Rule that regulates financial and technological services entities – Resolution No. JPRF-F-2023-076

Resolution No. JPRF-F-2023-076 issued on September 12, 2023 by the Financial Policy and Regulation Board incorporates a new chapter called “Rule regulating technological financial entities” to Title II “National Financial System”, Book I “Monetary and Financial System” of the Codification of Monetary, Financial, Securities and Insurance Resolutions. The purpose of this standard is to regulate the activities of the Technological Financial Services Entities.

The most relevant points of this resolution include:

Subsection I defines key terms related to financial technology, such as data analytics, automated advisors, cybersecurity, Fintech, among others. These definitions lay the foundation for the regulation of these entities and provide an initial understanding of the activities that will be subject to supervision. The definitions that most caught our attention are:

Digital credit granting: Automated process involving promotion, client risk assessment, approval and disbursement of credit through electronic platforms, excluding crowdfunding.

Digital credit granting entities: These are technological financial services entities that offer credit products exclusively through electronic platforms, using automated processes and without capturing resources from the public for intermediation purposes.

Technological financial services: include financial activities based on digital and electronic technology, provided by entities recognized by law. This includes digital credit granting entities, neobanks, personal finance and financial advisory entities, and others as may be designated by the Financial Policy and Regulatory Board.

Subsection II – establishes compliance requirements to prevent money laundering and terrorist financing (ARLAFDT) within financial technology services entities. The term established for the implementation of the standards is six (6) months after their qualification before the Superintendency of Banks.

In subsection III – establishes the parameters of the operations to be followed by technological financial services entities covers several important aspects for digital credit granting entities, among them:

Scope and Minimum Capital: Establishes that these entities must comply with specific regulations, such as the Organic Monetary and Financial Code and the Fintech Law, and have a minimum capital of USD 200,000.00.

Qualification: The Superintendency of Banks will establish qualification requirements, including policies, processes and cybersecurity, allowing entities to operate in various credit segments to encourage innovation.

Policies and Controls: These entities are required to design adequate policies and controls to manage their business risks.

Supervision and Control: The Superintendency of Banks will supervise these entities with a focus on risk management.

Operations: They should provide clear information on terms and conditions, have credit simulators and offer specific products, such as direct credit granting and credit card issuance.

Technological Infrastructure: They can use various technologies and must comply with regulations in this area.

Protection of Financial Users: They must inform in a complete and transparent manner, maintain updated information and disclose their identity. Portfolio Rating and Provisions: Rating criteria and provision percentages are established.

Novation, Refinancing and Restructuring: The processes are governed by specific regulations.

Write-off of Debentures: Subject to loan and obligation write-off regulations.

Subsection IV establishes the risk management of digital credit granting entities, where a Risk Management Committee is established with various responsibilities, including:

Define operational risk and establish the need for clear policies for its management.

Emphasize the importance of identifying and quantifying operational risks.

Point out the need to periodically review mitigation plans and address risks not mentioned in the standard.

Establish information security management, including the designation of an Information Security Management Officer and the creation of policies and procedures.

Sole Transitional Provision: Entities must implement the risk management standards within one year after qualification.

A series of general and transitory provisions related to the digital granting of credit and risk management in financial institutions in Ecuador are established.

General Provisions:

• Digital credit granting entities must comply with the rules and regulations of the Central Bank and the Superintendency of Banks.
• They should apply the rules on the ratio of total technical equity to assets once the corresponding accounting standard is issued.
• The Superintendency of Banks will issue the necessary control regulations.
• Only qualified entities can grant digital credits.

Transitory Provisions:

• The Superintendency of Banks will issue rules for rating entities in two months.
• It will issue a chart of accounts in three months.
• Entities must implement the standards within six months of qualification.