theWotfsberg

Group

Fln¡ncl¡l Instltuüon N¡re:

Locrtlon (Countryl :

Wolf¡b.re Greup Con tpordlnt Brn*lng Du. Dlllg.mo Qs3üonmlm (CBDOQI Vl.2

BANco DE BoGorA

COLOMBIA

@inswerrdon.Legr|Enüty(LE)Lev9|.Thi3mc.mtheF|n!nc|r||ntüü,t|onw||lrn3worthcqu6gmn.|fe¡ttnrlüm¡to paFnt, hord ofrca t 3ub3ld¡rry lovel lor whlch rny br¡nchca would be con¡ld.Fd covcred by thlt p.renü:ubaidlary DDCI. Thlt quest¡onnrlra

ihould not covor morr thrn ono LE. Elch quo3tlon In the DDQ wlll nc€d to b€ rddresaad from the poltpoctlw of tho LE rnd on bohalf of ¡ll ol ltrrrrnche¡, lf r rrapon3o for the LE dlfiared for one of it¡ brancho3 thl! ntcd3 to bc hlghltghtcd rnd dct ¡l t€glrdlng th¡3 dlffofrnce captured .t tho ond ofr.ch 3ub3ec0on. lf a br.nch burlne.r actlvlty (product! ofrelld, cllent br3e atc.l b sbnmc.ntly dttltnnt th¡n lt! hord offico, t||3 br.nch 3hould complcto

| !ap¡rrto que¡üonn¡lF.

¡rl

-=-q,¡-rón

A¡3w!tTlñItffiÉG.¡¡¡- ' ,: ";i

'ull Legal Name BANCO DE BOGOTA

2 \ppend a l¡st of branches which are co\rered byr¡s ouesüonna¡re

Local Branches

5 ull Legal (Rsgistered) Address Calle 36 No. 7-47 Bogotá, Colombia

4 rull Prlmary Bus¡ness Address (if difrerenl fromLbove)

5 )ate of Ent¡ty incorporat¡on/ establishment Nov 1 5/1870

6 ;elecf type of omershP anú appeno anMershio chart if available

5a tubl¡dy Traded (25% of shares publ¡cly traded)Y€s

6a1 f Y, ind¡cate the exchange uaded on ano [trer;ymbol

Bolsa de Valores de Colombia - BVC (BBO)

6b lember OwYled/ Mutual fes6c iovemment or State Owned by 25% or more No

6d Owned ts

6d1 I Y, provide d€tails of shareholde6 or ultimateÉnefic¡al owners with a holding of 10% or more Shareholder: GRUPO AVAL ACCIONES Y VALORES S.A

% Participation: 68.74%

7 6 of the Ent¡Vs total shares composed of bearerhares

N/A

)oes the EnüV, or any of its bEncnes, operatender an Ofishore Bank¡ng License (OBL) ? Yes

üa 'Y, proMdó the name ot lne relevant DEncn/es,üich oDorate under an OBL

BANCO DE BOGOTA PANAMA S.A.

I lame of primsry financial regulstor / suPsMsoryruthority

Financial Superintendency of Cdombia

10 rcüde Legal Enlity ldentifier (LEl) if available 5493OOLYHE7LWSKDZTs3

O Ths Woltsb.rg Grcup 201E Pag6 1cBoDo v1.2

lYoú¡b.rg Group Cof|t¡pon t¡r* Erntlng Ds Dlllgpnc. Oú¡tlonmltr (caDDQ) vl'2

tfovide tho tull |egal name d ms umms¡9 PaFn¡f different from the Ent¡ty comd€ting the DDQ)

\¡/A

t2 Juritd¡ct¡on of licenong aunonly ano r€gulalort ull¡mate perent

üA

t3 S€lgd th€ bu3¡ne$ ar9e3 appl¡caDlo to rn€

13¡ l€tail Bankino fegEnk¡no / Wealth Menaoemenl )s

t3 to í6s13d onal Bank¡no Yss

¡e to13f :inanc¡al Ma¡kels Trad¡nE Yeg

o'3

Sefvice&l CGtody ¡s

3h tf Not3 I elult¡latcral Devel(t3J )ther

l¡t )oe3 ihe Ent¡ty hav6 a r¡gnmcad (1 0% ornore) otfshore customer bas€, eilher byrumber of cuslomers or by revenues (where oñ¡hore means nd domiciled in the jurisdidionuha.a h-^! aani^6a a¿ bim ñtuidA.l\ t

No

t4a f Y, provide d€tails of the counlry and %

t5 rlecl the dos€st valu6:¡r {umb€r of emDloveeE 1 0001+b Ag Ghátér thrn IS5OO m¡ll¡ón

t0 :onñm that ell re3ponse3 provid€d ¡n therbov€ S€dion ENTIW & OWNERSHIP are'eDresentáive of all the LE s branchos

Yes

16e f N, clarify which qu€stioñ tho dificrence/s€late to end the brancly'$ lhat ih¡s appl¡es to.

t6b f appfoprieto, provide any edd¡üonalnlormáion / corfext to tho ansry€É ¡n thigiecl¡on.

O Tho V\rolfsb€r! Grsp 201 I CBDDQ V1.2

Wolflbrg Group ColñlpondGnt Banklnq Oue Dlllg.nc. QuesilonnrlE (CBDOQI Vl'2

ffit7 )oes the Entity oñer the following produds and

17z ofresoondent Bank¡nq No

17 ¿1

17 a2 )oes the Ent¡ty offer Correspondent Bankingr.ruima l^ dómaql¡c háñk.?

17 a3 )oés the Enüty allo\ t domel¡c bank cl¡ents torr üd. r{ruñclr.ám r.¡d¡ññahiDs?

17 a1 )oes the Ent¡ly have processes and pro@dures

n place to ¡dentify downstrcam relationsh¡ps

'irh ¡^ñad¡^ háñLa,

l7 e5 )oes the Entity offer correspondent bank¡ngr-^;éc.^ E^rd^ñ Qá^Lc?

17.6 )oes the Ent¡ty allol^t downstream relat¡onsh¡psuith F^rnidñ Rank.?

17 a7 )oes the Entily have p[ocesses and procedures

n place to identify dou/nstream relat¡onsh¡psvith Foreisn Banks?

17 t8 )oes the Ent¡ty offer corr€spondent banking!añ;éá r^ rd,¡l4d tlCPe/lr\/TS?

l7 ao )oes the Entity allor¿ downstream relationsh¡psJrh MSFIQ,/MVTS?

7 el( )oes the Entity have proc¡sses and procedures

n dace to identify do\rnlream relationsh¡psdrh ¡tce /M\trct

17h )rivate Bánkino ldomestic & intemat¡onal) lesc frede Finence fes

l7d r Accounls \,lo

e Stored Value lnlruments \ot7Í ross Border Bulk Cash Deliverv

)omestic Bulk Cash Deliverv \ot7h Cash Letter \o7l lemote Deoosit Capture No

'/¡rtuel /Dio¡tal Currencies \o

k -of Price Securities NO

7l lold Mail No

m lross Border Remittances No

17n Service to walk-in custome6 (non-accountNo

o Soonsorino Private ATM3 No

ttp other high risk produds and services ¡dent¡fedby the Enl¡ty

18 3onfirm that all responses proüd€d in theabove Sed¡on PRODUCTS & SERVICES are. -- ^^-.rL¡- ^a ^ll

rhá | Er! hrañ^haa

Yes

188 f N, darify wh¡ch quel¡ons the d¡fferénce/selate to and the branch/es that this applies to.

r8b f appropriaié, provide any additlonalnformation / context to the answers in this;edlon.

O Th€ Woltsb€rg GmuP 2018 Pago 3 CBDDQ V1,2

- AilL. cfF & SAI¿STIONSPROGRATMEt9 )oes the Entity have a programme that s€ls

ninimum AML CTF and Sanctions landardsa^árd¡ññ tha {^lltuiñ^

^ñmmñehlc't9a \ppointed Ofiicer with suffic¡enl

rvñÁ;a^É/avÉd¡€aYes

t9b )ash ReDortino Yesc ts

t9d =uv Yes19e lenefic¡al OwneÉh¡D

Testino Yes19o Reüil Yest9h tolici6s and Procedures )s

t9¡ Assessmeni Yest9i anclions )s

19k t Screenino\dverse lnformdion Screenino Yes

19m s Activilv Remrl¡no Yes

19n frain¡no and Educat¡on lso ln Mon¡lorino Yes

20 tolv many full t¡rne employees are In lhe:ntity's AML, CTF & Sanciions Comdiance 50+

21 s the Enl¡tys AML, GTF & Sanctlons polrcy

rpproved d least annually by the Board orr^,,i,^lá^l eaÁi^. tra^a^añañl n^ññi{aó?

Yes

22 )oes the Board or equ¡valent Sen¡orillanagement Comm¡tle€ rece¡ve regular€porting on the ldus of the AML, CTF &:6ñá¡^ñ.

^mEññat

Yes

z3 )oes the Entity use third parties to carry oú any>omponents of ¡ts AML, CTF & Sanct¡ons No

lJa , provrde funher delatls

t4 lonlirm thal all responses provided ¡n the abovliection AML, CTF & SANCTIONS Programmerrá Oá^rá-Á^aat¡r,a {

^ll lha I Era h¡áñ^hae

Yss

ne f N, clafify which quest¡ons the dfference/selate to and the branch/es that th¡s applies io.

!4b f appropriate, provide any add¡tionelnformal¡on / contexi to the answers in thisieclion.

Wolfsb.r! Gnup Com3pondsnt Brnklng Due Dlllg3nc. QuedlonmlF (CBDDQI v1.2

@ The Woltsb€rg Goup 2018 Page 4 CEDDQ V1.2

r ^NTI

ERIFENYAGORPUPTIOiIl5 las the Ent¡ty documented policies and

lrocedures cons¡stent with applicable ABC'€gulations and requ¡rements to [reesonablylrrevent, deted and reporl bribery and:onuDtion?

Y€s

!0 )oes the Ent¡ty have an entorprise widerrogramm€ that setg min¡mum ABC standards? Yes

¿7 les tho Ent¡ty appointed a des¡gnated officer orrffic€rs with suflic¡ont oxpcrience/expertise€sponsiUe for coordinating the ABCrfogramme?

Yes

¿8 Do63 the Entity have adeguate 3tañ withappfopfiate le\rels of expefienccr'expefl¡se to¡mplemcnt the ABC programme?

Yes

t9 s the Entitys ABC programme applicable to:

tue Jo¡nt v€ntures Yes

¡9b fhird parties acting on behalf of th€ Enlity Yes

t0 )oes the Entity have a global ABC policy that:

l0a Prohiuts the giüng and rocc¡ving ol bnbes?Th¡s indud€s promising, offering, giüng,solicitetion or receiüng of anything of value,direclly or ind¡Bctly, if improperly intended toinlluence adion or obtain an advantage

Yos

t0b Indudes enhanccd requirements regard¡ngintoraclion with public officials? Yes

¡oc lndud$ a prohitit¡on againl the fals¡fication ofbooks end rocor& (this may bé with¡n the ABCpolicy or eny cÉher policy epplicable lo the LegalEnüty)?

Yes

¡l Ooo3 the Entity hav€ controls in place tomonitor the effedivencss of the¡r ABCprogramme?

Yes

,2 Does the Erf¡tys Boárd or Sen¡or ManagemerfCdrÍtbe reo¿i\é regular Managpmentlnformation on ABC matters?

Yes

t3 Does the Entity pelorm an Enterpris€ \MdeABC risk assessment? Yes

13a lf Y seled the frequency 12 Monthsl¿l Does th€ Entity have an ABC residual risk rating

that is the ne{ résult of the controlsEffecfiveness and the inherent risk

Yos

woll¡bcr! G6up Comrpondcnt B.n¡lng Ds otlhcrcc Qu!.tlonmlD (CBODQI Vl'2

@ The Wofsberg Goup 2016 Pago 5 CBDDO V1.2

5 }0€3 lho Ent Vs ABC EWRA corrar no r||l€r€ntisk componanb delailed belorv:

'5a btantial liab¡liv creatod by intsmedlarlos andth6r thir*party proüdars as aPPmPflate Yes

r5b )oruption risks r$odated with the countrl€sInd ¡rdustries in whidr lhs Enüty doos büs¡n€$,liÉ.*,

^¡ thñrnh ¡ñlañdd¡ári.s

Yes

i5c 'ransacl¡ons, producls or sefvices, ¡ndudingms€that ¡nvohre stÉte-owFd or state.controllednt¡t¡es or public ofricials

Yes

i5d ;omipt¡on ñsl(3 asgoc¡abd wm gms anoospitality, hirin9fntomsh¡ps, cttarit¿bleomlions end Dolii¡cal contibut¡ons

Yes

roo ;hanges in buslne$ acl¡vities that rnrylaterially increas€ lhe Ent¡ty3 coruPtion risk Yss

6 ,o€8 lh6 Enl¡ty'3 intgmal eudit tunciion or otherÍlopsnde¡t lhird party cowr ABC Policies and Yes

,oos the Enüty proúdo mandatory ABC lrainhg

I' loard and Senior Commitl$ Manag€mont Yes

7b st L¡nE of Dsfoncs Yeg

lc nd L¡ne of Defence Yes

7d ilú L¡ne of Defonce Y€s

7e ifd palies to wtlich specific oompl¡arioe ectiviüesubject to ABC risk haw been out3oufcod

Not Applicabl€

7Í lon-employed worter3 as apPrcPrialecontradors/consultants)

Not Appl¡cable

t )o€s ths Entity pmüdo ABC tuE¡n¡ng that ¡s

arg€tod to specific rolss, rsspon3¡bil¡lies andrc{¡ülias? Yes

I )onfim lhat all r€spons63 provided in tho sbove¡edion Anti Brib€ry & Corupt¡on a|€sprssentati\ro of all the LE s branches Yes

9¡ i N, clarify wh¡ch queEtions lhs ditrór€nc€/sBlate to and the branch/es lhat th¡s appl¡es to.

9b I app.opr¡ale, proüdo any addiüonal informaüoncontel lo thE amyvors in th¡s soclion.

Wotbb.fg Gd¡p Corrr¡pon Lú Brntlng Dl| Olllg.ñG. QD¡ironl|ln lCBDml v'1.2

O Th. Wolftb.rg Grcup 2018 Pege 6 CBDDQ V1.2

i Coucres.¿FáocEDUREs10 las tho Enüty documented policies and

)roc.dures consistent with apd¡cable AML,

ITF & Sandions regulations and requ¡r€ments^ é^-^^akL, ñrAr,á^a Aá..1

^^A .aÁñ'

l0e \ronev launderino Yes

10b feroril fnanc¡no YeslOc lanclions violal¡ons1t {re the Ent¡tys polic¡es and procedures

,^iá.d áf la-d á^ñ',álh,Yes

J2 {re the Entitys policies and procedures gapped¡dá¡ñel/mmn¡Éd ló

12a JS Siendards

J2 al lf Y, does the Entity rets¡n a record of ther¡c'

'lfc?Yes

t2b :u Standards No

t2 b1 f Y, doés the Entity retain a record of the

t3 )oes the Enlity have polic¡es and procedureshat:

t3a )rohibit the open¡ng and keeping of anonymougrnd lictitious nemed accounts Yes

t3b trohib¡t the opening and keeping of accountsor unlicens€d banks end/or NBFIs Yes

t3c )rohih,it deal¡ng with other entit¡es that prov¡de

)ank¡ng services to unlicensed banks Yes

43d )rohibit eccounts/relationships with shell banksYes

13e )rohibit deal¡ng with another entity thal provldes

rervices to shell banks Yes

13f Prohib¡t open¡ng and keeping of accounts forSec{ion 31 1 designated entities

Yes

139 Proh¡bit opéning and keep¡ng of accounts forany of unlicensed/unrcguleled remittanceagents, exchang$ houses, cssa de cámbio,bureaux de change or money tranler agents

Yes

t3h Assess the risks of relalionships wlth PEPS,

indud¡ng their family and close assoc¡ates Yes

¡3i Def¡ne eicataion processes for f¡nancial crimerisk ¡ssues Yes

$j )efine the process, where appropriate, forem¡nating existing customer reletionships dueo f¡nancial crime risk

Yes

13k Specify ho r potentially susp¡cious activllydentílied by emdoy€es ¡s to be óscalated and

nvestigatedYes

BI )utline the processes regarding screening foriandions, PEPS and negaüve med¡a Yes

13m Cutl¡ne the processes for lhe maintenance olntemal 'lvatchlils" Yes

A Has the Entily dol¡ned a r¡sk toleranceláement or s¡m¡lar document which defines arisk boundary around théir business?

Yes

r5 )oes the Ent¡ty have a record retent¡on

)rocedures that comply with appl¡cable larús? Yes

t5a f Y. what is the retention Penod? 5 Years or more

t6 ]ónfirm that all responses proüded in the¡bow Sedion POLICIES & PROCEDURES are

?pres€ntati\re of all the LE s branchesYes

15a lf N, clarify which questions the dlfference/sr€late to and thc branch/es that this applies to.

t6b lf appropride, proüde any additionaliniomation / context to the an$¡eE in ih¡s

secfion.

wolt3ber! Grcup com3pondcnt Brnklng Du. Dlllg.ncc Qrc.tlonnrlF (CBDDQ) vl.2

@ ThE Wo[3b6rg GrcuP 2018 Psge 7 CBDDQ V1,2

.. cTF &€ANCTIONS RISK¡t7 Does the Erfity's AML & CTF EVVRA crver the

inherenl risk comoonents deiailed below: Yes

17a Cl¡enl Yes

t7b Producl Yes

vc Channel Yes

17d Geography Yes

18 Do€s the Entity's AML & CTF EVVRA cover thecontrols efecliveness componenls dela¡ledbelow:

lEE Transaclion Mon¡toring Yes

lEb Cuslomer Due Diligence Yes

lüc PEP ldenlmcation Yes

18d Transadion Screnino Yesüe Name Screen¡ng aga¡nl Adv€rse Med¡a &

Negative News Yss

18f Training and Educat¡on Yes

rüg 3oveman@ Yes

18h Management I nformat¡on Yes

t9 'tas the Entitys AML & CTF EWRA Oeén:omoleled ¡n the lal 12 months? Yss

l9a lf N, provide ths date when the lal AML & CTFEWRA was comoleted.

t0 loes lhe Entilys Sandions EWRA cover lhenherent risk components detailed below:

ioe :lierf Yes

r0b ,roducl Yes

toc lhannel Yes

50d 3eography Yes

51 )oes the Entity's Sanclions EWRA cover theDnlrols eñecliveness comDonents dela¡led)elovrr:

Yes

t1 a lulomer Due D¡l¡gence Yes

tl b fransaction Screening Yes

tl c {ame Screen¡ng Yes

tl d -¡st Managemenl Yes

le [raining and Educá¡on Yes

i1 | iioveman@ Yes

tl g Vlanag€ment I nformation Yes

i2 las the Entitys Sancl¡ons E\ /RA been)omole{ed ¡n the last 12 months? Yss

iza f N, proüde the date when the last Sancl¡ons:VVRA was completed.

t3 jonÍrm thal all responses prouded ¡n theibove Seclion AML. CTF & SANCTIONS RISK\SSESSMENT are reoresentat¡ve of all the-E's branches

Yes

t3a It N, clanfy wh¡ch questions lhedifierenc€y'srelate to and the branc¡/es that thisapdies to.

t3b lf appropriate, proüde eny addit¡onalinformation / context lo lhe answers ¡n thissecl¡on.

Wolf3berg Group Comlpondont Brnklng Dm Dillgonc€ QusltlonnrlF (CBDDQI Vl.2

@The Woltsberg Gmup 2018 Page 8 CBDDO V1,2

l-t(YC. ettt-nd EbD,4 Does tho Entity \rerify the idontily of the

customer? Yes

t5 É)o the Entitys pol¡c¡és and procedures set outwh€n COD mud b6 complet€d, e.g. at the timecf onboarding or with¡n 30 day3

Yes

t6 ywrich of the following does the Entity galhera¡rd rctdn when conduciing CDD? Sdadell that apply:

t6a )wnership strudure Yes

;6b luslomer identifi cation Yes

i6c :xpeded ad¡v¡ty Yes

t6d \lature d businesJemploytnenl Yes

i6e rroducl ugage Yes

t6f )urpos6 and nalurc of relat¡onsh¡p Yes

tog 3ource of funds Yes

;6h Source dwselth Y€g

i7 \re each d lhe folloliling identiñed:

i7, Jltimate benef¡cial o¡rnershiP Yes

i7 al \re ult¡mate ben€lfcial or^,ncrs ver¡f¡ed? Yes

t7b {uthorised signatorics (where applicablo) Yes

tt c (ey contrcllers Y€s

t7d Cth6r relc\rad pan|eg

t8 /vtat is thc Entitys minimum (lowest) thresholdlpplied to beneficial owftership identification ? Other (Speciry the porcentage) 5%

t9 )oee the due diligence process result in

:ulomera receiüng a risk classificat¡on? Yes

BO f Y, what faclors/criterie aro used to doterminehe culonr€/s dsk da$ilicetion? Sélécd all thet¡ppy:

¡08 rroducl Usage Yes

i0b Seography Yes

t0c 3us¡ness Typ€/lndulry Yes

i0d -egal Enüty type Y€s

t0e AdveBe lnformat¡on Yes

¡0f Cther (sp€cify)

Wolf¡b.'g Góup Coñ|pondrd B.r*lne Du. Dlltg.nc. Qottlonn lrt (CBOml Vl.2

O the Wblftbqg GrcuP 2018 Pagc 9 CEDDO Vl.2

i1 )0e3 th€ Ent¡ty hava a risk bas€d approech to¡cfsaning culomer3 for adwn]on€die/n€gative n€{ú3?

Yeg

t2 f Y. i3 th¡s at:

tze 3nboarding Yes

i2b (YC rsnewal Yes

i2c Trigger evenl Yes

t3 What ¡s the m€thod us€d by the Entity to Ed€3nfor adwrs€ medla / n€gativ€ news?

t3. {utomat€d Yes

t3b Manual

i3c Comtination of eutomated and manual

i4 Dog3 th€ Entity ha\r€ a dsk ba!€d epptoech toscrsening culomers and conn€cl€d part¡$ tod€t€m¡ne wh€ther thsy are PEP3, or controlledby PEP8?

Yes

¡5 lf Y, ¡E th¡s et:

t5e Cnboarding Yes

t5b KYC renewal Ygs

t5c Irigger event Y€s

i6 úvhat is th6 m€thod us€d by the Entity to scrBenDFE'e?

i6a qúomatédYes

i6b \,lanud

i6c lomb¡nat¡on of automated and manual

,7 ffi rne Emr¡y ffi Po$qs, P|wuE anqproc€sses to revie$/ and é3calate polsntialmatches from screoning customeÍs andconnecied parties to d€lermine whelher th€yare PEPS, or controlled by PEPs?

Yes

¡8 )0€3 lh6 Entity have a procass to ¡ovie{v and¡odale culomer information based on:

iEe (YC renewd Yes

t8b l-rigger evenl Ye9

i9 )o€3 the Entity ma¡nta¡n and roport rfi€tñca onr¡rent and p*t periodic or trigg€r c\rent du6t¡ligenc€ reüarvs? Y€s

Woll¡b.f¡ Gmp Con$pond.na B¡rülng D|¡. Dllh.m. Qm3tlonml|| ICBDm] Vl '2

O Ih€ Wbfsbsr! Gmp 201 I Page 10 CBDDO V1.2

¡0 From the lil b€low, which cáegories ofcuslomer3 or induetries are subjecf to EDD and/or are relricted, or prohibited by ihé EntitysFCC programme?

f0a {on-ac@unt customers Proh¡bited

r0b )fishore customors Prohibited

loc ih6ll benks Prohibited

70d ulWS/ MSB culomers Prohibited

100 )EPs EDD on a risk bas€d approach

70t )EP Rdated EDD on a risk based approach

tsg )EP Closc Associate EDD on a risk based approach

70h lor$pondcnt Banks Prohibited

70 hr I EDD or EDD & Relrided, does the hlJL)

rssossmcnt oontain the el€merfs as scd out in

he Wolfsborg Conespond€nt Banking)rincioles 2014?

Yes

f0 l {rms, de{cn3€, military Prohibited

¡0'| {tomic poiler Prohibited

/0k :xtrad¡vs indulries Prohib¡t€d

/0 1 Prec¡ous metals and stoneg EDD on a risk based approach

rom Unf39ulated charitios Prohibited

|¡0n Rogulated charitiss EDD on a r¡sk based epproach

/oo Rod light business / Adutt enterta¡nmenl Prohibited

70p {on-Govemment Organi3ations EDD on a risk based aPProach

'0q /¡riual curenc¡eg Prohibited,gr Vleri¡uana Proh¡bited

r0s :mbassiedconsulales EDD on a risk based approach

f0t 3ambling EDD & Restricted on a risk based approach

/0u )ayment Scrvice Provider EDD & Restrictod on a risk basod approach

rov 3{her (sp€dfy)

l1 f restrided, proüdc deta¡ls of theestridion

t2 )oos th€ Enüty pcrform an add¡t¡onal cont¡ol or

tuality reücw on clients subjed to EDD? Yes

t3 ]onfirm that dl responses providad ¡n thc¡bove S€dion KYC, CDD and EDD are

€presentative of all the LE s branchesYes

13¡ lf N, clerify which questions the difi€rencé/srelat€ to and the branch/es that this apdies to

/3b lf eppropriate, proüde any addlt¡onalinfomation / coflt€xt to ths ans\ ters in thiss€dion.

Wo¡frbGrg Greup Co''t.poilLrt A.nklng D|¡. Dugrm. Qmdmmlo (CBDOQI Vl.2

O Tho Wotflbdg CrwP 2018 Pag6 1 1CBDDO V1.2

r- rro¡rllToRltrl6 A. REPORTIIlGl4 )o€s the Entity have risk besed polic¡es,

)rocedures and monitoring prooesses for lhedentification and reporting of suspic¡ousrct¡v¡tr?

Yes

75 /vhal is the method used by lhe Ent¡ty tononitor transaclions for suspic¡ous acl¡vities?

,54 \utomated Yesf5b Vlanual

,5c lombinat¡on of automated and m€¡nual

76 f manual or combind¡on selected, spec¡fy whalype ol transacl¡ons are monilored manually

t7 )oes the Enlity have regulatory requ¡remenls to'eport currency transacl¡ons? Yss

77a f Y, does the Entity have polic¡es, procedures

¡ndprocesses to comply with currencyeporting requiremenls?

Yes

l8 )oes the Entity have pol¡c¡es, procedur€s and)rocesses to review and escalate matters¡rising from the monitoring of culomerransaclions and acliüty?

Yes

79 Conf¡rm that all responses prov¡ded in lheabow Seciion MONITORING & REPORTINGare reoresenlalive of all the LE's branches Yes

79a lf N, clarify wh¡ch questions the differenc€/srelate to and the branch/es that this applies to

/9b f appropriate, provide any add¡t¡onalnformallon / conlexl to the answers in thisred¡on.

,. PAYTEUT TRA,i{SPAREIICY¡0 )oes lhe Entily adhere to the Wolfsberg Group

tayment Transparency Standards? Yes

H )oes lhe Ent¡ly have pol¡c¡$, procedures andrrocesses lo lreasonably] comply with and havc>ontrols in place lo ensure compliance w¡th:

tle :ATF Recomrnendalion 16 Yes

t1 b -ocal Regulations Yes

tl bl Specffy the regulalion Exl€rnal Notic€ 029 ol 2014 SARLAFTExternal Notice 055 of2015 SARLAFTColombian Penal CodeOrganic Statuts of the Financial System (Articles 102-'t?7l

tl c f N, expla¡n

l2 Does the Ent¡ty haw procosses in plaoe lor6pond to Requol For lnfomation (RFls) fromother entities ¡n a timely manner? Yes

l3 )oes the Ent¡ty havs conlrols to support thenclusion of fequ¡red end accurete originalor

Yes

Wolflberg Grcup Comrpondant Brn¡lng Dm Dlllgsncs QuútlonmlF (CBDDQ) V1.2

@The Wofsbeo Grup 2018 PegE 12 CBDDO V1,2

t4 )oes the Entity have controls to support thendusion of required beneficiary in intemational)ayfnent me$ag6s? Yes

t5 lonfirm that all responses proüded ¡n the¡bovesedion PAYMENT TMNSPARENCYare reoresentative of all the LE s branches Yes

¡5a lf N, clarify which questions the difierence/srelato to and the branch/es thet th¡s appl¡es to.

t5b lf appropriate, proüde any additional¡rformation / context to the ans\¡vers in th¡s

sectaon.

lO- SAfrlCTlOf,St6 )oes the Entity have a Sandions Policy

¡pproved by management fggard¡ng

)ompliancs with sandions law apdic¿ble to the:ntity, induding with respocl its bus¡ness

)onducted with, or through accounts held atoreign financial inlitutions?

Yes

B7 Does the Entity have pol¡c¡es, procedures, orother controls reasonably dos¡gned to prevent

the use of another ontity's accounts or services

in a mannor caus¡ng the othcr enüty to üolatesanclions prohib¡üons applicable to the otherentity (induding prohititions within the otherentitYs locsl jurisdiciion)?

Yes

t8 Do€s the Entity have policies, procedures oro(her @ntrols reesonably designed to proh¡bt

and/or detec't aclions taken to ovade applicablesanct¡ons prohibitions, such as stripping, ortheresubmiss¡on and/or mask¡ng, of sancl¡onsrelevant irformation in cross bordertransacfions?

Yes

19 Does the Entity scre€n its customers, includ¡ng

bencfic¡al ornership information collected by

the Entity, during onboarding and regularlythereafter against Sanct¡ons Lists?

Yes

)0 /vhat is the me{hod used by lhe Entity?

l0a vlanual

t0b \ulomated Yes

l0c ináion df Automated and Manual

l1 )o€s the Entity scre€n all sandione relevant

lata, ¡nduding at a m¡nimum, entity sndocation informat¡on, contained in cross borderrransaclions against Sencl¡ons Lists?

Yes

,2 /vhat is the me{hod used bv the Ent¡iy?

tZe Uanuált2b {utomated Yes

l2c Oombina¡on Automated and Manual

,3 S6led the Sanctions L¡sts used by theEntity in its sand¡ons screen¡ng prmsses:

,3a lonsolidated Un¡ted Nations Security councilSandions L¡st (UN) used for scfe€ning custom€rs and beneficial owners and for l¡ltering transactional data

3b Jh¡tc¿ States Department of the Tréasurysl,lf¡ce of Foroign Assets Control (OFAC) used fof scf€€ning customefs and beneficial owners and fof flt€ring transactional data

,3c fffice of Financ¡al Sand¡ons lmplementatlon-rMT (OFSD used fof screening customers and boneficial owners and for filtefing transactional data

)3d :uropean Union Consolidded L¡st (EU) used for scre€ning customers and b€nef¡cial owners and for filtering transactional data

13e -ils ma¡nta¡ned by other G7 member countr¡es

Wolfsb.rg Greup Com.pondsnt B¡nklng Du. D¡llgrnc. Qu.stlonnalru (cBoDQl vl.2

@The Wofsb€rg GrcuP 20'18 Pag6 13CBDDQ V1,2

wolfsbsrg Grcup Comspondsnt B.nklng Du. DltlCsnce Quolilonmlfr ICBDDQ) V1.2

)3f )ther (specify) lntemal list

,4 vvhen new enlities and natural oersons areadded to sandions lils, hol¡/ many bus¡nessdays before the Entity updates its lists?

Same day to 2 days

¡5 when updates or add¡tions to the sanctionsL¡s1s are made, how many busin€$ daysbefor€ the Enüty updá$ the¡r ad¡ve manualand / or automal€d screen¡ng system againl:

,54 3ulomer Data Sam6 day

)5b Transaclions Same day

,6 Does the Entity have a phys¡cal pres€nce, e.9.,branch$, subsidiaries, or representative off¡oeslocded ¡n countries/regions aoainst which UN,OFAC, OFSI, EU and G7 member counlries

No

Sanc{ions?l7 Confirm that all responsss provided in lhe

abo/e Seclion SANCTIONS ere repres€ntativeof all lhe LE s branchsE

Yes

,7. lf N, clanfy whÉh quesltons the drference/srelate to and the branclves that this apd¡es to.

,7b lf appropriale, provide any add¡t¡onalinformat¡on / contel to the answers in thisseclion.

t,t," Tl EDI¡CATION ,.

)8 )oes lhe Entity proúde manclatory train¡ng,ilhich ¡ndudes :

taa dent¡f¡cation and reporting of lransácl¡ons lo¡ovemment aulhorit¡es Yes

)8b :xamples of different forms of moneyaundering, terrorist financ¡ng and sancl¡ons¡olal¡ons relevant for the typ€s ol producls end¡ervices offefed

Yes

tuc nlernal pol¡c¡es for conirolling moneyaundering, tenoril t¡nanc¡ng and sand¡ons/iolat¡ons

Yes

¡8d \¡eu, ¡ssues thel occur ¡n the markel, e.9.,r¡gnif¡canl regulalory ac'tions or new regulalions Yes

,üe londuci and Culture Yes

¡9 s the above mandatory tra¡n¡ng provided to : Yes

t9a Soard and Senior Comm¡ttee Management Yes

t9b st Line of Defence Yes

t9c lnd L¡ne of Delence Yes

¡9d lrd Lrne of Detence Y€s

,9e tfo pames ro wntcn spec|Íc FUU ac¡tvtues nav€¡een outsourced Nol Applicable

)9f Nof}employed workers(conlraclors/consultanls) Not App¡icable

t00 Does the Entity proüde AML, CTF & Senct¡onstra¡ning thal is targeled to specif¡c roles,respons¡bil¡ties and high risk products, servicesand ac'tivil¡es?

Yes

O Th€ Woltsber! Goup 2018 Pags 14 CBDDO V1.2

t01 )oes thc Entity proüdc custornisad trdning forqML. CTF and Sandiq|r staff? Yes

t02 lonfirm thei ell rÉponre! proüded ¡n thc¡bo¡cScdion TRAINING & EDUCATION arcrprr3cntstirre ol dl thc LE r branchca

Yes

tg2 e I N, darify wh¡ch qu€3tiom tho ditferencds'clato to and thc branchlcs thet th¡s eppl¡et to.

t02 b f approprietc, proüde any addit¡onalnbmet¡on / contcxt to thc anlyvof3 in this¡cdion.

v2.t03 \fctha EnütyE t(Yc proc.|lct end docum.nB

rub¡cd to qudity a¡luranc. trtting? Yes

ilx )oc| thc Ent'ty haw e program wid€ rFk baEod

lorndiancc Testing procese (lop€rato to thendepcndcnt Audit funcfion)? Yes

105 :onfm that all rclponso3 proüded ¡n th€ abovt

lcd¡on QUALITY ASSURANCE /:OMPLIANCE TESTING are ¡cpresentative d¡ll ths LE s branchrg

Yos

105 ¡ f N, derify wtrich qucations thc dificrcncr/sddc to lnd the brench/es thd th¡3 epplica to.

[r5 b f approprietc, provido any eddit¡ondnformaüon / contoxt to the anü,Yers in th¡8

¡cdion.

: 111L":;-',.':--{t06 tn addiüon to in3pcd¡ons by tho gowmmcnt

supcwiron/regulCon, doc! tho Enüty h¡\r€ anintcmal audit fundion, a t.sting funclion orothor indcp.nd€rit third party, or bolh, thdeEscasca FCC AML. CTF and Sanctionspolicig3 end practicas on a r€gulsr be3¡3?

Yes

r07 Hon, oft n ir thc Enfrty auditsd on its AML CTF& Senction! programmc by thr following:

107 ¡ nt6md Audit O€pertmonl Y€arly

t07 b ixtemd Third Paily Comoorcnt basod r6viows

Wo|frb.rg Oroug Goñ..9ofilona B¡|*¡tg h¡. DlllgrrE C¡||rtbnr¡F. ICADDQI Vf .2

O thc Wbltlb€O GrcuP 2016 P.Cc 15 cBoDo v1.2

Uroff¡b.r! Goup Corn¡pondsnt Slnklng Duo Dlllgem. Qucüonilltr ICBDm) Vl.2

t08 )oe3 the intornal audit function or dherridopend€nl th¡rd party co\rer the follo¡Ying¡reag:

toü a \ML, CTF & SanctioN Pol¡cy and pn oeduresYos

t08 b fiC / CDD / EDD and underly¡ngn€thodolog¡es Yes

loE c franselion Moniloring Yes

t08 d franEadion Screen¡ng ¡nduding lor send¡onsYes

loE 3 Name Screening & List Management Y€s

toE f fraining & Educat¡on Yes

r0ü g Technology Yes

toE h sov€mance Yes

t08 | teport¡ng/Metrics & Managemed InformelionYes

r08 i ;uspic¡ous Ad¡vity Filing Yes

to8 k :nterDris€ \Mde R¡sk Ass€ssmenlYes

t08 | )th€r (sp€dfy)

r09 \re edverse findings from ¡nlsrnal & extemal¡¡dit track€d to complet¡on and ass6s€d fordequacy and compleleness?

Yes

t.t0 lonfrm thet all r€pomes providod ¡n theúo\re Sedion,AuDff ar€ represontal¡w of allhe LE's branches

Yes

t10 a f N, clarify wh¡ch questioñ the differenco/seláe to and lh€ branch/es thá th¡s appli$ to.

t10 b f appropriete, provido any additionalnlomalion / context to lhe answers in thisseciion.

@ The Wofsberg G@p 2018 CBDDQ V1.2

Wolfsberg Group Correspondent Banking Due Diligence Questionnaire (CBDDQ V1.2

Declaration Statement

Wolfsberg Group Correspondent Banking Due Diligence Questionnaire 2018 (CBDDO V1.2)

Declaration Statement (To be signed by Global Head of Correspondent Banking or

equivalent position holder AND Group Money Laundering Prevention Officer, Global Head of

Anti- Money Laundering, Chief Compliance Officer, Global Head of Financial Crimes

Compliance OR equivalent)

BANco oE BoGorA (Bank name) is fully committed to the fight against financial

crime and makes every effort to remain in full compliance with all applicable financial crime

laws, regulations and standards in all of the jurisdictions in which it does business and holds

accounts.

BANco pE BocorA (Bank name) understands the critical importance of having

effective and Sustainable controls to combat financial crime in order to protect its reputation

and to meet its legal and regulatory obligations.

(Bank name) recognises the importance of transparencyBANCO DE BOGOTA

regarding parties to transactions in international payments and has adopted/is committed to

adopting these standards.

BANCO DE BOGOTA (Bank name) further certifies it complies with/is working to

comply with the Wolfsberg Correspondent Banking Principles and the Wolfsberg Trade

Finance Principles. The information provided in this Wolfsberg CBDDQ will be kept current

and will be updated no less frequently than on an annual basis.BANCO OE BOGOTA (Bank name) commits to file accurate supplemental

information on a timelY basis.

I, N/A (Global Head of Correspondent Banking or equivalent),

certify that I have read and understood this declaration, that the answers provided in this

Wolfsberg CBDDQ are complete and correct to my honest belief, and that I am authorised

to execute this declaration on behalf of

-

l, oleco r¡uRnoo (su¡s.) (MLRO or equivalent), certify that I have read and

understood this declaration, that the answers provided in this Wolfsberg CBDDQ are

complete and correct to my honest belief, and that I am authorised to execute this

deClaratiOn On behalf gf e¡Ncooesocor¡ (Bank name)

Sep 09/2019

(Signature & Date)

(Signature & Date)

@ The Wolfsberg GrouP 2018 Page t7 CBDDQ V1.2