Instruction No. 1/2026 on the Credit Liabilities Central Registry

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 .................................................................................................................................................................................................. Topics Credit Liabilities :: Credit Liabilities Central Registry Mod. 99999940/T – 01/14 Index Text of the Instruction Annex I to the Instruction – Characterization of information blocks, reporting frequencies, and deadlines Annex II to the Instruction – Description of variables Annex III to the Instruction – Definition of domain tables Annex IV to the Instruction – Information on branches abroad of participating entities Text of the Instruction Subject: Regulation of the Credit Liabilities Central Registry This Instruction primarily aims to revoke and replace Instruction No. 17/2018, of August 27, which regulates the operation of the Credit Liabilities Central Registry ("CRC"), in order to incorporate the necessary changes for the implementation of Decree-Law No. 103/2025, of September 11 ("Decree-Law No. 103/2025"), which transposed Directive (EU) 2021/2167 of the European Parliament and of the Council of November 24, 2021, establishing a harmonized framework for access to and exercise of the activity of managing non-performing bank credits, as well as a set of requirements for credit acquirers (Credit Assignment and Management Regime, hereinafter "RCGCB"), and for the revision of the CRC regime. Under the RCGCB, a duty is established for institutions and credit managers to report to the CRC the credits subject to assignment and the information elements relating to these credits provided for in applicable legislation and regulation, namely the information provided for within the scope of the CRC. In this way, it is necessary to (i) expand the scope of application to include credit managers as new participating entities, (ii) add additional information for the purpose of monitoring credits subject to assignment, and (iii) exempt participating entities from the duty to report information on assignments provided for in Article 9 of the RCGCB, given that the Bank of Portugal will, in accordance with the requirements of this Instruction, receive all information provided for in this regard at its headquarters.

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 Decree-Law No. 103/2025 also approves a new CRC regime, due to the need to update the current legislative framework, revoking the previous regime, and notably updating the definition of participating entities, the information subject to centralization, and the scope of centralization reporting. In the definition of participating entities, in addition to the entities provided for by the RCGCB, the list is expanded to include (i) entities authorized in other Member States that grant credit in Portugal under the free provision of services regime, (ii) crowdfunding financing service providers regarding credits arising from loans they have promoted, and (iii) credit institutions, payment institutions, electronic money institutions, and alternative credit investment funds constituted in another Member State may also be designated by the Bank of Portugal as participating entities for which credits originally granted in Portugal have been assigned. Regarding the information subject to centralization, the obligation to report daily credit events is introduced, making it necessary to define these events and their respective reporting rules. Regarding the reporting of centralization, the possibility is introduced for participating entities to access information on centralization relating to the 12 months prior to the last available centralization. Within the scope of this revision, the following changes are also introduced: (i) incorporation into the text of the Instruction of the reporting requirements applicable to the information to be communicated to the Bank of Portugal, (ii) introduction of an additional requirement regarding the ratio between the total amount of monthly installments associated with all loans held by the borrower and their net monthly income after taxes and mandatory Social Security contributions (debt service-to-income ratio, DSTI), for the purpose of monitoring the Bank of Portugal's Recommendation regarding new credit contracts concluded with consumers, (iii) introduction of an additional requirement for the purpose of monitoring credit intermediaries, whose legal regime is established by Decree-Law No. 81-C/2017, of July 7, and (iv) introduction of an additional requirement for the assessment of credit product characteristics. Thus, having Decree-Law No. 103/2025 revoked the legal regime relating to the CRC, approved by Decree-Law No. 204/2008, of October 14, it is considered more appropriate to revoke Instruction No. 17/2018 and adopt this Instruction, in order to ensure greater legal clarity of the regulation. This Instruction was subject to public consultation, in accordance with Article 101 of the Administrative Procedure Code, approved by Decree-Law No. 4/2015, of January 7, and the National Data Protection Commission was consulted. In these terms, in the exercise of the competence conferred upon it by Article 17 of its Organic Law, approved by Law No. 5/98, of January 31, in its current wording, by paragraph 6 of Article 2, by paragraphs 1 and 3 of Article 4, and by paragraphs 1, 2, 4, and 5 of Article 6 of the new CRC regime, which is contained in Annex II to Decree-Law No. 103/2025, of September 11, by Regulation (EU) 2016/867 of the European Central Bank

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 of May 18, 2016, on the collection of granular data relating to credit and credit risk, and by paragraph 3 of Article 9 and point (a) of Article 55 of the Credit Assignment and Management Regime, which is contained in Annex I to Decree-Law No. 103/2025, of September 11, the Bank of Portugal determines the following: Chapter I General Provisions Article 1. Object This Instruction regulates the operation of the Credit Liabilities Central Registry (CRC), which aims to centralize financial, accounting, and risk information on actual and potential credit liabilities arising from credit operations carried out by participating entities, in any form or modality, for which individuals, legal entities, or equivalent persons, resident or non-resident in national territory, are beneficiaries. Article 2. Scope of Application 1 - This Instruction applies to participating entities which are: a) Credit institutions, financial companies, payment institutions, and electronic money institutions with headquarters in Portugal; b) Credit institutions and financial institutions with headquarters abroad authorized to grant credit in Portugal through a branch; c) Entities referred to in the preceding letters authorized in other Member States and which grant credit in Portugal under the free provision of services regime; d) Alternative credit investment funds constituted in Portugal; e) Crowdfunding financing service providers regarding credits arising from loans they have promoted; f) Credit managers or institutions authorized in Portugal to exercise credit management activities in the name and on behalf of assignees under the Credit Assignment and Management Regime, approved as Annex I to Decree-Law No. 103/2025, of September 11, as well as credit managers authorized in other Member States operating in Portugal through the establishment of a branch or under the free provision of services regime, regarding credits granted in Portugal; g) Other entities designated by the Bank of Portugal: i. With a stable establishment in Portugal and exercising credit granting functions under special regimes;

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 ii. With a stable establishment in Portugal, not included in letter f), and exercising other functions associated with the assignment and management of credits originally granted in Portugal; iii. Being credit institutions, payment institutions, electronic money institutions, and alternative credit investment funds constituted in another Member State for which credits originally granted in Portugal have been assigned. 2 - Participating entities are obliged to communicate to the Bank of Portugal the information referred to in Article 6, with the Bank of Portugal being responsible for centralizing and disseminating information. 3 - Participating entities that communicate the information referred to in Article 6 appear on the list published on the Bank of Portugal's website. Chapter II Duty to Report Article 3. Scope of Information Participating entities are obliged to provide the Bank of Portugal with all information elements relating to the characterization of credit, as well as, where applicable, all advanced, financial, accounting, and risk information regarding liabilities arising from credit operations granted: a) In Portugal, to residents or non-residents in national territory, by their headquarters, subsidiaries, agencies, and branches; b) Abroad, to residents in national territory, by their branches abroad; c) Abroad, to non-residents in national territory, by their branches abroad, when expressly requested by the Bank of Portugal. Article 4. Covered Operations All credit operations meeting at least one of the following conditions must be reported to the CRC, in accordance with the description in Article 6: a) They imply credit risk for the participating entity; b) They constitute an asset of the participating entity; c) They are recognized under the applicable accounting standard and have previously generated credit risk for the participating entity;

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 d) They are managed by the participating entity and the creditor is not a participating entity in the CRC. Article 5. Excluded Operations 1 - The following types of operations must be excluded from reporting to the CRC: a) Debts forgiven by participating entities; b) Credit granted in discount of bills that were subject to restructuring, for which only the credit granted in discount of the new bill must be reported; c) Debt securities in the portfolio of participating entities. 2 - Contracts with an initial amount of less than 50 EUR must be excluded from reporting to the Bank of Portugal. Participating entities must begin to report information regarding such contracts if credit increases occur resulting in an outstanding amount equal to or greater than 50 EUR. Article 6. Information to be Communicated to the Bank of Portugal 1 - The information that participating entities must communicate to the CRC is organized into information blocks, based on their characteristics and nature: a) Static information — the base structure of CRC information, characterized by stability over time, although it may be subject to occasional changes. The following information blocks are included in this type: i. Block 1 — Entity; ii. Block 2 — Contract/instrument; iii. Block 3 — Protection; iv. Block 4 — Complementary to the contract; b) Periodic information — information whose reporting has a predefined frequency: daily, monthly, or quarterly. The following blocks are included in this type: i. Block 5 — Financial information; ii. Block 6 — Accounting information; iii. Block 7 — Entity risk information; iv. Block 8 — Instrument risk information; v. Block 9 — Advanced information.

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 2 - The characterization of information blocks, variables, reporting frequencies, and deadlines results from Annex I, the description of variables from Annex II, and the definition of domain tables from Annex III. 3 - Regarding branches abroad of participating entities, the information to be sent to the CRC depends on the country of location of the branch and the type and residence of the debtor, with the information blocks to be communicated identified in Annex IV, in accordance with the above. 4 - Amounts to be reported to the Bank of Portugal are expressed in euros, with two decimal places. 5 - Interest rates and other percentage values must be reported on a base of 100, with five decimal places. Article 7. Correction of Reported Information 1 - Whenever a participating entity, on its own initiative or at the request of the debtor or guarantor/surety, verifies that there has been an omission or inaccuracy in any past or present communication, it is obliged to proceed with the respective correction, sending the necessary communications to the Bank of Portugal for this purpose. 2 - The correction of information communicated to the Bank of Portugal must be carried out by participating entities within a maximum period of five business days. 3 - The deadline for correction counts from the moment the participating entity becomes aware of the omission or incorrect communication of any information. 4 - For the purposes of the preceding paragraph, the following are considered, namely, statements passed by the participating entity to its clients acknowledging the error or omission, or attesting to the regularization of a certain liability, as well as communications sent to them following complaints presented by clients, whether in the Complaints Book of the participating entity itself or through the Bank of Portugal. Chapter III Information to Debtors Article 8. Duty to Inform 1 - Participating entities must, upon the conclusion of the credit contract and on an auditable medium, inform debtors and guarantors/sureties about facts that may generate communications to the CRC. 2 - Participating entities must inform debtors of the start of communication of a credit contract with overdue amounts or written off to assets, prior to its sending to the CRC.

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 3 - In the case of guarantors or sureties who are called upon to replace debtors in the payment of the credit, participating entities must inform them of this situation and should only report them in a situation of overdue or written off to assets if the payment of the credit has not been made within the established deadline for this purpose. Article 9. Deadline for Retaining Proof of Information Provided to Debtors Proof of the provision of information to debtors or guarantors/sureties in accordance with Article 8 must be retained, on any auditable medium, for a period of five years, counting from the date on which the information was provided. Chapter IV Centralization Article 10. Definition and Scope of Centralization 1 - Centralization is the process of aggregating information on credit liabilities, for each individual, legal entity, or equivalent person, intervening in a credit contract as a debtor, guarantor, or surety. 2 - The monthly centralization carried out and disseminated by the Bank of Portugal covers the following elements: a) Information communicated by participating entities, relating to credit liabilities on a contract/instrument to contract/instrument basis, with its respective characterization; b) Data extracted from information sent to the Bank of Portugal by the Ministry of Justice regarding insolvency declarations of individuals and legal entities, in accordance with point (c) of paragraph 6 of Article 38 of the Insolvency and Corporate Recovery Code, approved by Decree-Law No. 53/2004, of March 18. 3 - Centralization does not cover all information reported to the Credit Liabilities Central Registry. 4 - The dissemination of centralized information excludes non-recourse factoring contracts, until at least 90 days have elapsed after the maturity of the invoices or bills of exchange, and credits in the form of deposits. Article 11. Distribution of Centralized Information 1 - The Bank of Portugal makes available, monthly, to the participating entities referred to in letters a) to d) and sub-letter i) of letter g) of Article 2, the centralization of credit liabilities relating to debtors and guarantors/sureties communicated by them, without any identification of the participating entities responsible for the information or the indication of the locality where the credit was contracted. 2 - The information received by the Bank of Portugal in accordance with point (b) of paragraph 2 of Article 10 is included in the centralized information with the indication of the judicial act associated with the process.

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 Article 12. Deadline for Dissemination of Centralized Information The centralized information referred to in the previous article is distributed on a monthly basis, until the end of the month following that to which the data relate. Article 13. Dissemination of Corrections to Centralized Information The Bank of Portugal periodically disseminates to participating entities corrections to the centralized information on debtors or guarantors/sureties previously communicated by them. These corrections cover information received after the distribution of their respective centralizations. Article 14. Access to Centralized Information 1 - In addition to the provision of centralized information provided for in Article 11, access to the centralized information of potential clients is granted to the participating entities referred to in letters a) to e) and sub-letter i) of letter g) of Article 2, provided they have obtained from these a request for credit granting or authorization to carry out this consultation. 2 - The information on credit liabilities made available to participating entities within the scope of centralized information consultations refers to the last month of distributed centralization, in its most up-to-date version, i.e., incorporating corrections made after that distribution. 3 - When requested, the participating entities referred to in letters a) to e) and sub-letter i) of letter g) of Article 2 may consult the centralized information of potential clients relating to the last 12 months prior to the last centralization or to daily events occurring since the last centralization, provided they have obtained from these a request for credit granting or authorization to carry out this consultation. 4 - In the context of a credit renegotiation, the participating entities referred to in letters f) and sub-letters ii) and iii) of letter g) of Article 2 may consult the centralized information in accordance with the definitions in the preceding paragraphs, with the express consent of the debtor for this purpose. 5 - The Bank of Portugal also provides access to the centralization of credit liabilities to insurance companies that, under the legal and regulatory provisions in force, are authorized to operate credit and surety insurance as provided for in Decree-Law No. 183/88, of May 24, while debtors with commercial credits granted by the insured remain as active parties in credit and surety insurance. 6 - Individuals, legal entities, or equivalent persons have the right to know their information, centralized and disseminated by participating entities, including the identification of the participating entities responsible for the information. Observing the existence of errors or omissions, they may request their correction or update with the participating entity responsible for the communication to the Bank of Portugal.

Instruction No. 1/2026 BO No. 2/2026 Supplement • 2026/02/24 Topics Credit Liabilities :: Credit Liabilities Central Registry .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 Article 15. Deadline for the Bank of Portugal's Response to Requests for Centralized Information The deadline for responding to requests for centralized information provided for in the previous article varies depending on how the consultation is carried out: a) File transfer — occurs by the next business day after receipt of the request; b) Online consultation or web services — occurs immediately, with the system available seven days a week, between 8:00 and 24:00. Article 16. Information Security 1 - When the consultation of centralized information is based on a request for credit granting or the express authorization of the client, participating entities must ensure, prior to the consultation, the adequate identification of the data holder. 2 - Participating entities must adopt technical and organizational measures for the traceability and auditing of individualized access to Credit Liabilities Central Registry information. Article 17. Information Retention Period 1 - For the purposes of centralizing credit liability information and its dissemination, periodic information communicated under this Instruction has a retention period of five years. 2 - For the purposes of centralization