M-2026-013: Transition of Cash Service Alliance Web Application Access to BSP VPN

BANGKO SENTRAL NG PitlPINAS All Authorized Agent Banks (AABs) Transition of the Cash Service Alliance ItsA1 Web Application Access to the BSP Virtual Private Network 01PN I In line with the Bangko Sentral rig Pillpinas' (BSP) continuing frorts to enhance operational esiliency and promote a more secure, reliable, an efficient digital workspace. this is to inform all AABs that the BSP's Information Technology Infrastructure and Op rations Department (ITIOD) is initiating the transition of the CSA access from Citri to a VPN-based platform with a scheduled cutover date on 08 May 2026. In view of the foregoing. AABs are hereby instructed to undertake necessary actions and participate in the following activities to facilitate the smooth transition of access to CSA from Citrix to VPN; For OFFICE F THE DENrv GOVERNOR I REGIONAL OPERAnoNS AND ADVOCACY SECroR Subject MEMORANDUM No. 2026-013 Reference No. ROSS-2026-03-0053 A PreparatoryActivities I. AABs shall submit to the designated local system administrators of BSP Regional Offices and Branches (ROBS). the updated and dulyaccomplished VPN Regist ation Forms in PDF format riot later than 08 May 2026. The approp iate VPN Registration Form to be accomplished shall depend on the AAB's IT infrastructure capability. Accordingly, AABs are advised to coordinate with their respective IT departments to determine the correct VPN form t be completed. Copies of t e forms are provided in the Remote VPN Form (Annex A1 and Site-to-Site VPN Form (Annex B). Alternatively, the forms may be downloaded from the following links: a. Remote VPN Form d. f b. Site-to ite VPN Form SI^^ Should there be any VPN concerns/queries and/or need for further assistance our BSP IT Support may be reached through email at 2. AABs sha I assign responsible point persons to ensure efficient coordinati n during enrollment, configuration. and testing activ'ties. . O 88.1. TBSP 0277) @ ESPmall@bsp. gov. ph @ bsp. gov. ph Classification: GENERAL ^ A. Mahinl St. Malate 1004 Manila. Philippines

CSA Con, ^9,411;, bn and tosting I. The IT departments of AAB Head Offices shall coordinate with their respective ranch offices on the configuration and activation of their VPN connectivit to ensure access to the CSA sites: a. Primary Site 2. AABs' authorized CSA users shall actively participate in the testing activities that will be conducted by the ITIOD team, 3. During the parallel testing phase. AABs shall access CSA through both Citrix and the CSA Web Portal via VPN. Given the use of two (2) portals, intermittent access issues may be encountered. Nonetheless the BSP assures that appropriate measures will be implemented to minimize operational disruptions. As part of the on tingency protocol, should VPN access issues arise, the AABs shall be advised by BSP ROBS' local system administrators, upon confirmation from IT100, to temporarily revert to Citrix access. Nori-compliance with the VPN on boarding requirements by the cutover date may lead to loss of system access and may disrupt operational processes dependent on the CSA ROB application. The cooperat on and timely participation of all AABs are critical to the successful implementation of this endeavor. Any changes to the above activities will be communicated accordingly Should there be further clarifications to the aforementioned activities. your designated representative/s may coordinate with the designated local system administrators of the BSP ROBS or via e-mail at b, Second ry Site For guidance and appropriate action. 31 March 2026 Aha: AIS Cmssification: GENERAL BERNADETrE -PUYAT Deputy r r Page 2 of 2

BANGKO SENTRAL NG PILIPINAS VIRTU L PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) Company/Institution Name IRegistrant) Complete Address Includezp code/ Date of Request Registrant's UsedRepresentative icest Name, First Name, M, Department!'Office/Unit ise/ect one . Accounting . Information Technology . Trade Services . Cash Operations . Remittance . Treasury Remote Access VPN . Existing VPN User . Reset VPN Password Two Factor Authentication 12FA) Details . New Device . Retire Device . . 7;^b/et . . Smart Phone . .Desktop . . Laptop Device Operating System: Clickor tap here to enter text. Terms and Conditions: I. The requested VPN access to BSP is provided for the exclusive use of Registrant to allow access in PhilPaSS Plus Participant Browser and STP The re ues~ is accom lished b the Registrant's authorized UsedRepresentative and approved and signed by the Registrant's Authorizing Officer. 2. The Registrant shall . conform to all the technical requirements of the BSP; . be responsible for any upgrades on hardware/software, configuration and troublesnooting to establish and support the VPN connectivity. as may be required: . Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users o any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP may revoke, block, or permanently disallow the use of this service without prior notice due to reasons that may compromise internal security. 4. Anyissues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP Payments and Settlements Department IPSD) through the contact details provi . New VPN User Position Title 7^b/et Sri 78rt Phone Desktop Laptop Business Email Address Business Contact No. Agreement I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings unauthorized users/computers. onto Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. . Treasury Backroom I. Trust . Reset PIN I. Delete VPN Account (Signature over Printed Namej Registrant's UsedRepresentative In t Is orm. TDIO Form No. 04-006 ' Version O ' U dated 27 Sep 2021 11, Authorized by Date Isignature over Printed Name) Registrant's Authorizing Officer File/Ref. No. Date ' Pagel of 3

a I -A. 444***;;;;;$!>%^:^$!^%\,'- BANGl<O SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) 111. Operational/Business Recommending Approval: . Endorsed . Denied (Signature over Printed Name) Head I Approving Officer BSP Endorsing Department/Unit IV. Recommending Approval: . Endorsed . Denied isignature over Printed Namej Authorized Officer Technology and Digital Innovation Office V. Approval: V!, Processed by: Date u ' ';" ': ' I' I:.',.-: * ' '\ ,.;

• ..J *****.:.t \ ;; .'.: .,**,,. it, , ~ Isignature over Printed Name) Authorized Approver Technology and Digital Innovation Office Isignature over Printed Name) Authorized Staff Technology and Digital Innovation Office Action/s Taken: Date **,.., * . , *v
  . 4. ' . . . t$*; Date Date TDIO Form No. 04-006 ' version O ' Up dared 27 Sep 2021 File/Ref. No ' Page 2 of 3

REMINDERS I, Filling-up the VPN Connectivity Registration Form IRemoteAccessVPN) I. Application with incomplete/Inaccurate Information leg. , name of Participant user, IP address for Remote ACce^ VPN details. applicable Application Name, etc. .) will be returned to the Participant Institution. 2. The Participant Institution must accomplish one (1) VPN Connectivity Registration Form (Remote Access VPN) per BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK 01PN) CONNECTIVITY REGISTRATION FORM (Remote AccessVPN) 11. Guidelines A Assistance may be requested from the IT Personnel (Network/Sealriq/) of the Participant Institution accomplishing this section. I. Requirements for Remote Access VPN Connectivity a. Internet AccessService IMinimum 2Mbps) b. Workstation c. VPN client Ito be provided by BSP) B. Complete the Remote Access VPN and'orTwo FactorAuthentication (2FAj details . Only one device can be registered. . For new VPN request, tick the "New VPN User"' and specify the New Device Information for 2FA. . For replacement of device for2FA request, tick the ""Existing VPN User" and fillout the New and Retile Device Information for2FA . For reset of VPN password request, tick the "ResetVPN Password" . For deletion of an existing VPN account request, tick the "Delete VPN Account' C. Dormant or idle accounts for 90days shall be deactivated D. If request for reactivation is not received, the account shall be deleted after being dormant for another thirty (30) days from date of deactivation. E. Requests for reactivetion of dormant accounts shall use the VPN Registration Form. user For further clarifications and inquiries, contact the concerned BSP Department 1/1. BSP End-UserDeparrrrient Contact Details asp End-User Department Application/System Payments and PhilPaSS Participant Browser Settlements Department PhilPaSS Third Party Sysaem ipso) PhilPaSS Plus Participant Browser and STP Foreign Loan Approval and Registration System (FLAReS) Personal Equity and Retirement Account IPERA) Monetary Operations System IMOS) Liqu dity Forecasting System ILFS Financial Markets - Domestic Market Operations Department Greater Manila Regional Office ICMROj Department of Supervisory Analytics IDSAj Department of Loans and Credit Cyber Security Group ICSG) EmailAddress Payments_unit@bspgov. ph Technology Risk and Innovation Supervision De artment TRISD Cash Services Portal ICSPy Integrated Currency Management System 11CMS) Cash Service NIIanceICSA) Financial Stability Coordinating Council- Information Sharing Loans and Credit Management Information System (LCMIS) Governance Risk and CompliancelGRCj System TDIO Form No. 04006 'Version O ' Updated Sep 2021 BSPTD-MMOS@bsp. gov. ph Contact No. 8400-7071 8400-7024 8400-7073 CSd_icms-gp@bsp. gov. ph CSa@bsp. gov. ph tsf-eis@bsp. gov. ph e, ?S@bsp. gov. ph ICmis@bspgov. ph CIOng-iko@bsp. gov. ph 8708-7020 8708-7042 8708-7038 8708-7047 8708-7024 9884-8286 8988-4853 8708-7452 in piabasan@bsp. 90v. ph macatangayds@bsp. gov. ph 306.2889 Flier Ref. No. TL: 8708-7701 Loc 2807 or 2351 87087701 IOC. 2113 87087701 IOC. 2135 ' Page 3 of 3

BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) Company/Institution Name (Reg trant) Complete Address 11nc/udez, ;>code/ Date of Request Registrant's UsedRepresentative 11.85r Name, First Name. M, Department/Office/Unit Ise/ect one/ . Accounting . Information Technology . Cash Operations . Remittance . Add IP Address A. Primary VPN Gateway Client/Host IP Address B. Secondary VPN Gateway Client/Host IP Address C. DR VPN Gateway Client/Host IP Address D. Test VPN Gateway Position Title Client/Host IP Address Terms and Conditions I. The requested VPN access o BSP is provided for the exclusive use of Registrant to allow access In PhilPaSS Plus Participant Browser and SFP The request is accomplished by the Registrant's authorized User/Representative and approved and signed by the Registrant's Authorizing Officer 2. The Registrant shall . conform to all the technical requirements of the BSP; . be responsible for any upgrades on hardware/software. configuration and troubles hooting to establish and support the VPN connectivity, as may be required; . Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP .may revoke. block, or permanently disallow the use of this service without prior notice due to reasons that may compromise Internal security. 4. Any issues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP Pa merits and Settlements Department IPSD through the contact details provided in this form. Business Email Address . Trade Services . Treasury Site-to-Site VPN . Delete IP Address Prei^?fled Date of Delet/bn. ' Business Contact No. A. Primary VPN Gateway Client!'Host IP Address B. Secondary VPN Gateway Client/Host IP Address C. DR VPN Gateway Client/Host IP Address D. Test VPN Gateway Client/Host IP address . Treasury Backroom . Trust Agreement I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings onto unauthorized users/computers. Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. (Signature over Printed Namej Registrant's UsedRepresentativ TDIO Form No. 04007 ' Version O ' U ated 27 Sep 2021 11, Authorized by Date Isignature over Printed Namej Registrant's Authorizing Officer Filer;?e, . No. Pa

,. fly, ;$44,**$7^;^^;$^^;,,^?@;,!;@y""' *;$ BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK tvPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) 111. Operational/Business Recommending Approval: . Endorsed . Denied Isignature over Printed Namel Head I Approving Officer BSP Endorsing Department/Unit IV. Recommending Approval: . Endorsed . Denied Isignature over Printed Name) Authorized Officer Technology and Digital Innovation Office Vl. Processed by: V. Approval: Date isignature over Printed Namej Authorized Approver Technology and Digital Innovation Office Isignature over Printed Name) Authorized Staff Technology and Digital Innovat;on Office Action/s Taken: Date TDIO Form No. 04007 ' Version O ' Updated 27 Sep 2021 File/Ref. NG ' Page 2 of 3

BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (/PN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) I. Filling-up the VPN Connectiv y Registration Form Isite-to-Site VPN) Application with incomplete/Inaccurate information Ie. g. , name of Participant user, IP address for Site￾to-Site VPN, applicable Application Name. etc. I will be returned to the Participant Institution. The Participant Institution may use one (1) VPN Connectivity Registration Form for all the end-users P addresses Use separate sheet for additional IP addresses as necessary. 2. 11. Guidelines A Assistance may be reque ted from the IT Personnel (Network/Security) of the Partic'pant institution accomplishing this section I. Requirements for Site-to-Site VPN Connectivity a. Internet Access Services (Minimum 2Mbps) b. Static Public IP address provided by Internet Service Provider c. Enterprise firewall or an IPSECNPN-capable router REMINDERS B. Complete the Site-to-Site VPN details I. Indicate the static Public IP address of your Primary. Secondary and DR VPN Gateway. 2. Specify the static Public IP address assig ned to your institution or assig n one (1) Private IP address for all the participants of the system. Please refer to table below. For further clarifications and inquiries, contact the concerned BSP Department 111. Ssp End-User Department Co tact Details Private IP address range BSP End-User Department Payments and Settlements Department (Psoj Financial Markets - Domestic Market Operations Department Application/System Phi Pass Participant Browser Phi ass Third Party System Phi Pass Plus Participant Browser and SrP Foreign Loan Approval and Registration System IFLAReS) Personal Equity and Retirement Account IPERA) Monetary Operations System IMOS) Liquidity Forecasting System ILFS) 10,000 -10,2552S5.254 172,601 -1723/255.254 192.168.0.1 -, 92,168,255254 Greater Manila Regional Office IC M RO) Department of Supervisory Anal^ics IDSA) Cyber Security Group ICSG) Technology Risk and Innovation Supervision Department ITR!SD) EmailAddress Payments_unit@bsp. gov. ph Cash Services Portal ICSP)/ Integrated Currency Management System ticMSj Cash Service Alliance ICSA) Financial Stability Coordinating Council-Information Sharing TDIO Form No. 04-007 'Version O ' Updated 275ep 2021 Governance Risk and Compliance (CRC) System BSPTD-M MOS@bsp. gov. ph Contact No. 8400-7071 8400-7024 8400-7073 CSd_icm5-gp@bsp. gay. ph CSa@bsp. gov. ph tsf-eis@bsp. gov. ph CIOng-Iko@bsp. gov. ph in PIabasan@bsp. gov. ph macatangayds@bsp. gov. ph 8708-7020 8708-7042 8708-7038 8'708-7047 8708.7024 9884-8286 8988-4853 8'708-7452 File!'Ref. No 306,2889 8708770110c. 2113 87087701 IOC. 2135 ' Page 3 or s