Operational and Services External Circular DG-GI-393, Subject 3: Information Management Instruments

Document No: OT/PF/MAR/2026/126520 Addressee: Natural and legal persons Page 3 - 00 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 MANUAL OF THE GENERAL DIRECTORATE OF INFORMATION MANAGEMENT (DGGI) Date: Friday, March 20, 2026 Subject 3: Information Management Instruments

This Circular replaces Annex 2: Document Management Program (DMP) of April 11, 2025, of the Operational and Services External Circular DG-GI-393 corresponding to Subject 3: "Information Management Instruments of the Corporate Manual of the General Directorate of Information Management (DGGI)"

The main changes are: • The validity period of the DMP (2026 – 2029) is updated, in accordance with the Bank's Strategic Plan. • The status and project and initiative sheets are updated.

Sincerely,

MARCELA OCAMPO DUQUE Executive Manager LUIS FRANCISCO RIVAS DUEÑAS General Submanager of Corporate Services

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2- 1 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments DOCUMENT MANAGEMENT PROGRAM 2026 - 2029 Approval Instance: General Submanager of Corporate Services Blessing Instance: General Directorate of Information Management Institutional Archival Authority: Document Management Department Publication: via Operational and Services External Circular – CEOS DG-GI-393

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -2 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments Content

1. General aspects ........................................................................................................... 3 1.1. Background......................................................................................................................... 3 1.2. Scope................................................................................................................................... 7 1.3. Audience ...............................................................................................................................8 1.4. Requirements for the development of the DMP .......................................................................... 8 1.5. Progress of document management programs............................................................. 11
2. Document management processes.................................................................................. 16 2.1. Processes established by Decree 1081 of 2015 .......................................................... 16 2.2. Guidelines of the Law on Transparency and Access to Public Information...................... 17 2.3. Information governance policies.................................................................................. 17
3. Phases of implementation of the document management program..................................19 3.1. Alignment with the Bank's Strategic Plan...................................................................... 19 3.2. Alignment with other information management instruments .......................................... 19 3.3. Short, medium, and long-term goals............................................................................... 19 3.4. Resources for the development of the DMP ................................................................................... 20 3.5. Articulation with other programs and systems of the entity ............................................... 22
4. Specific projects .......................................................................................................22 4.1. General description ............................................................................................................. 22 4.2. Project sheet............................................................................................................... 23
5. History of changes.........................................................................................................28

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -3 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments DOCUMENT MANAGEMENT PROGRAM (DMP) 2026 – 2029

1. General aspects The formulation of a Document Management Program (DMP) is defined in Law 594 of 2000, in Decree 2609 of 2012 (compiled in Decree 1080 of 2015) and more recently, in Law 1712 of 2014, which establishes that this program is part of the instruments for information management and its elaboration and publication is mandatory for all obligated subjects, among which is the Bank of the Republic.

In order to achieve the objective set by the aforementioned norms, the DMP includes the projects and initiatives developed by the Bank in matters of document and information management in the short, medium, and long term, under principles of efficiency, economy, timeliness, availability, environmental protection, control and follow-up, document grouping and archival link, allowing support for the functions, compliance with the mission, and preservation of the institutional documentary memory.

1.1. Background 1.1.1. Document management program of 1993 Since 1993, the Bank of the Republic has had a DMP, being the first entity in the State to formulate it, thus anticipating what was established in Law 594 of 2000 or the General Archives Law. Since then, the Bank has become a reference of good practices in document management for many public and private entities, not only in terms of its archival model, but in the proposal presented at a time when the legal norms on the matter were incipient.

The 1993 DMP was based on the guidelines and recommendations of UNESCO, and contemplated activities in three aspects: • Creation and production of documents • Use and conservation • Disposition and elimination

To develop these elements, the Bank initially undertook the development of the following activities; some of which were developed in the following years: Assignment of responsibilities for document management.

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -4 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments • Control over document production (process analysis and suppression of unnecessary copies). It included an inventory and review of forms and forms (coded BR). • Definition of an organization model for the Bank's archives (management, central [departments], and the General Archive). • Restructuring of the Bank's Archive Manual (archive norms and procedures consistent with archival theory). • Formulation in 1998 of the Document Conservation Regime, established in Law 31 of 1992 as well as the definition of guidelines for the selection and elimination of documents. • Automation of the Archive and Correspondence management. • Creation of instances to approve and adopt document management policies and guidelines (Administrative Unit for DMP coordination, Document Management Office).

In turn, the DMP proposed the development of the following projects: • Forms and forms management • Reports management • Correspondence management • Reprography management (microfilming) • Electronic documents management • File systems and information recovery management • Archives management • Copier management (photocopying) • Mail and telecommunications management (external and internal messaging) • Process and procedure redesign • Identification and description of documentary series • Document evaluation (included the elaboration of document retention tables) • Vital or essential documents management (in case of catastrophe)

The above projects were carried out by the Bank between 1996 and 2010, with the exception of the following: • Reports management • Process and procedure redesign • Identification and description of documentary series • Vital or essential documents management (in case of catastrophe)

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -5 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments 1.1.2. Document management consultancy In 2011, as a result of an internal analysis carried out by the Document Management Department, the need was seen to carry out a diagnosis of the Bank's situation in terms of document management, for which a specialized consultancy was contracted, from which the following programs and projects were proposed, to be developed in the medium and long term, and incorporated into the Bank's planning for each period: • Project for the review of formats and supports for long-term preservation • Installation of the components of the Document Management System platform • Technical, functional design and configuration of the Document Management System (ECM) • Correspondence System • Guaranteed Digitization System • Creation of a digital signature system • Electronic registration window • Electronic Archive System (RM of Open Text) • Development of methodologies and instruments for document management • Analysis of structured information in databases • Program for the normalization of templates and forms • Document planning program • Implementation of DMS in the International Exchange Dept. • Implementation of DMS in the Fiduciary and Securities Dept. • Implementation of DMS in DODM/OMAS processes • Implementation of DMS in the Human Resources Dept. • Implementation of DMS in the Acquisitions Dept. • Implementation of DMS in the Accounting Dept. • Implementation of DMS in Industrial Plants • ISO 30300 Certification Project

Although the above programs and projects were to be developed between 2013 and 2017, a good part of them were incorporated into a larger project whose purpose is to implement a Corporate Content Manager (CCM).

1.1.3. Document management program of 2015-2016 For the year 2015, and as a result of the entry into force of the Law on Transparency and Access to Public Information (Law 1712 of 2014), the Bank of the Republic approved the DMP, which followed the guidelines indicated by the General Archive of the Nation, a document that was published on the Bank's website. The following subprograms were proposed:

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -6 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments • Electronic Document Management • Reprography Management • Institutional Training Plan • Change Management Plan

It is worth mentioning that that version of the DMP was defined for the very short term, considering that the Bank was advancing in the implementation of the Information Management System (IMS), approved in 2016, and the CCM, which were part of the Bank's corporate information management modernization program, orienting its goals towards a document management based on business processes.

1.1.4. Document management program of 2017-2021 In development of the Information Management Modernization Program at the Bank, the Information Management System was consolidated, in which the Information Management Model is established, which covers both Structured Information (Data) and Unstructured Information (Documents). For the latter case, the main project proposed was the implementation of the CCM, which is allowing the Bank to carry out a digital transformation in its documentary production, through the availability of different technological, methodological, and operational resources that cover the document lifecycle, from its generation or receipt, to its final disposition.

1.1.5. Document management program of 2022 - 2025 As a result of the production launch of the CCM, directly linked to digital transformation processes, the Bank advanced in the digitalization of documentary production. This progress was achieved through the use of available methodological, technological, and operational resources, allowing a coherent and logical harmonization in the information lifecycle, independent of the support, repository, or production medium, whether structured or unstructured information.

1.1.6. Document management program of 2026 - 2029 In the present DMP, the main projects and initiatives oriented to continue and consolidate the digitalization of documentary production are described, mainly supported by the methodological, technological, and operational resources already available. Likewise, considering the maturity of document management at the Bank, it is necessary to advance towards goals linked to the Strategic Plan, so that the direct and logical articulation in the information lifecycle is continued and strengthened, independent of the support, repository, or production medium, covering both structured and unstructured information.

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -7 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments In accordance with the above, and in order to have concrete and measurable planning, this document proposes some projects and initiatives with annual periodicity, according to the planning of the General Directorate of Information Management and the Document Management Department, who define and prioritize the work plan to address the Bank's needs in terms of document and information management.

1.2. Scope The DMP is aligned with the objectives, guidelines, and goals of the Bank's Strategic Plan and is a component of the Bank's Information Management System. The Bank's corporate information1 is generated internally or externally, in accordance with the Bank's processes, and is divided into two. The first is structured information2 (data) which corresponds to that registered in computer systems or databases. The second is unstructured information3 (documentary) which corresponds to that included in physical or electronic documents, as illustrated in the following graph.

1 Corporate Information: is that which is generated or received in the development of a function, process, service, procedure, or operation, assigned to the Bank and must be managed throughout its lifecycle. In such a way that this information fulfills at least one of the following functions: a) Serves as support or proof of rights, obligations, or responsibilities on the part of the Bank or its stakeholders in relation to it. b) Supports the decisions, norms, or policies taken or established by the competent instances of the Bank. c) Is generated as a result of the interaction between the Bank and its clients, contractors, or users, which may be of interest to them or may generate legal effects. d) Allows compliance with any norm or policy, leaving evidence and proof of the actions carried out by the people who provide services to the Bank, whether employees or third parties. e) Contributes to institutional memory. f) Corporate Information includes both unstructured or documentary information and structured information or data.

2 Structured Information: Structured information refers to the logical organization of data in databases, XMLs, spreadsheets, word processor formats, among others; and which may be contained in the Bank's technological solutions, or in data exchange files that the Bank receives from or delivers to third parties, or which results from the consolidation of different information sources or from analysis, forecasting, or projection processes (analytics).

3 Unstructured Information: That contained in the Bank's physical or electronic documents.

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -8 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments Source: Bank Republic. Information Management System Manual

1.3. Audience The DMP is directed at the employees of the Bank of the Republic at their different levels, as well as at contractors and stakeholders, who, by reason of their links and relationships with the Bank, are subject to compliance with the information management policies approved by the Board of Directors. The development, implementation, and compliance with the activities that are part of the DMP is the responsibility of all the Bank's departments and consequently of the entity's employees; in some cases, it will be required that contractors comply with some of the guidelines and activities of this Program, a situation that must be recorded in the respective contracts, or through Service Level Agreements (SLAs).

1.4. Requirements for the development of the DMP 1.4.1. Normative Both in the formulation and in the development and implementation of the DMP, the following norms are taken into account:

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -9 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments • Law 527 of 1999. Regulatory law of electronic commerce and data messages • Law 594 of 2000. General Archives Law and its regulatory norms, issued by the General Archive of the Nation. • Law 1437 of 2011. Statutory law of administrative and contentious administrative procedure. • Law 1581 of 2012. Habeas Data Law and Protection of Personal Data and its regulatory norms. • Law 1712 of 2014. Statutory Law on Transparency and Access to Public Information and its regulatory norms. • Decree 1080 of 2015. Unique Decree of the Culture sector. • Decree 1081 of 2015. Unique Decree of the Presidency of the Republic sector. • Resolution 1519 of August 4, 2020, issued by the Ministry of Information and Communications Technologies, by which the standards and guidelines for publishing the information indicated in Law 1712 of 2014 are defined, and the requirements for access to public information, web accessibility, digital security, and open data are defined.

The Bank, through the competent instances such as the Board of Directors, the General Submanager of Corporate Services, the General Directorate of Information Management, and the Document Management Department, develops the internal norms necessary to lead to the implementation of the programs, projects, and activities established within the present DMP, which are complemented by the projects proposed from the Information Management System-IMS.

1.4.2. Economic For the implementation of the DMP, the General Directorate of Information Management and the Document Management Department manage the required budget items, which are part of the annual budget and the Medium-Term Expenditure Framework of the Bank, which is reviewed each year. On the BR website, annual budget information can be consulted at the following link https://www.banrep.gov.co/es/transparencia-acceso-informacion-publica.

1.4.3. Administrative Due to the fact that the DMP is part of the Information Management System – IMS, initially approved by the Information Governance Committee4 and currently by the General Submanager of Corporate Services, its implementation is in charge of the Document Management Department and the General Directorate of Information Management. To assume and develop the new responsibilities demanded by implementing all the services provided by the CCM, the Document Management Department has the necessary staff to modernize the entity's document management.

4 The Bank's Information Governance Committee existed as a strategic decision-making instance between 2015 and 2020, the year in which it was eliminated.

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -10 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments Additionally, the Bank has made available the creation of several roles associated with information management processes (structured and unstructured), thanks to which it will be able to comply with the new regulatory framework and the demands and trends emerging in this matter. In order to lead the information management modernization process, the Bank has an information governance structure divided into three levels: Strategic, Tactical, and Operational.

1.4.4. Technological Within the technological infrastructure necessary to support the Information Management System (IMS), the Bank acquired and implemented a CCM5 (and Open Text), named iConecta. This CCM has the functionalities and infrastructure necessary to manage electronic documents during their lifecycle, being defined as the institutional repository, where the electronic archive documents produced and received by the Bank, in the development of their functions and activities, are preserved.

Gradually, the functionality performed by different technological document management tools is being replaced or integrated, such as: • Delfos: System for correspondence management (Stopped functioning since 2019 and its functionality was incorporated as a Correspondence Module in iConecta). • SIAF: Referential system to facilitate the consultation of files and physical documents and control archive technical processes, currently in the process of shutdown and migration to iConecta. • ADOCS: Repository for the conservation of digitized images and electronic reports. Stopped functioning in 2020 and the information preserved there was migrated to iConecta. • Portafirmas: Platform for the administration of digital certificate resources (electronic signature).

5 Corporate Content Manager (CCM): is the set of technologies (known as ECM Enterprise Content Management), tools, and methods used to capture, administer, store, preserve, dispose of, and deliver content within an organization.

Document No: OT/PF/MAR/2026/126520 Annex 2 Page 3 - A2 -11 OPERATIONAL AND SERVICES EXTERNAL CIRCULAR DG-GI-393 Date: Friday, March 20, 2026 Subject 3: Information Management Instruments • Corporate Mailboxes: They ceased to be official repositories for information conservation; therefore, the migration of email messages that require conservation to iConecta is currently being executed.

Additionally, iConecta is being integrated with different technological tools necessar