Guidelines for the Grant and Implementation of the Rural Bank Strengthening Program Digitalization Technical Assistance

To Subject BANGKO SENTRAL NG PILIPINAS OFFICE OF THE GOVERNOR MEMORANDUM NO. M-2026- All Concerned BSP-Supervised Financial Institutions Guidelines for the Grant and Implementation of the Rural Bank Strengthening Program (RBSP) Digitalization Technical Assistance The Monetary Board, in its Resolution No. 81 dated 18 January 2024, approved the RBSPTechnical Assistance (TA), which consists of Digitalization, Financial Advisory, and Capacity Building components intended to accelerate the digital transformation of rural banks (RBs) and enhance their operations, capacity, and competitiveness. The RBSP TA shall serve as the deployment mechanism for the incentives and support to qualified RBs under the RBSP. The provision of incentives and support is in line with Memorandum No. M-2022-024 dated 5 May 2022, which provides the RBSP overview, and Memorandum No. M-2022-040 dated 13 September 2022, which outlines the Guidelines on the Implementation of the RBSP. One of the key components under the RBSP TA is the RBSP Digitalization TA (the 'TA"), which aims to support RBs in the migration from legacy information technology (IT) systems to cloud-based or Software-as-a-Service (Saas) Core Banking Systems (CBS). For purposes of these guidelines, a Saas CBS is a cloud-hosted core banking system operated by an external provider and accessed by the bank over secure electronic channels on a subscription or usage basis and is treated as outsourcing of IT systems under BSP regulations. The TA shall include assistance for the acquisition and subscription to a Saas CBS for a limited period to enable enhancements in the operational efficiency. operational resilience, business continuity, cybersecurity, and regulatory compliance capabilities of RBs. In the long run, the TA likewise aims to support the viability and competitiveness of RBs amid the increasing digitalization in the financial system. These Guidelines set forth the scope. qualification requirements, documentary requirements, procedures, and other governing rules for the grant and implementation of the TA. as follows: I. Scope and Duration The TA shall provide qualified banks with support for the implementation and multi-year subscription to a Saas CBS, subject to the BSP's evaluation and approval in accordance with these Guidelines. The support shall include the services necessary to implement and operationalize the CBS, such as system configuration, data migration, system integration, testing, user training, commissioning. cloud infrastructure, technical support, system updates, and maintenance services.

The TA shall cover the following periods: • an Implementation Period of six (6) months maximum, reckoned from the date of issuance by the Bangko Sentral ng Pilipinas [BSPJ to the Service Provider of the deployment notice' covering the Recipient RB. The Implementation Period shall cover the deployment of the CBS up to successful full system Go-Live': and • a fixed Subscription Period of thirty-six [36) months from the end of the Implementation Period. The Subscription Period shall cover the continued access to and operation of the CBS and related support services upon successful system Go-Live. II. Definitions For purposes of this TA: • Implementation refers to the activities necessary to deploy the CBS up to successful system Go-Live, including system configuration, data migration, system integration. testing, and training of the Recipient RB's personnel. • Subscription refers to the ongoing provision of system access, cloud infrastructure, security and compliance, technical support, maintenance services, and system updates and related training following system Go-Live. • Recipient RB refers to an RB whose application for the RBSP Digitalization TA has been approved by the BSP and has duly executed the RBSP Digitalization TA Agreement with the BSP. Ill. Documentary Requirements The following documentary requirements shall be submitted for their application for the TA: a. Letter of Application addressed to the Deputy Governor, FSS and signed by the President or an equivalent officer of the bank. The letter shall express the bank's interest to avail of the RBSP Digitalization TA and briefly discuss how the TA aligns with or supports the bank's long-term strategic, operational, digitalization, or financial inclusion initiatives; b. Corporate Secretary's Certificate on the Board of Director's [BOD) approval of the Bank's application for the RBSP Digitalization TA. The bank may also attach supporting documents, where available, such as strategic plans, digitalization roadmaps, information technology plans, business plans, or similar internal documents; c. Certificate of Compliance, including its capital computation, with the minimum capital requirements under Circular No. 1151. as of latest available cut-off date' at the time of the application for the TA using the template attached as Annex A: 1 The deployment schedule for each recipient bank may vary depending on the date of submission of the bank's TA application, completion of the BSP evaluation and approval process. and execution ofthe TA Agreement between the BSP and the recipient bank. 2 Full system Go-Live shall be determined upon completion of the required implementation activities or milestones. in accordance with the Terms of Reference (TOR) and issuance by the BSP, in coordination with the recipient bank, of the Certificate of Completion and Acceptance (CCA). indicating that the Saas CBS is ready and available for production use. 3 Latest quarter-end reference cut-off date {e.g .. 31 December 2025, 31 March 2026) Page2 of7

d. Certification from the President or an equivalent officer of the bank that the bank has no existing subscription to a Saas CBS platform at the time of the application for the TA: e. Accomplished self-assessment checklist (Annex BJ signed by the President or an equivalent officer of the bank: and f. Accomplished IT Outsourcing Questionnaire (Annex C). IV. Qualification Criteria To be eligible for the TA. the applicant bank must meet the following criteria: a. The bank submitted an application or a Letter of Intent, for any of the following RBSP Tracks during the program's availability period (21 September 2022 to 21 September 2025): Merger/Consolidation, Acquisition or Third-Party Investment. Upgrade of Banking License, or Capital Build-Up Program: b. The bank's adjusted capital as of latest available Financial Reporting Package (FRP) cut-off date immediately preceding the date of application for the TA is compliant with the minimum capital requirements under Circular No. 1151. dated 24 August 2022: and c. The bank does not have an existing subscription to a cloud-based or Saas CBS at the time of application for the TA. The BSP shall also consider the bank's overall risk profile, latest supervisory assessment, outsourcing risk management framework. information technology (IT) readiness, and operational capacity to support the prudent deployment, implementation, and sustainability of the TA. V. RBSP Digitalization TA Agreement The RBSP Digitalization TA Agreement [or TA Agreement)shall contain the general. terms and conditions governing the availment and implementation of the TA. The BSP, through the handling FSD, shall notify the bank and furnish a copy of the TA Agreement to be executed between the BSP and the Recipient RB upon favorable evaluation of the bank's application. The bank's acceptance of the TA Agreement shall be approved through a Board Resolution authorizing the bank's availment of the TA. execution of the TA Agreement, and designation of the authorized signatory. The signed TA Agreement shall be notarized by the respective notary public of the Recipient RB and the BSP. The designated BSP signatory shall sign the TA Agreement only upon receipt of the bank's signed and notarized TA Agreement. Failure of the bank to submit the signed and notarized TA Agreement within ten [10) banking days from receipt of notification of favorable evaluation from the BSP, may be considered as non-conformity with the subject TA agreement. VI. Conduct of Self-Assessment Prior to Application The successful implementation and sustainability of the TA require the commitment and active participation of recipient RBs. Prior to submitting their applications, applicant banks shall conduct a self-assessment of their readiness and suitability to avail of the TA. The self-assessment shall consider key operational, organizational. and sustainability factors relating to the implementation and utilization of the Saas CBS. Page3 of7

In this regard, applicant banks shall accomplish and submit, together with other documentary requirements, the Self-Assessment Checklist provided in Annex B, duly signed by the bank's President or its equivalent officer. The actual terms, conditions, roles, and responsibilities relating to the availment and implementation of the TA shall be governed by the TA Agreement. should the bank's application be approved. VII. Application and Evaluation Procedures Step 1: Submission of Application The applicant bank shall address its Letter of Application to the Deputy Governor, Financial Supervision Sector (FSS), copy furnished to the head (i.e .. Director/Acting Director/Officer-in-Charge) of the bank's handling Financial Supervision Department (FSD). All documentary requirements, under Section Ill of these Guidelines, shall be scanned and submitted via email to fssmail@bsp gov ph. copy furnished to the TWG-RBSP through J:wg.c rbsp@bsp gov pb. Consistent with Memorandum No. M-2024-044 on the amended guidelines on the submission of reports/documents and communication through the BSP FSS mail-in account, the email subject shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application> The FSS Unit refers to the bank's handling FSD. For subsequent submissions relating to deficiencies, additional documents, or clarification, the email subject shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Additional Submission> Step 2: Completeness Validation Within five (5) banking days from receipt of the application and documentary requirements, the BSP shall acknowledge receipt thereof and inform the applicant bank whether the submission is complete; or additional documents, information, or clarification are required. If the BSP determines that the submission is complete, the BSP shall inform the applicant bank accordingly and proceed with the evaluation of the TA application. On the other hand, applications with incomplete documentary requirements shall be returned and not be considered as officially received until all identified deficiencies have been fully complied with. Step 3: Evaluation of Application The BSP shall evaluate the application based on the qualification criteria under Section IV of these Guidelines.Additional information may be requested by the BSP, as necessary, for purposes of evaluating the application. Page 4 of7

Considering that the TA involves support for the adoption of a Saas CBS, which constitutes a material IT outsourcing arrangement, TA applications shall likewise be evaluated in accordance with applicable BSP regulations on outsourcing, technology, and related risk management requirements. For purposes of th is TA. the applicable regulatory requirements and processes may be streamlined or calibrated, taking into account the unique nature and implementation arrangements of the TA. without prejudice to the BSP's assessment of the bank's readiness and capacity to effectively implement and manage the Saas CBS. The BSP shall complete the evaluation within twenty-five (25) banking days from determination of completeness of documentary requirements under Step 2. If the application is recommended for approval, the BSP, through the FSD handling officer, shall inform the bank accordingly via email and provide the following: a. A copy of the proforma TA Agreement: and b. An acknowledgement template indicating the estimated or indicative cost of the TA to be allocated to the bank. On the other hand, if the bank's application is not recommended for approval, the BSP shall return the application without further processing and inform the Bank accordingly of the results of the evaluation, as may be appropriate. The Bank may submit a new application once the identified deficiencies or concerns have been addressed. subject to the availability of the TA. Step 4: Execution of the TA Agreement by Bank The bank shall review the terms and conditions under the RBSP Digitalization TA Agreement. If acceptable, the bank shall sign the same through its President or authorized signatory and have the document notarized. The bank shall submit the following, a. Signed and notarized TA Agreement; b. Corporate Secretary's Certificate of the BOD's approval of the bank's availment of the TA: the execution of a notarized TA Agreement: and the designation of the authorized signatory; and c. Copy of the acknowledgement form indicating the estimated or indicative value of the TA allocated to the bank, duly signed by the bank's authorized signatory. Within ten (10) banking days from receipt of the BSP's notification under Step 3, the bank shall submit the following: • Scanned copies of the said three (3) documents, to be submitted via email to fssmail@bsp .iov ph, copy furnished to the TWG-RBSP through twg.: rbsp@bsp gov ph. The email is addressed to the Deputy Governor, FSS, copy furnished to the head (i.e .. Director/Acting Director/Officer-in-Charge) of the bank's handling FSD. The email transmitting the said documents shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Submission of TA Agreement> Page 5 of7

• The original hard copies of the said three (3) documents shall be submitted to the BSP via courier/mail. The accompanying transmittal letter shall be addressed to the Deputy Governor, FSS, with copy furnished to the head (i.e .. Director/Acting Director/Officer-in-Charge) of the bank's handling FSD, as follows: LYN I.JAVIER Deputy Governor Financial Supervision Sector Bangko Sentral ng Pilipinas A Mabini St,. Ma late Manila, Philippines Copy furnished: [Name of FSD Head] [Designation] [Financial Supervision Department] Bangko Sentral ng Pilipinas For purposes of determining timeliness of submission, the date of receipt by the BSP of the email containing the scanned copies shall be the basis. Failure to submit the required documents within the prescribed period may be considered a waiver or refusal of the TA. Step 5: Approval and Execution of the TA Agreement by the BSP Upon receipt and review of the bank's signed and notarized TA Agreement, the BSP shall formally approve the application and cause the execution and notarization of the TA Agreement by the authorized BSP signatory. The BSP, through the FSD handling officer, shall furnish the bank with the complete set of signed and notarized TA Agreements within ten (10) banking days, or such longer period as may be necessary, from availability of duly notarized and BSP-signed TA Agreement. Scanned copies of the signed and notarized TA agreements shall be transmitted by the BSP via email to the bank's signatory and focal person: while hard copies of the same documents shall be transmitted via courier/regular mail to the bank's registered address with the BSP, or, if requested, received in person by the bank. Upon receipt thereof, the bank shall officially be considered a Recipient RB of the RBSP Digitalization TA. Step 6: Pre-deployment Activities Upon transmittal by the BSP of the complete set of signed and notarized TA Agreements via email, the TWG-RBSP shall coordinate with the Recipient RB and the Service Provider regarding the conduct of pre-deployment activities and other implementation arrangements necessary for the TA deployment. VIII. Application Period The BSP shall begin accepting applications for the TA one (1) month from the issuance of these Guidelines. During the interim period, the BSP may conduct briefing sessions, orientations, or other information dissemination activities to guide RBs on the TA and facilitate their self-assessment and application preparations. Page 6 of7

The deadline for the submission of applications shall be announced separately by the BSP through its official communication channels. IX. Amendments and Supplemental Guidelines The BSP may amend. supplement. clarify, or issue additional guidelines. procedures. or instructions as may be necessary for the effective implementation of the TA. The BSP may likewise extend or adjust the timelines. submission periods. processing periods. or other procedural requirements under these Guidelines. as may be deemed necessary or appropriate, taking into consideration the availability of the TA. X. Communications and Announcements Notices. announcements. clarifications. supplemental guidelines. and other issuances relating to the TA shall be communicated by the BSP through official channels. including memoranda, circular letters. press releases. industry meetings, and other BSP communication platforms. For questions and clarifications. concerned banks may send electronic mail to their handling FSD. copy furnished. twg-rbsp@bsp gov ph. For guidance and implementation. ~ M'-;.MOLONA, JR. Governor /2. August 2026 Page 7 of 7

ANNEX A <Bank Letterhead> CERTIFICATION This certifies that <Name of Bank> with capital of .P<aroount> as of <date month and year of latest available cut-off date>. as supported by the attached capital computation, and with <number of> branches, complies with the minimum capital requirement of .P<aroount> for rural banks, pursuant to Section 8.3 of Republic Act No. 8791 (The General Banking Law of 2000). as implemented by Section 121 of the Manual of Regulations for Banks. and as amended by Circular No. 1151 dated 24 August 2022. This further certifies that the Board and the Bank's stockholders have been informed and fully understand that should the Bangko Sentral determine that the Bank does not comply with the aforesaid minimum capital requirement. the Bank's relevant RBSP Technical Assistance application shall be returned without further processing. Signed this_ day Qf <month> 2026 at the <location>. Alt: As stated <NAME AND SIGNATURE OE PRESIDENT> Position4 4 The signatory may be the President or an equivalent officer of the bank. Page 1 of2

<Name of Bank> CAPITAL COMPUTATION As of <month> 2026 Particulars A. Unimoaired Paid-in Caoital Surolus Undivided Profits B. Add: Deposit for Stock Subscription recognized as eauitv oursuant to Section 123 of the MORB C. Deduct: 1) Treasurv stock 2) Unbooked allowance for probable losses (which includes allowance for credit losses and impairment losses) 3) Total outstanding unsecured credit accommodations, both direct and indirect, to DOSRI granted by the bank proper: Provided, That in the case of government-owned or -controlled banks, the adjustment shall not include the unsecured peso-denominated credit accommodations to the Philippine National Government 4) Total outstanding unsecured loans, other credit accommodations and guarantees granted to subsidiaries 5) Total outstanding loans. other credit accommodations and guarantees granted to related parties that are not at arm's length terms as determined by the appropriate supervising deoartment of the Banako Sentral 6) Deferred tax assets that rely on future profitability of the bank to be realized, net of (a) any allowance for impairment and (b) associated deferred tax liability, if the conditions cited in PAS 12 on Income Taxes are met: Provided, That, if the resulting figure is a net deferred tax liability, such excess cannot be added to net worth 7) Reciprocal investment in equity of other banks/enterprises, whether foreign or domestic. the deduction shall be the lower of the investment of the bank or the reciprocal investment of the other bank or enterorise 8) Government counterpart equity, except those arising from conversion of arrearages under the Banako Sentral rehabilitation oroaram TOTAL CAPITAL Note: Supporting documents may be attached to this Annex Amount . Page 2 of2

ANNEXB RBSP Digitalization Technical Assistance (TA) Self-Assessment Checklist Name of Bank: ________________ _ Date Accomplished: _____________ _ Please check(✓) the box to confirm that the following areas have been considered in the bank's self-assessment: E] Self-Assessment Area Assessed Remarks/Comments (if any) D The bank has assessed the alignment of the TA LIi with its strategic. operational. digitalization, and/or financial inclusion initiatives. D The bank has assessed the readiness of its LJ personnel, processes. systems, and operational arrangements to support the implementation and utilization of the Saas CBS. The bank has assessed the availability of adequate connectivity, IT infrastructure, and 3 other relevant operational support □ arrangements necessary for the implementation of the Saas CBS. The bank has considered the need to designate capable personnel (e.g .. focal person, 4 digitalization champion)who will actively □ coordinate with the BSP and Service Provider throughout the implementation and subscription periods of the TA. D The bank understands that availment of the TA entails compliance with applicable terms and □ conditions, including subsequent monitoring and reporting requirements of the BSP. The bank has assessed its ability to sustain and 6 maximize the utilization of the Saas CBS □ during and, where feasible, beyond the TA period. The bank has considered its willingness and capacity to assume accountability and 7 responsibility over the continued use □ {subscription}, maintenance, administration, renewal. and modification (if any) of the Saas CBS upon completion of the TA period. r:7Ebank has considered other operational, ncial, or organizational factors relevant to □ its digital transformation initiatives. Page 1 of2 I

We confirm that [Name of Bank] has conducted an internal self￾assessment and has considered the foregoing areas in determining its readiness and suitability to apply for the RBSP Digitalization TA. We acknowledge that the actual terms, conditions, roles, and responsibilities relating to the availment and implementation of the TA shall be governed by the RBSP Digitalization TA Agreement, should the Bank's application be approved. [Name and Signature of President' Position: _______ _ Date: _________ _ 5 The signatory may be the President or an equivalent officer of the bank. Page 2 of2

IT OUTSOURCINCl QUESTIONNAIRE FOR BSFI Note: This self.assessment should be maintained by high·!eve! officer.; who have direct understanding of the institutions outsourcing arrangements. The BSF/'s President or equivalent officer must review and sign-off prior to submission to BSP. Please indicate specific refimmces {e,g, index, page, section, or title J to supporting documents. NAME OF BANK: DATE ACCOMPLISHED: ____ _ b. Foreign Currency Deposit System (R.A. 6426) c. Anti•Money Laundering Act (RA No. 9160, as amended), particularly on data/ file retention d. Electronic Commerce Act (RA 8792) e. Data Privacy Law (RA 10173) f. Cybercrime Prevention Act (R.A. 10175) g. General Banking Law (RA 8791) h. Electronic Banking Services (BSP Circular 1033) i. Consumer Protection (BSP Circular1048) 2. Clover11anc::1>°andRi$kMana ement, a. Adoption of written, board·approved outsourcing policy. Please provide details on policy title, Board approval and last review date. if already available b. Risk assessment procedure, results and justification in pursuing a technolo outsourcin en a ement c. BSFJ's internal audit role/involvement prior to and after the engagement ofa TSP 3. Vendor Mana emen Performance ancl Su rt a. BSFl's monitoring process to manage the outsourced IT service b. Process to audit TSP to assess its compliance with entity's policy, rocedures, securi controls and re ulato re uirements Pagelof2 Annex C

---------- - 1--:;-,-;--..,--- ,c-;---;:~- -:-;- - -, ..... ' - ---- '[ 110T~,1-:-,,r- -3r~ ...... ii"ii'o'1_...-, c r,111ni"''Y.2"=: l . . - -~ - - '-- '- ~-~ /1..:-s --, ___ .._ ~·-- . - -- - - -- ____ i_ (~= :,-___ ,._.:~ ~ f~C~;~\C-~~ .... ,?:::-':'".j) _______ _j c. BSFl's procedures in identifying, reporting, and responding to security incidents and violations d. BSFl's contingency plan for replacing the TSP in the event of its cessation 4. Security and. Priva"" .. . a. Information security policies and initiatives to incorporate activities outsourced to TSP and risks pertaining to compromise of confidential/sensitive information orocessed and/or stored bv the TSP b. A comprehensive data inventory and a suitable data classification orocess to facilitate TSP's imolementation of identitv and access controls C. Monitoring and management for integrity checking. compliance checking. security monitoring, comprehensive incident response methodoloaies. and network oerformance d. Procedures established to securely destroy or remove the data when the need arises (e.g., upon contract termination, either on expiry or prematurely) 5. . ausiness'<::qnti11uity Planning .• . a. Responsibilities and procedures for availability, data backup, incident response and recovery, Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO) of svstems or annlications outsourced b. Frequency of business continuity and disaster recovery tests, validation process and testinq methodoloav c. Contingency plan for replacing the TSP in the event of its cessation Page 2of2