This volume is a product of the staff of the International Bank for Reconstruction and Development/The World Bank. The World Bank does not guarantee the accuracy of the data included in this work. The findings, interpretations, and conclusions expressed in this paper do not necessarily reflect the views of the Executive Directors of the World Bank or the governments they represent. The material in this publication is copyrighted. FINANCIAL SECTOR ASSESSMENT PROGRAM - DEVELOPMENT MODULE EL SALVADOR FINANCIAL INFRASTRUCTURE TECHNICAL NOTE NOVEMBER 2016 This Technical Note was prepared in the context of a World Bank Financial Sector Assessment Program mission in the Republic of El Salvador in March 2016 led by John Pollner and overseen by Finance and Markets Global Practice, World Bank. The document contains technical analysis and detailed information underpinning the FSAP assessment’s findings and recommendations. Further information on the FSAP program can be found at www.worldbank.org/fsap. THE WORLD BANK FINANCE AND MARKETS GLOBAL PRACTICE LATIN AMERICA AND THE CARIBBEAN REGION VICE PRESIDENCY i Contents Page Executive Summary .................................................................................................................. 1 I. Payment and Securities Settlement Systems................................................................ 16 A. Legal and Regulatory Framework ........................................................................................ 16 B. Large-value payment systems .............................................................................................. 21 C. Retail payment systems and services.................................................................................... 25 D. Government payments .......................................................................................................... 29 E. Securities clearing and settlement systems ........................................................................... 32 F. International remittances ...................................................................................................... 35 G. Payment system oversight and cooperation.......................................................................... 36 II. Credit reporting Systems.............................................................................................. 39 A. Overview .............................................................................................................................. 39 B. Legal and Regulatory Framework ........................................................................................ 43 C. Credit Reporting Service Providers ...................................................................................... 50 H. Credit Registry ..................................................................................................................... 58 I. Credit Information on MSMEs and Corporates ................................................................... 62 J. Cross-Border data flows ....................................................................................................... 64 K. Role of the Authorities ......................................................................................................... 65 III. Secured Transactions and Collateral Registry ......................................................... 69 Boxes Box 2: Use of credit information for banking supervision: the case of Mexico................................... 61 Box 1- Data items for a comprehensive commercial credit report ....................................................... 64 Figures Figure 1-– Portfolio distribution of bank and financial credit to private sector ................................. 42 Figure 2- Credit Information Flows in El Salvador ............................................................................. 43 Figure 3- Complaints received by the Consumer Protection Agency in relation to credit histories ... 48 Figure 4- Retention Periods ................................................................................................................. 49 Figure 5- Ownership Structure of Equifax ........................................................................................... 52 Figure 6- Ownership Structure of Infored............................................................................................ 53 Figure 7- Ownership Structure of Protectora de Credito (Procredito) ............................................... 53 Figure 8- Main reasons for bounced cheques in El Salvador .............................................................. 57 Figure 9: Commercial credit information market ................................................................................ 62 Figure 10- Institutional CRS Oversight arrangements ........................................................................ 69 Tables Table 1: Volumes and values of RTGS and CCECH ............................................................................ 22 Table 2- Impact analysis of consumer consent rule in existing databases ........................................... 47 ACRONYMS ABANSA Salvadoran Banking Association ACH Automatic Clearing House Anti-Money Laundering/Combating AML/CFT the Financing of Terrorism ATM Automated Teller Machine BCR Central Bank of El Salvador (Banco Central de la República del Salvador) BIIA Business Information Industry Association CCECH Cheque Clearinghouse (Camara de Compensacion Electronica de Cheques) CEDEVAL Central Securities Depository CNR National Registry (Central Nacional de Registros) CPMI Committee on Payments and Market Infrastructures CRS Systemic Risk Committee (Comité de Riesgo Sistémico) CRS Credit Reporting System CRSP Credit Reporting Service Provider CSD Central Securities Depository DGT Dirección General de Tesorería DUI Unique identification (Documento Único de Identidad) DVP Delivery-versus-payment EFT Electronic Fund Transfers ETF Exchange Traded Fund FCPL Consumer Protection Law FEDECACES Salvadoran Federation of Associations of Cooperatives and Savings and Loans FEAGIN Fondo Fiduciario Especial para Atender a los Afectados de las Operaciones Ilegales del Grupo Insepro FEDECREDITO Federation of Credit Unions and Worker's Banks Fondo Fiduciario Especial para Atender a los Afectados de las Operaciones Ilegales del Grupo FEAGIN Insepro FMI Financial Market Infrastructure FOSAFI Fondo de Saneamiento y Fortalecimiento Financiero FSAP Financial Sector Assessment Program G2B Government to Business (payment transaction) G2P Government to Person (payment transaction) IOSCO International Organization of Securities Commissions MINEC Ministry of Economy MSMEs Micro, Small and Medium-Size Enterprises MTO Money Transfer Operator NBCSI Non-Bank Credit and Savings Institutions NCRS National Credit Reporting System NIT Tax Identification Number (Numero de Identificacion Tributaria ) NPL Non-Performing Loan NPS National Payments System OTC Over-the-Counter P2P Peer-to-Peer PFMI Principles for Financial Market Intermediaries POS Point-of-sale RNPN National Registry of Natural Persons (Registro Nacional de Personas Naturales) ROSC Report on Standards and Codes RSP Remittance Service Provider RTGS Real Time Gross Settlement ii Electricity and Telecommunication Superintendency (Superintendencia de Electricidad y SIGET Telecomunicaciones) SITE Servicio Interbancario de Transferencias Electronicas SME Small and Medium-Size Enterprise SML Security Markets Law SPM Sistema de Pagos Masivo SSF Financial System Superintendency (Superintendencia del Sistema Financiero) STP Straight-through-processing SV Securities Superintendence (Superintendencia de Valores) TSA Treasury Single Account WB World Bank iii PREFACE The note was prepared in the context of a World Bank Financial Sector Assessment Program mission in El Salvador during March 6-15, 2016. The team comprised John Pollner (Mission Chief), Rekha Reddy (Deputy Mission Chief), Maria Teresa Chimienti, Denise Dias, Tamuna Loladze, Fredesvinda Montes, Mateo Clavijo Munoz (all World Bank staff); Jose Rutman (Former Regulation General Deputy Manager, Central Bank of Argentina), and Monica Caceres (Former Deputy Superintendent, Insurance, Chile). This Financial Infrastructure Technical Note was written by Maria Teresa Chimienti and Fredesvinda Montes. The note contains technical analysis and detailed information underpinning the FSAP assessment’s findings and recommendations. Further information on the FSAP program can be found at www.worldbank.org/fsap. iv EXECUTIVE SUMMARY 1 Payment and Settlement Systems 1. Since the last FSAP, the national payments system (NPS) has consolidated and expanded. The real-time gross settlement (RTGS) systems owned and operated by the Banco Central de Reserva de El Salvador (BCR) is the backbone of the NPS and is widely subscribed by both banks and supervised non-bank financial institutions. 2 In 2015, the RTGS system settled transactions equivalent to 1.8 times the country’s GDP; volumes have grown at an annual average of 17 percent over the last three years. Through the RTGS system, the securities settlement system of the Bolsa de Valores de El Salvador conducts its money settlements in central bank money based on Model 2 Delivery versus Payment (DVP). 3 The private-sector automated clearinghouse (ACH) and the central-bank cheque clearinghouse also settle through the RTGS. 2. Recently, a number of legal initiatives – amendments to the Ley Organica and the Ley de Supervision Financiera, Ley para Facilitar la Inclusion Financiera, Ley de Firma Electronica, and others – as well as several regulations have broadened the supervisory perimeter and addressed specific aspects of payment systems and services. In addition to the role of operator, the BCR is formally tasked by the Ley Organica with the regulatory agenda and oversight of payment and securities settlement systems. 3. In 2013, the BCR launched a service for government disbursements called Sistema de Pagos Masivos (SPM).4 Although limited to the payments of government contractors, it is expected that the SPM be leveraged in the future to consolidate government-to-person (G2P) payments. 4. The private-sector ACH was launched in 2011 and has been expanding its membership and range of services over time. However, volumes remain low, 5 and the prospect of growth are not clear while “bancarization” is still low and large-volume government payments are handled through the SPM. 5. ATM and POS terminal deployment in El Salvador is below the average for the Latin America and the Caribbean, but above the average for lower-middle income countries. Although there are no consolidated statistics on POS penetration, anecdotal evidence suggests that POS terminals are concentrated in urban areas. ATM and POS clearing and settlement is concentrated in Serfinsa-ATH and Credomatic, respectively. 6. The cooperative sector can compete in the provision of payment services to the 1 This Technical Note has been prepared by Maria Teresa Chimienti, Fredes Montes (all WB). 2 Including associations and federations of cooperatives and cajas de credito that comprise unsupervised entities (e.g. FEDECREDITO, FEDECACES) 3 DVP Model 2 refers to systems that settle securities transfer obligations on a gross basis and funds transfer obligations on a net basis. 4 In fact, this system only supports bulk payment transactions (lotes) through the RTGS system, while banks proceed to credit the beneficiaries based on the information received through the SPM within the same day. 5 About 200,000 transactions in 2015, equivalent to less than 3 percent of the total value settled in the RTGS system (Source: BCR, ACH). 1 public, and is generally provided adequate access to the payments infrastructure. Among non-financial institutions, Tigo Money has reached 350,000 active mobile money accounts in five years of operations, and also undertakes over-the-counter (OTC) transactions. 7. Dematerialization of securities was achieved, being over 99 percent of total securities held in Cedeval dematerialized. Securities accounts at Cedeval are held at the level of the final beneficiary, and the person that appears as the owner in such accounts is recognized by law as the legal owner. Securities ownership is transferred by means of book entries, which the Law on Book Entry recognizes as a means to transfer ownership. To facilitate the domestic market participants, Cedeval has links with the two international central securities depositories – Euroclear and Clearstream. 8. Consistently with the provisions of the Securities Market Law, the clearing and settlement is effected by the Bolsa through the Sistema Electrónico de Liquidación Bursátil (SELIB). To mitigate principal risk inherent to an exchange-of-value system, securities are blocked prior to the settlement of the cash leg. However, the time lag between the blocking of the securities and final settlement of both legs can be significant. 9. There are two main possible future developments that are worth mentioning in the context of securities clearing and settlement: (i) the clearing and settlement function will be taken over by Deceval and an interface with the RTGS will be established; (ii) there is a project of regional integration of the stock exchanges of El Salvador with the stock exchange of Panama. 10. As of Q1 2016, the average cost of sending USD 200 to El Salvador is 4.33 percent, significantly below the global average of 7.53 percent, and even lower than the regional average for Latin America and the Caribbean of 5.92 percent. 6 According to World Bank estimates, remittances to El Salvador reached USD 4,363 million in 2015, representing 17 percent of the country’s GDP. Over 90 percent of incoming remittances originates from the United States, followed by Canada. 11. Notwithstanding these positive developments, the payments system remains exposed to certain risks and presents areas of inefficiency that the BCR aims to address comprehensively and in stages through a revised national payment system strategy. Legal and regulatory framework 12. Remaining legal risks and gaps should be addressed at the earliest and in a comprehensive manner, e.g. through a payment system law. For example, although the RTGS system’s rules and processes are designed to provide clear and certain final settlement, settlement finality is not covered at the level of law. Securities transfers effected by the central securities depository (Cedeval) also lack legal coverage of settlement finality. In addition, netting is not recognized at the level of the law, thus posing a legal risk to a number of netting schemes in El Salvador. The regulatory perimeter should also be broadened by 6 Source: Remittance Prices Database (https://remittanceprices.worldbank.org/en) 2 applying a functional, risk-based approach to payment system regulation to include non- banks that are currently outside of the purview of the BCR. 13. Authorities should strengthen the legal foundations for electronic payments. Indeed, there is no statutory provision on the recognition of electronic funds transfers 7 as valid means of payments. Also, cheque images are not legally recognized as replacement of the original cheques for re-presentment, thus physical exchange of cheques must take place. Large-value payment systems 14. It is important that the BCR determine whether the current RTGS infrastructure can satisfy the expectations that have been set in the international standards for systemically important payment systems. The Principles for Financial Market Infrastructures (PFMI) emphasize that FMIs should be efficient and effective in meeting the requirements of its participants and the market it serves (Principle 21). In this respect, while in general the system has emerged as practical for its current users, the key issue is to determine whether it is flexible enough to respond to changing demand and evolving technologies. 15. In the short term, the BCR should discourage the use of large-value cheques; in the medium term, large-value cheques should be eliminated. In addition to posing risk concerns, cheques are a source of inefficiency and inhibit the optimal use of the RTGS system. Related to the above point, if the RTGS system usage for customers’ transactions is to be promoted, straight-through-processing (STP) needs to be achieved. 16. Gaps in RTGS operational risk management should be addressed at the earliest; to ensure high standards of operational reliability, the BCR should stress test the actual capacity and f the system on an ongoing basis. Business continuity plans should incorporate the use of a secondary site designed and equipped to ensure that critical IT systems can resume operations within two hours from the disruption. The BCR should forecast the plausible demand in light of market development and BCR strategic objectives. 17. The RTGS rules should be amended to: (i) clearly define the point after which confirmed but unsettled payments can no longer be revoked, and (ii) include procedures for facilitating the participants’ suspension and the orderly exit. In fact, there seem to be ambiguity as to whether queued transfer instructions and “scheduled” payments (pagos programados) would be considered irrevocable. As the operator of the RTGS system, the BCR should monitor compliance of its participant on an ongoing basis. 7 Electronic funds transfers are referred to as means a transfer of funds which are initiated by a person so as to instruct, authorize, or order a payment service providers to debit or credit an account maintained with that payment service provider through electronic means, and includes point of sale transfers, ATM transactions, direct deposits or withdrawal of funds, mobile payments, internet, card or other devices. 3 Retail payment systems and services 18. Cash and cheques dominate the retail payments landscape in El Salvador; to accelerate the transition to electronic payments, the BCR should promote the expansion of the retail payments infrastructure and ensure that it is fully and efficiently leveraged. 8 The retail payment system as a whole will also benefit from non-bank competition subject to proportionate requirements and efficient access to infrastructure. 19. First, there is great potential in migrating large volumes of cheques to electronic payments (also combined with measures aimed to reduce the use the cash). Manual cheques processing – from the physical transfer of cheques that cannot be cleared locally to the daily physical exchange of cheques – exposes the BCR to operational risk. Together with cash, cheques are inefficient and costly although the indirect costs inherent to these instruments are often overlooked in economic analysis. 20. The implementation of the direct debit component into the SITE should be expedited as a key factor to promote electronic payments. Enabling direct debits in the ACH could help reduce cash payments for certain common use cases. The most common use case scenarios for direct debit transfers are recurring (e.g. monthly or quarterly) payments of a certain amount or an amount within a specific range. Bill payments are heavily cash-based in El Salvador. 21. ACH governance arrangements and fees are critical in ensuring the largest participation possible. Although a private enterprise, ACH can also be seen a public utility and a fundamental prerequisite for increasing usage of transaction accounts. The BCR as the payment system overseer should ensure that (i) key systems have a reasonable, cost-related pricing policy that incentivize broad subscription, (ii) governance arrangements take into consideration the interest of non-shareholder participants, and (iii) relevant information / data and key procedures is publicly disclosed. The implementation of the direct debit component by the ACH should be expedited as a key factor to promote electronic payments. Enabling direct debits in the ACH could help reduce cash payments for heavily cash-based bill payments. 22. Limited penetration of POS infrastructure and the patterns of usage of payment cards should be analyzed by the BCR also in relation to interchange fees. From the perspective of deepening POS penetration in the country, the BCR should determine whether possible distortions in the interchange fees are being passed on to merchants in the form of high costs and disincentives combined with the no-surcharge rule sanctioned by law. The BCR should also consider whether price signals to customers when choosing between using a credit or a debit card are appropriate. The BCR as the payment system overseer should include card payment systems in its purview. 23. The BCR should carefully plan and take a balanced approach to regulatory requirements on interoperability to avoid discouraging investment in innovation on the one hand, and the emergence of duplicative networks on the other hand. As far as mobile money is concerned, it would be appropriate to expect that in the medium term 8 The CPMI-World Bank Payments Aspects of Financial Inclusion report provides guidance in this regard. 4 customers be able to top-up and transfer the balance in the mobile money account from/to various types of accounts, including a traditional bank account. Government payments 24. Authorities are encouraged to complete the process to implement the Treasury Single Account (TSA) by concentrating all incoming government funds / disbursements into/from the TSA; on the other hand, the main concern with the SPM is the lack of STP and its inherent inefficiency. This is an area where the BCR could also consider leveraging existing (privately-owned) ACH infrastructure. 25. In light of the opportunity that G2P and G2B represent in terms of shifting large volumes of cash and paper-based payments to electronic means, and to achieve broader financial inclusion objectives, the choice of the underlying transaction account should meet the specific payment and store-of-value needs of the recipients. In particular, the use of prepaid cards for subsidies and other social transfer programs as envisioned by MINEC should be considered in light of: (i) cards acceptance infrastructure; (ii) payment functionalities, and; (iii) transaction fees and other costs. In light of the low levels of bancarization amongst the recipients of social transfers, e-money products may also be considered in the medium term as an option to receive social transfers. 26. As far as P2G and B2G payments are concerned, there should be a wide range of online and in-person electronic payment options to pay tax obligations. Similarly, government collections should leverage the networks for physical points of access to the largest extent possible. Securities settlement systems 27. The transfer of the securities clearing and settlement function to Cedeval is potentially a positive development from an efficiency and risk management perspective. The link/interface between Cedeval and the RTGS would enable the simultaneous settlement of the securities leg and the cash leg, thus eliminating the current issue of time lag. 28. However, the corporate governance and transparency aspects of Cedeval should be assessed against international standards. In particular, the risk management function should have sufficient independence and access to the board to ensure that Cedeval’s operations are consistent with the risk-management framework established by the board. Participant inputs to Cedeval decision making should be ensured through appropriate mechanisms, such as a user group. In terms of transparency, Cedeval should also complete and publish responses to the Disclosure Framework for FMIs. 29. Prior to assuming a clearing and settlement function, Cedeval should integrate financial risks in its risk-management policy and framework. At a minimum, a securities settlement system should maintain sufficient resources to cover the exposures of the two participants that would create the largest credit exposure in the system. 5 30. Cedeval’s settlement system should provide final settlement by the end of value date. Cedeval’s processes as a securities settlement system should be designed to complete final settlement no later than the end of value date. Cedeval should discontinue the practice of deferral of settlement to next business day as implemented by the Bolsa, which entail overnight risk exposure. 31. The general business risk profile of Cedeval may also change as a result of providing a new service. Cedeval should ensure that it holds liquid net assets funded by equity equal to at least six months of current operational expenses. This is to ensure that Cedeval can continue operations as a going concern should it incur in any losses. 32. The link arrangements of Cedeval with Euroclear, Clearstream and any other regional CSD should be evaluated in line with the recommendations of the PFMIs (Principle 20) to mitigate all link-specific risks such as legal, credit and liquidity, custody, and operational risks. In a regional arrangement such as the integration plan with the stock exchange of Panama, some of the risks mentioned above may be exacerbated because of the cross-border nature. International remittances 33. Remittance inflows should be leveraged to provide a significant portion of the population with access to a transaction account. According to Government and World Bank sources, over 1.3 million people or 20 percent of the country’s population receive remittances, and 17.3 percent receive domestic remittances in particular.9 Remittances (both cross-border and domestic), are acknowledged as another type of large-volume and recurrent payment stream that can be leveraged to advance financial inclusion. The BCR should consider allowing receiving international remittances to e-money accounts. 34. A payment system law – as suggested above – would allow addressing at the statutory level the main aspects of the operations of RSPs and remittances as a payment instruments. As a result, RSPs would fall under the discipline applicable to payment service providers, including licensing and licensing criteria, outsourcing and third party arrangements, and powers to the BCR to oversee remittance services. Payment system oversight and cooperation 35. The BCR would benefit from a clear definition of payment system oversight objectives, standards, tasks, and tools. Consistently with the Organic Law of the BCR, the oversight objectives should prioritize the overall safety and efficiency of payment and settlement systems and also include other important public policy objectives such as financial access/inclusion. In the oversight of systemically important payment systems and other FMIs, the BCR should be guided by the Responsibilities of Authorities of the PFMIs. 9 Encuestas de Hogares de Propositos Multiples, 2014; Global Findex 2014. 6 International guidance and best practices are also available with regard to retail payment systems. 10 36. It is suggested that the BCR establish formal cooperation arrangements with private sector stakeholders. Regardless of the specific form of cooperation, and bearing in mind efficiency and effectiveness considerations with respect to the number of participants, the BCR should adopt a the most comprehensive approach possible. For example, the national payments council is a permanent body for high-level cooperation and consultation in the area of payment and settlement systems. 37. The respective responsibilities and activities of the BCR and the SSF with regard to payment and securities settlement systems should be clarified and more closely coordinated. The licensing and supervision of the operators of payment and securities settlement systems carried out by the SSF (ACH, Cedeval/Bolsa) would benefit of a closer cooperation with the BCR to deepen the analysis of financial risks (credit, liquidity) arising in and borne by the systems. Direct and effective lines of inter-institutional communication should be established and contacts points identified to ensure continuous communication. The BCR and the SSF should address any gaps (and overlaps) in the respective mandates and responsibilities. Credit Reporting Systems 38. The present Technical Note is a result of the mission conducted in February 2016 by an international expert in the context of the FSAP. The team had extensive meetings with key participants in the credit reporting systems space and is grateful to the support and collaboration received from the SSF and the BCR in the elaboration of this report. The team held meetings with the SSF, the BCR, the Central Nacional de Registros (CNR), all existing credit bureaus, 4 banks, the banks association, the association of micro finance institutions, the Inter-American Development Bank, 2 telecommunication services providers, association of credit unions and Consumer Protection Agency (Defensoria del Consumidor). The mission team regrets that the questionnaire provided to the authorities was not fully completed which might undermine the quality of the present report. 39. The analysis of the status of credit reporting systems in El Salvador has been conducted taking into consideration the General Principles for Credit Reporting issued in 2011. Although this report does not comprise a detailed assessment of the General Principles it does build in some of their principles namely General Principle 1 on data quality and General Principle 4 on Legal and Regulatory Framework and consumer protection. In addition this note also looks into the status of credit reporting oversight taking into 10 This guidance elaborates on and apply the framework BIS-World Bank Principles for International Remittance Services of 2007. More recently, the BIS-World Bank Group report on Payment Aspects of Financial Inclusion (PAFI) examines demand- and supply-side factors affecting financial inclusion in the context of payment systems and services, and suggests measures that could be taken to address these issues in light of increasing access to transaction accounts as a stepping stone to broader inclusion. 7 consideration the Recommendations for Effective Oversight included in the General Principles for Credit Reporting. 40. Credit Reporting Systems have been in existence in El Salvador since 1997 comprising both a credit registry and several credit bureaus. However despite the length of history data collected, the CRS is far from being effective or reliable. Credit bureaus have focused on specific niches instead of capturing comprehensive credit information from individuals and legal entities. Equifax has the largest database from the bank and financial system while Trans Union includes limited information from banks, retailers and some MFIs however data distribution is uneven as information from banks is shared under a closed user group environment. Other credit bureaus such as Infored and Procredito operate capture information from credit unions, retailers, micro finance institutions (MFIs) and insurance companies, hotels and schools. These latter credit bureaus base their products and services on identification information mostly used by creditors for marketing and collection purposes. 41. The lack of an efficient credit reporting systems affects access to credit in particular MSMEs access to credit. MSMEs’ limited access to credit, particularly for investment, is evidenced by the fact that, as of end 2015, lending to this market segment accounted for just 16.40 % of total lending by the financial system compared to 32% in consumer lending and 25% in housing. In addition a large portion of the credit to MSMEs constituted medium term credit (between one and two years). 42. Positive credit information from banks is only shared between banks due to existing bank secrecy provisions under the banking law. Credit reporting systems in El Salvador are extremely fragmented and contain incomplete data which impede the evaluation of the creditworthiness of individuals and companies. Even if information is available in the same credit bureau, positive credit information from the banking sector is not shared with other sectors impeding creditors and deferred payments service providers to have a complete picture of the debtor. In general, despite the existence of several credit reporting service providers for at least two decades, the CRS relies excessively on negative information and identification data including address. 43. There are 5 telecommunication service providers developing new payment models for their services. Although a large number of consumers are currently accessing telecommunication services on pre-paid model (80%) of their current clients, the objective in the next three years is moving an additional 20% to post-paid. For such objective they would need additional information regarding re-payment behaviour particularly from credit cards, however they are only able to access negative information from the banks. In addition all telecommunication companies have expressed difficulties in completing the formats provided by the credit bureaus and they typically need their support to complete them. Some of the telecommunication companies will be providing e-money related services including credit although they aim at using internal proprietary information to offer such services. Information included in their files includes payment transactions, geo-reference, enquiries and usage. Finally, the telecommunications law includes restrictive provisions regarding the sharing of information held by telecommunications companies and therefore only share negative data from their clients. 8 44. There are a number of additional information available and government –held databases such as the Centro Nacional de Registros (CNR) that would be valuable to enhance data completeness in credit bureaus. The CNR comprises several registrars including the individuals’ registrar, the immovable property registrar, the commerce registrar, intellectual property registrar, and movable property registrar. In particular information from adults could serve verify the identity of individuals registered in the respective credit bureaus, the information included under the companies registrar could serve to evaluate the level of formality and transparency of companies applying for loans. Information from the intellectual property could also add value to creditors as regards to potential security interests based on intellectual property rights in the name of a specific debtor. Finally the movable registrar holds relevant information regarding value of collateral for movable assets. 45. Reforms in the credit reporting space resulted in cleansing of all credit bureau databases after Supreme Court Ruling against Dicom/Equifax on the need to prove consumer consent from consumers whose data is included in their databases. This ruling not only impacted Equifax but all other credit bureaus. In all at least 1 million records have been erased from each credit bureau as the credit reporting service providers were not able to prove the existence of consumer consent for many of those files. Additional clarifications were made transferring the responsibility for consumers’ consent to the data providers instead of the credit bureaus which in turn resulted in some data providers not submitting additional data to the credit bureaus. 46. The legal and regulatory framework requires further attention in order to ensure a clear and non-discriminatory legal framework. In particular he following aspects should be taken into account; • Amend article 232 of the banking law regarding ban secrecy to allow for an exception not only to the credit registry but also to credit bureaus; • Establish clear rules to calculate the retention period on negative information recently established in the law; • Adopt guidelines on how to prove the existence of consent for all information included in the CRS; • Adopt clear rules on the use of public information by credit bureaus; • Adopt rules regarding communication protocols to effectively implement consumers rights related provisions; • In addition the law should be clear on aspects related to cross-border data flows, exit criteria ensuring business continuity and measures related to potential sanctions that do not leave the market without service. 47. The SSF is well positioned to implement an oversight framework for CRS seeking to ensure the efficiency, safety and reliability of the CRS. The SSF has the mandate to supervise credit bureaus while at the same time operates the credit registry. There is no 9 formal oversight for CRS as a whole although the law attributes mandate to the SSF for the operations of the credit registry as well as the supervision and licensing of credit bureaus operating in El Salvador. The BCR has also the mandate since the latest legal reform in 2015 to regulate the credit bureaus and the Defensoria del Consumidor is responsible for the implementation of the consumer protection law including aspects related to credit reporting and also 48. Creditors have suffered from the lack of credit information services during the period the largest provider of credit information was suspended. Equifax/Dicom served the banking sector with credit reports and value added services that were not available in any other service provider in the market. As a result of the recent legal reforms requiring the previous consumers’ consent prior to sharing information with any credit bureau resulted in the deletion of a large number of records. In addition the 2015 amendments to the Law on Credit Histories reduce the retention period for negative information. 49. In the absence of a standard consumer protection framework, the BCR should also enhance consumer protection guidelines, including clarifying credit reporting rights, credit conditions and methods of emergency update of data. The adoption of a standard consumer consent clause for all credit bureaus would enhance clarity for consumers as well as the establishment of adequate protocols for data dispute and allow consumers to get a free copy of their credit report at least once a year. 50. Despite the authorities’ efforts, consumer protection aspects related to credit reporting could be further strengthen. In particular a tighter control regarding the use of credit information for certain purposes while also allowing consumers to object the use of their information for additional purposes that go beyond evaluation of creditworthiness subject to consumers’ request for credit/service involving deferred payment or existing credit or similar obligation. 51. Authorities should consider ways to further integrate data sources, such as the Centro Nacional de Registros (CNR), to complement credit information available in credit bureaus in particular in relation to companies which is very limited in the existing CRS. Other sources of relevant information for creditworthiness evaluation include; (i) information on bounced cheques from the BCR given the relevance of cheque as a payment instrument, (ii) positive information from telecommunication companies. Authorities could engage with CNR and evaluate the existing barriers ( e.g. legal, technological) to enable the sharing of such data with all credit bureaus. Collateral Registry 52. Both the secured transactions law and the electronic collateral registry are very recent and require some additional time to adequately implement all the relevant aspects included in the law. The law follows the OAS model law on secured transactions which has also been developed in other countries in the region. 10 53. In ensuring efficiency of the system, it is critical that authorities, ABANSA and other creditors join forces and build awareness on the existence of this law and registry and promote their usage Key Recommendations Priority Timeframe Payment Systems Legal and regulatory Legal risks resulting from gaps in High MT the legal framework should be (medium addressed at the earliest and in a term) comprehensive manner, e.g. through a Payment System Law. In particular, settlement finality (both funds and securities transfers), netting, protection in case of insolvency, should be recognized/addressed at the statutory level. The legal foundations of electronic payments should also be strengthened. Close the gap in regulation of High MT payment system operators (payment card switch) and non-bank payment service providers (bill aggregators), and outsourcing. Issue proportionate e-money High MT regulations. Large-value payment Undertake a detailed assessment of High MT systems the RTGS system to determine if the current infrastructure can satisfy the expectations that have been set in the international standards for systemically important payment systems and the needs of the market it serves. Discourage the use of large-value High MT cheques; in the medium term, large- value cheques should be eliminated. RTGS system usage for customers’ Medium MT transactions should be promoted; this also implies enforcing straight- through-processing (STP). 11 Key Recommendations Priority Timeframe Stress test the actual capacity and Medium MT performance of the system on an ongoing basis. Amend RTGS rules to include Medium MT suspension and orderly exit of a participant that is not compliant with the BCR participation requirements. Address gaps in RTGS operational High MT risk management, including establishing a secondary site. Retail payment Discourage the use of cheques for Medium MT systems retail payments: (i) incentivize person to person electronic fund transfers (EFTs) through appropriate pricing to divert low-value cheque volumes, and; (ii) maintain cheque clearing and settlement on a T+1 basis as a disincentive to use cheques compared to electronic instruments. ACH to expedite direct debit High ST (short component of SITE as a key factor term) to promote electronic payments. Monitor ACH participation fees in Medium MT the interest of encouraging the largest participation possible. Collect information and analyze Medium MT interchange fees as a possible factor in impeding broader POS penetration. Set clear, medium term expectations High ST for interoperability of e-money solutions. Government Authorities to complete the process High MT payments to implement the Treasury Single Account (TSA) by concentrating all incoming government funds / disbursements into/from the TSA. 12 Key Recommendations Priority Timeframe SPM lacks STP; going forward, Medium MT BCR to consider leveraging existing infrastructure (ACH) BCR to work with payment service High ST providers to ensure that underlying transaction account of G2P and G2B payments meets the specific payment and store-of-value needs of the recipients. Securities settlement In light of Cedeval’s plans to act as High ST systems the securities settlement system, corporate governance and transparency aspects be assessed against international standards. Prior to assuming a clearing and High ST settlement function, Cedeval should integrate financial risks in its risk- management policy and framework. Cedeval’s processes as a securities High ST settlement system should be designed to complete final settlement no later than the end of value date. Cedeval should discontinue the practice of deferral of settlement to next business day. Cedeval to achieve simultaneous High ST DvP2 through the appropriate interface with the RTGS. From a business risk perspective, Medium MT and in light of future plans that may affect its business risk profile, Cedeval to ensure that it holds liquid net assets funded by equity equal to at least six months of operational expenses. The link arrangements of Cedeval Medium MT with Euroclear, Clearstream and any other regional CSD should be evaluated in line with the recommendations of the PFMI. 13 Key Recommendations Priority Timeframe International Address the main concepts/aspects High MT remittances of the remittance operations through the payment system law. BCR to work with payment service High MT providers to leverage inflows to provide a significant portion of the population with access to a transaction account. Oversight and Define payment system oversight High ST cooperation objectives, scope, standards, tasks, and tools to scale up oversight activities. Oversight and Establish formal cooperation Medium MT cooperation arrangements with private sector stakeholders; in doing so, adopt an inclusive approach as appropriate. Oversight and BCR, SSF to clarify and more High ST cooperation closely coordinate the respective responsibilities and activities with regard to payment and securities settlement systems should be clarified and more closely coordinated. Credit Reporting Systems Legal and Regulatory Amend article 232 on bank secrecy. Medium MT Framework BCR should formulate clear Medium ST guidelines regarding consumers’ rights. BCR develop guidelines on High ST retention periods. BCR to develop a standard consent High ST clause for all data providers. BCR to analyze the adequate data High ST field to be included in credit bureau databases. 14 Key Recommendations Priority Timeframe Credit Reporting Seek ways to enable access to Medium LT Service positive credit information to all users. Include additional information from Medium LT (long other data sources (e.g. cheques, term) companies registry, collateral registry, telecommunications). Enhance transparency of Credit Medium ST Reporting Service Providers. Seek ways to exchange information Medium MT between credit bureaus to provide creditors a comprehensive credit report. Credit Information on Enable the flow of MSMES credit Medium MT MSMEs information creditors. Credit Registry SSF and BCR to sign a MoU High ST regarding the access to information included in the Credit Registry and in credit bureaus to effectively perform their tasks. SSF to evaluate the need to access Medium MT credit information from the credit bureaus to perform their supervisory function. Cross- Border SSF and BCR to evaluate the impact Low MT of cross-border lending and the need to share credit information with other countries. Consider portability of credit reports Medium MT for migrants. Role of Authorities SSF to formally establish an High ST oversight function and unit for CRS clearly defining policy objectives, roles and responsibilities and instruments. SSF differentiate the role of credit High ST registry operator with the role of CRS overseer. 15 Key Recommendations Priority Timeframe Secured Transactions and Collateral registries Legal framework Authorities to develop regulation on High ST secured transactions. Registry Authorities and private sector join Medium ST forces to raise awareness on the new secured transactions law and foster the use of the collateral registry. I. PAYMENT AND SECURITIES SETTLEMENT SYSTEMS A. Legal and Regulatory Framework 1. The legal framework for the payment and securities settlement systems in El Salvador is composed of several laws and regulations, each addressing specific aspects of the operation of payment systems and provision of payment services. The framework legislation comprises the Organic Law of the Central Bank of El Salvador (Ley Organica del Banco Central de Reserva de El Salvador, Decree Law No. 746 of 1991), the Treaty on Payment and Securities Settlement Systems of Central America and the Dominican Republic (ratified by El Salvador through Decree No. 399 of 2007, hereinafter the “Treaty”), the Financial Supervision and Regulation Law (Ley de Supervision y Regulacion del Sistema Financiero, Decree Law No. 592 of 2015), the Banking Law (Ley de Bancos, Decree No. 697 of 1999), the Law of Cooperative Banks and Savings and Loans Associations (Ley de Bancos Cooperativos y Sociedades de Ahorro y Credito, Decree No. 849 of 2000), the Financial Inclusion Law (Ley para Facilitar la Inclusion Financiera, Decree No. 72 of 2015), the Securities Market Law (Ley de Mercardo de Valores, Decree No. 809), the Dematerialization Law (Ley de Anotacion en Cuenta, Decree No. 742 of 2002), the Electronic Signature Law (Ley de Firma Electronica, Decree No. 133 of 2015). This framework is supplemented by a number of regulations. 2. Notwithstanding this extensive body of law, basic payment system concepts lack legal coverage. These include: (i) settlement finality (of funds and securities transfers alike); (ii) legal recognition of bilateral/multilateral netting arrangements; (iii) electronic presentment of cheques, and; (iv) protection from third-party claims on collateral posted in a payment system. The electronic processing of payments and the evidential value of electronic records are determined in the Organic Law of the BCR (art. 67) and in the Banking Law (art. 60). The Treaty establishes that payment and settlement systems “recognized” by the Central Bank based on pre-determined criteria (e.g. systemic importance) enjoy legal protection as per the Treaty. This includes irrevocability and settlement finality of funds transfers and securities transfers (arts. 4-5), protection of guarantees used in a recognized payment systems (art. 7), and explicit provisions and definitions for the payment system oversight function (art. 11). The Treaty also contains an article on the creation of and legal framework applicable to regional payment systems (art. 13). However, the application of this framework 16 to payment systems in El Salvador is uncertain in the absence of an explicit designation of systems as per art. 3 of the Treaty. In addition, the legal protection of the Treaty would not extend to non-systemically important payment systems, thus leaving retail payment systems without coverage (unless “recognized” by a central bank as systemically important). 3. The Financial Supervision and Regulation Law vests the BCR with powers to regulate payment systems, and the Financial Superintendence (Superintendencia del Sistema Financiero, SSF) with the supervision of operators and service providers. The supervisory perimeter of the SSF was broadened in 2015; it includes the following entities among others: (i) the BCR (as far as banking services and management of reserves); (ii) banks, cooperatives, and savings and loan associations regulated under the Law on Cooperative Banks and Savings and Loan Associations; (iii) the stock exchange, central securities depository, and broker-dealers; (iv) operators and administrators of payment and securities clearing and settlement systems; (v) companies that provide services that are complementary of financial services to members of the financial system; (vi) money transfer operators at both international and local level, and; (vii) currency exchange bureaus. Based on this Law, the BCR recently issued regulations for money transfer services (“Normas técnicas para el registro, obligaciones y funcionamiento de entidades que realizan operaciones de envío o recepción de dinero” No. 18 of 2015). 4. The Organic Law confers upon the BCR the responsibility to ensure the smooth functioning of (internal and external) payments, and to adjust the supply of payment instruments to the level of development of the economy (art.3 g, h). Art. 67 of the Organic Law elaborates on the roles of the BCR as: i. overseer of payment and securities settlement systems, especially those that are fundamental for the stability and efficiency of the financial system; ii. payment system regulator; as such, the BCR has the power to establish the rules for the access, participation, suspension and exclusion of participants and administrators of payment and securities settlement systems; iii. operator of payment systems, with the faculty to charge fees in function of the costs incurred in the operation of the system, and to take collateral to guarantee its operations. It is worth noting that art. 67 also recognizes the electronic processing of payments. 5. In addition, the BCR acts as financial agent of the Government. As established in the Organic Law is not a lender of last resort (see art. 51, with the exceptions of the circumstances of art. 49 which contemplates: major deteriorations of liquidity; general illiquidity of the market; severe economic downturn; and; a calamity). Therefore, credit and overdrafts in a payment system do not apply. 6. The legal basis for e-money and simplified accounts are provided in the Financial Inclusion Law, 2015. E-money (defined as a monetary value represented in an electronic record – see art. 6 (a) and accepted as a means of payment by person(s) other the issuer), does not constitute a deposit nor is protected by deposit insurance (art.6 (b)). E- 17 money providers must be constituted as limited liability companies with the sole purpose of providing e-money; on the other hand, subject to BCR authorization, the Law allows e- money providers to engage in clearing and settlement, although the letter of art. 2 only refers to mobile payments. It is understood that banks, cooperative banks, and sociedades de ahorro y credito are authorized to issue e-money subject to complying with the provisions of the Law that are applicable to them. According to the Law, admissible uses of e-money include cash-out (withdrawals), domestic transfers, and payments. E-money is subject to both maximum balance (four minimum monthly wages, equal to approximately USD 1,000) and transaction limits (one minimum monthly wage per transaction or four minimum monthly wages in a month). Art. 10 of the Law establishes that the amount-of e-money must be fully (cien por ciento) backed in a non-remunerated, bankruptcy-protected account at the BCR. E- money providers are subject to the supervision of the SSF and must comply with BCR regulations. Simplified accounts (art. 20) are limited to natural persons, can only be used through electronic means, and are subject to similar balance and transaction limits as e- money accounts. 7. In the quest to expand access to financial services, the BCR has taken steps to regulate third-party arrangements (agents and agent network managers). Commercial banks, branches of foreign banks, cooperative banks, and sociedades de ahorro y credito (who wish to engage a third party for the provision of a range of banking/financial services on their behalf) are subject to BCR regulation on financial correspondents (Normas Técnicas para Realizar Operaciones y Prestar Servicios por Medio de Corresponsales Financieros y de Administradores de Corresponsales Financieros of March 2015). Agents and agent managers While agent exclusivity is not explicitly prohibited, the regulation contemplates the case of a second financial institution engaging an agent of another principal and prescribes that a viability study be conducted prior to engaging the agent (no authorization required). The BCR is in the process of regulating third-party arrangements for e-money providers. Agents of non-financial entities that provide payment services (e.g. bill aggregators) are unregulated. 8. Legal provisions for issuing securities in dematerialized form are determined in the Law on Book Entry, 2011. The Law provides for the issue, ownership transfer, and maintenance of records for dematerialized securities (chapters II and III). The Law establishes that dematerialized securities are a type of securities as are physical securities (art. 1). Dematerialization is mandatory for exchange-traded securities and irreversible. Chapter III on custody establishes that prior to trading on primary market, securities must be delivered to the central securities depository (CSD). The Law (art. 34) ensures that the securities held in custody are protected against third-party claims in the event of bankruptcy of the CSD. 9. The general framework for both government and corporate securities is specified in the Securities Market Law (SML). However, the SML does not define netting, finality and irrevocability of securities settlement nor does it provide coverage in case of insolvency of another system’s participant. The SML requires that the Bolsa de Valores 18 establish mechanisms for the clearing and settlement of securities; it also allows a CSD to provide clearing and settlement services. Recommendations 10. It is recommended that legal risks resulting from gaps in the legal framework be addressed at the earliest and in a comprehensive manner, e.g. through a Payment System Law. Although the provisions of the Treaty provide an umbrella for “designated” systems, they (i) may lack enforceability in the absence of a formal designation of systemic importance, and; (ii) would not apply to the national payments system as a whole – for example, retail payment systems may be left in a void. In particular: • Settlement finality for both funds and securities transfers should be dealt with at the statutory level. Payment system operators must then specify the rules to achieve final settlement in their operations, i.e. the irrevocable and unconditional transfer of an asset or financial instrument, or the discharge of an obligation by the operator / participants. • Netting arrangements – i.e. arrangements to convert several claims or obligations into one net claim or one net obligation – should be legally enforceable. The lack of such provision in the legal framework of El Salvador is an issue of concern in light of (deferred) net settlement of the cash leg of securities transactions, and also affects ACH and cheques clearinghouse operations, and the clearing and settlement schemes used by the cooperative sector. • In addition, payment and securities settlement systems need to be protected from the opening of insolvency proceeding against the operator or one of the participants following the entrance of a payment order into the system itself (i.e., exclusion of the “zero-hour rule”). Currently, the transactions of an insolvent participant in a payment system could be considered void or voidable by liquidators and the relevant authorities. Therefore, transactions that appear to have been settled by systems’ rules and were thought to be final may in fact be reversed. In a deferred net settlement (DNS) system, this implies that the netting of transactions must be unwound, and participants’ positions recalculated. As a consequence, participants’ balances may undergo significant changes thus leading to credit and liquidity risks. • Principles on finality and irrevocability, as well as those on the protection from insolvency should be extended to collateral pledged in a payment system. Collateral arrangements may involve either a pledge or a title transfer, including transfer of full ownership. If a payment system accepts pledge collateral, it should have a high degree of certainty that the pledge collateral has been validly created in the relevant jurisdiction and validly perfected, if necessary. If a payment system relies on title transfer collateral, it should have a high degree of certainty that the transfer is validly created in the relevant jurisdiction, will be enforced as agreed, and cannot be re-characterized, for example, as invalid or unperfected collateral or some other category that prevents its enforcement as agreed. 19 11. Gaps also emerge with regard to the regulation of non-banks for the provision of payment services, which the BCR should close by adopting a risk-based, functional approach to non-banks. Although there is no firm definition of non-banks in El Salvador or at the international level, these can be defined as entities involved in the provision of retail payment services whose main business is not related to taking deposits from the public and using these deposits to make loans. As a consequence of incremental changes to the payment system legal framework, regulation of non-bank provision of payment services is fragmented and incomplete: • In virtue of the Financial Inclusion Law and upcoming regulations, non-banks can engage in the provision of e-money, and can use other non-banks as agents to provide certain services on their behalf. Prior to the Law, Tigo was established as the sole mobile money provider in the country. • From unregulated, money remitters became regulated in 2016, although due to limitations in the underlying legal framework, a number of aspects related of their operations remain unaddressed (see section F on international remittances). • There are examples of non-bank front-end providers that are unregulated / unsupervised, such as Punto Express – a payment aggregator. • There are other gaps in the regulation of operators of retail payments infrastructures. While ACH systems were regulated by the BCR in 2011, entities operating payment card switches such as Serfinsa ATH are not subject to regulation or supervision. • Outsourcing of back-end services (e.g. IT services, providers of data center services, or other entities that provide back office operations) is generally not regulated, although draft e-money regulations do contemplate outsourcing and establish criteria to engage third-party service providers. 12. All persons that wish to provide payment services or operate payment systems must apply for a license from the SSF, and there should be a consistent licensing regime tailored to non-banks. In developing comprehensive, risk-based regulation, the BCR should consider that in general risks posed by non-banks in retail payments do not differ materially from those posed by banks, especially when they are providing the same type of payment services. However, specific aspects that may require increased attention with non-bank payment service providers in mind are the management of financial and operational risks, ensuring a level playing field, protecting consumers’ rights, and managing risks that might arise from the use of agents and outsourcing. 13. The BCR should regulate e-money in a way that is practical from an operational perspective and sustainable for both issuers and the BCR. Art. 10 of the Ley de Inclusion Financiera requires that e-money issuers keep the e-money “float” in an account at the central bank. This provision reportedly originated from the concerns about the inadequacy of available legal tools against the risk of misuse of the funds. For the purposes of keeping and accessing funds at the BCR, draft e-money regulations establish that e-money 20 issuers open an account in the BCR and subscribe a contract of participation in the BCR- operated RTGS system. This would eliminate barriers to access for non-banks, but operational issues would remain. In fact, draft regulations seems to interpret this requirement as depositing a “guarantee” in the central bank equivalent to at least 100 percent of e-money issued, which would be less onerous operationally for non-bank e-money issuers. However, it is not clear how sustainable (end efficient) for e-money issuers is to maintain both the account at the BCR and at a commercial bank for day-to-day liquidity management. BCR perspective, the law requires that the BCR ensure that the balance of electronic money represented on the platform of the issuer does not exceed the cash kept in the central bank. In other jurisdictions, a custodian bank would be responsible for reconciling the funds held in the custodian account against the cumulative value of all e-money accounts issued by the service provider so as to avoid any discrepancy between the e-money accounts and the custodian account. Custodian bank’s responsibilities also extend to (i) complying with prevention of money laundering and financing of terrorism regulations and requirements, and (ii) maintaining adequate and complete records of the aggregate e-float and the amount in the custodian bank. The modalities of BCR controls are still to be established; if the BCR is not in a position to outsource controls to a third party, it should explore systems and arrangements that are consistent with its responsibilities and available resources. Finally, it is not clear whether e-money regulations provide the right incentives to banks who, among other things, are also required to keep the equivalent of total e-money issued at the BCR. 14. Authorities should strengthen the legal foundations for electronic payments. The new legal framework provisions include the recognition of electronic signatures as equivalent to their physical ones. It is acknowledged in the Law of the BCR that operations performed in payment systems may be made by electronic data interchange and to this end electronic records are recognized probative value for the participants and the BCR. However, there is no statutory provision on the recognition of electronic funds transfers 11 as valid means of payments. Also, cheque images are not legally recognized as replacement of the original cheques for re-presentment, thus physical exchange of cheques must take place. B. Large-value payment systems 15. A real-time gross settlement (RTGS) system was implemented by the BCR in 2010 and is at the hearth of the national payments system. This system enables participants to execute transfers in US dollars on a gross basis and in real time through the current accounts they hold at the BCR. The RTGS system counts with 40 participants to date and is widely subscribed by both banks and supervised cooperatives, as well as pension funds, insitituciones autonomas, the Treasury, the deposit insurance fund, a second tier bank. In addition, the securities settlement system of the Bolsa de Valores de El Salvador conducts its money settlements in central bank money based on Model 2 Delivery versus Payment (DvP). The private-sector automated clearinghouse (ACH) and the central-bank cheque 11 Electronic funds transfers are referred to as means a transfer of funds which are initiated by a person so as to instruct, authorize, or order a payment service providers to debit or credit an account maintained with that payment service provider through electronic means, and includes point of sale transfers, ATM transactions, direct deposits or withdrawal of funds, mobile payments, internet, card or other devices. 21 clearinghouse (Cámara de Compensación de Cheques del Banco Central de Reserva) also settle their net balances through the RTGS. Bolsa de Valores, ACH, and the same BCR also hold accounts in the RTGS. Volumes settled in the RTGS have grown at an annual average of 17 percent over the last three years. In 2015, the system processed transactions for a total value of USD 44.2 billion. 16. Cheques are heavily used including for high-value transactions. Although cheque volumes have slightly decreased for two consecutive years, they represent over half the total values settled in the RTGS. In 2015, the BCR settled 5.9 million cheques, down from 6 million in 2014, for a total value of USD 23.7 billion, representing a decrease by 8 percent over the previous year. There is no information on the number of high-value cheques; the average cheque value is about USD 4,000. To mitigate the credit risk inherent to deferred net settlement of cheques, at 13:30 hours the BCR reserves in the participants’ accounts in the RTGS system the equivalent of the maximum net debit position of the last three months plus 5 percent for bounced cheques. Table 1: Volumes and values of RTGS and CCECH RTGS CCECH Year Value Volume Value Volume (in USD thousands) (unit) (in USD thousands) (in thousands) 2014 82,385 57,694 25,819 6,016.,47 2015 44,242 66,596 23,702 5,924,166 Source: Banco Central de Reserva de El Salvador 17. The operating hours of the system are well defined with specified cut-off times for various types of transactions. The RTGS business hours are from 8:30 AM to 5:30 PM. Extensions of the operating day may be allowed on a case-to-case basis. The last slot in the operating day is reserved for payments originating from the settlement of securities in the Bolsa. After the final cut-off time all pending transactions are cancelled and end-of-day operations take place. Peak times are from 10 to 11 (largest peak time) in correspondence of large-volume payments initiated by the Government and from 3:00 to 4:00 (second largest peak time). 18. As per RTGS system rules, payment instructions that have been accepted by the system (i.e. once they have passed the system’s controls) become final and irrevocable once the accounts of the payer and the payee have been affected. Prior to settlement, instructions that have been accepted by the system can be revoked (art.4.6 of RTGS rules). RTGS rules establish that participants’ accounts in the RTGS cannot be embargoed (art 5.11). 19. Transactions are settled immediately if funds are available in the sending participant’s account. In the event of insufficient balances in the payees account, the 22 transaction could be queued; in practice, queuing facilities are not used. The system does not allow participants to assign or change priorities to their payment orders. The BCR is not the central bank of issue and does not provide intraday or overnight credit facilities (see Legal and Regulatory Framework). In addition to their opening balances and funds received from other participants during the day, RTGS participants that are commercial banks, cooperative banks, sociedades de ahorro y crédito, and cooperative associations can use part of their statutory reserve requirements at the BCR (or foreign bank) for payment purposes. Cash deposits up to 25 percent (primer tramo) of total reserve requirements can be freely used for payment purposes. As necessary, an additional 25 percent (segundo tramo) in form of cash or BCR-issued securities can be used subject to a penalty fee established by the BCR in proportion to the amount that the financial institution has withdrawn. The remaining 50 percent (tercer tramo) cannot be used unless authorized by the SSF. There are no penalties for non-repayment of cash deposits by end of day; however, for the purposes of determining compliance with reserve requirements, the SSF will consider the average daily balances in the reserve accounts over a period of fourteen consecutive days. 20. Notwithstanding the RTGS system being identified as a critical process in the BCR risk management framework, the BCR did not set up a secondary site. RTGS system resilience relies exclusively on duplication of hardware/software at the same BCR facilities of the (primary) site. The time to resume operations after a disruption in the system is calculated at one hour. Business continuity plan scenarios include the total failure of the system, and a partial as well as total failure of the participants. In extreme circumstances, the RTGS system has alternative manual arrangements in place. Operational reliability metrics and objectives are nor clearly defined or systematically measured. The RTGS capacity is unknown; the RTGS operator reports that increasing stress volumes have caused a slowdown of the system. 21. RTGS charges are applied on a monthly and quarterly basis with no particular relation to cost recovery. Bank participants pay a consolidated fee for the use of all BCR- operated payment systems, including RTGS, cheque clearinghouse, SPM, and the administration of the reserve requirements. Recommendations 22. It is urgent that the BCR undertake a detailed assessment of the RTGS system to determine whether the current infrastructure can satisfy the expectations that have been set in the international standards for systemically important payment systems. The recommendations below have been formulated under the assumptions that no major impediments exist to bring the current system to comply with the international standards. On the other hand, it should be noted that the BCR not being the central bank of issue, its capacity in the current circumstances to help manage participants’ liquidity risk arising from the participation in the system is significantly reduced. The PFMIs also emphasize that financial market infrastructures should be efficient and effective in meeting the requirements of its participants and the market it serves (Principle 21). In this respect, while in general the system has emerged as practical for its current users, the key issue is to determine whether it 23 is flexible enough to respond to changing demand and evolving technologies. This determination should be made in light of the strategic objectives for the RTGS system and the payments system as a whole. 23. In the short term, the BCR should discourage the use of large-value cheques; in the medium term, large-value cheques should be eliminated. Large-value cheques represent a source of both financial risk – as a result of deferred net settlement – and of operational risk – due to manual processing. In addition to posing risk concerns, cheques are a source of inefficiency and inhibit the optimal use of the RTGS system. Large value cheques can be discouraged by (i) imposing charges on both the drawee and the presenting bank, and (ii) setting an appropriate threshold value. The BCR should collect information on the number of high-value cheques. 24. Related to the above point, the RTGS system usage for customers’ transactions should be promoted; this implies enforcing straight-through-processing (STP), among other things. In the absence of STP, participant manually enter / modify / approve and upload / download payment instructions one by one. As a result, there may be significant delays in crediting customers’ accounts. RTGS systems rules require that participants credit customers’ account no later than end of day, thus making the RTGS system unsuitable for time-sensitive payments. Participants motivate delays in interfacing their core banking to the system with internal cost-opportunity considerations. However, the benefits of STP should be discussed with the banks, and eventually the BCR should draw a plan to achieve full STP with participants. For some non-bank participants there could be an issue of technical preparedness as well that should be taken into account and can justify a proportional approach. Other factors to be considered that have an impact on customers’ transactions through the RTGS system include service availability and transaction fees imposed by banks. The BCR should monitor these factors. 25. The BCR should stress test the actual capacity and performance of the system on an ongoing basis. In fact, there are concerns that RTGS capacity cannot be scaled up, and that an increase in the number of transactions (for example, as a result of migrating large- value cheques to the RTGS or a broadened participant base) may negatively impact service levels and ultimately the efficiency of the system. The BCR should forecast the plausible demand in light of market development and BCR strategic objectives. 26. Settlement finality should be addressed in the legal framework as prescribed by international standards (Principles 1 and 8 of the Principles for Financial Market Infrastructures). Although the RTGS rules clearly define the point of which settlement is final, this definition is not supported or acknowledged in the legal framework of El Salvador and is only binding for systems’ participants; therefore, finality is not enforceable against third party-claims. The RTGS rules should clearly define the point after which unsettled payments can no longer be revoked, as there seem to be ambiguity as to whether queued transfer instructions and “scheduled” payments (pagos programados) would be considered irrevocable. It is best practice to prohibit the revocation of unsettled payments (if allowed) 24 after a certain point in time in the settlement day in light of liquidity risk that can arise from this practice. 27. The rules of the RTGS system should be amended to include procedures for facilitating the suspension and the orderly exit of a participant that is not compliant with the BCR participation requirements. RTGS participation requirements allow open access to RTGS services on the basis of risk-related criteria listed in the system’s rules. Participants are also required to report any developments that may affect the normal functioning of the system and their ability to meet their obligations. However, the BCR has not defined the procedures that apply in the event that a participant breaches or no longer complies with the participation requirements. RTGS rules do not contemplate suspension or exit, and no reference is made of BCR faculties to issue warnings or impose fines. As the operator of the RTGS system, the BCR should monitor compliance of its participant on an ongoing basis. 28. Gaps in operational risk management should be addressed at the earliest. The BCR facilities represent a single point of failure in the operations of the RTGS system: if the BCR physical site were under attack or unavailable, the entire system would risk to fail. Business continuity plans should incorporate the use of a secondary site designed and equipped to ensure that critical IT systems can resume operations within two hours from the disruption. Even in extreme circumstances, the BCR should guarantee that settlement can be completed by end of day. The choice of geographical location of the secondary site should be guided by comparative risk analysis, i.e. the secondary site should have a distinct risk profile from the main site. In the short term, the BCR should ensure that its redundant capacity is adequate to the circumstances of the RTGS system – e.g. various clearing processes supported. C. Retail payment systems and services 29. Cash and cheques dominate the retail payments landscape in El Salvador. Notwithstanding a second consecutive year decline, the total number of cheques is twice as big as credit transfers and direct debits combined. For 2014, the BCR reports 6 million cheques as opposed to 2.6 million credit transfers (both intrabank and interbank) and 405,364 direct debits (only intrabank). The ACH system processes (interbank) credit transfers for around USD 1.6 billion compared to 23.7 USD billion handled by the BCR-operated cheque clearinghouse, the five biggest banks accounting for 79.9 percent of total cheques values. In June 2014, there were 415 active payment cards (debit, credit) per 1,000 inhabitants. World Bank 2012 comparative data ranked El Salvador below the average for Latin American and the Caribbean for payment cards penetration. Although the number of debit cards is more than double the number of credit cards, it appears that credit cards are more used at the point- of-sale than debit cards. In January-June 2014, credit card transactions had reached 12.3 million, while debit cards transactions were 9.7 million. This tendency is confirmed in previous years as well. In the same period, card holders had withdrawn cash for a total of USD 1.6 billion or 20.2 million cash withdrawals. According to 2014 Findex data, 72 percent of adults pay utility bills, of which 95.5 percent use cash to pay bills. 25 30. Cheque clearing process is semi-automated, and physical exchange is still required due to truncation not being supported in the legal framework. The Cámara de Compensación de Cheques del Banco Central de Reserva has been operating since 2003. Settlement takes place on the same day through the RTGS system; customers must be credited on T+1. The clearing process is organized in three phases: i. first clearing session. Cheques deposited the previous day within the San Salvador region are cleared first between 7:15 am and 7:45 am; ii. second cheques clearing session. Cheques drawn in the larger urban areas outside of San Salvador are exchanged locally, between 1:15 pm and 1:45 pm; also included in the second clearing are cheques presented outside of San Salvador that cannot be exchanged locally); iii. the third and final clearing session occurs at 4:30 pm for cheque returns. As a way to mitigate the credit risk inherent to deferred net settlement of cheques, at 1:30 pm the BCR reserves in the participants’ accounts in the RTGS system the equivalent of the maximum net debit position of the last three months. The residual potential exposure resulting from cheque returns (third clearing) is covered by reserving an additional 5 percent of the daily net debit balance. For liquidity management, banks have free access to the first tranche of their reserve requirements (25 percent); the second tranche (25 percent) can be used subject to a penalty rate. The third tranche can only be authorized by the SSF. Should a bank be unable settle by 4:45 p.m., unwinding would take place. In practice, cheques returns are below 2 percent of participants’ net debit balances, and the BCR never resorted to unwinding. 31. The automated clearinghouse (ACH de El Salvador) recently enabled individuals’ electronic credit transfers, although limited to the seven participating banks. ACH was founded in 2010 by four banks; in the period 2012-2015 three additional banks joined, while five new members are expected for 2016, including two of the largest cooperatives. ACH operates the Servicio Interbancario de Transferencias Electrónicas (SETI): in 2015, 141,564 transactions were processed for a total value of USD 1.6 million. ACH settles SETI net balances through the BCR system once a day at 5:00 PM; a project to move to more frequent settlement cycles is being evaluated with the BCR. To mitigate credit risk, at 12:00 noon ACH calculates preliminary net debit positions and instructs the participants via RTGS to set aside the funds plus 5 percent for any returned instructions. After the validations cycle has been completed, ACH calculates the final net balances for settlement. Should funds be still insufficient at the time of settlement, the ACH operator will proceed to unwinding. There is no guarantee fund. The ACH operator does not assume credit risk vis-à-vis participants. ACH is regulated by the BCR and supervised by the SSF. 32. Payments between financial cooperative belonging to the same group are cleared and settled in the books of the associations (the mission met with Fedecredito and Fedecaces). Typically, credit risk is managed through reserve requirements at the respective associations; in case of inability to pay by a member financial cooperative, the association may intervene with own funds to guarantee settlement subject to certain limits of 26 bilateral exposure to the members. While in general operational risk is acknowledged, it is not possible to draw general, sector-wide conclusions on the quality of operational risk management. 33. ATM and POS clearing and settlement is concentrated in Serfinsa-ATH and Credomatic, respectively. According to the banking association, there are about 1,600 ATMs (excluding ATMs owned by financial cooperatives) and 21,700 POS terminals. Fedecredito and Fedecaces – two associations of financial cooperatives – own 150 and 90 ATMs, respectively. Although official data indicates terminals’ presence in all fourteen departmentos, statistics on distribution of ATM and POS terminals are not available. With over 12,000 POS terminals, Credomatic is the largest acquirer for Banco de America Central (BAC), who is also among the three largest issuers in the country. The mission did not meet with Credomatic or BAC. Serfinsa-ATH is owned by three banks and has a network of 6,200 POS terminals and 1,300 ATMs (belonging to six banks). ATH-Serfinsa settles ATM and POS transaction in commercial bank money in the country. In general, cash withdrawals at own bank ATM are free of charge; cardholders pay up to $3.50 (+VAT) for withdrawals at other banks’ ATMs. Bank fees and changes – including ATM withdrawal fees – are published regularly by the SSF. The BCR does not collect market-wide information on interchange fees. 34. Tigo – the biggest mobile network operator with 49.6 percent market penetration – has begun to provide mobile money services in 2011, and reached the 1 million customers mark in 2016. As of today, Tigo money is the only e-money product available in the country. Tigo money has been operating in El Salvador for five years, and reached 1 million customers in 2016 (including account owners and customers who transact in cash with an agent who executes an electronic payment on their behalf 12) and 350,000 active accounts. It offers P2P, bill payments, and also international remittances as an agent of five MTOs, including Western Union and Ria. Tigo claims to have 2,500 own agents in addition to 1,000-1,200 additional third-party agents (e.g. Super Selectos, a chain of supermarkets) that reach 210 municipalities. Tigo operates according to Millicom risk management guidelines, and has established maximum per transaction and daily transaction limits by type of product, and a total balance limit of USD 750. Tigo money reports having a risk management framework and documented business continuity procedures that are tested 1-2 times a year. Tigo money is subject to anti-money laundering requirements and reports to the SSF. 35. The biggest network of financial correspondents in the country is managed by Fedecredito. Internet banking very limited: as it appears from 2014 BCR data, less than 10 percent of account holders have access to this channel. Fedecredito has established a total of 216 agents throughout the 14 departamentos; the banking sector has a whole has 177 (Banco Agricola, Davivienda) according to the Banking Association. Fedecredito reports 3.7 million transactions at corresponsales in a year. Financial correspondents in El Salvador are 12Commonly referred to as over-the-counter (OTC) transactions. 27 not allowed to open accounts (although they can collect and transmit the necessary documentation) or to initiate international remittances. Recommendations 36. There is great potential in migrating large volumes of cheques to electronic payments (also combined with measures aimed to reduce the use the cash). Manual cheques processing – from the physical transfer of cheques that cannot be cleared locally to the daily physical exchange of cheques – exposes the BCR to operational risk. Together with cash, cheques are inefficient and costly although the indirect costs inherent to these instruments are often overlooked in economic analysis. Cheque processing automation / truncation should be considered in the context of a comprehensive retail payments strategy. The measures to be considered in combination are: i. in the short term, introducing a differential pricing mechanism for cheques and RTGS transactions for high-value cheques to divert them to RTGS (also see recommendations for large value payment systems); ii. as a logical corollary, ACH person to person electronic fund transfers (EFTs) should be incentivized through appropriate pricing to divert low-value cheque volumes, and; iii. maintaining cheque clearing and settlement on a T+1 basis as a disincentive to use cheques compared to (faster, but also cheaper and more convenient) electronic instruments. 37. The implementation of the direct debit component into the SITE should be expedited as a key factor to promote electronic payments. Enabling direct debits in the ACH could help reduce cash payments for certain common use cases. The most common use case scenarios for direct debit transfers are recurring (e.g. monthly or quarterly) payments of a certain amount or an amount within a specific range. Typical examples would be payments for utilities (e.g. water, electricity, etc.), information and communication services (e.g. internet service provider, mobile network operator, etc.), insurance premiums, membership contributions or rental fees. In El Salvador, these are cash-intensive payment use cases. While the payer can be a consumer or a business, the payee is typically a business or an incorporated association. For payees, the use of direct debits for the collection of their accounts receivable has the potential to reduce transaction costs, due to process optimization and increased automation (especially as regards reconciliation and collection of account receivables). Moreover, direct debits can contribute to increased cash flow predictability and a lower risk of payment default, since it is the payee who initiates the payment and not the payer. Payers can benefit from automation and increased convenience too, since they do not have to initiate the transaction. Finally, banks can benefit from an increased use of direct debits too, due to the potential higher rate of automation. Direct debits require that a pre- authorization be given by the payer, which entitles the payee to initiate one or more direct debit transfer collections according to the rules of the scheme defined in the mandate. The BCR will have to determine the form and content of the mandate, consistently with the relevant legal framework, and may require that the mandate be digitally signed by the payer. 28 38. ACH participation fees should be monitored in the interest of encouraging the largest participation possible. ACH has fair, open, and risk-based access criteria. However, potential candidates to join the system may consider participation fees as being a disincentive. It is understood that ACH fees are calculated on the basis of cost recovery objectives as a proportion of volumes transacted. The BCR as the payment system overseer should ensure that key systems have a reasonable, cost-related pricing policy that incentivize broad subscription. ACH governance arrangements should take into consideration the interest of non-shareholder participants. Finally, public disclosure of relevant information / data and key procedures is a best practice. Although a private enterprise, ACH can also be seen a public utility and a fundamental prerequisite for increasing usage of transaction accounts. 39. Limited penetration of POS infrastructure and the patterns of usage of payment cards should be analyzed by the BCR also in relation to interchange fees. A study carried out by the Competition Authority in 2011 pointed out to an interchange fee scheme that does not properly reflect resource costs, but is rather determined by the product or type of commerce. Also, the Competition Authority noted that the same fee apply to credit and debit card transactions alike. Also, the Credit Cards Law, art. 35(d) prevents merchants from surcharging for credit cards or steering customers to other forms of payment. The study concluded that there are barriers to entry and lack of competition in the payment cards market. From the perspective of deepening POS penetration in the country, the BCR should determine whether possible distortions in the interchange fees are being passed on to merchants in the form of high costs and disincentives combined with the no-surcharge rule sanctioned by law. The BCR should also consider whether price signals to customers when choosing between using a credit or a debit card are appropriate. The BCR as the payment system overseer should include card payment systems in its purview. 40. There is a risk that inefficient and duplicative networks that are not interoperable (or de facto do not enable seamless access by the customer) may emerge. As non-banks are allowed for the first time to compete in the provision of payment services to the public, first movers have a legitimate interest in capitalizing on high infrastructure investments. The BCR should take a balanced approach to regulatory requirements on interoperability: as far as mobile money is concerned, it would be appropriate to expect that in the medium term customers be able to top-up and transfer the balance in the mobile money account from/to various types of accounts, including a traditional bank account. D. Government payments 41. The Sistema de Pagos Masivos (SPM) administered by the BCR facilitate electronic government-to-business (G2B) payments. Launched in 2013, SMP supports payments to central government vendors/suppliers. In 2015, SPM volumes reached 87 million instructions for a total of USD 3.8 million. The SPM cycle is comprised of a number of stages which can be summarized into two main, consecutive processes: 1) Account validation. The Direccion General de Tesoreria (DGT) – charged with the disbursement of the budget allocated to government agencies – submits bulk 29 instructions (lotes de cuentas) to the SPM based on the information it has received from the government agencies. The lotes de cuentas are first screened by the BCR, then made available to the banks for their internal validations, which consist of checking the accuracy of bank account numbers and tax identification numbers (Número de Identificación Tributaria, NIT) – among other validations. Banks returns the lotes to the SPM for final validation by the DGT. 2) Payment processing. The DGT submits bulk payment instructions (lotes de pagos) through the SPM. Upon verifying that payment instructions match the lotes de cuentas, RTGS payment instructions are generated – one for each lote – from the DGT to the participant banks. In case of discrepancies, bulk payment instructions are rejected. Once the payment has settled, the BCR provides the participating banks with the payments details in order to credit customers’ accounts. SPM rules provide that customers must be credited “immediately”. If the participating bank delays in downloading the lote after the payment has settled, the BCR returns the funds to the DGT through the RTGS system. Failure to read / download the lotes within the times established by the BCR, as well as delays in crediting customers’ accounts are sanctioned by the BCR according to the terms of the Organic Law. 42. Each day, the SPM runs two cycles with settlement at 9:30 a.m. and 12:30 p.m. (a third SPM cycle could take place in certain exceptional circumstances). Banks are connected to SPM through Web service. 43. Government-to-person payments are processed either as cash or as account transfers; there are plans to migrate these payments to SPM, although with no definite timeline. Government salaries and pensions are effected in the form of an instruction sent to banks and the consolidated amount payable transferred from the Government’s account with the BCR to the banks’ account with the BCR, by issuing a payment instruction through the RTGS system. 44. Social transfers are paid in cash or through bank transfers. The Ministry of Economy (Ministerio de Economia, MINEC) has put forward a plan to leverage the gas subsidies scheme for possibly consolidating all government transfers to a prepaid card (and even international remittances). Starting in June 2015, the MINEC card (Tarjeta Solidaria) formally replaced the personal identification (Documento Único de Identidad, DUI) to claim the gas subsidy (the migration to cards had started earlier in January 2014). Tarjeta solidaria does not have a payment functionality: the beneficiary’s information stored in the bar code on the card is read and validated through SMS at the gas distribution point. The payment for the difference between the gas purchased and the gas subsidy is typically in cash. Registered resellers also hold a similar card and can either receive their balance to their account at a financial institution, or redeem it in cash at associated non-bank agents (no bank account required, e.g. punto express). As of today, MINEC has distributed 1.3 million cards. The drivers of Tarjeta Solidaria are manifold and have to do with the overall rationalization, control, and sustainability of the gas subsidy program. MINEC calculates savings by over USD 300 million since 2011 a result of re-designing the program in the first place and the new delivery system through tarjeta solidaria. The next generation of tarjeta solidaria is a prepaid MasterCard to underpin the delivery of the Universal Social Protection System. In 30 addition, cardholders could receive remittance payments from the United States directly to their prepaid card. 45. The Government revenue collection is predominantly through cheques and cash at a variety of channels, though there is an ongoing effort to offer and promote additional online payment mechanisms. Income tax declarations have already moved online through the webpage of the tax authority (Dirección General de Impuestos Internos, DGII); however tax payments have only begun their transition to online means. Internet banking is also limited. In-person payments can be effected at banks or tax collection agencies. Accepted payment instruments include cash, cheques, and payment cards issued by some banks. Tax collection agencies will be phased out reportedly by 2017. Recommendations 46. Authorities are encouraged to complete the process to implement the Treasury Single Account (TSA) by concentrating all incoming government funds / disbursements into/from the TSA; on the other hand, the main concern with the SPM is the lack of STP and its inherent inefficiency. In its current form, both the payment process and information validation lack of end-to-end STP. After vendors/suppliers, Government salaries are planned to migrate to the SPM. The BCR infrastructure does not support bulk payment transactions. This is an area where the BCR could also consider leveraging existing (privately-owned) ACH infrastructure. 47. It is important that the choice of underlying transaction account of G2P and G2B payments meet the specific payment and store-of-value needs of the recipients. Government disbursements represent an opportunity in terms of shifting large volumes of cash and paper-based payments to electronic means, and to achieve broader financial inclusion objectives. While significant progress was already made in this regard, cash- intensive segments remain. In addition, once funds are deposited into the beneficiary’s account, he/she may still choose to cash out. For these reasons, migration plans to G2P and G2B payments to electronic payments must carefully consider product design to meet the needs of the target population. In particular, the use of prepaid cards vs. other types of transaction accounts for subsidies and other social transfer programs as envisioned by MINEC should be considered in light of a number of factors: (i) cards acceptance infrastructure; (ii) payment functionalities (e.g. whether domestic P2P and bill payments are enabled), and; (iii) transaction fees and other costs. The BCR should evaluate the penetration of transaction accounts amongst the recipients of social transfers: in light of the low levels of bancarization, e-money products may also be considered in the medium term as an option to receive social transfers. 48. There should be a wide range of online and in-person electronic payment options to pay tax obligations. Advancing in the transition from residual manual filing procedures to online declaration would provide a significant incentive for online payments, and decrease the cost associated with paper/cash handling at the collection point. On the other hand, since internet banking services are not widely offered or used yet, as an alternative to bank transfers, payment cards and other prepaid instruments as appropriate should be widely accepted. Similarly, government collections should leverage the networks for physical points 31 of access to the largest extent possible. The implementation of payment vouchers with a barcode should make it possible to use a wider range of locations including agents of banks and also non-banks. E. Securities clearing and settlement systems 49. All products and players are required by regulation to be listed and traded on the domestic securities exchange (Bolsa de Valores de El Salvador); the latter is also the majority shareholder of the only central security depository (CSD) in the country. Repos dominate the securities market of El Salvador, with 78 percent and 57 percent of total volumes and values negotiated, respectively, with government securities (Treasury bills) as the underlying assets for the most part. Typically repos are used for short term liquidity management, and the majority range from 5 to 8 days. In addition to issuing Treasury bills which represent 62 percent of the local primary market for public securities, the Ministry of Finance of El Salvador undertakes Eurobond issuance (although there were no issues in 2015). The corporate primary market is dominated by securitization operations. The secondary market is relatively small with 7 percent of total volumes negotiated on the stock exchange. 50. According to the Law on Book Entry, immobilization/dematerialization is a pre- condition for trading securities on the stock-exchange; over 99 percent of total securities held in Cedeval are dematerialized. Securities accounts at Cedeval are held at the level of the final beneficiary, and the person that appears as the owner in such accounts is recognized by law as the legal owner. Direct participants in Cedeval can be of two types: broker-dealers – who are allowed to negotiate on the stock exchange, can effect securities transfer and have access to the full range of Cedeval’s services – and other direct participants such as banks, insurance companies, pension funds, etc. that operate on the stock exchange through broker-dealers). Indirect participants are natural and legal persons as well as institutional investors whose names appear on the securities accounts and are not connected to the system, having to rely on a direct participant to use the services of Cedeval. Each day, Cedeval conciliates end-of-day balances in the accounts of each depositor against the transactions performed during the day (including new issuances and expirations/maturities). 51. Securities ownership is transferred by means of book entries, which the Law on Book Entry recognizes as a means to transfer ownership. Cedeval reports that securities transfers are only processed as long as there are enough securities in the account of the seller, although Cedeval’s rules do not explicitly forbid account overdrafts. Cedeval’s rules do not make explicit reference to finality of securities transfers, but refer to the settlement process becoming irrevocable once concluded. 52. Cedeval’s board is comprised of ten members, of which three are qualified as independent, and counts with a risk committee and an audit committee that report to the Board. However, Cedeval’s risk management function only reports to the CEO. Cedeval has a comprehensive risk management policy that is approved by the Board and contemplates legal, operational, and reputational risk (also including general business risk). The risk management processes that conform this framework are: identification, evaluation 32 of risks (identification, analysis and assessment of risk), mitigation of risks (accept, mitigate, transfer, etc.), control (of efficiency and effectiveness of mitigation measures), monitoring, and communication of risks. Internal and external risk factors are considered. The ultimate responsibility for risk management rests with the Board of Cedeval; the responsibilities of the CEO with respect to risk management are also documented. The latest version of the comprehensive risk management policy dates back to 2012. Cedeval reports having redundancy arrangements, and a contingency plan that also incorporates the use of a secondary site. From a business risk perspective, it is worth noting that 76 percent of Cedeval’s investments are in liquid instruments that carry low market risk. 53. To facilitate the domestic market participants, Cedeval has links with the two international central securities depositories – Euroclear and Clearstream. The total value of securities maintained through linked CSDs is approximately USD 2 billion, representing 26 percent of total securities held in Cedeval. 54. Consistently with the provisions of the Securities Market Law, the clearing and settlement is effected by the Bolsa through the Sistema Electrónico de Liquidación Bursátil (SELIB) using a DvP 2(like) model; money settlement takes place in central bank money through the BCR RTGS system. Rolling settlement has been adopted for all market segments: from T+0 (repo market) to T+3 (secondary market). Once the net positions have been calculated, the settlement process is organized in three phases and varies depending on whether the client is a bank and, as such, has an account in the RTGS, or an ordinary investor without access to the RTGS. In a first phase, the bank participant with a net debit position initiates a credit transfer through the RTGS system to the account of the Bolsa in the BCR by no later than 2:30pm. Also by 2:30pm the funds that broker-dealers have deposited in the accounts of the Bolsa at commercial banks are transferred to account of the Bolsa at the BCR. In a second phase, the Bolsa instructs the BCR to debit its account and credit the account of the commercial banks on behalf of the participant broker-dealers with a net credit position. The commercial banks have until 3:00pm to credit the account the Bolsa, from which the Bolsa then credits the accounts of clients of the broker-dealers according to their instructions. In the third a final phase, the BCR accounts of the participant bank with a net credit position are credited through the RTGS by not later than 4:00 pm. To mitigate principal risk inherent to an exchange-of-value system, securities are blocked prior to the settlement of the cash leg. However, the time lag between the blocking of the securities and final settlement of both legs can be significant. In case of insufficiency of funds in the account of the broker-dealer, money settlement can be de postponed by up to 24 hours subject to the agreement of both parties. If there is no agreement, the broker-dealer can apply to the Bolsa for “authorized” overdrafts to be guaranteed by means of a promissory note. A penalty rate is applied by the Bolsa. 55. There are two main possible future developments that are worth mentioning in this context: (i) the clearing and settlement function will be taken over by Cedeval and an interface with the RTGS will be established; (ii) there is a project of regional integration of the stock exchanges of El Salvador with the stock exchange of Panama. 33 Recommendations 56. In light of the plans of Cedeval to act as the securities settlement system, it is suggested that corporate governance and transparency aspects be assessed against international standards. In particular, the risk management function should have sufficient independence and access to the board to ensure that Cedeval’s operations are consistent with the risk-management framework established by the board. For this purpose, there should be an additional reporting line to a non-executive director to the board via a chief risk officer or equivalent. Cedeval should publicly disclose the board members that it regards as independent. Cedeval may also consider setting a limit on the duration of the board member’s terms. International standards require that the board performance as whole and of individual board members be evaluated. Participant inputs to Cedeval decision making should be ensured through appropriate mechanisms, such as a user group. In terms of transparency, in addition to publicly disclosing rules and key procedures, a description of the system’s design and operations, fees, and data on transaction volumes and values, Cedeval should complete and publish responses to the Disclosure Framework for FMIs. 57. Prior to assuming a clearing and settlement function, Cedeval should integrate financial risks in its risk-management policy and framework. According to the draft instructions, Cedeval will continue using a DvP model 2 and, as in the current system operated by the Bolsa, can authorize overdrafts. At a minimum, a securities settlement system should maintain sufficient resources to cover the exposures of the two participants that would create the largest credit exposure in the system. Cedeval should elaborate on participant-default procedures. Cedeval could consider analyzing whether in the current legal framework the application of previously provided collateral may be subject to prevention, stay, or reversal. 58. Cedeval’s should provide final settlement by the end of value date. First, Cedeval rules should include a clear definition at the point at which settlement is considered final, and also of the point after which unsettled payments may be revoked, it being understood that unilateral revocations of accepted and unsettled payments should be restricted. Cedeval’s processes as a securities settlement system should be designed to complete final settlement no later than the end of value date. Cedeval should discontinue the practice of deferral of settlement to next business day as implemented by the Bolsa. This practice can entail overnight risk exposure and is not consistent with international standards. It should be clear from the system’s rules that any deviations from operating hours are exceptional and granted for operational reasons. 59. It is acknowledged by international standards that DvP does not necessarily require a simultaneous settlement of obligations. However, the length of time between the blocking of the securities, the settlement of the cash, and the subsequent release and final delivery of the blocked securities should be minimized. Therefore, the current system is not prevented from achieving DvP strictly speaking. On the other hand, the link/interface between Cedeval and the RTGS would enable the simultaneous settlement of the securities leg and the cash leg, thus increasing efficiency and eliminating the current issue of time lag. 34 60. The general business risk of Cedeval may also change as a result of providing a new service. Cedeval should ensure that it holds liquid net assets funded by equity equal to at least six months of current operational expenses. This is to ensure that Cedeval can continue operations as a going concern should it incur in any losses. 61. The link arrangements of Cedeval with Euroclear, Clearstream and any other regional CSD should be evaluated in line with the recommendations of the PFMIs (Principle 20) to mitigate all link-specific risks such as legal, credit and liquidity, custody, and operational risks. In a regional arrangement such as the integration plan with the stock exchange of Panama, some of the risks mentioned above may be exacerbated because of the cross-border nature. F. International remittances 62. According to World Bank estimates, remittances to El Salvador reached USD 4,363 million in 2015, representing 17 percent of the country’s GDP. The annual growth observed in the last three years is 4 percent. Over 90 percent of incoming remittances originates from the United States, followed by Canada. 63. As of Q1 2016, the average cost of sending USD 200 to El Salvador is 4.33 percent, down from 4.64 of the Q4 2015. This costs is significantly below the global average of 7.53 percent, and even lower than the regional average for Latin America and the Caribbean of 5.92 percent. As far as costs are concerned, there is no material difference between RSP types –bank average is less than 1 percentage point less costly than the money transfer operator (MTO average; at the global level instead, the average cost of sending remittances through banks is 4.7 percentage points more costly than MTOs. 64. Banks – acting on behalf of MTOs – disburse approximately 60 percent of total remittances; the second largest type of remittance service provider (RSP) are the association of cooperatives (Fedecredito, Fedecaces) also as agents of MTOs with 23 percent; the remaining 17 percent is controlled by Airpak-Western Union. Exclusivity as a market practice is limited to Western Union, who has two exclusive agents – Airpak and Banco Hipotecario. All RSPs report that recipients pick up remittance payments in cash over the counter. In general, banks have not yet undertaken systematic efforts to capture this (potential) client segment. Fedecredito’s efforts to contribute to overall “bancarization” emphasize mobile banking and non-bank agents. 65. Following the amendments to the Ley de Supervision y Regulacion del Sistema Financiero subjecting RSPs to the supervision of the SSF, regulations were issued by the BCR that establish a registration regime for RSPs and dictate rules for their operations. These regulations fill a gap in this space; however, in the absence the underlying payment system legal framework to underpin BCR regulatory powers, the scope of the current regulations is limited (e.g. on risk management). 35 Recommendations 66. A payment system law – as suggested in section A on the legal and regulatory framework – would allow addressing at the statutory level the main aspects of the operations of RSPs and remittances as a payment instruments. As a result, RSPs would fall under the discipline applicable to payment service providers, including licensing and licensing criteria, outsourcing and third party arrangements, and powers to the BCR to oversee remittance services. 67. Remittance inflows should be leveraged to provide a significant portion of the population with access to a transaction account. Recent statistics of the Ministry of Finance report that over 1.3 million people or 20 percent of the country’s population receive remittances. 13 According to Findex, 17.3 percent of the population receive domestic remittances, of which 65 percent in person and in cash. Remittances (both cross-border and domestic), are acknowledged as another type of large-volume and recurrent payment stream that can be leveraged to advance financial inclusion. The BCR should consider allowing receiving international remittances to e-money accounts. G. Payment system oversight and cooperation 68. The 2011 amendments of the Organic Law of the BCR entrusted the BCR with the oversight of payment systems; the SSF is tasked with the supervision of operators and service providers. Art. 67 of the Organic Law of the BCR is explicit in recognizing the BCR as the overseer of payment and securities settlement system, especially of those that are critical for the efficiency and stability of the financial system. In 2015, the supervisory perimeter of the SSF was broadened in 2015 to include – among others – international and domestic money transfer operators. Art. 3 of the Law on Supervision and Regulation of the Financial System also grants the SSF broad powers to supervise the individual and consolidated activity of the integrant parts of the financial sector. Supervision is defined broadly in the Law as to include oversight (see art. 3). The supervision of payment system operators and providers is assigned to the Intendencia de inclusion financiera y otras entidades within the SSF, which includes “financial inclusion entities” (e.g. non-bank e- money issuers) on the one hand, and all other entities (e.g. remittance service providers, exchange bureaus, ACH) on the other hand. The SSF is also the supervisor of Cedeval and the Bolsa. 69. The BCR has not formally established a payment system oversight policy or dedicated department; however, some oversight activities are being carried out by the Department of Financial System Development (Departamento de Desarrollo de Sistema Financiero) of the Financial System Directorate (Gerencia del Sistema Financiero). If formalized, this arrangement would ensure the independence of the BCR payment system oversight function from the operational tasks housed in the Directorate of Financial Operations. Oversight activities revolve around the collection of statistics (number of ATMs and POS terminals, number internet banking users, number of accounts – by type, and 13 Encuestas de Hogares de Propositos Multiples, 2014 36 balance, number of payment cards in circulation, geographical distribution of branches, number and value of transactions by payment instrument and access channels including correspondent agents). Currently, this information is collected only from banks, although the BCR is in the process of expanding it to the cooperative sector. The Departamento de Desarrollo del Sistema Financiero is tasked with preparing the payment system oversight report that summarizes the operations of the main systems and the latest developments, and also makes recommendations for improving the oversight function. Starting in 2014, the frequency of this report was increased to twice a year. 70. There is no formal mechanism for cooperation with the private sector on payment system matters besides ad-hoc consultations with the relevant stakeholder. Cooperation among authorities is achieved through Systemic Risk Committee (CRS). Created in 2013, the objective of the CRS is to oversee the stability of the financial system. It is composed of the Ministry of Finance, the BCR – who also coordinates the CRS, and the Institute of Deposit Insurance. CRS faculties range from promoting initiatives of law, to developing mechanisms for information sharing, and undertake activities in the areas of crisis preparedness, technical assistance, and training. At the regional level, the BCR participates in the Western Hemisphere Payments and Securities Settlement Forum. Recommendations 71. The BCR would benefit from a clear definition of payment system oversight objectives, standards, tasks, and tools: • Consistent with the Organic Law of the BCR, the oversight objectives should prioritize the overall safety and efficiency of payment and settlement systems. The BCR should give consideration to formalizing other important public policy objective such as financial access/inclusion, consumer protection, competition, and transparency. The discharge of these objectives should be regularly measured and evaluated. • In fulfilling its regulatory and oversight responsibilities of systemically important payment systems and other FMIs, the BCR should be guided by the Responsibilities of Authorities of the PFMIs. International guidance and best practices are also available with regard to retail payment systems that elaborate on and apply the framework BIS-World Bank Principles for International Remittance Services of 2007. More recently, the BIS-World Bank Group report on Payment Aspects of Financial Inclusion (PAFI) examines demand- and supply-side factors affecting financial inclusion in the context of payment systems and services, and suggests measures that could be taken to address these issues in light of increasing access to transaction accounts as a stepping stone to broader inclusion. • Oversight activities may be distinguished by type / timeline: typically continuous/daily activities include system monitoring, analysis, and daily reporting, and “dynamic” risk analysis (i.e., investigation triggered by an incident), while periodic activities may include the assessment of payment and settlement systems 37 against the prevalent international standards, and the preparation / publication of periodic analytical reports. In addition, activities such as policy dialogue / cooperation, improvements to the legal and regulatory framework, research and training, etc. span across all areas of oversight. • Key tools / sources of information include official systems documents and records, regular and ad-hoc reports, internal reports from board meetings and internal auditors, on-site visits and inspections, information on operations outsourced to third parties, and dialogue with systems’ management and participants. The combination of oversight tools (from moral suasion to inspections and sanctions) should be designed according to BCR powers and the overall institutional framework. The BCR should determine whether it has the necessary powers and resources to discharge its responsibilities and in particular to obtain the necessary information from the entire spectrum of systems and providers, and induce corrective change as appropriate. Gaps have been noted in this regard in the analysis of the legal and regulatory framework (see section A above). 72. It is suggested that the BCR establish formal cooperation arrangements with private sector stakeholders; regardless of the specific form of cooperation, and bearing in mind efficiency and effectiveness considerations with respect to the number of participants, the BCR should adopt a the most comprehensive approach possible. For example, the national payments council is a permanent body for high-level cooperation and consultation in the area of payment and settlement systems. NPC terms of reference aim to ensure clear tasks and responsibilities, appropriate level of representation and expanded membership to include, in addition to the largest commercial banks, all other major stakeholders with an interest in payments and securities clearing and settlement systems, such as other financial institutions, the key government institutions concerned with payments, non-financial payment service providers, payment systems operators, etc. The function of the NPC is to advise the central bank on payments system developments, ensuring that all relevant stakeholders have the opportunity to present their views. It can have a role in: (i) preparing strategic documents for the overall payment system architecture; (ii) monitoring the implementation of payment systems developments; (iii) facilitating the sharing of information; (iv) selecting the main principles and options for system designs; and (v) endorsing the priority and the schedule of individual projects; (vi) promoting standardization of procedures and systems. 73. The respective responsibilities and activities of the BCR and the SSF with regard to payment and securities settlement systems should be clarified and more closely coordinated. The licensing and supervision of the operators of payment and securities settlement systems carried out by the SSF (ACH, Cedeval/Bolsa) would benefit of a closer cooperation with the BCR to deepen the analysis of financial risks (credit, liquidity) arising in and borne by the systems. There should be arrangements whereby the BCR informs the SSF of all risks potentially affecting financial institutions as a result of their participation in payment and settlement systems. On the other hand, the SSF should provide the BCR with the information necessary to ascertain the potential risks that a financial institution under the supervision of the SSF may pose for the safe and efficient operation of 38 payment systems. Direct and effective lines of inter-institutional communication should be established and contacts points identified to ensure continuous communication. The CRS also provides an umbrella to develop and implement a system-wide approach to FMI risk management (e.g. interdependency analysis, joint testing of business continuity arrangements, etc.). With regard to retail payments, while the scope of BCR oversight has not been formally defined, it is expected that this is extended beyond the entities that are currently supervised by the SSF, and include all relevant retail payment systems and services regardless of ownership or supervisory regime. The BCR should also establish cooperative arrangements with the consumer protection and competition authorities in light of ensuring the efficiency of the national payments system and fulfilling the public policy objective of financial inclusion through wide access to and sustained usage of transaction accounts. II. CREDIT REPORTING SYSTEMS A. Overview Context 74. Credit Reporting Systems (CRS) enable banks, financial institutions and other creditors expanding responsible lending to individuals and firms. In the absence of efficient credit bureaus, access to credit maybe restricted, selective and expensive. Establishing an effective credit reporting system is especially beneficial to the informal economy, particularly for entrepreneurs, who are able to leverage positive credit histories towards decreasing their risk perception to lenders, thus obtain credit on favorable terms, subject to less guarantee or collateral requirements. In sum, if CRS perform adequately, firms and individuals should be less credit-constrained, since specific types of informational asymmetries are being dealt with. A World Bank study14 shows that in countries without a credit bureau around 50% of small firms report significant financing constraints; whereas in countries with a credit bureau this figure is only 27%, and small firms are 40% more likely to get a bank loan. 75. CRS are considered a valuable tool to support banking and financial supervision and regulation. Data in credit registries has been used extensively for many years to support regulation and supervision of individual financial institutions. For example, micro-data is a key input for off-site supervision, which includes monitoring of the performance of individual financial institutions and their compliance with relevant laws and regulations. More recently, credit reporting micro-data has also become important in areas such as the implementation of the internal ratings-based (IRB) approach of the Basel II/Basel III regulatory capital frameworks for banks, for example by facilitating supervisory validation of internally-estimated risk parameters. 14 Love and Mylenko: “Credit reporting and financing constraints” - World Bank - October 2003. 39 76. CRS also support macro prudential supervision. In addition to ensuring the stability of the financial system as a whole, central banks and/or other financial supervisors perform a series of analyses and have designed instruments to, respectively, continuously monitor the stability of the financial system and take preventive measures if and where appropriate. Data obtained from credit registries is one of the key inputs that allow central banks and other financial supervisors to perform such analyses from a systemic perspective. Moreover, credit data is crucial for the calibration of macro-prudential policy measures (e.g. counter-cyclical capital buffers, quantitative limits to certain key ratios in lending, such as loan-to-value and loan-to-income). 77. A National Credit Reporting System (CRS) comprises a broader institutional framework related to credit reporting activities in a given country, including the following: (1) the credit registry, if one exists; (2) credit bureaus, if they exist, including those run by chambers of commerce, bank associations, and any other organized database on borrower performance available in the economy; (3) commercial credit reporting companies if they exist, (4) the legal framework for credit reporting including aspects related to privacy, bank secrecy, trade secrecy, prudential regulation and fair competition; (5) the regulatory framework for credit reporting, including the institutional capacity in government to enforce laws and regulations and to oversee the CRS; (6) the characteristics of other pertinent borrower data available in the economy, such as data from companies registries, identification of firms and individuals, court records, utility payments; (7) the use of credit data in the economy by financial intermediaries and others, for example, the use of credit scoring or use of credit data in banking supervision; and (8) the cultural context for credit reporting. 78. In 2011, the General Principles for Credit Reporting were issued by the World Bank representing the only existing international standards in credit reporting. The General Principles (GPCR) provide an internationally agreed framework through principles and guidelines for safe, efficient and reliable credit reporting systems including roles and responsibilities of the parties and recommendations for effective oversight of the systems. The General Principles have been included in the Compendium of Standards and Codes of the Financial Stability Board (non-core) and represent the only exiting internationally agreed framework in the credit reporting area. The GPCR indicate the key characteristics that should be satisfied by different credit reporting systems and the infrastructure used to support them to achieve a stated common purpose, namely Expanded Access and Coverage, Fair Conditions, and Safe and Efficient Service for borrowers and lenders and banking supervisors. Although during this FSAP an assessment against the General Principles has not been conducted, the key recommendations and observations presented in this document are based on the framework provided by the General Principles for Credit Reporting. Status in the country 79. An array of different entities including bank and non-bank financial institutions provide credit in El Salvador to consumers and legal entities. The population in El Salvador is approximately 6.4 million and data on financial inclusion shows 40 that only a fraction have access to credit. There are 11 private commercial banks, 2 state owned banks (SOB), 1 development bank, 1 foreign bank and 7 cooperative banks. In addition there are 9 financial institutions, 4 savings and credit cooperatives, 2 leasing companies, 2 factoring companies 18 insurance companies 48 credit unions and 2 micro finance institutions. 80. Banks and financial institutions favor consumer credit, rather than MSMEs (MYPES) lending and housing loans. El Salvador has a small, open, and dollarized economy with a productive structure geared toward services and consumption, and heavy trade dependence on the United States economy. Salvadoran MSMEs 15 represent 30 % of the country’s GDP and generally have a limited ability to innovate owing to the obsolescence of their equipment and the prevalence of outdated business models. Still they account for 99.6% of the country’s enterprise and generate 58.5% of employment 16. Their inability to gain access to more modern technologies and migrate towards more productive business models is due largely to low levels of investment, resulting from limited access to medium- and long-term credit. MSMEs’ limited access to credit, particularly for investment, is evidenced by the fact that, as of end 2015, lending to this market segment accounted for just 16.40 % of total lending by the financial system; and most of this credit was extended to MSMEs for terms between one and two years (medium- term credit). The portfolio distribution chart below (Figure 1) also shows that consumer credit accounts for 32% of the total lending keeping an increasing trend. 15 MSMEs refers to the definition established by Law in MSMEs which includes legal entities up to 50 employees and assets not exceeding 4,817 minimum salary units on annual revenue. See Ley de Proteccion, Fomento y Desarrollo de la micro y perquena empresa, Ley MYPE, 2014. 16 National Census, El Salvador, 2005. 41 Figure 1-– Portfolio distribution of bank and financial credit to private sector 35.00% 30.00% 25.00% 20.00% 15.00% 10.00% 5.00% 0.00% Préstamos Préstamos a Préstamos al Crédito a la Otros comerciales PYMES Consumo vivienda 2013 2014 2015 Source; own elaboration based on BCR data, February 2016. 81. The National Credit Reporting System (NCRS) in El Salvador is composed by a credit registry (Central de Riesgos) and four credit bureaus licensed by the Financial Supervisory Authority (Superintendencia de Servicios Financieros-SSF). The credit registry is operated by the SSF and has been functioning since 1997 capturing loans from all types of credits on both individuals and legal entities facilitated by entities under the SSF supervision. Equifax provides consumer credit information in El Salvador since 1996 mostly focused on loans and credit provided by the banking sector and financial institutions although they also include data from telecommunication companies and some retailers. Trans Union started operations in 2011 offering credit information services to the retail and microfinance segment although they also include information from banks. Infored has been operating in the market since 2000 and its participated by 6 local microfinance institutions, therefore their database is mostly composed by data from cooperatives, microfinance institutions, credit unions, and retail including also factoring and insurance. Finally Procredito has been operating since 1967 as a non-profit association representing mostly retail, MFIs and real sector entities. Two additional credit reporting systems operated by Fedecace and Fedecredito include information from their respective credit cooperatives affiliates although they are not licensed by the SSF. The graph below depicts the information flow in El Salvador based on responses received from Credit Reporting Service Providers (CRSPs). The Figure 2 below depicts the flow of credit information in El Salvador. 42 Figure 2- Credit Information Flows in El Salvador Data Providers CRSPs Products Users Banks (14) SSF (+/-) Credit report Cooperative Banks (7) (corporate+SMEs SSF Credit Unions(4) ad-hoc Regulated entities +Individuals) (+/-) Banks, retailers, MFIs, auto finance Equifax Scoring (1.2M) Credit Retailers, MFIs Banks,Cooperatives, Trans Union Report cooperatives (- retailers, MIFs (1 M) banks +/- from all Alerts Banks, Cooperatives, others under Credit Unions, Infored reciprocity) retailers, MIFs, Addresses (5M) ONGs, Insurance Consumers Retailers, MIFs, Previous (certified copy $$) manufacturers, Procredito enquiries hotels, schools (100,000) Source; author’s elaboration based in mission findings, 2016 82. There is no formal oversight established in El Salvador although the laws recognize different roles as regards to credit reporting systems to different authorities. Firstly the SSF has the legal mandate to supervise credit bureaus and operates the credit registry, while the BCR is charged with the regulatory framework for credit bureaus and the Consumer Protection Agency (Defensoría del Consumidor) acts as regulator and enforcement agency in relation to consumer related claims about financial services including credit information related to credit bureaus. In addition the Telecomunication Supervisory Authority (Superintendencia General de Electricidad y Telecomunicaciones – SEGIT) also plays a role regarding the sharing of information from telecommunication and utility companies with third parties. B. Legal and Regulatory Framework Context 83. General Principle 4 establishes that the overall legal and regulatory framework for credit reporting should be clear, predictable, non-discriminatory, proportionate and supportive of consumer rights. The legal and regulatory framework should include effective judicial or extrajudicial dispute resolution mechanisms. A sound legal and regulatory framework is necessary to ensure smooth functioning of CRS. Data providers, lenders, consumers and other stakeholders need to have confidence about the data collection, distribution and use of information related practices in the CRS. In particular 43 the following aspects need to be considered; (i) criteria for investors and operators of bureaus and registries; (ii) setting out the regulatory and supervisory framework; (iii) data scope to be included in credit bureaus and or registries; (iv) permissible purposes; (vi) operational aspects including rules for data submission and data access, pricing, data retention and security (v) consumers’ rights regime; and, (iv) enforcement mechanisms. These aspects need to be addressed in the legal and regulatory framework governing CRS. 84. Rules regarding the protection of data subjects/ consumers should be clearly defined. At the minimum these rules should include: (i) the right to object to their information being collected for certain purposes and/or used for certain purposes, (ii) the right to be informed on the conditions of collection, processing and distribution of data held about them, (iii) the right to access data held about them periodically at little or no cost, and (iv) the right to challenge accuracy of information about them. Status in the country 85. The legal and regulatory framework covering aspects related to credit bureaus is mainly provided by the Law on Credit Histories issued in 2012 although an array of additional laws impact also the organization and functioning of the CRS. The Banking Law (Ley de Bancos, Decree No. 697 of 1999) includes article 232 on bank secrecy provisions which impede the sharing information between banks and other creditors. Although there is no data protection law in the country the Consumer Protection Law (Ley de Proteccion al Consumidor, Decree N0 776 of 2005) establishes provisions related to the protection of personal data further developing article 2 of the Constitution of El Salvador including data held by credit bureaus. In addition Law on Banking and Financial Supervision (Ley de Supervision y Regulacion del Sistema Financiero, Decree Law No. 592 of 2015) covers the mandate of Financial Supervisory Authority (SSF) and the Central Bank (BCR) as regards to supervision of financial services and regulated entities including credit bureaus (Agencias de Informacion de Datos). Finally, the Law on Credit Histories (Ley de Historial de Credito, Decree 695 of 2011) covers main aspects of credit reporting in El Salvador and finally the Ley de Usura Decree 221 of 2013 has also an impact on the credit reporting system. 86. The Banking and Financial Supervision Law establishes the mandate of the SSF as regards to the supervision of financial institutions. Article 3 establishes several tasks to the SSF such as; (i) ensuring legal compliance, (ii) licensing institutions participating in the financial sector, (iii) monitor risks, (iv) facilitate the efficient, transparent and smooth function of the financial system, (iv) ensure that supervised entities act according to best practices avoiding use of privileged access to information, (v) cooperate with authorities in charge of fair competition and consumer protection, (vi) request the supervised entities to adopt international standards and best practices regarding risk management and corporate governance, and (vii) request the collaboration of other authorities in order to effectively perform their tasks. 44 87. The credit registry legal framework is established under the Banking Law (Ley de Bancos Decree No. 697 of 1999), Cooperative Banks Law (Ley de Bancos Cooperativos y Sociedades de Ahorro y Credito Decree No. 849 of 2000),) and SSF regulation on the collection of credit information for the credit registry (NPB4-17). Article 59 establishes that every bank and financial institution should take into consideration borrower’s solvency and repayment capacity during the loan evaluation. Article 61 of the Banking Law establishes that the SSF shall operate a credit registry with information on debtors from the SSF regulated entities with the objective of enabling the evaluation debtor’s creditworthiness. The credit registry can be delegated to a private party for its operation. The Cooperative Banks Law under its article 39 mandates that all cooperatives licensed by the SSF should submit credit information to the SSF and shall be able to access credit information from the credit registry. 88. Article 232 17 of the Banking Law covers bank secrecy and confidentiality. The provision includes an exception to the confidentiality rule when submitting information to the credit registry but it is silent regarding credit bureaus. The current provision not only impedes the sharing of information from banks with non-banks financial institutions and other types of creditors but also poses some questions as regards to the adequacy or not of providing information to credit bureau unless the SSF understands a legitimate interest and has already authorized such practice. 89. The Usury Law (Ley de Usura 18 Decree 221 of 2013) includes requirements for those that provide microcredits to properly evaluate the debtors’ repayment capacity. In this context, this law creates incentives for those creditors involved in microcredit to participate in credit reporting systems and make use of their services. 90. Main aspects of credit bureau activities are covered under the Law on Credit Histories (Ley de Regulacion de los Servicios de Informacion sobre el Historial de Credito de las Personas, 2012) and recent amendment in December 2015. The law further develops the protection of privacy recognized by the Constitution of El Salvador and covers the following: i. Scope of the law; refers to “economic agents” including individuals and legal entities that submit, store, distribute or access credit information but excludes the SSF; 17 Bank Secrecy Art.232. Information regarding liabilities received by the banks are subject to bank secret and can only be disclosed to its owner or legal represent and to the tax authority if there is an investigation involving that individual. All other transactions are subject to confidentiality and can only be disclosed to authorities listed under art. 201 of the banking law, those that have a legitimate interest and authorized by the SSF and when required by the tax authority. This confidentiality provision does not conflict with art.61 as regards to the credit registry. 18 Under article 5.5) the Usury Law defines microcredit as credit provided to individuals and legal entities and requires at least; i) procedures and forms to collect financial information to ensure the creditworthiness evaluation including identification and address and any other relevant information to analyze debtors repayment capacity. 45 ii. Confidentiality of information; Information should not be shared with third parties although the law is not clear regarding the meaning of third parties which might call for additional interpretation. iii. Role of authorities; The SSF has the mandate to supervise and regulate credit bureau activities although this latter role has been transferred to the BCR in the recent amendments from 2015. In addition the Defensoria del Consumidor is charged with consumer dispute resolution and also market conduct responsibilities. iv. Licensing process; The law introduces the need to obtain a license from the SSF prior to engage in credit bureau activities and requires them to have their domicile in El Salvador. The interested parties should apply for a license to the SSF adjoining certain documents related to its business plan, security measures, shareholding, company registration and solvency of its management. v. Consumers’ rights; access, consent prior to data submission, correction and deletion and also consumers are entitled to claim damages in court. In addition the rights could be exercised through an economic agent, a credit bureau, the SSF and the Defensoria del Consumidor. vi. Restrictions regarding data to be included; name of individuals representing legal entities unless they are connected to the loan, black lists, subjective information, data related to ideology, sexual orientation, political or religious opinion, consumer behavior, emotional characteristics, deposit accounts. vii. Violations of law and sanctions; sanctions included in the law range from fines up to 300 salaries (aprox. 90,000 USD) to suspension or cancelation of activities. 91. The implementation of the Law on Credit Histories (Ley de Regulacion de los Servicios de Informacion sobre el Historial de Credito de las Personas, 2012) resulted in the deletion of more than 1 million records in each credit bureau due to the lack of consumer consent. Article 14 d) establishes the need to obtain consumer’s consent before submitting the data to any credit bureau. In addition consent is also required when accessing the database but the lack of consent cannot be used by creditors to reject the provision of the service (see article 16). The rule on consent was implemented by all credit bureaus as a result of the ruling of the Constitutional Supreme Court 142-2012 INDA vs Equifax. As a result of such ruling Equifax and all other credit bureaus cleaned their databases and erased all records that where not supported by consumers’ consent. The impact of consumer consent on existing credit bureaus is summarized below (Table 2). 46 Table 2- Impact analysis of consumer consent rule in existing databases Credit Bureau 2014 2015 (March) Equifax (banking 2.1 million records 1.125 system) Equifax (retail) 3.1 million records 1.2 million records Procredito (individuals) 3.1 million records 100,000 records Procredito (firms) 62,000 records 2,000 records Source; Own elaboration based on data from Equifax and Procredito, February 2016 92. The recent amendment to the Law on Credit Histories (Ley de Regulacion de los Servicios de Informacion sobre el historial de Credito de las Personas, 2012) also requires additional changes to existing databases. Retention period for negative information was established in 3 years since the data was included in the database 19 and the amendment establishes that (i) information should be erased from the credit history after a period no longer than 3 years since the data was included in the database, (ii) if such data refers to negative information that has been repaid, then information should not be kept for more than 1 year since the inclusion of the data into the database and if the information refers to loans below 93. The law on credit histories calls for further regulation as regards to the retention periods. In credit reporting there are two main activities affected by retention period related rule. One of them refers to storage of data and the other one to the distribution of data to the users. Rules regarding retention periods should take this difference into consideration when formulating its rule. The retention period should differentiate between periods to distribute the data and periods to maintain the data in the system and further distribute such data. 94. The legal provisions related to the management of credit bureaus databases when sanctioned with suspension of activities does not ensure business continuity. The process established under new article 32A mandates the sanctioned CRS to handle the database to the SSF until the violation is corrected. In case the violation is not corrected the SSF will keep the database and will erase the information after 12 months. 95. Consumer protection practices in El Salvador as regards to the correction, and deletion of data are not harmonized across the credit bureaus and each of them apply different protocols. While some of them provide a copy of the report to consumers others direct them to the consumer protection agency. The consumer complaints are very low provided that there are 4 credit bureaus and one credit registry sharing information on at least 3 million of individuals and only 341 complaints have been received at the Defensoria del 19 see article 13 of the regulation on credit histories (SSF circular 21 de junio 2012) 47 Consumidor in the past 5 years. This information shows that consumers are not aware of their rights and process to correct data or that the process is so cumbersome that consumers refrain from exercising their rights. Figure 3- Complaints received by the Consumer Protection Agency in relation to credit histories Sector 2011 2012 2013 2014 2015 TOTAL Telecommunications 3 132 13 8 2 156 Banks 12 33 27 11 7 90 Retailers 1 15 17 11 1 45 Real Sector 1 0 3 6 3 13 Cooperatives and SACCOs 0 1 6 1 2 10 Credit Bureaus 0 6 1 2 0 9 Tourism 0 6 1 0 1 8 Auto-Finance companies 0 0 3 2 1 6 Non-bank financial services 1 1 1 0 1 4 TOTAL 18 192 72 41 18 341 Source; Defensoria del Consumidor, February 2016 Recommendations 96. Authorities should consider amending the article 232 on bank secrecy to enable access to comprehensive credit information to all creditors operating in El Salvador and other relevant credit bureau participants. The SSF should take into consideration the need to better evaluate information on outstanding loans and better predict future repayment capacity instead of evaluating borrowers based only on existing default information. The availability of positive credit information would contribute to mitigate over-indebtedness. Typically bank secrecy provisions include an exception to the provision of credit reporting services moreover in an environment where consumer consent is a requirement to submit data to the credit bureaus. 97. BCR should formulate clear guidelines regarding the provision of consumers’ rights. Identifying one primary source of access to the credit report, (i.e. credit bureaus), establishing a protocol to communicate between credit bureaus and data providers regarding the correction of data, agreeing on operational rules to update the corrected data in the system with no major impact to the integrity of the database and providing consumers with additional information regarding the name of the creditor and the previous enquiries made by creditors to his/her data could be some of the measures adopted by the BCR. In addition, the implementation of consumer consent clause should allow consumers choose the appropriate use of their data. 98. BCR should clearly define the timelines for retention periods taking into consideration the difference between data storage and data distribution. It is important to reflect on the methods to calculate the period avoiding room for interpretation of the rule. 48 A typical example would be the so-called “window effect” which consists on computing the period since the moment the data has been reported to the credit bureau while the data is reported every month, therefore the data is never erased from the system. Whatever method is used to calculate the period defined in the law, the rule should be clear as observed in the General Principle 4 of the General Principles for Credit Reporting on legal and regulatory framework. A benchmark using data from 188 countries on the typical number of years that credit bureaus keep negative data in the system is provided below. (Figure 4) Figure 4- Retention Periods Source; own elaboration based on Doing Business data, 2015 99. BCR in coordination with Defensoria del Consumidor should develop a standard consent clause to be used by all credit bureau participants when collecting credit information that would be later on included in the credit bureaus. The consent clause established under articles 14 and 16 of the law on credit histories allows credit bureaus to use the information obtained from consumers only if a consent is previously obtained from consumers. The adoption of a standard consent clause would contribute to provide confidence in the credit bureau industry while at the same time control for potential abuses in the use of information. In this sense, the language should be drafted in a manner that allows credit bureaus to collect the data and use it for the purposes of evaluating consumers’ creditworthiness in relation to loan applications or services based on deferred payments but should ensure that the clause also limits the use of the information for marketing purposes or other purposes not related to credit. Finally clear guidelines regarding the need to prove the existence of consent would ensure a clear legal environment as well as clear identification of the participant responsible for obtaining consumer’s consent. A potential solution would be for the SSF to request random samples of consumers consent to the different data providers. Another measure could involve the need for data providers to request consumer consent when capturing the data and develop an automated mechanism in the data file and add a check of consent to the validation rules. 49 100. As regards to the data format, BCR should conduct an analysis of the relevant data items that would be necessary to include in the credit bureaus versus those data items that are not key for the evaluation of the creditworthiness of individuals and legal entities. In conducting such exercise, BCR should take balance the need for information with the right to privacy of individuals. A proper identification of individuals and legal entities which might also call for additional verification against existing government held information such as National Registry of Natural Persons (Registro Nacional de Personas Naturales) and National Registry (Central Nacional de Registros). In addition BCR should also carefully analyze the need for information related to credit operations taking into account restructures, portfolio transfers, related parties and new financial developments which could pose a risk to the credit market. Information on cheques, credit cards 20, mobile money services and government loans and take this opportunity to clarify through regulation ambiguities in the law. For further guidance on typical information to include as relates to MSMEs please see Box 1 of this report (paragraph 121). C. Credit Reporting Service Providers Context 101. Entities offering credit reporting services are classified into Credit Registries Credit Bureaus and Commercial Credit Reporting Companies, depending on the primary purpose they pursue, the scope of data they include in their databases and the types of participants contributing and accessing information. 102. A Credit Registry is defined as a network exchange of credit information typically operated by the Central Bank or other financial supervisory body. These registries are usually operated on a not-for-profit basis, and collect information on creditworthiness of firms and individuals generally supplied by regulated entities on a systematic and typically compulsory basis. Credit registries are frequently set up to facilitate banking supervision and typically collect information only above a certain amount threshold. However, these systems can also assist lenders in their credit decision process. 103. A Credit Bureau is defined as a network exchange of credit information and other related information supplied by both regulated and non-regulated entities and other sources. This network facilitates the exchange of credit information among banks and financial institutions but can also include other entities participating in transactions involving deferred payments. The primary role of a credit bureau is to collect and distribute credit data from different sources, synthesize it and distribute it back to the network participants, typically for a fee. Credit bureaus also develop value added services such as credit scoring models, fraud detection and other portfolio monitoring products enabling network participants to better manage their credit allocation. 104. Commercial Credit Reporting Companies or Credit Reporting Agencies are entities that collect information on trade credit from business to business lending and 20 In 2014 credit card transactions reached 12.3 million while debit cards were only 9.7 million. 50 bank lending. Information collected refers to businesses, including sole proprietorships, partnerships and corporations for the purpose of credit risk assessment, credit scoring or for other business purposes such as the extension of trade credit. They usually collect data directly from businesses not from the banks. The figure below shows the current credit information market from consumer lending to corporate lending enabling creditors to make informed decisions regarding loans and credits. 105. General Principle 3 establishes that the Governance arrangements for CRSPs should ensure accountability. Transparency and effectiveness in managing the risks associated with the business and provide fair access to information by relevant users. Governance arrangements for credit reporting service providers and credit reporting data providers should ensure timely and accurate disclosure of relevant matters related to the entity and its activities. The management of credit reporting service providers and data providers should identify all relevant risks faced by the organization. Credit reporting service providers are technology-intensive and deal with multiple parties that provide and use data. The potential for operational errors, either within the credit reporting service provider or from outside is therefore significant. Operational risk is not only related to the proper operation of information technology equipment or other pieces of infrastructure; unintentional human errors, or unlawful activities like the unauthorized access to data by the service provider staff or others are also a key source of operational risk. Operational risks can also lead to legal problems. Status in the country 106. Trans Union El Salvador is one hundred per cent owned by Trans Union Corporation based in Chicago (United States. Trans Union Central America (TUCA) operates at regional level and serves Guatemala, Honduras, Costa Rica, Nicaragua and El Salvador keeping the mainframe and infrastructure in Guatemala. It is difficult to understand from their website the types of services offered in El Salvador, the types of data collected and further used and final users. Trans Union started operations in 2011 offering an alternative to Equifax but their business really took off when the Equifax service was not available as many clients move at that time to Trans Union seeking credit information services that were no longer available from their previous service provider. They obtained license to operate from the SSF in 2014. They include information mostly on individuals focusing on consumer lending from products offered include credit reports, score alerts, portfolio monitoring and used to offer address verification integrated into anti-fraud products. There is also no information regarding the authorization obtained from SSF and the legal and regulatory framework governing their activities. Finally consumers’ rights and protocols to effectively exercise these rights including consent, right to access and correct data and cost to receive a copy of the report. 107. Equifax Dicom is participated by Equifax South America and some local banks and has been operating in El Salvador since 1997 introducing new technologies to the credit reporting market in El Salvador. Dicom has 52 employees and 4 management areas including; (i) management (ii) marketing, (iii) operations, (iv) legal and (v) HHRR. 51 Some of these units serve several countries at the same time (Figure 4). Equifax does not include the ownership structure in their website or information related to the legal and regulatory framework that covers the activities of Dicom in El Salvador. In addition, the website does not provide information to consumers regarding the right to access and protocol to follow or information related to the types of users that will be accessing the information or a sample of consumers’ consent. Adding this information to the website will provide for transparency and confidence on consumers. The services offered by Equifax are focused on products generated with consumer information provided by the banks and other non-bank institutions. Types of products include; (i) credit report, (ii) previous enquiries, (iii) alerts, (iv) portfolio monitoring and (v) credit bureau score. Prior to the introduction of the Law on Consumer Protection they also included information on previous addresses and telephones but this service if not available anymore. The Equifax services were closed by the SSF for some time and after applying for a new license their services were restored. Figure 5- Ownership Structure of Equifax Equifax Banco Industrial 6% Banco Agricola Equifax South 18% America 76% Equifax South America Banco Agricola Banco Industrial Source; Equifax, February, 2016 108. Infored is a one hundred per cent Salvadorian capital entity participated by Primer Banco de los Trabajadores and several organizations that operate in the micro- lending space. Infored was established in 2000 and obtained SSF authorization in 2014. Information in their database is tailored to entities currently not regulated by the SSF. Infored operates with a team of 15 staff including IT, business and administration units. Their database is kept in El Salvador and their products include credit reports and other services based on previous addresses, telephone directories and a score. For the score they use the positive information from the banks but not in the reports. Reports are based on information obtained mostly from non-banks and offer a credit history of 12 months. Infored obtained license to operate as a credit bureau from the SSF in 2014. 52 Figure 6- Ownership Structure of Infored INFORED Primer Banco Educacion ONG de los Tabajadores Microservicio s Fedecaces Genesis Consultores Micronegocio s Source; Infored, February 2016 109. Procredito has been operating in the market since 1967 and its oriented to retailers 79% of the credit collected in its database refers to retail loans and 15% from industry. Products and services provided are based on consumer credit reports and include; (i) address verification and (ii) debt collection. While their hit rate was close to 70% it has decreased significantly to below 40% after the data cleanse conducted in 2015. Figure 7- Ownership Structure of Protectora de Credito (Procredito) PROCREDITO Industry Services 15% sector… Financial Sector 2% Microcredit 2% Retailers 78% Source; Procredito, February 2016 110. Fedecaces collects information from the members of the Federation of cooperatives including 31 cooperatives offering services to 225,000 members. Although they also participate in other two existing credit bureaus they are not regulated by the SSF and therefore do not submit data and access the credit registry. Fedecaces has developed their 53 own credit reporting system called SICURIC where each cooperative provides information through a private network and dedicated lines to each of them. The system creates early warnings on probability of default and classifies the portfolio into different categories than the ones established by the SSF. They have also developed a score for SMEs (Score para MYPES) using variables such as age, title, civil status, income. 111. Pricing of services is established under bilateral agreements based on the volume of data obtained from each participant and the volume of enquiries made by each user. In this context, none of the bureaus displays a pricing policy in their respective websites. As for consumers all credit bureaus interviewed assured that once a year a free credit report was provided on a free basis to consumers upon request although not many consumers requested the reports. For subsequent copies prices varied from 1USD to 7 USD per report. The law allows credit bureaus to charge for certified credit reports. 112. Policies are established under the bilateral agreements between each credit bureau and each of the data providers. There are internal users groups that allow for an additional data fragmentation. Despite the existence of information from several sectors (e.g. banks, non-banks financial institutions, microfinance institutions) only negative information flows within the credit bureaus with no restriction whereas positive data (i.e. on time re- payment) is only available for banks. 113. The law allows for the sharing of information from all different creditors and other users with the prior consent on the consumer. Market signs (i.e. recent deletion of data due to lack of consent) show that the practice of obtaining consumer consent is not in present in El Salvador and that implementing such measure for historical data was not feasible or cost effective for the credit bureaus. 114. There are some credit bureaus that allow the access of information to collection agencies and other purposes. The law does not establish a limitation on the purposes of the use of the information and therefore information from credit bureaus is used for other additional purposes. 115. Information in El Salvador CRS is fragmented and products developed rely excessively on negative information. While the banking sector can access negative and positive information from all sources, all other creditors and deferred payment service providers are only able to access negative information from the banking sector. It is common however that financial institutions participate in more than one credit bureau depending on the type of borrowers they are evaluating. Hit rates in general are low and based on interviews with users they are below 50%. The current data fragmentation does not foster responsible lending and could lead to over-indebtedness. 116. The BCR should ensure that credit information collected by the credit bureaus is sufficient and not excessive for the evaluation of the creditworthiness of individuals and legal entities. General Principle 1 of the General Principles for Credit Reporting 54 establishes that CRS should have relevant, accurate, timely and sufficient data collected on a systematic basis from all reliable, appropriate and available sources and should retain this information for a sufficient amount of time. CRS require comprehensive and quality credit information. Credit information should be sufficient in terms of scope of data and scope of data providers. When data is limited CRS tend to be poor and less predictive, when scope of participants is limited information will not include the total credit exposure of each individual and or firm. Systems based on negative information provide data on defaults and tend to be static while systems based on both positive and negative information show payment behavior of the individuals and consumers and tend to include also history of payments and defaults. 117. There is no unique identification in El Salvador for individuals which generates homonymies. While some credit bureaus use sophisticated fuzzy logic techniques to identify individuals in their databases, there are still many situations where individuals included in the database are confused with others with similar name and last name. 118. Telecommunication companies are not providing all the information on the repayment history of their clients. Initially telecommunication companies provided information related to addresses and telephone numbers which were extensively used by creditors for collection purposes. This practice was stopped when the Supreme Court established the need for credit bureaus to upload data that can be supported with consumer’s consent. Telecommunication companies hold information on a large number of individuals in El Salvador and the information related to on time payment or top ups could be particularly relevant for financial inclusion objectives however without accessing positive credit information from banks credit facilities these companies have little incentives in sharing their information through credit bureaus. 119. Even when information from different sources is stored in the same credit bureau it is not shared with all credit bureau members. Positive information from banks is only shared among banks and all other creditors and bureau members access only negative information creating an unfair environment as regards to information access which impedes responsible lending practices. Recommendations 120. Authorities should seek ways to enable the access to positive data from the banking sector. On one hand, the amendment of the article 232 of the banking law establishing an exception to the bank secrecy and on the other hand, seeking incentives for banks to share positive data with other institutions. In this sense the role of credit bureaus in providing confidence regarding the confidentiality of the data and the development of value added services for banks that would foster comprehensive information sharing is essential. 121. Given the existence of 4 different credit bureaus containing credit information from different sectors, options should be explored to make more efficient the access to comprehensive credit information systems. Creditors would benefit from exchange of 55 information between different credit bureaus that would enable comprehensive reports on borrowers. Current exercise led by the BCR to establish standardized formats would enable convergence of data in the different databases which could pave the way for a future exchange of information between different credit bureaus. Examples of this practice can be observed in Mexico between Buro de Credito and Circulo de Credito and in Cyprus between Artemis and Aiantas. 122. Credit bureaus and authorities should explore options of including additional relevant information into their databases. There are other sources of data that hold relevant information that could contribute to a more detailed debtor’s profile. Information on bounced cheques and information in particular held by the CNR are very relevant for a better evaluation of MSMEs. i. Bounced cheques; Although the payment system should move to electronic payments, cheques are still very common in El Salvador (32 million cheques were issued in 2015), yet a large amount of cheques compensated are bounced back (700,000 in 2015). Among those 46% are bounced back as a result of lack of funds in the account of the issuer. Other reasons include signature mismatch, or errors in completing the cheque while to a lesser extent the existence of forgery is not considered a major reason for bounced cheques. This information if it does not create a major effort could be shared with the credit registry and credit bureaus including, name of the issuer, date of the rejected cheque and amount. In addition the information could keep track of the number of rejections during a certain period of time. Please note that this option should not create incentives in the market to keep using cheques instead of moving on to a more efficient payment instrument 21. 21 Please see additional discussion in the Payment Systems section of this technical note. 56 Figure 8- Main reasons for bounced cheques in El Salvador Source; BCR, December 2015 ii. CNR: Companies Registry- There are 86,000 legal entities registered in the companies registry including sole proprietors and companies. Information collected includes all relevant information to the creation of the company (e.g. name of shareholders, address, sector, date of creation, changes in the board of directors and/or shareholding) financial statements (e.g. financial information and also the date last financial statements were registered). The credit registry currently captures information on 9,000 companies approximately. iii. CNR: Collateral Registry- Information collected in the registry includes data on the borrower (name, NID and address), the asset (i.e. value, serial number, date of the pledge). The system is electronic and centralized has 700 users and includes information from 142 companies. It should be noted that the law on Secured Transactions has been recently passed and was enacted in April 2016. The law allows for all types of movable assets to be used as collateral. iv. Telecommunication companies; There are 5 telecommunication companies operating in El Salvador and currently only some of them are sharing information with the credit bureaus and they only share negative data with the credit bureaus. Telecommunication companies gather information on the payment behavior and top up of their clients covering 1 to 3 million people in their respective databases. Information includes clients in post-paid services and clients in pre-paid type of contracts on both lad and mobile services. 123. Credit bureaus in El Salvador should provide relevant information related to critical aspects of their operations in the county to the public at large. Information 57 related to the type of data providers, rules to collect data and access data, protocols to follow regarding consumer complaints and costs for such processes as well as enabling an on-line system for consumers to access their credit reports would provide transparency and additional confidence for consumers in the market. H. Credit Registry Context 124. Banking and Financial sector regulators typically access relevant information on credit transactions to effectively carry out their supervisory functions (both on-site and off-site). In some countries, credit registries are the main tool supporting authorities in this function while in others the collection of certain data items in a systematic basis from the regulated entities is complemented by additional information captured from the credit bureaus 22. The rationale behind the creation of a credit registry or a credit bureau have been thoroughly discussed and the legal basis for such creation is clearly included under the law on credit history (see article 9 on common state register of credit history). 125. Credit registries are a frequent component of credit and loan reporting systems, sharing a basic framework regarding their institutional arrangements, the type of data they collect and their policies regarding distribution of credit data. Usually these registries are operated either by the central bank or the superintendence of financial institutions. While they are major credit and loan information collectors, due to their own nature they normally limit themselves to requesting information from regulated financial sector intermediaries, who are compelled to report by means of law or resolution. Reporting financial institutions usually furnish borrower’s identification, outstanding debt, type of credits, risk rating, collateral and guarantees, business sector and others. 126. The information stored in these databases is used to support the prudential regulation and banking supervision, to produce economic analysis and research (computing measures of credit by sector, by credit quality, portfolio credit risk models, etc.) and often to foster the operation of the local credit and loan reporting system, producing credit reports and distributing credit information back to the financial institutions and even to credit bureaus. These potential uses entitle the operator (central bank or banking superintendence) to compel banks to report all the information considered relevant, both positive and negative, and can therefore assemble a more complete picture of credit in the regulated financial sector and even operate where the legal environment is inhospitable for private credit reporting ventures. 127. While the public sector is not to replace the private sector in this regard, credit registries are an important tool for the prudential supervision of financial institutions and for the control of the credit in the economy and help correct eventual inefficiencies in 22 For additional information please see The Role of Credit Reporting Systems in Supporting Financial Supervision and Regulation, The World Bank, 2016. 58 the credit reporting system such as insufficient competition 23, not enough sharing of positive and negative information, existence of credit information fragmentation, inappropriate treatment of customer complaints, fair access to credit information and access to relevant information to support banking and financial sector supervision and regulation. Both the creditor’s need to enjoy the benefits of sharing and disclosing credit information and the specific needs of supervisors to monitor the credit market and the individual institutions facilitating credit while ensuring that their regulated entities have sufficient tools to comply with prudential rules are supported by profuse empirical evidence. 24 128. New and often more complex data needs of central banks and other financial sector regulators and supervisors have emerged as a result of changes in the financial sector regulatory and supervisory paradigm and the new analytical techniques that have been developed, and continue to be developed, in connection with such changes. A robust credit reporting system can play an important role in satisfying these data needs. It should be noted that credit bureaus and commercial credit reporting companies can also play a role in supporting financial regulation and supervision and broader financial stability tasks. As a matter of fact, some central banks and financial supervisors already resort to credit bureaus and commercial credit reporting companies to obtain the data they need to discharge their micro- and/or macro-prudential responsibilities 25. Status in the country 129. The Credit Registry is operated by the SSF and was established in 1997 to implement article 61 of the Banking Law. The Credit registry includes information from 1,731,289 individuals and 9, 966 legal entities 26. The following institutions submit credit information to the Credit Registry on a monthly basis; (i) banks, cooperative banks and savings and credit cooperatives (SACCOs), f cooperative bank federations, insurance companies, development banks, Fondo Fiduciario Especial para Atender a los Afectados de las Operaciones Ilegales del Grupo Insepro (FEAGIN), Fondo de Saneamiento y Fortalecimiento Financiero (FOSAFFI) and al entities regulated by the SSF. 130. Information is submitted on a mandatory basis to the SSF according to a pre- established data structured included in the Annexes of NPB4-17. The information submitted refers to all loans and credits from all SSF supervised entities including the following details; (i) name, (ii) NIT, (iii) loan classification, (iv) creditors’ name, 23 See Negrin J. L., “Mecanismos para compartir información crediticia. Evidencia internacional y la experiencia mexicana”, El Trimestre Económico, Vol. LXVIII (3), N°271, July – September, 2001 24 See Jappelli, T. and M. Pagano, “Information Sharing in Credit Markets: International Evidence”, Inter- American Development Bank, Working Paper R-371, June 1999. Further statistical evidence for Brazil and Argentina has been found in Majnoni, G., M. Miller, N. Mylenko and A. Powell, “Improving Credit Information, Bank Regulation and Supervision: On the Role and Design of Public Credit Registries”, World Bank, June 2004. See also Barron J. and M. Staten, “The Value of Comprehensive Credit Reports: Lessons from the U.S. Experience”, Purdue University and Georgetown University, 2003. 25 The Role of Credit Reporting Systems in Supporting Financial Regulation and Supervision, The World Bank, 2016. 26 Data provided by SSF and refers to December 2015. 59 (v)outstanding balance (vi) date of submission. In addition supervised entities need to provide a loan classification based on the following categories; (i) A. Normal, (ii) B deteriorating (iii) C1 unsatisfactory, (iv) C2 unsatisfactory deteriorating, (v) D1difficult collection, (vi) D2 difficult collection deteriorating, and (vii) E loss. The law allows to disclose information on those borrowers classified as D and E. Supervised entities can access the information which is provided in a snapshot format although they can also access information from the past 12 months upon request. There is no additional charge to each enquiry as 50% of the maintenance cost of the credit registry is passed on to the supervised entities through the 1/1000 tax on assets. Information is submitted in XML on a monthly basis and requires a letter of data accuracy signed by the respective institution official. Identification of individuals and legal entities is based on the tax number Numero de Identificacion Tributaria (NIT) as there is no unique identification document for citizens in El Salvador. Recommendations 131. The SSF and BCR should elaborate a Memorandum of Understanding (MoU) clearly establishing the type of information required by BCR to effectively conduct its mandate. The BCR is charged with the macro prudential supervision. In this sense, highly sophisticated analytical techniques for use in financial sector regulatory and supervisory tasks, both from the micro- and macro-prudential perspectives, continue to emerge. These are allowing financial sector authorities to enhance the depth of the various analyses they perform on either a regular or ad hoc basis, as well as to look at potential problems in financial institutions from new angles. The role that telecommunication companies, conglomerates and newly sophisticated financial instruments play in the economy at large require more granular data to effectively develop early warning systems. Increasing concerns regarding over-indebtedness in the population at large requires analysis at household level. Given this scenarios the BCR should be able to communicate to the SSF their data needs and SSF should be able to meet their needs without major delay. SSF in their role as micro prudential supervisor requires granular information on the credit performance of the financial sector but some 132. SSF and BCR might need to complement data from credit registries with data from credit bureaus to perform their supervisory functions. There are some times where authorities are not able to capture all information that they need to effectively conduct their banking and financial supervision or credit bureaus are not able to capture all relevant information related to existing loans in a given country. In mature credit reporting markets, this collaboration between credit bureaus and authorities might be possible provided that certain pre-conditions 27 are in place. Financial sector authorities should look to take advantage of the specific strengths of the various CRSPs for regulatory and supervisory 27 These pre-conditions related to the fact of existing efficient credit bureaus, developed value added services extensively used by the creditors, sufficient history included in the bureaus and procedures to enhance data quality aspects. In addition the role of CRS activities oversight is in place and performed by authorities for some time. 60 purposes and in this context regard them as complementary to each other, rather than as substitutes (see Box). Box 1: Use of credit information for banking supervision: the case of Mexico Authorities in Mexico operated a credit registry (SENICREB) for some time, capturing credit information from regulated entities into their system. This registry is composed by two main files; one R04 (information regarding the financial characteristics of each of the different types of credit granted by financial institutions, which are within their balance or under their administration) sent to the National Banking and Securities Commission (CNBV) and the Accountability Portfolio Report ( granular data on commercial loans above fifteen thousand USD given to companies, individuals with business activities and to Federal States, and for house acquisition or construction plus aggregated data on loans below fifteen thousand USD) sent to Banco de Mexico. This registry did not capture information on shadow banking or consumers’ identification or information on housing credit granted by government agencies. The two credit bureaus operating in Mexico capture granular data from consumers of regulated and non-regulated entities. However there are still some entities that do not provide data to the bureaus (e.g. INFONAVIT) and quality issues remain. Both systems present lack of homogeneity. Authorities decided to collect also information from the bureaus and include such data into their supervisory cycle together with the data captured by the credit registries. The most useful data from bureaus in Mexico relates to granular data on loans by non- regulated entities and also on unpaid tax liabilities. Creating and maintain a unified database that will: (i) incorporate information about all financial entities that grant credit, (ii) improve the quality of the database through centralizing the information in a specialized unit for its exploitation and (iii) give access to the database to other financial authorities so as to have a unified diagnosis of the credit information within the country. The new system will allow also the following tools; a) Trends in household debt and its sources (banking and non-banking system); b) Evolution of the size of the non-banking system and its implication to financial stability; c) Sources of the deterioration of credit portfolios by type of credit and institution; d) Early recognition of portfolio deterioration processes by credit type; e) Trends in borrowing of commercial and government entities; f) Competition trends in bank credit (e.g. migration of customers between credit institutions); g) Level of access finance; h) Credit aggregates as early indicators of economic activity, and i) Impact of credit in the formulation of prices in the economy. Source; Banco de Mexico for ICCR, February, 2015 61 I. Credit Information on MSMEs and Corporates Context 133. Information on SMEs can be typically captured by different CRSPs including credit rating agencies, commercial credit reporting companies, credit registries and credit bureaus. SMEs typically face more severe constraints to growth than do large companies. Some of the obstacles to SME financing are associated precisely to their own nature as smaller companies. This includes factors such as lack of critical economic size, and the somewhat informal and generally less sophisticated management of SMEs. The information collected would also depend on the type of financing available in a given market to SMEs. The graph below depicts the typical sources of data on SMEs and the most frequent CRSPs that collect such data and service users with informational products. These products might range from ratings, specific scoring models developed for SMEs, investigative reports and credit re-payment reports. (Figure 9). Figure 9: Commercial credit information market Status in the country 134. El Salvador’s economy is dominated by the service sector, which accounts for 60 percent of GDP. The manufacturing sector accounts for 25 percent, and agriculture and 62 related sectors for 12 percent. The economy has been officially dollarized since 2001. El Salvador’s most important export category remains maquila products (manufactured products assembled for re-export), which account for 22.6 percent of all exports, and which have traditionally been composed of products with low value-added that are not technologically intensive. 135. The lack of credit information is one of the facts that constrains access to credit and financing to MSMEs. Although there are several demand-side factors that explain the difficulties many MSMEs face in gaining access to credit, the lack of behavioral track records and internal procedures for generating quality information on their activities and operations, as well as strong resistance to sharing information is one of the key challenges that banks and financial institutions face when evaluating MSMEs lending applications. Others include; (i) limited administrative and financial management capacity and (ii) lower levels of capitalization and capacity to offer collateral. 136. There is no commercial credit reporting company in El Salvador capturing information from commercial lending and loans to SMEs from non-banking sector. Credit bureaus currently collect information on both individuals and firms but the data collected is still focused on the type of data required to evaluate consumer lending and is not focused on commercial lending. In addition the number of firms included in each bureau is reported to be very low. Finally the type of data collected by the bureaus is tailored to consumer lending and might need additional data items to effectively reflect MSME lending risks. Although each country might require specific actions to enhance data collection on SMEs, there are some data items that would be desirable to collect on firms in general and store them in a common database to evaluate the creditworthiness of legal entities Recommendations 137. It is critical that the positive information form the banking system flows to all the relevant creditors. Creditors such as cooperatives, microfinance institutions, retailers and telecommunication companies are only able to access negative information from banks but no information related to the outstanding commitments of individuals and legal entities with banks is available for these types of creditors. (Please see recommendation included under paragraph 117 of this report) 138. Additional information specifically related to legal entities should be included in the credit bureaus. In addition information related to (i) collateral, (ii) value of the collateral, (iii) related parties, (iv) legal structure, (v) financial statements, (vi) sector of activity and (vii) status of the legal entity (i.e. active/non active) enables a more comprehensive analysis of the borrower. There are certain data items that are typically collected in comprehensive commercial credit reports (Box 1). 63 Box 2- Data items for a comprehensive commercial credit report  IDENTIFICATION OF LEGAL ENTITIES Company identification data (e.g. tax identification, LEI, company registration number)  TRADE REFERENCES Information from third parties that in the recent past have extended credit to the applicant, or from public sources that report the credit performance of the applicant.  PUBLIC RECORD FILINGS Court actions; Collections; Suits; Liens and registered charges; Bankruptcies  FINANCE SECTION Balance sheet and profit and loss data; Age of financial statements; Comparatives with sector data; Company versus consolidated financial statements (if applicable); Corporations Law Classifications  CURRENT INVESTIGATION Significant items that have impacted the company performance (e.g. its risk and/or delinquency scores); Media research; Results of general interview with the firm and any comments in relation to the financial statements; Where Interview has been declined, the reason for same is provided.  BANKING FACILITIES Bank name and address; Overdraft details and/or other facilities; Type of bank  HISTORY Incorporation/registration details and a chronology of the applicant’s history. Useful data elements include: Corporate structure; If a branch of a foreign company; Company name changes; Limited by guarantee; Shareholding; Directors antecedents; If applicable, parent, ultimate parent and affiliates.  LEGAL STRUCTURE Details regarding the corporate structure of the firm. These are normally obtained directly from an authority, e.g. the Companies Office in the UK or the Australian Securities and Investment Commission.  EXECUTIVES The Chief Executive Officer; Common Directorship/s; Antecedents (where relevant); Other personnel or key managers; Representation on other Boards; Adverse information on Directors; Any changes or when the names of the Directors differ from that shown at the appropriate legal authority Source: Adapted from BIIA (2012), “Standards Governing Commercial Credit Reporting Companies” J. Cross-Border data flows 139. Credit Information from El Salvador is not shared with other countries at this moment. In Central America all countries (Honduras, Nicaragua, El Salvador, Guatemala and Costa Rica) except for Panama have a credit registry operated by the Superintendence collecting information on loans and credits facilitated by supervised entities. In addition there are two bureaus that are present in more than one country (Equifax and TransUnion) sharing even the platform and mainframe where data serving all countries in the region is kept. In a highly competitive and global environment, with cross-border lending activity becoming increasingly prevalent, access to relevant information to evaluate the creditworthiness of borrowers provides a key element to enable access to capital for economic growth. 64 Recommendations 140. The SSF and BCR should evaluate the impact of cross-border lending and the need for sharing information across the border at the minimum between authorities. A regional forum for credit reporting system where authorities discuss relevant aspects of credit reporting and collaborate with each other in case needed might an option. In this context, CEMLA and the Western Hemisphere for Credit Reporting Initiative could serve as a platform to further develop this forum. 141. The SSF and credit bureaus should explore existing options to allow migrants to have a credit report available. There are several portability models available for consumers and legal entities to use when there is no sufficient information on one country but information is available in another. In particular portability reports options between El Salvador and US, or between El Salvador and Nicaragua, Guatemala, Costa Rica, and Honduras could be explored. K. Role of the Authorities Context 142. The smoothness and reliability of information flow and sharing mechanisms affect the efficiency of the real economy and the financial markets; they also have an impact on access to credit by different segments of the population and firms. Market forces alone may not be able to achieve the objectives of efficiency and reliability of the credit reporting systems since participants and operators may not have adequate incentives to share the information on creditors. In addition, the institutional structure of the credit reporting systems may not provide incentives or mechanisms for efficient design and operation. 143. These are the reasons why in many countries the authorities’ involvement in the credit reporting area is an integral component of their overall mandate to ensure stability of the financial system and access to financial services. In this context the authorities (central bank, banking supervisor, Ministry of Finance, etc.) perform a number of different functions in their national credit reporting systems. These functions may include direct involvement in managing public credit registries and in overseeing the system as a whole. 144. The role of the authorities is particularly relevant in developing a vision for the systems, in coordinating with all stakeholders and in carrying out a reform plan, if necessary. This role stems from the need to ensure an adequate legal and regulatory basis, an efficient functioning of the credit reporting industry and public databases and the adequate level of consumer protection. In all cases, in order to pursue the public interest in the credit reporting systems, the authorities should ensure that the systems observe the General Principles for Credit Reporting, as overseers, to guarantee the (financial and operational) reliability and efficiency of all the systems. 65 145. In light of the different perspectives authorities and stakeholders tend to take on credit reporting systems, it is particularly important that a framework to oversee the financial information industry be developed in each country. In particular, the CRS overseer could play a key role to reconcile conflicting public policy actions by finding a satisfactory equilibrium to issues that, if not properly addressed, have the potential to jeopardize the development of the financial sector or economic growth. The oversight framework includes specifying the objectives, policies and instruments the overseer(s) will adopt in carrying out the function as well as the cooperative framework. 146. It is appropriate that credit reporting systems oversight be explicitly entrusted to the authorities by law. Specifying the objectives in relevant legislation may be the most direct way for providing a well-founded legal basis for the overseer(s) to implement appropriate policies and make it accountable in pursuing its goal and mandate in the credit reporting area. 147. Since several authorities share responsibilities for the development and smooth functioning of credit reporting systems in any given country, it is of paramount importance that regulators and supervisors develop appropriate schemes of cooperation in this matter. In particular, effective cooperation among market participants, between regulators and market participants and among regulators is essential for the development of sound and efficient credit reporting systems. On the one hand, the sharing of credit information generates significant externalities for the financial sector and other economic sectors and increases access to credit. On the other hand, within the credit reporting systems, the lack of information sharing and coordination failures due to the existence of conflicts of interests (and information costs) as well as the intermediaries’ unwillingness to cooperate can lead to “sub-optimal” equilibria in the organizational arrangements as to the system’s reliability and efficiency. The credit reporting systems overseers are therefore entrusted with making up for a specific type of failure in the market for information sharing, i.e. the coordination failures Status in the country 148. Credit bureaus in El Salvador are subject to the supervision of the SSF while the BCR is responsible for the regulation related to credit bureau activities and the consumer protection agency (Defensoria de Proteccion al Consumidor) deals with consumer complaints. Article 7 of the Banking and Financial Supervision Law establishes that all credit reporting systems operating in El Salvador are subject to SSF supervision. Article 5 of the Credit History Law establishes also that the SSF is responsible for licensing credit bureaus and keeping a registry with all entities providing such services. Article 5 also establishes that BCR is responsible for the formulation and adoption of regulation related to credit bureaus. In addition it will also be responsible for the establishment of the data retention periods and data items that consumers should provide to the respective bank or financial institution for the evaluation of their credit worthiness. Article 6 of the Law on Credit Histories 66 149. Collaboration between SSF and BCR is necessary for the effective, safe and reliable functioning of the CRS in El Salvador. Article 30 of the SSF law establishes that BCR and SSF should coordinate and enact MoUs enabling exchange of information in order to coordinate and ensure financial stability. Moreover article 5 of the Credit History Law establishes the need to access information from credit reporting systems to facilitate the role of BCR in monitoring and evaluate public policies related to the financial system as well as in order to calibrate impact of credit reporting and financial sector regulation. 150. Consumers’ claims and data related disputes require collaboration between SSF, BCR and Consumer Protection Agency (Defensoria del Consumidor). Dialogue between authorities could serve to strengthen the role that each authority plays as regards to consumer protection. The SSF when conducting examinations could include a module on consumer protection designed in collaboration with Defensoria del Consumidor, BCRA when formulating regulation related to consumer protection related aspects should coordinate with SSF to evaluate the impact of the measures and with the Defensoria del Consumidor to monitor the implementation of the regulation. In addition exchange of information or even publication of statistics on complaints by sector, region and type of request as well as credit bureau or data provider could help other authorities adopt relevant measures to correct inappropriate behaviors. Recommendations 151. The SSF should formally establish an oversight function clearly defining public policy objectives of credit reporting systems and communicating such objectives to all relevant participants to the CRS. In designing the oversight framework, authorities should go beyond legal compliance and seek ways to ensure the safety, reliability and efficiency of the CRS. In such context, not only the entities that are subject to the regulation of the SSF should be subject to oversight but also those that are under the regulatory purview of other authorities but participate in the CRS (e.g. all types of data providers, credit reporting service providers and users). The following key considerations should be taken into account; i. Authorities at the national level should identify credit reporting systems that should be subject to regulation and oversight using publicly disclosed criteria; ii. One or more authorities should be appointed as primary overseer. Such authority(ies) should coordinate its/their oversight actions with other relevant authorities. iii. Authorities should have powers or other capacity consistent with their relevant oversight responsibilities, including the ability to obtain information and induce change. iv. Authorities should have sufficient resources to fulfill their regulatory and oversight responsibilities 67 v. Authorities should clearly define their regulatory and oversight objectives, roles, regulations, and policies to set clear expectations for credit reporting systems and facilitate compliance with applicable policy requirements and standards; vi. Authorities should publicly disclose their objectives, roles, regulations, and policies to provide accountability in the exercise of regulation and oversight of credit reporting systems; vii. Authorities should cooperate with each other, as appropriate, to support more efficient and effective regulation and oversight of credit reporting systems. viii. Authorities should ensure that the General Principles 28 and related roles are applied consistently to all credit reporting system participants. ix. Financial sector authorities should engage in meaningful and constant dialogue with CRSPs, and in general observe the Recommendations for Effective Oversight of Credit Reporting Systems included in the GPCR report. 152. While roles and responsibilities of each authority are clearly identified in the law, there is a need to strengthen collaboration between authorities in order to achieve an effective oversight. The SSF is well-positioned to become the primary overseer for the overall credit reporting systems in El Salvador. Other authorities identified include; (i) the BCR as regulator of the credit bureaus, (ii) the Defensoria del Consumidor in charge of the consumer protection aspects related to credit bureaus and (iii) the SEGIT due to its role regarding credit information on telecommunication and utilities. Finally the Ministry of Economy in the role regarding the implementation of the law on secured transactions and ultimate responsible of the CNR also plays a role regarding the access and further use of information held in these registries. To avoid duplication, inconsistencies or gaps in oversight, all authorities in the cooperative arrangement should agree on their responsibilities and expectations, for example in a memorandum of understanding (MoU) or similar document. It is particularly important to be clear about the objectives of the cooperative oversight, the policy requirements and standards against which the system will be assessed, the scope and frequency of the information to be shared, and the procedures for assessing the system. (Figure 10 depicts the main authorities involved in CRS in El Salvador) 153. The SSF should differentiate the role played as operator of the credit registry with the role of overseer of the credit reporting system as a whole. Ideally the credit registry as well as any other credit reporting system in the country should fall under the scope of oversight and therefore the establishment of a separate unit focused on ensuring the safety, reliability and efficiency of the systems should be established. 28 The General Principles for Credit Reporting, The World Bank, 2011 68 Figure 10- Institutional CRS Oversight arrangements SEGIT Consumer Protection Agency BCR Credit Bureaus SSF Data Providers Data Users III. SECURED TRANSACTIONS AND COLLATERAL REGISTRY Context 154. Collateral facilitates credit by reducing the potential loss lenders face from loan defaults. While land and buildings are widely accepted as collateral for loans the use of movable collateral (such as inventory, accounts receivable, livestock, crops, equipment, and machinery) is restricted by non-existing or outdated secured transactions laws and registries. The term “secured transactions” refers to credit transactions where a creditor holds an interest in a debtor’s movable property (“collateral”) to secure a loan or a debt obligation. The interest in movable property is also referred to as “security interest,” “pledge” or “charge.” 155. Reforming the movable collateral framework thus enables businesses to leverage the greatest part of their assets and obtain credit for growth. Movable collateral strengthens financial systems by: (i) diversification of assets held by financial institutions efficiently spreading the risk, (ii)reducing concentration in the financial system, by providing banks with profitable lending opportunities in the SME sector to increase their financial market share; and (iii) improved liquidity of assets, especially short-term assets such as accounts receivables. 156. Secured transactions laws should be structured to enable businesses to maximize the extent to which they can utilize the value inherent in their movable assets 69 to obtain credit. 29 A key aspect of an adequate secured transaction law is the effectiveness against third parties which required a simple mechanism to achieve third-party effectiveness through registration of a notice in a quick and inexpensive way. Another relevant aspect of an adequate legal framework on secured transactions refers to the priority which allows for the concurrent existence of security rights having different priority status in the same assets. This makes it possible for a business to utilize the value of its assets to the maximum extent possible to obtain secured credit from more than one creditor using the same assets as security, while at the same time allowing each creditor to know the priority 30 of its security right. Status in the country 157. Movable assets are not broadly used as collateral by creditors operating in El Salvador. There are some specialized factoring companies and other creditors might take equipment and machinery but they would prefer to real state to movable assets. The recently passed law requires the Ministry of Finance to issue regulation so that it can be implemented. 158. Security is enforced through asset and property seizure proceedings within the execution process. In these proceedings the court judge appoints an executor judge, who has the legal power to seize the debtor’s assets. Enforcement through seizure of movable goods is harder since the executory judge must obtain proof that the debtor is the owner of the goods before seizing them. 159. A law on Secured Transactions (Ley de Garantias Mobiliarias) has been enacted in April 2016. The law is based in the Model Inter-American Law on Secured Transactions (“Model Law”), and has been adopted with the support of the OAS. The law establishes conditions for registering the pledge, the types of assets that could be registered and the procedure to register and access the database. In addition the law establishes priority for the security and provides several choices for the creditor to execute the rights over security in case of default. 160. A large number of assets can be pledged. Any movable property belonging to the pledgor on an ownership basis or other real rights that can be alienated may be pledged, including tenant rights, right to undivided share of a joint property, promissory claims, intellectual property rights, stocks, and other rights (claims) resulting from agreement obligations. A right with a defined period of validity may be pledged only until the end of the term of validity. Things or rights originating in the future, including future stores or debts receivable without restrictions, may be pledged. Goods in turnover/commerce may also be pledged. The Government may determine a registry of objects which cannot be a subject of pledge due to their historical or cultural value, or those that are material to the state security. 31 The execution requires debtor notification and the completion of a specific form 29 UNCITRAL Legislative Guide on Secured Transactions, United Nations, 2010 30 Priority refers to the right of a person to derive the economic benefit of its security right in preference to the right of a competing claimant. 31 Law on Pledge, article 4.6. 70 for execution of the asset. Once completed and notified the debtor, the creditor can choose between arbitration, extrajudicial process in presence of a notary or judicial system. 161. There is an electronic collateral registry operated under the CNR. The system is accessible on-line for both registration of new pledges and also for consultation and automated forms are available to ease data entry by creditors instead of uploading all the contracts manually. A table of fees depending on the type of service requested to the registry is established in the law 32 (see article 50) which range from $1-15 USD. In addition to the cost of registering the security right, there is an annual cost for password maintenance per user. The database is indexed by debtor and includes information on the type of asset, value of the asset, amount secured versus the total credit, and date of the registration of the security. The registry has already 700 users although it is expected to increase its use once the new law is implemented. Recommendations 162. Ministry of Finance to keep working on the development of regulation related to the secured transactions. In this context, consultation with creditors through the different existing associations namely ABANSA and ASOMI would allow the regulator to take into consideration practical implications of the implementation of the law. In addition this process could serve to raise awareness on the existence of the law and the new framework put forward aiming at diversifying economic growth and fostering broader access to finance for MSMEs. 163. Authorities should join forces with CNR and continue promoting the Ley de Garantias Mobiliarias among the banking and financial sector institutions encouraging them to use the collateral registry. Fostering the use of the collateral registry by a large number of users on all security rights and encumbrances over movable assets would allow for product diversification in the financial services, increase confidence in creditors to lend to SMEs and would allow SMEs access to credit. 32 Article 50 of the Secured Transactions Law (Ley de Garantias Mobiliarias) establishes a list of fees related to the type of document to obtain from the registry as well as annual fee for the maintenance of passwords and access to the database. 71