EL SALVADOR Law and Practice Contributed by: Héctor Torres, Annette Herrera, Daniel Leiva and Raquel Santos, Torres Legal
These frameworks establish comprehensive obliga- tions for controllers, processors and regulated enti- ties, including breach notification and reporting duties, risk management systems and customer due diligence policies aligned with FATF standards. The newly cre- ated ACE supervises information security compliance, while the Financial Investigation Unit oversees AML reporting. As a result, legal due diligence now routinely includes verification of data governance, cross-border trans- fer and cyber risk management frameworks, as well as review of AML/KYC policies, beneficial ownership registers and suspicious activity reporting procedures. Transactions involving technology companies, fin- techs and digital asset service providers are subject to more rigorous scrutiny to ensure that target entities comply with these regulatory standards. This has ele- vated the importance of compliance audits, privacy by design and AML programme testing as integral parts of the diligence process. 9.2 Technology Company Due Diligence Public and private companies must now provide potential bidders with financial, operational and com- pliance information, including evidence of conformity with data protection, cybersecurity and AML require- ments. Boards may allow access to IT system docu- mentation, internal policies and compliance manuals, subject to confidentiality agreements that protect sen- sitive information. Because disclosure obligations are equal for all bid- ders, data room management has become increas- ingly formalised, and companies are advised to anonymise or pseudonymise datasets before sharing them. Failure to comply with the applicable frame- works can lead to administrative fines, AML sanctions or reputational risk, all of which materially affect trans- El Salvador’s new data protection regime introduces a modernised structure aligned with international stand- ards. It distinguishes between minor, serious and very serious infringements, with sanctions that may include monetary penalties and temporary suspension of data processing. The law also regulates international data action valuations. 9.3 Data Privacy
transfers, requiring either adequacy recognition or specific contractual safeguards approved by the ACE. These developments mark a turning point in the local M&A environment: privacy and cybersecurity compli- ance have become core components of transactional risk assessment, bringing El Salvador closer to the regulatory frameworks applied in the EU and other advanced jurisdictions.
10. Disclosure 10.1 Making a Bid Public
As of now, the only acquisition in El Salvador made through the stock exchange involved pension fund administrators (PFAs) and a bank. Shares were traded on the stock market, and this case is quite unusual because it involves regulated companies. Specifically, the regulations require that any investor intending to hold more shares of these companies, which are sub- ject to specific controls due to their industry, must seek authorisation from the Superintendency of the Financial System for approval of the purchase at the conglomerate level. Additionally, when a natural or legal person will not own more than 50% plus one of the shares, but will own more than 10%, they must also request authori- sation. However, this does not apply to technology companies but could be applicable in the future for a bank that operates solely as a digital platform, which, due to their nature, fall under special regulations. 10.2 Prospectus Requirements Under the regulations in El Salvador, a prospectus is not required for the issuance of shares in a stock-for- stock takeover offer or business combination. Addi- tionally, there is no requirement for the buyer’s shares to be listed on a specific exchange in the home market or any other identified markets. 10.3 Producing Financial Statements In all transactions and markets, bidders are usually required to produce financial statements, pro forma or otherwise, in their disclosure documents for both cash and stock-for-stock transactions. In El Salvador, these financial statements must be prepared in accordance
114 CHAMBERS.COM
Powered by FlippingBook