Circular Letter No. CC/2024/00000023: Dissemination of Information Regarding Personal Identification Documents

Circular Letter No. CC/2024/00000023 Sent to: Credit Institutions, Financial Companies, Payment Institutions, and Electronic Money Institutions. Mod. 40000375/T – 01/14 Subject: Dissemination by the banking system of information regarding personal identification documents

1. Framework The Bank of Portugal provides, upon request by individuals, a service for disseminating information regarding situations of loss, theft, robbery, forgery, counterfeiting, and illicit use of personal identification documents and their recovery (hereinafter referred to as "DIP/DIR"), with the entities subject to the supervision of the Bank of Portugal, hereinafter referred to as Institutions, as recipients.

The provision to individuals of a rapid means of communication with the banking system, which allows overcoming the difficulties associated with the number and dispersion of the institutions that comprise it, with the objective of informing about situations involving, inter alia, the loss, theft, robbery, forgery, counterfeiting, and illicit use of personal identification documents and their recovery, is relevant in the prevention and combating of the illicit, actual or potential, use of such documents by third parties, as well as their consequences for their respective holders and for the banking system itself.

This service, in addition to its manifest utility for citizens, allows institutions to strengthen their internal prevention mechanisms and combat illicit situations, avoiding the grave legal and financial consequences that often arise from the fraudulent use of personal identification documents by someone other than their actual holders.

The dissemination of the aforementioned requests is carried out through the Electronic Platform for Registration and Transmission of Official Documents (PERTO), with the Bank of Portugal favoring the receipt and sending of requests through the use of an electronic solution made available for this purpose on the Banking Customer Portal (Personal Identification Documents | Banking Customer Portal (bportugal.pt)).

The Bank of Portugal wishes to reiterate that this service is not intended for situations of loss, theft, robbery, forgery, counterfeiting, and illicit use involving bank cards, checks, or other payment means; in such situations, the respective holders should contact the issuing entities as soon as possible.

Mod. 40000375/T – 01/14 2. Dissemination of Requests Requests will continue to be disseminated to all entities supervised by the Bank of Portugal that should be recipients of information regarding lost and recovered documents, including, among others, all institutions authorized to receive deposit funds and to conclude consumer credit contracts, corresponding to the relevant universe for knowledge of situations of potential or actual illicit use of personal identification documents.

Only requests that expressly refer to situations of loss, theft, robbery, forgery, counterfeiting, and illicit use of personal identification documents, as well as requests that, in the reverse sense, inform about the recovery, replacement, or other alteration regarding the status or validity of documents subject to a previous request, are admissible for the purposes of making this service available by the Bank of Portugal.

For this purpose, the following documents shall be considered exclusively as personal identification documents: the citizen card, the identity card, the passport, and the residence authorization in national territory.

3. Operationalization of the Service The Bank of Portugal only recognizes legitimacy to request dissemination to the holder of the documents or to their representative. For this purpose, an electronic solution is made available on the Banking Customer Portal that allows the completion and electronic submission of the request (preferred channel), automatically generating the respective identification reference. In the impossibility of using this channel, a form designated "Request for dissemination of information regarding personal identification documents" (attached to this Circular Letter) can be completed, printed, and delivered at a Bank of Portugal customer service point, accompanied by the required documentation.

The attachment of a police or judicial report or declaration, which specifies what happened to the identification documents, is a necessary requirement for the aforementioned dissemination, and the applicant may attach other information or related documentation that is relevant.

The operationalization of the service will follow the following procedure: a) The applicant ensures the completion of fields marked as mandatory, in order to facilitate the analysis and processing of requests, both by the Bank of Portugal and subsequently by the recipient Institutions; b) The document issued by a judicial or police entity (e.g., police report) attesting to the occurrence on which the request is based must be attached;

Mod. 40000375/T – 01/14 c) Any requests for clarification or additional elements (e.g., request for official justificatory documents) should be made by the recipient Institutions directly to the applicant; d) In the event of recovery, replacement, or other alteration regarding the status or validity of documents that have been the subject of a previous dissemination request, the applicant assumes responsibility for making a new request to the Bank of Portugal, using the same type of form and marking the fields specifically intended for this purpose, which will serve to inform the recipient Institutions; e) The Bank of Portugal will make this dissemination service available at no cost to applicants, and therefore, no expense (even under the title of administrative fees or other analogous charges) shall be charged by the recipient Institutions to the Bank of Portugal.

4. Delimitation of Responsibility of the Bank of Portugal The Bank of Portugal acts in this process under the title of mere collaboration, facilitating the communication process between individuals and the recipient Institutions, with the latter ultimately responsible for verifying the regularity of the information communicated by the applicant and the consequent final decision on the procedure to adopt. Under no circumstances can any responsibilities be attributed to the Bank of Portugal on the part of the applicant or the recipient Institutions of the dissemination.

5. Final Provisions Circular Letter No. CC/2020/00000015, of 16-03-2020, is revoked.

Mod. 40000375/T – 01/14 Request for dissemination of information regarding personal identification documents ATTENTION: Use a pen and write in legible capital letters. Read the instructions (on the back) for the correct completion of this form. Fields marked with an asterisk (*) are mandatory.

I | Personal identification data to which the dissemination request applies Name* Address* Locality* Postal Code* – Phone Email ID Document No.* Identity Card/Citizen Card (indicate at least one) Passport Residence Authorization/Title Tax Identification Number (NIF)*

II | Identification documents (to which the dissemination request applies) Documents Lost, stolen, robbed, forged, counterfeited or illicitly used Recovered, replaced, or whose status or validity has been subject to alteration Citizen Card Identity Card Passport Authorization or residence title

III | Identification of the representative Name* Address* Locality* Postal Code* – Phone Email ID Document No.* Identity Card/Citizen Card (indicate at least one) Passport Residence Authorization/Title Tax Identification Number (NIF)*

I declare that the information elements I provide correspond to the truth and that I have read, understood, and accepted without reservation the conditions for using this service. Date _____ /_____ /_______ (dd/mm/yyyy) Signature

Mod. 40000375/T – 01/14 Note The Bank of Portugal acts in this process under the title of mere collaboration, facilitating the communication process between individuals and entities subject to its supervision, with the latter ultimately responsible for verifying the regularity of the information communicated by the applicant and the consequent final decision on the procedure to adopt. Under no circumstances can any responsibilities be attributed to the Bank of Portugal on the part of the applicant or the supervised entities.

Mod. 40000375/T – 01/14 Request for dissemination of information regarding personal identification documents Completion Instructions I Personal identification data to which the dissemination request applies Name Indicate your full name; Address Indicate your full address, including the postal code, as well as a contact telephone number (or mobile) and email address; Identity Card/Citizen Card, Passport, or Residence Authorization/Title Indicate at least one of the following identification numbers: Identity Card/Citizen Card number, Passport, or Residence Authorization/Title number; Tax Identification Number (NIF) Indicate your Tax Identification Number (NIF).

II Identification documents (to which the dissemination request applies) (*) Mark in the corresponding fields of the second column the documents that were subject to loss, theft, forgery, counterfeiting, or illicit use; Mark in the corresponding fields of the third column the documents that, having been subject to previous dissemination, have since been recovered, replaced, or whose status or validity has been altered.

III Identification of the representative To be completed in situations where the request is made by a representative of the document holder: Name Indicate your full name; Address Indicate your full address, including the postal code, as well as a contact telephone number (or mobile) and email address; Identity Card/Citizen Card, Passport, or Residence Authorization/Title Indicate at least one of the following identification numbers: Identity Card/Citizen Card number, Passport, or Residence Authorization/Title number; Tax Identification Number (NIF) Indicate your Tax Identification Number (NIF).

You must attach to this form the police or judicial report or declaration attesting to the occurrence on which the request is based.

Compliance with the duty of information towards the data subject I Responsible party, grounds and purpose The personal data collected are processed by the Bank of Portugal, a public law corporation with registration number 500 792 771 and headquarters at Rua do Comércio, No. 148, 1100-150, Lisbon (hereinafter referred to as the Bank), in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the Regulation) and other applicable data protection legislation, based on the exercise of public interest functions vested in the Bank, in accordance with Article 6(1)(e) of the GDPR and for the purpose of disseminating information regarding personal identification documents (DIP).

II Obligation The provision of personal data is mandatory. Failure to provide it will result in the non-processing of the operation in question.

III Retention Personal data are retained for 10 years.

IV Recipients The collected personal data will be communicated to Currency Exchange Agencies, Banks, Central Credit Union of Mutual Agricultural Credit, Savings Banks, Mutual Agricultural Credit Unions, Mutual Agricultural Credit Unions (not belonging to SICAM), Credit Financial Institutions, Electronic Money Institutions, and Payment Institutions.

V Rights The collected personal data will be communicated to Credit Institutions and Financial Companies.

VI Contacts The aforementioned rights are exercised by requesting the Bank's Data Protection Officer, by completing a form made available for this purpose, at the Bank's premises or, alternatively, to the following addresses: Email Data Protection Officer@bportugal.pt; or, Postal Mail Bank of Portugal Data Protection Office Rua do Comércio, 148 1100-150 Lisbon

VII Complaint Furthermore, you have the right to lodge a complaint with the National Data Protection Commission (CNPD), as the supervisory authority.