External Regulatory Circular DSP-465 of March 31, 2026, Subject 18: Interoperability of Immediate Low-Value Payment Systems

Board of Directors Bulletin of the Bank of the Republic Number: 10 Date: March 31, 2026 Pages: 101 Content • External Regulatory Circular DSP-465 of March 31, 2026, Subject 18: Interoperability of Immediate Low-Value Payment Systems. This bulletin is published in development of what is provided in letter a) of Article 51 of Law 31 of 1992 and the paragraph of Article 108 of Law 510 of 1999. Board of Directors Secretariat – Carrera 7 14 78, sixth floor – Bogotá, D. C. – Phones: +57 (601) 343-1111 and +57 (601) 343-1000

Document No: OT/PF/MAR/2026/128045 Page 18 - 00 Recipients: Entities Administering Low-Value Payment Systems that process services for payment orders and/or immediate fund transfers, Superintendency of Finance of Colombia, and Superintendency of the Solidarity Economy. Subject 18: Interoperability of Immediate Low-Value Payment Systems. The External Regulatory Circular DSP-465 of May 15 and September 3, 2025, and of March 6, 2026, corresponding to Subject 18: INTEROPERABILITY OF IMMEDIATE LOW-VALUE PAYMENT SYSTEMS, is entirely replaced. The changes are made, primarily, with the aim of establishing: • The faculty of Participants linked to more than one Immediate Low-Value Payment System (SPBVI), who use in said systems the same classification of Payment Orders and/or Immediate Fund Transfers, to register in the Federated Directories of each of said SPBVIs all or some of the Keys of the shared classification. • The new deadline to comply with what is provided in numeral 2.2.3. of Annex 5. • The new deadlines for transitional measures 1.2., 2.1. and 3.2. of Annex 7. This Circular enters into force from its publication. Sincerely, MARCELA OCAMPO Executive Manager DIONISIO VALDIVIESO BURBANO Deputy Manager of Payment Systems and Banking Operation

EXTERNAL REGULATORY CIRCULAR DSP-465 DEPARTMENT MANUAL OF PAYMENT SYSTEMS Date: Tuesday, March 31, 2026

Document No: OT/PF/MAR/2026/128045 Page 18-1 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. This Circular regulates External Resolution No. 6 of October 31, 2023 issued by the Board of Directors of the Bank of the Republic (JDBR) on the interoperability of low-value payment systems that provide services related to Payment Orders and/or Immediate Fund Transfers. The Circular will be mandatory for the Entities Administering Immediate Low-Value Payment Systems (EASPBVI) that process Intra-SPBVI and Inter-SPBVI Operations. The terms that appear in uppercase in this Circular, regardless of whether they are expressed in singular or plural, have the meaning attributed to them in External Resolution No. 6 of 2023 and in this Circular.

1. Definitions a. Acquirer: Are the agents defined in numeral 2 of article 2.17.1.1.1. of the Single Regulatory Decree 2555 of 2010, or the norms that replace, modify, or regulate it. b. Timestamp: Date and time information that EASPBVI and Participants must include in the messages required to advance, among others, the processes of Key Management and Resolution, and the Compensation and Settlement of Payment Orders and/or Immediate Fund Transfers. c. Payment Service Provider: Are the agents defined in numeral 20 of article 2.17.1.1.1. of the Single Regulatory Decree 2555 of 2010, or the norms that replace or modify it. d. Time-Out: Maximum time to complete or decline the process.
2. Interoperability in Immediate Low-Value Payment Systems EASPBVI must comply with the technical and operational processes indicated in this Circular to process Payment Orders and/or Immediate Fund Transfers. In the regulations of Immediate Low-Value Payment Systems (SPBVI), EASPBVI must require Participants to comply with these provisions, for which they may develop one or more of their functions through Payment Service Providers under the same terms established in the Single Regulatory Decree 2555 of 2010 or the norms that replace or modify it.

Document No: OT/PF/MAR/2026/128045 Page 18-2 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. 3. Characteristics of Payment Orders and/or Immediate Fund Transfers 3.1 Characteristics Payment Orders and/or Immediate Fund Transfers will be immediate when the following characteristics are met: a. Only one Payment Medium is used to debit and one or more Payment Mediums to credit the funds. b. It is initiated by entering a Key or reading/using a QR Code. c. It is initiated by the Originator on any day and hour. d. It is processed within a maximum period of twenty (20) seconds. The parameters for compliance with this provision are detailed in Annex 5 of this Circular. 3.2 Maximum Value of the Payment Order and/or Immediate Fund Transfer The maximum value of each Payment Order and/or Immediate Fund Transfer will be equivalent in current legal currency to one thousand (1,000) Basic Value Units – UVB. Participants may define a maximum value lower than the one stated above or other types of limits, for example, number of operations per day, as long as these attend to their risk management policies. Participants may also allow the configuration of limits by Clients, for example, by value or number of operations. 3.3 Classification of Payment Orders and/or Immediate Fund Transfers In accordance with Article 8 of External Resolution No. 6 of 2023 of the BR, for interoperability purposes, Payment Orders and/or Immediate Fund Transfers are classified as follows: a. Payment to Commerce: Payment Order and/or Immediate Fund Transfer in which the Originator is a natural person and the Beneficiary is a natural or legal person who holds the status of merchant.

Document No: OT/PF/MAR/2026/128045 Page 18-3 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. b. Payment between Persons: Payment Order and/or Immediate Fund Transfer in which the Originator and the Beneficiary are natural persons. For the incorporation of other classifications of Payment Orders and/or Immediate Fund Transfers, the Bank of the Republic may take into account the recommendations of the Committee for Interoperability of Immediate Payments. 3.4 Standards and parameters of Access Technologies that allow initiating Payment Orders and/or Immediate Fund Transfers The Access Technologies that allow initiating Payment Orders and/or Immediate Fund Transfers for the classification provided in numeral 3.3 of this Circular are Keys and QR Codes. For the use of Access Technologies by Clients, Participants may integrate additional technologies compatible with the rules and standards applicable to Access Technologies and to the processing of Payment Orders and/or Immediate Fund Transfers provided in this Circular. 3.4.1 Rules associated with Keys EASPBVI will require their Participants that the handling of Keys be subject to the following rules: a. A Payment Medium may be associated with several Keys. b. A Key will be associated with a unique Payment Medium. c. A Key associated with a Payment Medium cannot be repeated in a Federated Directory. d. A Key cannot be repeated in the Centralized Directory. e. The Participant must define for each Key the SPBVI through which it will perform synchronization for Key management processes with the Centralized Directory. The SPBVIs must define the operational or technological mechanism for Participants to indicate the selected Federated Directory to synchronize information with the Centralized Directory. f. Participants linked to more than one SPBVI that use in said systems the same classification of Payment Orders and/or Immediate Fund Transfers as provided in numeral 3.3 of this Circular, may register in the Federated Directories of each of said SPBVIs all or some of the Keys of the shared classification. Participants who decide to register the same Key in the Federated Directories of each of said SPBVIs must guarantee that the update of information derived from Key management processes is performed first in the Federated Directory of the SPBVI chosen to synchronize with the Centralized Directory. Once the Participant receives a positive response from said Federated Directory, it must immediately update the information in the Federated Directories of the other applicable SPBVIs. g. Clients cannot edit or customize the content of the Key. h. When a Client updates any of their data and said data is being used as a Key, the Participant must require them to perform the Key modification process. The EASPBVI must ensure compliance with these rules.

Document No: OT/PF/MAR/2026/128045 Page 18-4 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. 3.4.2 Description of Key Types and Their Standards The following types of Keys may be used to initiate Payment Orders and/or Immediate Fund Transfers: a. Identity document number: Refers to any of the following identification numbers of the Client registered in the linking process with the Participant where the Client has their Payment Medium: citizen ID card, foreigner ID card, Unique Personal Identification Number (NUIP), identity card, Tax Identification Number (NIT), or passport. b. National mobile number: Refers to the national mobile number(s) of the Client registered with the Participant where they have their Payment Medium. c. Email: Refers to the email(s) of the Client registered with the Participant where they have their Payment Medium. d. Alphanumeric: Refers to the Key(s) generated by the Participant where the Client has their Payment Medium, which starts with the @ symbol, followed by a combination of numbers and/or letters. For the generation of this/these Key(s), the Participant will use characteristic information of the Client, so that it/them is/are easy to remember. Examples of alphanumeric Keys are the following: @3191234567, @AP1234567 and @MargaritaP e. Merchant establishment code: Refers to the identification code(s) assigned by the Acquirer(s) to the merchant establishment. Merchant establishments may have multiple codes assigned by one or several Acquirers. The assignment of the Merchant Establishment Code by the Acquirer must follow the structure for this type of Key provided in Table 1 of this Circular.

Document No: OT/PF/MAR/2026/128045 Page 18-5 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. SPBVIs must define procedures for changing Acquirers, preserving or not the Key. In the case of changing Acquirer while preserving the Key, the Key cancellation and registration process must be performed according to what is provided in Annex 1 of this Circular. These procedures cannot last more than twenty-four (24) hours. Keys that incorporate letters will not distinguish between uppercase and lowercase. For the case of Payment between Persons, the options for Key types offered to the Client will be: identity document, mobile number, email, and alphanumeric. For the case of Payments to Merchants, the options for Key types offered to the merchant will be: identity document, mobile number, email, alphanumeric, and establishment code. The Participant may limit the number of Keys that can be associated with a Payment Medium or a Client attending, among other criteria, security. EASPBVI may only incorporate in their Federated Directories information about Keys taking into account the following structure:

Document No: OT/PF/MAR/2026/128045 Page 18-6 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. Table 1. Structure of Keys to Initiate Payment Orders and/or Immediate Fund Transfers Key Type Number and type of characters Observations Identity Document XXXXXXXXXX Identity document number Maximum 18 alphanumeric characters Citizen ID card, foreigner ID card, identity card, NUIP, NIT, or Passport used for opening the Payment Medium. Cannot include hyphens, spaces, or dots. National Mobile Number XXXXXXXXXX National mobile number 10 numeric characters Does not include country code and always starts with the number 3. Cannot include spaces. Email xxxxxxxxxxxxxxxx@xxxx.xxx.xx xxxxxxxxxxxxxxxx@xxxx.xxx Up to maximum 30 characters before the @ symbol and 61 characters after. Has an @ symbol just before the domain. Alphanumeric @xxxxxxxxxxxxxxxxxxx Minimum 5 and maximum 20 alphanumeric characters after the @ symbol Starts with the @ symbol, followed by a combination of letters and/or numbers. The @ symbol is only used at the beginning of the Key. The alphanumeric Key is generated by the Participant where the Client has their Payment Medium. Cannot include spaces, accents, or the character ñ. Code assigned to the merchant establishment XXXXXXXXXXXXXX 10 numeric characters Identification code of the merchant establishment assigned by the Acquirer. Starts with double zero (00). The following 8 digits can be numbers between 0 and 9. Cannot include spaces.

Document No: OT/PF/MAR/2026/128045 Page 18-7 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. 3.4.3 Key Management Processes EASPBVI must incorporate in their regulation the obligation of Participants to adapt the Service Provision Channels established to carry out all Key management processes described below, following the guidelines of each process established in Annex 1 of this Circular. a. Registration: Operation performed by the Client to choose the Key(s) and associate them with their Payment Medium, prior to Client authentication under the terms defined by the Participant and authorization for the treatment of their personal data. This process must be executed even when the national mobile number is used as the Payment Medium number. The registration of Keys for Payments between Persons must be performed directly and exclusively by the Client, except in the following case. Alphanumeric Key Registration: From the start of the operation of the Operational Mechanism for Settlement, Participants may assign an alphanumeric Key to the Payment Mediums of their Clients for Payments between Persons and register said Key in the Federated Directories, when any of the following cases occur: i. The Participant creates a new Payment Medium for the respective Client or activates a Payment Medium that was inactive. ii. The Participant links to an SPBVI for the first time, having not been previously linked to other SPBVIs. The assignment of the alphanumeric Key can only be performed for active Payment Mediums and the registration of said Keys in the Federated Directories and the Centralized Directory must comply with the operational guidelines defined by the Bank of the Republic. For the purposes of this provision, a Payment Medium is considered active when an operation has been performed on it during a period of six (6) consecutive months. An operation is understood as provided in numeral 1.2.2. of Chapter III, Title I, Part II of the Basic Legal Circular of the Superintendency of Finance of Colombia.

Document No: OT/PF/MAR/2026/128045 Page 18-8 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. b. Modification: Operation performed by the Client to modify their registered Key(s) by other Key(s) of the same type or another type, and/or the Payment Medium associated with them by another Payment Medium of the Participant where the Key is registered. c. Cancellation: Operation performed by the Client to cancel the registration of the registered Key(s). d. Portability: Operation performed by a Client of a Participant to transfer their Key(s) and associate them with another Payment Medium in a different Participant. e. Blocking: Operation performed by the Client to temporarily suspend the use of the Key(s). f. Reactivation: Operation performed by the Client to activate the use of a previously blocked Key. g. Inquiry: Operation performed by the Client to know the Key(s) they have registered with the Participant from which they perform the Inquiry. Payment Orders and/or Immediate Fund Transfers can be initiated within the period established by the Participant, which in no case can exceed two (2) hours from the moment the Client receives the message of successful process of registration, modification, portability, or reactivation of the Key. The information derived from the processes described above must be included and updated in the Federated Directory administered by the EASPBVI in real time and also in the Centralized Directory once it enters into operation. 3.4.4 Blocking and Cancellation of Keys by Participants EASPBVI will include in their regulations that only in the cases described below may Participants: a. Block the Keys of their Clients when: i. The use of the Payment Medium associated with the Key(s) is suspended due to fraud, impersonation, or any other applicable risk, in accordance with what is provided by the Superintendency of Finance of Colombia regarding security for the execution of operations. ii. The Payment Medium associated with the Key(s) is classified as inactive, according to applicable regulatory provisions. b. Cancel the Keys of Clients when: i. The Client's Payment Medium associated with the Key(s) is cancelled. ii. Information regarding the death of the holder of the Payment Medium is received. iii. The inactivity referred to in letter a. ii. persists for an additional six (6) consecutive months. In this case, the Participant must inform the Client and the EASPBVI. Additionally, Participants must inform the EASPBVI about the incident so that it performs the blocking or cancellation of the Key(s) in the Federated Directory. Once EASPBVI are notified of the blocking, cancellation, or reactivation of a Key, they must inform the Centralized Directory in real time so that it performs the corresponding update. This will take place once the Centralized Directory enters into operation.

Document No: OT/PF/MAR/2026/128045 Page 18-9 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. 3.4.5 Obligations of EASPBVI Regarding Keys EASPBVI must have the necessary mechanisms that allow the processing of Payment Orders and/or Immediate Fund Transfers through Keys and incorporate in their regulation the obligation of Participants to adapt the Service Provision Channels established to initiate these operations, using Keys. Regarding Key management processes, EASPBVI must require in their regulations the following obligations from Participants: a. Inform their Clients about the characteristics and uses of Keys, as well as the terms and conditions of management processes. b. Send information about Key management processes to the EASPBVI in real time. c. Comply with norms related to data protection and habeas data, in particular, Law 1581 of 2012, Decree 1074 of 2015, and other norms that modify, replace, add, or regulate it, including the authorization of their Clients that allows the treatment of personal data related to Keys. d. Follow the activities defined in Annex 1 of this Circular for Key management processes. 3.4.6 QR Codes EASPBVI will require their Participants to implement the functionality of generating, reading, and/or using static and dynamic QR Codes to initiate Payment Orders and/or Immediate Fund Transfers, as indicated in numeral 3.4.7 of this Circular. The regulation of the SPBVIs must incorporate the following conditions: a. The QR Codes used to initiate Payment Orders and/or Immediate Fund Transfers must comply with the technical standards indicated in the Basic Legal Circular issued by the Superintendency of Finance of Colombia. b. Allow the Client to choose the Key that will be incorporated in the fields of the QR Codes to associate it with their Payment Medium. 3.4.7 Obligations of EASPBVI Regarding QR Codes EASPBVI must have the necessary mechanisms that allow the processing of Payment Orders and/or Immediate Fund Transfers through QR Codes. Likewise, they must incorporate in their regulation the obligation of Participants to adapt the Channels established to initiate these operations using QR Codes, as established below:

1. Payment between Persons a. Allow the reading and/or use of static and dynamic QR Codes to initiate Payment Orders and/or Immediate Fund Transfers.

Document No: OT/PF/MAR/2026/128045 Page 18-10 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, March 31, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. b. Generate static QR Codes to receive funds from Payment Orders and/or Immediate Fund Transfers. Participants may generate dynamic QR Codes for the same purpose. c. Allow incorporating the Key selected by the Client in the QR Code. 2. Payment to Commerce a.