CFN declares its audit reports and risk matrices reserved

The Corporación Financiera Nacional B.P. approved the index of information classified as reserved for the public financial entity, which ranges from internal and external audit reports to operational and information security risk matrices. The decision is contained in Resolution No. CFN-B.P.-GG-2026-0056-R, published in Section I of Official Registry No. 408 on Thursday, November 12, 2026, on page 45, and signed by the acting general manager, Mgs. Maricela Edith Benites Loor. The document is dated November 4, 2026, in its header and October 29, 2026, in its final clause, always in Guayaquil.

Six documentary series under reserve

Article 1 of the resolution lists the documentary sets that are now classified as reserved in accordance with the Organic Law on Transparency and Access to Public Information (LOTAIP):

• Board of Directors documentation classified as reserved
• All internal audit reports
• All external audit reports
• Information security and cybersecurity reports
• Information security risk matrix
• Operational risk matrix

The resolution tasks the General Secretariat with reviewing and updating semi-annually the documentary series that, under current regulations, must be classified as reserved. It also assigns the custody and archiving of the documents that supported the issuance of the index, with the formation of the corresponding file.

From the legal memorandum to the Transparency Committee

The administrative file was assembled in three steps. Through memorandum CFN-B.P.-SGJU-2026-0361-M, dated October 12, 2026, the General Legal Sub-management ruled that the General Management, “in its capacity as the highest institutional authority for these purposes,” was the competent body to issue and sign the resolution, based on Article 17, numeral 3 of LOTAIP.

The following day, memorandum CFN-B.P.-SEG-2026-0592-M forwarded the index for the knowledge and recommendation of the Transparency Committee. That committee resolved, in Article 2 of Resolution No. CTR-2026-012 of October 15, 2026, to “recommend to the highest authority of the CFN B.P. to approve the information classified as reserved and issue the corresponding resolution.”

Deadlines, custody, and restricted dissemination

The first general provision establishes that the information will lose its reserved status ten years after its classification, a period that can be extended up to fifteen years if the causes are justified, in line with Article 16 of LOTAIP. It clarifies that special protection personal data, confidential information, and information subject to banking secrecy will maintain their restrictions even after those periods have elapsed.

The resolution further warns that the unauthorized dissemination or delivery of reserved information, by any physical or digital means, will lead to administrative and judicial actions and the determination of administrative, civil, and criminal liabilities. The entity’s personnel are prohibited from reproducing, revealing, or using this information “including for informative, academic, or any other purposes.”

Article 5 provides for sending a copy of the resolution to the National Assembly and the Ombudsman’s Office within a maximum period of ten days from its signing, and Article 4 mandates its publication in the Official Registry and on the institutional website.

Regulatory Background

The preamble relies on numeral 2 of Article 18 of the Constitution, which allows reservations only in cases expressly provided for by law, and on Articles 235 and 353 of the Organic Monetary and Financial Code, which declare audit reports reserved and subject deposits and other operations of the national financial system to secrecy.

The resolution also invokes Executive Decree No. 291, dated June 5, 2024, published in the Second Supplement of the Official Registry No. 578 on June 13, 2024, which amended Article 2 of Executive Decree No. 868 of 2015 and defined the CFN B.P. as a second-tier public financial entity.

The classification affects the accountability of the public bank at a time when the LOTAIP requires that all reservations be exceptional, reasoned, and declared prior to any citizen request. The index extends a reservation—which the law envisions for specific documents—to complete series (“all” internal and external audit reports), and shifts the burden onto citizens to challenge each denial through the action for access to public information provided for in Article 91 of the Constitution.

Source: Official Registry No. 408, November 12, 2026, Section I, p. 45 (official reference: Resolution No. CFN-B.P.-GG-2026-0056-R).