Amendments to External Regulatory Circular DSP-465 of March 31, 2026

AMENDMENTS TO EXTERNAL REGULATORY CIRCULAR DSP-465 OF MARCH 31, 2026 In accordance with numeral 8, of article 8 of the Administrative and Contentious Administrative Procedure Code, the Draft Regulation "By which External Regulatory Circular DSP-465 "Interoperability of Immediate Low-Value Payment Systems" of March 31, 2026 and its Annexes is modified" is published for comments, for a term of fifteen (15) calendar days counted from the day following the date of its publication. Publication date: July 07, 2026 Deadline date and time: July 22, 2026, 5:00 p.m. In compliance with the provisions of Law 1581 of 2012, through which general provisions for the protection of personal data are issued, and Decree 1377 of 2013 which partially regulates it, incorporated into Single Regulatory Decree 1074 of 2015, the information provided to the Banco de la República will be protected by the personal data processing policy available at https://www.banrep.gov.co/es/transparencia/proteccion-datos-personales in the section "Personal Data Protection – Habeas Data". OBJECTIVE AND JUSTIFICATION OF THE DRAFT REGULATION This draft regulation is presented with the objective of modifying some of the provisions of External Regulatory Circular DSP-465 and its Annexes, among which the following stand out: i) updating the classifications of Immediate Payment Orders and/or Transfers and incorporating the definition of payment to legal entities, ii) incorporating the "Payment Reference" field, iii) updating Annex 5 "Operational and Messaging Standards for the Processing of Immediate Payment Orders and/or Fund Transfers (PO/FT)", iv) updating Annex 6 "Seal/Brand Use Manual" to include additional rules on the use of the Bre-B seal/brand, and v) the inclusion of Annex 8 "Participants that do not offer Payment Methods" to incorporate the rules applicable to their participation in Bre-B. LEGAL BASIS • Article 104 of Law 2294 of 2023 • External Resolution No. 6 of October 31, 2023 • External Regulatory Circular DSP-465 Click here to submit comments DRAFT REGULATION PUBLICATION FOR COMMENTS

Page 18-1 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, July 7, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. This Circular regulates External Resolution No. 6 of October 31, 2023, issued by the Board of Directors of the Banco de la República (JDBR) on the interoperability of low-value payment systems that provide services related to Immediate Payment Orders and/or Fund Transfers. The Circular will be mandatory for the Administrating Entities of Immediate Low-Value Payment Systems (EASPBVI) that process Intra-SPBVI and Inter-SPBVI Operations. Annex 8 of this Circular contains special provisions applicable to Participants that do not offer Payment Methods, whether or not they are supervised by the Financial Superintendence of Colombia or the Superintendence of the Solidarity Economy. Terms appearing in capital letters in this Circular, regardless of whether they are expressed in singular or plural, have the meaning attributed to them in External Resolution No. 6 of 2023 and in this Circular.

1. Definitions a. Acquiring: Is the activity defined in numeral 1 of article 2.17.1.1.1. of Single Regulatory Decree 2555 of 2010, or the norms that replace, modify or regulate it. b. Acquirer: Are the agents defined in numeral 2 of article 2.17.1.1.1. of Single Regulatory Decree 2555 of 2010 and article 2.11.14.3. of Decree 1068 of 2015, or the norms that replace, modify or regulate it. c. Timestamp: Date and time information that EASPBVI and Participants must include in the messages required to carry out, among others, the Key management and Resolution processes, and the Clearing and Settlement of Immediate Payment Orders and/or Fund Transfers. d. Payment Service Provider: Are the agents defined in numeral 20 of article 2.17.1.1.1. of Single Regulatory Decree 2555 of 2010, or the norms that replace or modify it. e. Time-Out: Maximum time to complete or decline the process. f. Payment Reference: Numeric(s) or alphanumeric(s) code(s) associated with an Immediate Payment Order and/or Fund Transfer, which allow(s) to identify the good and/or service object of said Immediate Payment Order and/or Fund Transfer, when required by the Beneficiary.

Page 18-2 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, July 7, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. The Banco de la República (BR) will define the operational and technical guidelines for incorporating the Payment Reference(s). 2. Interoperability in Immediate Low-Value Payment Systems EASPBVI must comply with the technical and operational processes indicated in this Circular to process Immediate Payment Orders and/or Fund Transfers. In the regulations of Immediate Low-Value Payment Systems (SPBVI), EASPBVI must require Participants to comply with these provisions, for which they may develop one or more of their functions through Payment Service Providers under the same terms established in Single Regulatory Decree 2555 of 2010 or the norms that replace or modify it. 3. Characteristics of Immediate Payment Orders and/or Fund Transfers 3.1 Characteristics Payment Orders and/or Fund Transfers will be immediate when the following characteristics are met: a. Only one Payment Method is used to debit and one or more Payment Methods to credit the funds. b. It is initiated by introducing a Key or by reading and/or using a QR Code. c. It is initiated by the Originator on any day and at any time. d. It is processed within a maximum period of twenty (20) seconds. The parameters for compliance with this provision are detailed in Annex 5 of this circular. 3.2 Maximum value of the Immediate Payment Order and/or Fund Transfer The maximum value of each Immediate Payment Order and/or Fund Transfer will be equivalent in current legal currency to one thousand (1,000) Basic Value Units – UVB.

Page 18-3 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, July 7, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. Participants may define a maximum value lower than that previously indicated or other types of limits exclusively for originating an Immediate Payment Order and/or Fund Transfer, for example, the number of operations originated per day, provided that these comply with their risk management policies. In case of defining this type of limits, Participants must inform their Clients, clearly and visibly, at the time of originating the Immediate Payment Order and/or Fund Transfer, that such limits are established by the Participant. For the reception of an Immediate Payment Order and/or Fund Transfer, limits lower than those established in the first paragraph of this numeral may not be defined, without prejudice to the limits established in the norms applicable to Payment Methods. Participants may also allow Clients to configure limits, for example, by value or number of operations. 3.3 Classification of Immediate Payment Orders and/or Fund Transfers In accordance with article 8 of External Resolution No. 6 of 2023 of the JDBR, Immediate Payment Orders and/or Fund Transfers are classified as follows: a) Payment to Merchant: Immediate Payment Order and/or Fund Transfer in which the Beneficiary is a natural or legal person who has an Acquiring relationship. b) Payment to Natural Person: Immediate Payment Order and/or Fund Transfer in which the Beneficiary is a natural person who does not have an Acquiring relationship. c) Payment to Legal Entity: Immediate Payment Order and/or Fund Transfer in which the Beneficiary is a legal person who does not have an Acquiring relationship. For the incorporation of other classifications of Immediate Payment Orders and/or Fund Transfers, the BR may take into account the recommendations of the Immediate Payments Interoperability Committee. 3.4 Standards and parameters of Access Technologies that allow initiating Immediate Payment Orders and/or Fund Transfers The Access Technologies that allow initiating Immediate Payment Orders and/or Fund Transfers for the classification provided in numeral 3.3. of this Circular are Keys and

Page 18-4 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, July 7, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. QR Codes. For the use of Access Technologies by Clients, Participants may integrate additional technologies compatible with the rules and standards applicable to Access Technologies and the processing of Immediate Payment Orders and/or Fund Transfers set forth in this Circular. 3.4.1 Rules associated with Keys EASPBVI will require their Participants that the management of Keys be subject to the following rules: a. A Payment Method may be associated with several Keys. b. A Key will be associated with a single Payment Method. c. A Key associated with a Payment Method may not be repeated in a Federated Directory. d. A Key may not be repeated in the Centralized Directory. e. The Participant must define for each Key the SPBVI through which synchronization will be carried out for Key management processes with the Centralized Directory. SPBVI must define the operational or technological mechanism for Participants to indicate the Federated Directory selected to synchronize information with the Centralized Directory. f. Participants linked to more than one SPBVI that use the same classification of Immediate Payment Orders and/or Fund Transfers in said systems as provided in numeral 3.3. of this Circular, may register all or some of the Keys of the shared classification in the Federated Directories of each of said SPBVI. Participants who decide to register the same Key in the Federated Directories of each of said SPBVI, must ensure that the update of the information derived from the Key management processes is carried out first in the Federated Directory of the SPBVI chosen to synchronize with the Centralized Directory. Once the Participant receives a positive response from said Federated Directory, they must immediately update the information in the Federated Directories of the other applicable SPBVI. g. Clients may not edit or personalize the content of the Key. h. When a Client updates any of their data and said data is being used as a Key, the Participant must require them to carry out the Key modification process. The EASPBVI must ensure compliance with these rules. 3.4.2 Description of Key types and their standards The types of Keys for initiating Immediate Payment Orders and/or Fund Transfers are the following:

Page 18-5 EXTERNAL REGULATORY CIRCULAR DSP-465 Date: Tuesday, July 7, 2026 Subject 18: Interoperability of Immediate Low-Value Payment Systems. a. Identity document number: Refers to one of the following identification numbers of the Client registered in the linking process with the Participant where the Client has their Payment Method: citizenship ID, foreign ID, Unique Personal Identification Number (NUIP), identity card, Tax Identification Number (NIT) or passport. b. Cell phone number: Refers to the national cell phone number(s) of the Client registered with the Participant where they have their Payment Method. c. Email: Refers to the email address(es) of the Client registered with the Participant where they have their Payment Method. d. Alphanumeric: Refers to the Key(s) generated by the Participant where the Client has their Payment Method, which begin(s) with the @ symbol, followed by a combination of numbers and/or letters. For the generation of this(these) Key(s), the Participant will use characteristic Client information, so that it is(they are) easy to remember. Examples of alphanumeric Keys are the following: @3191234567, @AP1234567 and @MargaritaP e. Merchant establishment code: Refers to the identification code(s) assigned by the Acquirer(s) to the merchant establishment. Merchant establishments may have multiple codes assigned by one or more Acquirers. The assignment of the Merchant establishment code by the Acquirer must follow the structure for this type of Key provided in Table 1 of this Circular. SPBVI must define procedures for changing Acquirers, whether or not the Key is retained. In the case of changing Acquirers while retaining the Key, the Key cancellation and registration process must be carried out in accordance with Annex 1 of this Circular. These procedures may not last longer than twenty-four (24) hours. Keys that include letters will not distinguish between uppercase and lowercase. The options for Key types offered to Clients who are natural persons or legal entities that do not have an Acquiring relationship will be: identity document, cell phone number