controlled by the client referred to in the preceding paragraphs of this article are expressly exempted from criminal, civil, administrative or any other kind of liability, provided that the provisions established in this Law, its regulations and other applicable provisions are complied with.

When, in accordance with the provisions of the preceding article, the Public Prosecutor's Office is informed of the limitation with preventive effect on the disposal of funds or assets belonging to or controlled by persons included in the lists or designated, it shall, within a time limit not exceeding seventy-two hours, request ratification of the preventive measure from a competent judge, who shall proceed to verify that the person listed or designated under the United Nations Security Council Resolutions coincides with the person whose funds or assets are subject thereto, based on the information provided by the Public Prosecutor's Office, and in such case, shall ratify the measure and issue provisions for the custody and preservation of said funds or assets.

Likewise, the competent judge may authorize access to the funds or other assets that have been limited with preventive effect, in the cases established in United Nations Security Council Resolutions S/RES/1452(2002), S/RES/1373(2001), S/RES/1718(2006) and S/RES/2231(2015) and successive ones as applicable, and prior to issuing the corresponding decision, shall give a hearing to the applicant and to the Public Prosecutor's Office.

The Obligated Persons shall lift the preventive measure: i) upon receiving a notification from a competent judge so ordering; or, ii) when the designation is revoked by the United Nations Security Council and its subsidiary bodies.