The Superintendency requires cooperatives to redesign their operational risk controls

The Superintendency of Popular and Solidarity Economy issued the Control Standard for the Management of Operational Risk in Entities of the Popular and Solidarity Financial Sector, published in the Second Supplement of the Official Registry No. 395 on Thursday, October 22, 2026. Resolution SEPS-IGT-IGS-IGJ-INR-INSESF-INGINT-INSEPS-0159, signed on September 30, 2026, in Quito, requires savings and credit cooperatives, mutual associations, central funds, and the National Corporation of Popular and Solidarity Finance to redesign their internal controls. The deadline to do so ranges from six to twelve months, depending on the segment in which each entity is located.

The instrument was signed by the General Technical Intendant, Freddy Alfonso Monge Muñoz, exercising the authority to “issue control standards” delegated by the Superintendent of Popular and Solidarity Economy, Christina Ivonne Murillo Navarrete. It is based on articles 74, 163, and 444 of the Organic Monetary and Financial Code and articles 151, 158, and 165 of the Organic Law of Popular and Solidarity Economy, and is aligned with the comprehensive risk management standards issued by the Financial and Monetary Policy and Regulation Board. The standard repeals resolutions SEPS-IGT IGS-INSESF-INR-INGINT-INSEPS-IGJ-0116, dated July 2, 2024, and SEPS-IGT IGS-INSESF-INR-INGINT-INSEPS-IGJ-2024-0123, dated July 5, 2024, and is effective from its publication.

Manual, risk matrix, and monthly reports

Entities in segments 1, 2, and 3, mutuals, central funds, and the Corporation must develop an operational risk manual according to their structure, size, and complexity, which includes policies, roles, identification and measurement methodologies, training strategies, and reporting mechanisms. They must also maintain an operational risk matrix and a centralized event database, managed by the risk unit.

Reports must be monthly—quarterly for segment 3—and contain, at a minimum:

• Details of the highest-risk events.
• Key operational risk indicators.
• Heat map showing the concentration of events by risk level.
• Magnitude of recorded losses.
• Matrices including business line, process, factor, inherent risk, and residual risk.

The documents must be submitted to the Comprehensive Risk Management Committee and be available upon request by the Superintendency. Entities in segments 4 and 5 have proportional requirements: defined and approved processes, registration of events with financial impact, separation of duties, and a personnel management manual.

Seven business lines and four risk factors

The regulation requires processes to be grouped into seven business lines: retail, microfinance, cards, commercial, real estate, payment clearing, and traditional treasury. Each process must be assigned to a single line, and none may remain unassigned.

There are four operational risk factors: people, processes, information technology, and external events. Based on this, events are categorized as: internal and external fraud, employment practices, client and product practices, damage to physical assets, business disruption due to technological failures, and deficiencies in process execution. The regulation also incorporates a specific section on legal risk, classified into documentation, legislation, and capacity risk.

Third Parties, Cloud, and Cyber-Fraud Policies

The articles dedicate a block to services provided by third parties. Anyone contracting cloud infrastructure, platforms, or software must have technical, information security, and legal reports; data centers must follow the ANSI/TIA-942 standard and have a minimum TIER III certification, while providers must be accredited with ISO/IEC 27001, following ISO/IEC 27017 and ISO/IEC 27018. Critical foreign providers require a subsidiary or counterparty in the country.

Entities in segments 1, 2, and 3, mutuals, central funds, and the Corporation must have alternative providers for critical services. Additionally, they must annually contract policies that cover, at minimum, illegal disclosure of databases, illegal interception of data, electronic transfer of equity assets, and attacks on the integrity of computer systems.

Deadlines and Responsibilities

The sole transitory provision establishes two calendars: six months from publication for segments 1 and 2, mutuals, central funds, and the Corporation; twelve months for segments 3, 4, and 5. The Board of Administration or Board of Directors approves policies, methodologies, and the manual; the Comprehensive Risk Management Committee evaluates and proposes; the risk unit executes and reports; and the legal representative implements. Internal auditors must evaluate management and test contingency, continuity, and recovery plans.

The Superintendency may order corrective measures and request the methodologies for their validation. The regulation also mandates the creation of plans to comply with the Organic Law on the Protection of Personal Data and the application of operational risk management to organizations and auxiliary service companies.

The impact falls directly on the internal control of a sector that manages the deposits of thousands of partners and savers: the regulation turns the risk matrix, monthly reports, and the evaluation of technological providers into verifiable obligations subject to supervision. For smaller entities, the challenge will be to comply within twelve months with documentation, cybersecurity, and business continuity requirements that were previously not detailed with this level of precision.

Source: Official Registry, Second Supplement No. 395, Thursday, October 22, 2026, Transparency and Social Control Function, p. 6 (official reference: SEPS-IGT-IGS-IGJ-INR-INSESF-INGINT-INSEPS-0159).