Guidelines on the Preparation of Recovery Plan for Banks with Simple and Non-Complex Operations

Annex A Page 1 of 11

OFFICE OF THE DEPUTY GOVERNOR I FINANCIAL SUPERVISION SECTOR MEMORANDUM NO. _________ To : ALL THRIFT/RURAL/COOPERATIVE BANKS Subject : Guidelines on the Preparation of Recovery Plan for Banks with Simple and Non-Complex Operations In its Resolution No. 1506 dated 13 October 2022, the Monetary Board approved the amendments to the guidelines governing the submission of recovery plan of banks as embodied under Circular No. 1158 dated 18 October 2022. The amended guidelines expanded the scope of application of recovery planning requirements to all banks, including thrift, rural, and cooperative banks. The first recovery plan of said banks is required to be submitted to the appropriate supervising department of the Bangko Sentral ng Pilipinas on or before 30 June 2024. A suggested format of the recovery plan for banks with simple and non-complex operations1 is provided in Annex A, which outlines the essential principles, components, and supervisory expectations for its preparation. Banks are expected to consider the suggested format as a starting point, and customize it in accordance with the institution’s size, nature of operations, and overall risk profile. It should be emphasized that while the provided format covers the minimum requirements of Circular No. 1158, banks are encouraged to elaborate on specific elements or provisions to enhance the credibility of their recovery plan as the suggested format is general in nature. Answers to frequently asked questions are also provided in Annex B to address the various queries and clarifications related to Circular No. 1158 and guide relevant stakeholders. For guidance and compliance.

CHUCHI G. FONACIER Deputy Governor 30 May 2024 1 Pertain to thrift, rural and cooperative banks which do not have the characteristics of “Complex Banks” as provided under Section 131 of the Manual of Regulations for Banks on Policy Statement and Definition of Terms.

Annex A RECOVERY PLAN (Suggested Format) This document shall be read in conjunction with Bangko Sentral ng Pilipinas (BSP) Circular No. 1158 dated 18 October 2022 on the Guidelines on Recovery Plan of Banks. I. Executive Summary This section shall present a brief overview of the recovery plan which would typically cover the following:

1. Purpose of the bank’s recovery plan;
2. Governance arrangements;
3. Summary of early warning indicators and triggers;
4. Key recovery strategies; and
5. Operational plan for the implementation of the recovery options. In the subsequent submissions of recovery plan to BSP, the executive summary should contain a description of any significant changes in the plan. II. Underlying Principles/Guidelines This section shall cover the relevant organizational structure, key principles and terminologies, and overall operational considerations to develop, review, maintain, and implement, as necessary, the recovery plan. A. Governance Arrangements This section shall contain the specific governance arrangements in the preparation, maintenance, implementation, and activation of the recovery plan. It shall clearly define the roles and responsibilities of the board of directors (board), designated officers/employees, and self-assessment functions during the different stages of recovery planning, to wit: (1) development, review and approval of the recovery plan during normal business conditions; (2) monitoring of internally-set triggers/indicators and reporting to board/management; and (3) activation of the recovery plan, execution of recovery options and communication plan during a crisis or stress situation. The governance arrangements shall also specify the following:
6. Level of authority required to activate the recovery plan and implement each type of recovery action;
7. Roles of the self-assessment functions and board-level audit committee in the independent review or assessment of the recovery plan; and
8. The responsibilities of the designated officer/s who is/are the lead owner/s of the recovery plan who should possess sufficient stature and authority (e.g., President). Duties and responsibilities of the board, President and designated officers in the recovery planning process may include the following: Board of Directors ▪ Put in place a robust governancestructure, and ensure sufficient and capable manpower to support the recovery planning process. ▪ Discuss and approvethe recovery plan including updates thereto. ▪ Approve action plans and provide direction and oversight during the recovery process.

Page 2 of 6 President ▪ Lead the recovery planning process and ensure that the recovery plan is maintained and updated as needed. ▪ Notify the Board regarding the situation and of the proposed decision whether to activate the recovery plan or not. ▪ Upon activation of the recovery plan, provide updates to the board and BSP on the current situation as well as the plans/strategies, as frequently needed. ▪ Oversee and/or lead the execution of the communication plan as laid out in Section J on Communication Strategy. ▪ Represent the bank in meetings and other external engagements, as required. Other designated officers/employees ▪ Monitor set triggers/ indicators. ▪ Report to the President any breach in triggers/indicators. Internal Auditor ▪ Conduct an independent review of the recovery plan on a periodic basis. In addition, this section explains how the recovery planning process is built into the bank’s business-as-usual risk management activities. As outlined in the BSP Circular No. 1158, the recovery plan shall complement existing capital, liquidity, and business contingency plan as well as the other crisis-management plans with a focus on recovering from extreme stress situations. Hence, the recovery plan is intended to be more comprehensive and holistic, integrating capital, liquidity, and operational aspects into a single plan. Further, this section shall discuss the maintenance of a management information system (MIS) that is adequate and capable of generating necessary information on a timely and accurate basis to enable the board and management to effectively discharge their respective responsibilities. B. Critical Functions and Services This section shall contain the information relating to critical functions and services, and MIS, which is necessary in recovery planning. Banks shall identify its critical functions and services. At a minimum, critical functions shall include deposit-taking and lending. Critical services, on the other hand, may include the following operational services:

1. Information technology covering the software applications (e.g., accounting, loan, CASA systems), data storage, and disaster recovery strategies, including description and mapping to the critical functions;
2. Regulatory reporting or the submission of required reports/documents to the BSP and other regulatory agencies such as the Securities and Exchange Commission, Bureau of Internal Revenue and Philippine Deposit Insurance Corporation;
3. Customer records/database; and
4. Outsourced services. Banks shall also provide the actions necessary to operate and maintain the critical functions and services in a recovery scenario, such as arrangements that would enable the continuous functioning of IT systems. C. Early Warning Indicators and Triggers This section shall discuss the set of triggers and early warning indicators (EWIs) in relation to the bank’s risk profile and desired risk appetite, and the procedures related to monitoring, escalation and approval process.

Page 3 of 6 In addition to capital and liquidity, banks may also include triggers relating to asset quality or profitability. Illustrative list of recovery plan triggers is shown below: Capital Indicators • Capital Adequacy Ratio (CAR) • Common Equity Tier 1 Ratio • Tier 1 Capital Ratio Liquidity Indicators • Minimum Liquidity Ratio (MLR) • Cost of Funding Asset Quality indicators • Non-Performing Loans (NPL) Ratio • Non-Performing Assets Ratio • Growth Rate of NPL • NPL Coverage Ratio Profitability Indicators • Return on Assets or Return on Equity • Net Interest Margin • Cost to Income Ratio D. Restoration Points This section shall specify and discuss the minimum level to which the selected financial indicators, which at least cover capital and liquidity, shall be restored post-recovery and the timeline for restoration for such indicators. The identified restoration points shall guide the extent and nature of recovery actions and should be set at a level that would restore the bank’s financial strength and viability. With respect to its relation to other indicators, restoration points are at a level higher than EWIs, such that, Minimum Regulatory Requirements < Triggers < EWIs < Restoration Points An illustration of triggers, EWIs and restoration points is shown below: Key Indicator Frequency of Reporting/ Monitoring Minimum Regulatory Requirement Triggers EWIs Restoration Points Timeline to Bring the Level to Restoration Point from Date of Breach of Trigger CAR Reported Monthly to the Board 10.0% 12.0% 14.0% 15.0% Within one month MLR Monitored Daily 20.0% 22.0% 24.0% 26.0% Within a week E. Recovery Options This section shall describe the recovery options that the bank can take in a timely manner during stress scenarios. The discussion should include the maximum time needed to implement such an option, the level of authorization required for each of the recovery option to be implemented, the maximum amount the recovery option could contribute to capital and/or liquidity restoration and the estimated benefits derived from such options in order to address the stress scenario. The identified recovery options should be practicable, realistic and will make material contribution to restoring the bank to its defined restoration points within a reasonable timeframe.

Page 4 of 6 Potential recovery options include:

1. Strengthening the bank’s capital position (e.g., capital infusion, suspension of dividends and bonuses, and reduction of high-risk weighted credit exposures);
2. Selling assets;
3. Merger or third-party investment; and
4. Implementing measures to secure adequate liquidity or funding while ensuring sufficient diversification of funding sources. This section should likewise include discussion on the set of actions that the bank will take, apart from the recovery options, to address the underlying causes of the stress events that triggered the activation of the recovery plan. For instance, weak credit risk management which led to the spike in NPL resulted in significant allowance for credit losses (ACL) and consequently decline in capital. Thus, recovery actions thereon are expected to go beyond restoring capital adequacy and asset quality, such that risk management system will also be strengthened. F. Stress Scenarios This section shall describe the entity-specific scenarios, system-wide stress scenarios and a combination thereof, including all relevant assumptions, identified by the bank. These scenarios take into consideration the bank’s risk profile, operations and business strategy. The discussion should also include detailed assessment of the impact of each scenario on capital and/or liquidity, as well as profitability, and asset quality, as may be applicable. Banks should identify and adopt stress scenarios that are plausible but sufficiently severe as to cause a breach in minimum regulatory requirements (e.g., capital or liquidity ratios). Banks may refer to its existing stress testing program in compliance with Section 151 of the MORB on the Guidelines on the Conduct of Stress Testing Exercises2 as a foundation for building scenarios. It may also consider the relevance of the entity-specific and system-wide events provided in BSP Circular No. 1158 in designing scenarios, which include the following: Entity-specific events System-wide events • Default of major counterparties • Severe outflow of liquidity • Major cyber-security breach • Severe operational risk event/loss (i.e., theft, robbery, or losses from prolonged failure to operate due to effects of typhoons and floods) • Damage to the bank’s reputation • Failure of significant counterparties affecting financial stability • Significant changes in the interest rate environment • High-impact events such as pandemic or climate-related events (i.e., COVID-19 pandemic, Typhoon Yolanda or 2013 Bohol earthquake) • Severe macroeconomic downturn The bank's recovery plan shall detail the corresponding recovery option/s and its aggregate impact to rebuild its capital and liquidity, among others, relative to each of the identified stress scenario. Banks with simple operations should test the adequacy of its recovery plan against at least one scenario, that is most relevant to their individual 2 As a starting point, simple banks may consider the following scenarios: a. Twenty percent (20%) and fifty percent (50%) of the total loan portfolio turning into NPL for full provision of ACL; b. Twenty percent (20%) and fifty percent (50%) deposit withdrawal; and c. Recognition of operational losses accounting for five percent (5%) and ten percent (10%) of total assets.

Page 5 of 6 circumstances, under each of the scenario types. Banks shall likewise keep adequate documentation of the stress-testing activity in its recovery plan (or include a cross-reference to a separate documentation). G. Preparatory Measures This section shall cover the nature and analysis of preparatory measures necessary to implement the recovery plan or to improve its overall effectiveness. These measures are aimed at addressing the legal and operational barriers to the effective implementation of recovery options and strategies. Further, banks should describe its escalation process upon the occurrence of a trigger event, including the mechanisms for decision making process and the roles and responsibilities of the key personnel involved. The preparatory measures shall include the timeline, resources required and personnel responsible for the implementation of these measures. The following are the examples of common preparatory measures which may be considered:

1. Documentation for capital issuance or infusions3 and availment of liquidity standby facilities;
2. Identification of potential third-party investors or merger partners as well as the procedures for merger;
3. Documentation and adoption of operational procedures for asset sale; and
4. Documentation of service level arrangements for material outsourced services and critical services. Progress in implementing these preparatory measures should be reported to the BSP pursuant to the reporting and notification requirements under Circular No. 1158. H. Testing/Simulation Exercise This section shall present the framework established by the bank in testing the feasibility and effectiveness of the recovery plan. The framework should define the (1) objectives and scope of testing; (2) procedures on the regular conduct of simulation exercises; (3) parties involved in the conduct of testing; (4) reporting of the results to the board; and (5) integration of findings in future revisions of the plan. Testing and simulation exercises consist of:
5. Annual desktop testing which is a tabletop exercise aimed to evaluate the feasibility and effectiveness of the recovery plan. It may cover a review of certain components of the recovery plan (i.e., triggers, recovery options), or walkthrough tests of processes and procedures for particular scenarios. A facilitator should be designated to guide the participants through discussion and analysis of scenarios in the recovery plan; and
6. Live simulation exercise which should be undertaken at least once every five years. It may cover full-scale live simulations to test the entirety of the recovery plan or specific elements of the plan. This exercise should be participated by the relevant members of the management, with each of them playing his/her own role in the recovery process. In certain instances, it may also be appropriate for the members of the Board to be included in the exercise (i.e., test the members/chairperson of the board’s ability to effectively communicate with relevant stakeholders). At the minimum, covered banks are expected to conduct the annual desktop testing. 3 This may include the Amendment of Articles of Incorporation if the authorized capital stock is already fully subscribed.

Page 6 of 6 The internal audit function or other independent competent units are expected to perform a regular assessment of the bank’s recovery plan and testing processes. I. Review and Updating of the Recovery Plan This section shall describe the arrangements and frequency of review, and the involvement of the board and management in the review process as laid out in the Item 2.A on Governance Arrangements. The recovery plan shall be subject to a comprehensive and regular review and update at least annually. More frequent reviews are warranted upon the occurrence of events that materially alter the bank’s structure, business model or operations, strategy, or risk exposure. J. Communication Strategy This section shall present the communication strategy to ensure that all relevant stakeholders are adequately informed of the bank’s actions under the recovery plan in a timely manner. It shall consider the communication needs of each recovery option and of different stakeholders. In developing a communication plan, banks should take into account the following:

1. Identification of key internal and external stakeholders; and
2. Engagement strategies highlighting the (i) mode of communication (i.e., electronic mails, social media, web-based information or news media statements/conferences); (ii) timelines in providing relevant information to each category of stakeholder; and (iii) lead communicators within the bank or the personnel responsible for communication. The communication strategy shall also indicate the reporting and notification requirements of the BSP as provided in Circular No. 1158. Shown below is an illustration of a communication plan for capital infusion as a recovery option. Recovery option Capital infusion Key stakeholders BSP, and bank stockholders Mode of communication and content BSP – Official letter informing the (1) bank’s decision to activate the recovery plan; (2) cause of breach of recovery plan threshold and triggers; and (3) actions taken/to be taken, including the implementation of recovery options. Stockholders – Official letters or electronic mails disclosing, among others, the rationale for implementing the recovery option; current financial condition and the expected impact of the recovery measure; and other consequences. Timeline BSP - Within 24 hours from the date of decision to activate the recovery plan. Stockholders – Within 48 hours from the date of decision to activate the recovery plan. Lead communicators/ personnel responsible BSP – President and Compliance Officer Stockholders – President and Chairperson of the board

Annex B FREQUENTLY ASKED QUESTIONS ON THE GUIDELINES ON RECOVERY PLAN OF BANKS UNDER CIRCULAR NO. 1158 DATED 18 OCTOBER 2022 To address the various queries and clarifications related to the Circular, the Bangko Sentral ng Pilipinas (BSP) is issuing the following frequently asked questions to guide relevant stakeholders: Relationship of Recovery Plan with Other Existing Plans

1. How does a recovery plan differ from the capital plan, capital restoration plan, contingency funding plan (CFP), business continuity plan (BCP), and pandemic plan? As a comprehensive document, the recovery plan is expected to complement the existing capital, liquidity, BCP, and pandemic plan, but with an end view of a bank recovering from extreme stress situations. The recovery plan is intended to be more comprehensive and holistic, which should integrate capital, liquidity, and other operational elements into one plan to be applied on a whole-of-bank basis. The recovery plan is also designed to avoid cases of a bank becoming non-viable. It should enable banks to be ready for periods of financial stress so that they can stabilize their financial position and recover from financial losses. Moreover, the recovery plan should identify options to restore financial strength and viability when a bank comes under severe stress. It should include credible recovery options, that address capital shortfalls and liquidity pressures, and processes to ensure timely implementation of recovery options in a range of stress situations. A recovery plan should sit alongside, but is distinct and separate from the capital, liquidity, operational and other plans/documents. Shown below are the comparison of recovery plan with other plans/documents (Table 1), and description of each document. Table 1: Comparison of Recovery Plan with Other Plans/Documents Document Business￾As-Usual Stress Prompt Corrective Action Financial (capital and liquidity) Operational Recovery Plan x Capital Restoration Plan x x CFP x BCP x x Pandemic Plan x x Description of Capital, Liquidity, Operational and Other Plans/Documents a. Capital Restoration Plan - contains the schedule for building up a bank’s capital base (primarily through an increase in Tier 1 capital) to a level commensurate to the underlying risk exposure and in full compliance with the minimum capital adequacy requirement in conjunction with the Prompt Corrective Action Framework. b. Contingency Funding Plan - describes the approach and strategies for dealing with various types of liquidity crises. c. Business Continuity Plan - details the orderly and expeditious process of recovery, resumption, and restoration of business functions in the event of disruptions.

Page 2 of 4 d. Pandemic Plan - refers to planning relevant in determining a pandemic’s scope and duration in ensuring resilience and continuity of a bank’s operations which is also Integrated in the BCP and follow the same business continuity management process. Recovery Options 2. Are the recovery options need to be sequenced or identified according to priority? Banks shall include in their recovery plan a comprehensive set of recovery options that are credible, practicable and appropriately sequenced. Recovery options under defined stress scenarios should be identified to assess the overall recovery capacity of banks. For instance, in a system-wide stress or combined scenario, it may be more challenging to issue capital, sell assets and/or access liquidity; hence, it is important to identify a set of recovery options and their order of prioritization. Meanwhile, additional recovery options without referring to a specific stress scenario or measures that will apply to all scenarios may also be provided as these would enhance the bank’s general crisis-preparedness and ability to respond flexibly during a crisis. 3. Is sale or disposal of real and other properties acquired (ROPA) and non￾performing assets (NPA) allowed as part of the recovery measures? Sale or disposal of ROPA and other NPA may be allowed as part of the recovery options provided that the maximum time needed to implement such option shall be considered. Thus, the sale or disposal of ROPA and other NPAs shall be supplemented with additional recovery options that can be executed within a shorter timeframe. Further, said option may be supported by detailed information regarding potential buyers and realistic discounts necessary to facilitate a sale considering the prevailing market conditions at the time of sale. 4. Are rediscounting facilities with the BSP or Land Bank of the Philippines (LBP) allowed as part of the liquidity recovery options? Banks may be allowed to tap rediscounting facilities with the BSP or LBP as secondary liquidity recovery options, provided that other primary sources of liquidity are identified. Circular No. 1158 provides that the recovery plan should exclude financial assistance in the forms of loans and advances extended by the BSP under Sections 83 and 84 of the Republic Act No. 7653 (The New Central Bank), as amended, which pertain to Loans for Liquidity Purposes under Special Credit Operation and Emergency Loans and Advances under Emergency Credit Operation, respectively. 5. Can a bank refer to its CFP for the liquidity recovery options? Banks may refer to its CFP as part of their liquidity recovery options, provided that the assumptions in the CFP are aligned with the recovery plan. Hence, the recovery plan and CFP may utilize the same recovery measures to restore the bank’s liquidity position to normal levels. However, in case the recovery plan contains more severe stress scenarios, additional options shall be included in the recovery plan. Stress Scenarios 6. What is reverse stress testing? As described under Section 151 of the Manual of Regulations for Banks on the Guidelines on the Conduct of Stress Testing Exercises, reverse stress tests may be used to determine the stress scenarios that could impair the solvency and/or liquidity of the bank. This type of analysis would help a bank consider scenarios beyond normal business expectations, and challenge common assumptions

Page 3 of 4 about performance and risk mitigation strategies. Reverse stress testing may also be carried out in a qualitative manner. This involves the development of a narrative report that discusses the dynamics of different risk types, risk factors, and feedback effects that would make the business unviable. For instance, if a bank has a loan portfolio that is highly concentrated to agricultural industry, a reverse stress test may help a bank identify conditions or changes in key variables that would cause losses sufficient to make the capital ratios fall below regulatory minimum levels. To further illustrate, as capital may be wiped out by allowance for credit losses (ACL) resulting in capital levels falling below the minimum regulatory requirements, reverse stress test for credit risk may involve determining the (a) level of non-performing agricultural loans and ACL that would make such scenario possible; (b) events that would lead to said situation (i.e., calamities and crops diseases); and (c) likelihood of the occurrence of said events. 7. Is there a need to explicitly show the calculated breach for each of the three stress scenarios (i.e., entity-specific, system-wide, and a combination thereof)? Yes. Banks should explicitly show the calculated breach for each stress scenario to determine the appropriate recovery option/s to be implemented. Preparatory Measures/Implementation Plan 8. What does “operational and legal pre-positioning” mean? Operational and legal pre-positioning are the necessary steps to overcome potential obstacles that could hinder the successful execution of recovery strategies especially during capital issuance, access to liquidity, asset disposal or merger. Testing and Simulation Exercise 9. How does desktop testing differ from live simulation exercise? The primary difference between the tabletop testing and live simulation is the environment created during the exercise and the duration. The annual desktop exercise is a facilitated group discussion in a low stress environment. It addresses potential problem areas and resolves questions on coordination and responsibilities, among others. Depending on the extent of review and discussion, the exercise may end in a shorter period. Meanwhile, live simulation exercise is a dry-run test of operational capability of recovery plan in a real-time live, stressed simulation. It creates a realistic, stressed environment where set of timelines, as provided in the recovery plan, should be adhered to. Adequate follow through of actions to address the deficiencies identified in both annual desktop and live simulation exercise shall be incorporated in the recovery plan. 10. What are the minimum areas that should be covered by the regular independent review or assessment? The internal audit function or a unit internal to the bank but independent from the team involved in drafting or implementing the recovery plan is expected to cover in its review the essential elements of the plan and the testing processes. The essential elements include governance arrangements, critical functions and services, indicators, triggers and restoration points, stress scenarios, and recovery options. The review of said elements should cover the adequacy of board oversight, consistency and integration of said elements to a bank’s risk management and stress testing process, reasonableness of the methodologies

Page 4 of 4 and assumptions used, adequacy of management information system, as well as the relevant internal controls in place. As to the testing processes, the independent review is expected to focus on the adequacy of scope and extent of testing, reporting of the results, and follow￾through of the actions taken to address the deficiencies or areas for improvement identified during the testing/simulation exercise. The results of the testing and lessons learned in the exercise should likewise be incorporated as enhancement to the recovery plan.