Provides financial services, in El Salvador

Ley de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas (Decreto Legislativo No. 695 of 2011), arts. 4(a), 19(h), 20-25 and 28-30 · Read the law's page

• If you hold credit-history data on consumers or clients, tell a consumer or client who proves their identity whether you are processing their credit-history information, and give them a copy when they ask.
• Rectify or delete a credit-history record that is unlawful, erroneous, unjustified or inaccurate when the consumer or client asks, and answer a request for access, rectification, modification or cancellation within five business days.
• Do not use, transfer, share or market the credit-history information in your database without the express consent of the person it concerns.

Normas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, art. 13 · Read the law's page

• This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from 4 April 2025 and again from 15 October 2025.
• Establish notification procedures under which your senior management and the Superintendencia are told as soon as you know of a materialized information-security or cybersecurity incident that exceeds the risk limits your board has approved, by the means available, with a brief description that covers the possible cause, the impact and the actions taken (article 13(a)).
• Within seven working days after reporting the incident, send the Superintendencia the complete documentation: start and end date and time, description, causes of the failure, technical diagnosis, channels affected, time out of service, impact, and the corrective actions or action plan (article 13(a)).
• Inform in a timely way, under your policies, the clients and users of financial products and services affected by a cybersecurity incident that compromised the confidentiality or integrity of their information, and tell them the measures taken to mitigate it (article 13(b)).
• If you outsource information-technology activities, set up transparent response procedures to share information with the Superintendencia seventy-two hours after an information-security incident occurs (annex 1, section C, point 1, which article 26 makes a condition of outsourcing).

Normas Técnicas para la Gestión de la Seguridad de la Información (NRP-23), CNBCR-07/2020, arts. 1, 2, 10, 12 y 32 · Read the law's page

• This binds the banks established in El Salvador and the branches of foreign banks, the financial conglomerates, pension fund managers, insurers, stock exchanges and brokerage houses, payment and securities-settlement system operators, e-money providers and the other supervised entities listed in article 2 (reached by declaring that you provide financial services). Article 2 was amended with effect from 4 April 2025 and again from 15 October 2025.
• Establish, maintain and document an information security management system that is consistent with your business-continuity management and your operational-risk management (article 10).
• Implement a cybersecurity function that reports to the board, the risk committee and senior management on its results at least every six months, including cyber threats, the effectiveness of the cybersecurity programs and a summary of the incidents that affected the entity (article 12).
• Review at least every six months the rights granted to users and how they are actually used, giving priority to critical infrastructure, systems and services, record each review and the actions taken in a log, and keep an inventory of profiles and accounts that covers user, administrator and vendor accounts (article 11(c) and (j)).
• Run a continuous, documented and periodically reviewed cybersecurity risk-management process with four stages: prevention, protection and detection, response, and recovery and learning. It includes tools that log and correlate events, continuous monitoring of the infrastructure, preservation of digital evidence, and continuity-plan tests that simulate cyberattacks (article 16).
• Test your technology infrastructure for vulnerabilities and intrusion at least once a year and whenever the infrastructure changes, send the Superintendencia a summary of the results within ten working days of receiving the provider's report, and send a remediation plan within thirty working days after that summary (article 20(i)).
• Apply security controls to the acquisition, development and maintenance of your systems, in so far as each applies: control access to source code, keep formal change and version control, check applications before they go into production, analyze and correct vulnerabilities during development and in production, and install software updates in a secure and controlled way (article 21).
• Before you replace or make a major change to a main system, or acquire infrastructure or systems for a new product or service, put a feasibility study and risk analysis to your board and send the same information to the Superintendencia fifteen working days before the system goes into production; give clients 24 hours' notice through the digital channel before planned maintenance takes it down (article 22).
• Before you outsource information-technology activities or operations, check that the service meets sections A, B and C of Annex 1 (risk assessment, provider due diligence, unrestricted access to the data for the Superintendencia and auditors, proof of the provider's security program and continuity plans, and exit plans), document that in a report to the Superintendencia fifteen working days before the activity goes into production, and attach a schedule of activities (article 26).
• Put in the outsourcing contract that you own your data and the provider acquires no rights to it, the service levels and contingency plans, prompt correction of vulnerabilities, end-to-end encrypted channels, isolation of your data from the provider's other clients, and return or secure deletion of the data on request or at termination; the provider's security may never be lower than yours (article 14; article 26 and Annex 1, section B).
• Tell the Superintendencia thirty working days before operations begin where your main and alternate data centers are or are being moved, with the work plan and the board minute, and show compliance with Annex 1 before you place a data center outside the country through outsourcing (article 25); tell it where backups are stored or processed within ten working days after operations start or the location changes (article 23).
• Within 120 calendar days after each financial year ends, send the Superintendencia a report on your level of compliance with the information security management system requirements, and send it your information security program every year and whenever it changes (article 29); send it the updated inventory and classification of information assets by 31 January each year (article 19).

Normas Técnicas sobre Medidas de Ciberseguridad en Canales Digitales (NRP-32), CNBCR-02/2022, arts. 1, 2, 4-7, 14, 18 y 41 · Read the law's page

• This binds the banks established in El Salvador, the branches of foreign banks, the savings and credit societies, the cooperative banks and their federations, and the investment banks that article 2 lists, for the information they handle in digital channels (reached by declaring that you are a bank). Article 2(d) to (f), which cover the cooperative banks, their federations and the investment banks, carry the amendment in force from 25 November 2025.
• Monitor your networks and technology infrastructure to detect security events and unusual activity in time, and include threat intelligence (article 4).
• Run vulnerability-management processes with penetration tests and vulnerability scans, and remediate or mitigate every security gap, not only the critical and high-risk ones (article 5).
• Keep a quick process to acquire, test and install patches, and stop using applications, operating systems and database managers that the vendor no longer supports with security updates (article 6).
• Use multi-factor authentication on every user account that accesses through the Internet and on privileged accounts (article 7).
• Encrypt critical information at rest or in transit, including on removable and mobile storage devices, with secure protocols (article 14).
• Have cybersecurity-incident response plans that mitigate the impact of an incident, and test them (article 18).
• Verify a client's identity for digital-channel operations with multiple authentication factors, at least three of those the article lists: category 1 questions drawn from the client's contract and use of products, category 2 passwords, category 3 one-time dynamic keys, and category 4 biometrics. To log in, require a client identifier of at least six characters and a category 2 or 3 factor; for the operations the article names, require a further category 3 or 4 factor. A digital-channel password has at least eight characters mixing upper-case and lower-case letters and numerals, expires within 180 days and may not repeat a recent one (articles 21, 22 and 25).
• End a client's digital-channel session automatically after 180 seconds of inactivity (up to five minutes for business banking) or when simultaneous sessions are detected, and block access to the digital channels after three consecutive failed attempts to authenticate, or when monitoring detects unusual or irregular transactional behavior (articles 30 and 35).
• Monitor digital-channel transactions in real time with specialized fraud-prevention tools, raise alerts on unusual, irregular or suspicious operations against the client's profile, and notify the client immediately of operations that deviate from it (article 33).
• When the platform behind the digital channels fails to detect a fraudulent transaction, or one the client did not request or carry out, and your analysis does not attribute it to the client, reimburse, compensate or reverse the amounts involved without adding fees or charges (article 36).
• Have tools against phishing, spam and spear-phishing, with continuing training for staff (article 8), antivirus or antimalware programs reviewed regularly (article 11), mobile-device management (article 12) and data-loss-prevention tools (article 13).
• Use protocols that authenticate users, authorize their use of resources and record their activity (article 15), keep activity records available for analysis (article 17), and keep the inventory of critical information assets up to date (article 16).
• When a client's user account is blocked in the digital channels, for any reason, offer digital or analog ways to unlock it, such as biometric identification, messaging applications, e-mail or a telephone number, except for blocks under article 35(b), (c) and (d); entities have three months from 25 November 2025 to comply (articles 26-A and 42-A).