Guidelines on Querying the Bangko Sentral ng Pilipinas Records through the BSP Fit and Proper System

Classification: GENERAL Page OFFICE OF THE DEPUTY GOVERNOR I FINANCIAL SUPERVISION SECTOR MEMORANDUM NO. M-2026-___ To : All Banks Subject : Guidelines on Querying the Bangko Sentral ng Pilipinas Records through the BSP Fit and Proper System Section 146 (Management of Human Resource-related Risk) of the Manual of Regulations for Banks requires banks to screen their applicants who passed the initial stages of pre-employment process against the Bangko Sentral ng Pilipinas (BSP) records. In line with this, a web-based facility called the BSP Fit and Proper System (FitPro) was developed. All banks shall use the FitPro upon completion of the registration requirements of their authorized representatives, in accordance with the following guidelines: A. Documentary Requirements for Submission

1. Participant1 shall submit three (3) original copies of the following: a. Terms and Conditions (TAC) – to be signed by the Participant. It provides, among others, the Participant’s duties and responsibilities, and other relevant provisions on information security and data privacy. The TAC is embedded in the FitPro and authorized representatives are required to review and accept before initiating any search. b. Participation Agreement (PA) – to be executed in notarized form, separately and in counterparts, by the BSP and the Participant. PA provides, among others, the mutual agreement between the BSP and the bank on their respective roles and responsibilities as the FitPro Operator and a Participant, respectively. c. Confidentiality and Non-Disclosure Undertaking (CNDU) – to be executed in notarized form by the authorized representatives 2 of the Participant. It describes the confidential relationship between the BSP and the Participant’s authorized representatives with respect to the disclosure of confidential information; and d. Registration Form (RF) – to be signed by the President (or its equivalent rank) and the Corporate Secretary. The RF includes a list of authorized representatives who will have access to FitPro, as supported by a Board Resolution3 . The prescribed templates can be downloaded from the BSP website, https://www.bsp.gov.ph/ses/reporting_templates. 1 Participant – refers to a Bank-counterparty of the BSP in the Participation Agreement on the use of FitPro by banks, acting through its authorized representative/s. 2 Authorized representatives/users/requestors – used interchangeably in FitPro-related documents, are personnel who are authorized to use or access the FitPro, i.e., the Head of the Human Resource Department and the Chief Compliance Officer of banks or their designated alternates. 3 The Board Resolution shall indicate positions rather than individual names, provided that internal controls are in place and the Corporate Secretary certifies the names of the current holders of said positions in the Registration Form.

Page 2 of 5 2. For purposes of initial assessment of completeness and correctness of documentary requirements, Participants shall submit a complete set of scanned copies of the TAC, PA, CNDU, RF, and the pertinent Board Resolution, duly signed but not necessarily notarized (as applicable), within five (5) banking days from the latest approval date of the required documents. These documents shall be emailed to dsa-fitpro@bsp.gov.ph using the prescribed subject format: FitPro DOC<space><Bank Name>,<space><Date of Submission in dd-Month Name￾yyyy> e.g. To: dsa-fitpro@bsp.gov.ph Subject: FitPro DOC ABC Bank, 30 June 2026 and using the following format as the prescribed filenames: [Document Code][Bank Acronym][Date in dd Month yyyy].extension Document Code Example File Type a. TAC TAC_ABCBank_30 June 2026.pdf pdf b.PA PA_ABCBank_30 June 2026.pdf pdf c. CNDU CNDU_ABCBank_30 June 2026.pdf pdf d. RF RF_ABCBank_30 June 2026.xlsx xlsx e. Signed RF RF_ABCBank_30 June 2026.pdf pdf f. Board Resolution BR_ABCBank_30 June 2026.pdf pdf 3. The BSP-Department of Supervisory Analytics (BSP-DSA) shall evaluate the scanned documentary requirements submitted via email, as provided under Item A.2 above. If complete and correct, BSP-DSA shall proceed with the registration in the FitPro of the Participant’s authorized representatives. If incomplete or with deficiencies, the BSP-DSA shall notify the Participant through the registered email address of its Chief Compliance Officer (CCO) or its designated alternate. Registration shall be deferred until all deficiencies are addressed and the complete set of documents is re-submitted. 4. Upon receipt of BSP-DSA’s notification confirming that the submitted scanned documentary requirements are complete and correct, the Participant shall, within ten (10) banking days, transmit three (3) original copies of the same documents, duly signed and notarized4 (as applicable), to the following address: The Director Department of Supervisory Analytics 11/F Multistorey Building Bangko Sentral ng Pilipinas A. Mabini Street, Malate Manila, 1004 Philippines 4 Failure of the Participant to submit the required three (3) original, duly signed and notarized (as applicable) copies of the documentary requirements within the prescribed deadline shall result in the suspension or deactivation of the Participant’s access to the FitPro until full compliance is achieved.

Page 3 of 5 5. The Participant will be notified via email once the BSP has completed the execution and notarization of its portion of the PA. Thereafter, copies of the fully executed counterparts, duly signed and notarized by both parties, shall be made available for pick-up by the Participant at the BSP Hub. B. Registration Procedures

1. Authorized Representatives/Users. Only the Head of Human Resource Department and the Chief Compliance Officer, or their officially designated representatives approved by the Board, shall be registered as authorized representatives for the FitPro. To ensure continuity and proper handling of user changes (e.g., resignation, reassignment), authorized access shall be linked to the users’ official domain￾based designated group email accounts for FitPro rather than their personal email. This approach ensures that system notifications and responsibilities remain active and accessible even when personnel changes occur.
2. Two-Factor Authentication (2FA). All authorized representatives shall enroll in the FitPro’s 2FA protocol, as outlined in the FitPro Requestor’s Manual available at the BSP website, https://www.bsp.gov.ph/ses/reporting_templates, where the latest version may be accessed.
3. Initial Registration Requirements. Initial registration of authorized representatives shall be processed upon BSP-DSA’s confirmation of the completeness and correctness of the scanned documentary requirements submitted via email.
4. Updating Authorized Representatives/Users. Any changes to the list of authorized representatives shall be made by submitting an updated RF and CNDU, following the procedures and formats in Item A.2.(c), (d) and (e). The updated RF will serve as the new list of authorized representatives and will replace the previously submitted RF.
5. System Credentials. Upon successful registration, FitPro will send the system credentials via email, including the user ID and default password. Authorized representatives shall change their password immediately after their first login. C. FitPro Access
6. System Access Details. ▪ URL: https://fitpro.bsp.gov.ph ▪ Availability: Monday to Friday, 9:00 AM to 6:00 PM, excluding holidays.
7. Support and Downtime. In the event of system inaccessibility due to periodic maintenance, unscheduled downtime, or other similar situations, the Participant or its authorized representatives may coordinate with BSP-DSA by sending an email to dsa-fitpro@bsp.gov.ph.
8. Access Reactivation. In cases of suspension or deactivation for reasons specified in this Memorandum, or for such other grounds as may be deemed appropriate by the BSP, reactivation shall require the submission of an email request to dsa-fitpro@bsp.gov.ph. Such request shall include a justification for the deficiency or discrepancy and a proposed action plan to prevent its recurrence.

Page 4 of 5 D. Authorization Form for Querying (AFQ) the BSP Records

1. Requirement to Secure AFQ. The Participant shall require applicants who have passed the initial stages of pre-employment screening to accomplish the AFQ in the exact format and wording prescribed under Appendix 80 of the Manual of Regulations for Banks, as amended by BSP Circular No. 1236 dated 11 June 2026. The latest version of the AFQ template can be downloaded from the BSP website, https://www.bsp.gov.ph/ses/reporting_templates.
2. Form Completion Standards. The AFQ shall be: ▪ Duly accomplished - Do not leave any blank fields. Indicate “N/A” for fields that are not applicable. ▪ Typewritten - All entries must be typewritten. Handwritten entries are strictly prohibited, except for signatures. Digital signatures may be used where acceptable; however, wet signatures or other forms may be required or permitted at the discretion of the Notary Public. ▪ Saved in PDF to be used in uploading to FitPro. ▪ The AFQ shall be the latest version prescribed by BSP. ▪ Duly signed by the applicant and notarized.
3. Upload and Validation. The Participant shall: ▪ Validate the completeness, authenticity and correctness of the AFQ prior to uploading to FitPro. ▪ Upload the AFQ before initiating any search in FitPro. ▪ Ensure AFQ details match the intended subject before initiating any query. The upload of AFQ that is incomplete, erroneous, falsified, or does not correspond to the intended subject of the query, is strictly prohibited and shall subject the Participant to appropriate sanctions, including suspension or deactivation of access to FitPro and other actions as may be warranted under existing regulations.
4. Retention and Accessibility. The Participant shall retain a copy of the AFQ and maintain a system for updating these records. Such records shall be made available during on-site examination or upon request for off-site verification. The AFQ copies shall be retained and disposed of in accordance with the Participant’s records retention and disposal policy.
5. Compliance and Confidentiality. Information obtained from FitPro shall be used solely for the purpose stated in the AFQ. No other information or data from the AFQ shall be divulged without the written consent or authorization of the applicant. E. FitPro Searches and Results FitPro searches are based on mandatory fields, specifically the first and last names, as reflected in the accomplished AFQ. The middle name is an optional field.

Page 5 of 5 Search results may yield either (a) no hit or (b) a hit requiring further verification. In cases where no hit is generated, the result is communicated directly to the CCO through FitPro. Conversely, where results necessitate further validation, the status shall be subject to verification by the BSP, and the outcome shall be communicated by the supervising department in charge of the bank to ensure accuracy and proper identification of the individual subject of the query. Banks may refer to the FitPro Requestor’s Manual for detailed guidance on the procedures for conducting searches and receiving the results. In conducting searches, authorized representatives shall ensure that the information being queried is consistent with, and limited to, the details provided in the AFQ. Where it is necessary to validate search results, authorized representatives may exercise due diligence in confirming the identity of the applicant, provided that such actions remain within the scope of the information disclosed in the AFQ. F. Important Reminders:

1. Participants shall develop and implement an internal policy and procedure to enforce accountability and responsible use of the FitPro.
2. Information obtained through FitPro shall be used solely for purposes authorized under existing BSP regulations and shall not be disclosed to any third party without the BSP’s prior written consent.
3. Information obtained from FitPro that does not pertain to the applicant shall be disposed of immediately upon receipt by the bank. Meanwhile, information pertaining to the applicant shall be processed and retained in accordance with the Participant’s existing human resource and data privacy policies. For compliance. LYN I. JAVIER Deputy Governor 06 July 2026