Guidelines for the Grant and Implementation of the Rural Bank Strengthening Program (RBSP) Digitalization Technical Assistance

.. BANGKO SENTRAL NG PILIPINAS OFFICE OF THE GOVEA NOR MEMORANDUM NO. M -2026-O42 To A ll Concerned BSP-Supervised Financial Inst itutions Subject Guide lines for t he Gra nt and Impleme ntation o f the Rural Bank Strengthening Progra m (RBSP) Digit alization Technical A ssist ance The Monetary Board. in its Resolution No. 81 dated 18 January 2024. approved the RBSP Technica l Assistance (TA). wh ich consists of Digita lization, Financia l Advisory, and Capacity Bu ildin g compon ents intended to accelerate t he digital t ransformation of rural banks (RBs) and enhance t h eir operations. capacity. and competitiveness. Th e RBSP TA shall serve as t h e deployment mechanism for the in ce ntives and support to qualified RBs under the RBSP. The provision of incentives and support is in line with Memorandum No. M-2022-024 dated 5 May 2022. which provides the RBSP overview. and Memorandum No. M-2022-040 dated 13 September 2022. which outlines the Guidelines on the Implementation of the RBS P. One of the key components under the RBSP TA is the RBSP Digitalization TA (the 'T A"'), which aims to support RBs in the migration from legacy information tec h nology (IT) systems to c loud-based or Software-as-a-Service (Saas) Core Banking Systems (CBS ). For purposes of these guidelines. a Saas CBS is a cloud- hosted core banking system operated by an external provider and accessed by the bank over secure electronic channels on a subscription or usage basis and is treated as outsourcing of IT systems under BSP regulations. The TA shall include assistance for the acquisition and subscription to a Saas CBS for a limited period to enable enhancements in the operational efficiency. operational resi lience. busi ness continuity. cybersecurity. and regulatory compliance capabilities of RBs. In the long run. the TA likewise aims to support the viabi lity and competitiveness of RBs amid the increasing digitalization in the financial system. These Guidelines set forth the scope. qualification requirements. documentary requirements. procedures. and other governing rules for the grant and implementation of the TA. as fol lows: I. Scope and Duration The TA shall provide qual ified banks with support for t h e implementation and mu lti-year subscription to a Saas CBS. subject to the BS P's evaluation and approval in accordance with these Guidelines. The support shall include the services necessary to implement and operationalize the CBS. such as system configuration. data migration, system integration. testing. user training. commiss ioning. cloud infrastructure. technical support. system updates. and maintenance services.

The TA shall cover the following periods: • an Implementation Period of six (6) months maximum. reckoned from the date of issuance by the Bangko Sentral ng Pilipinas (BSP) to the Service Provider of the deployment notic:e1 covering the Recipient RB. The Implementation Period shall cover the deployment of the CBS up to successful full system Go·Live2 ; and • a fixed Subscription Period of thirty-six (36) months from the end of the Implementation Period. The Subscription Period shall cover the continued access to and operation of the CBS and related support services upon successful system Go-Live. II. Definitions For purposes of th is TA: • Implementation refers to the activities necessary to deploy the CBS up to successful system Go-Live. including system configuration, data migration. system integration. testing, and training of the Recipient RB's personnel. • Subscription refers to the ongoing provision of system access. cloud infrastructure. security and compliance, technical support. maintenance services. and system updates and related training following system Go-Live. • Recipient RB refers to an RB whose application for the RBSP Digitalization TA has been approved by the BSP and has duly executed the RBSP Digitalization TA Agreement with the BSP. Ill. Documentary Requirements The following documentary requirements shall be submitted for their application for the TA: a. Letter of Application addressed to the Deputy Governor, FSS and signed by the President or an equivalent officer of the bank. The letter shall express the bank's interest to avail of the RBSP Digitalization TA and briefly discuss how the TA aligns with or supports the bank's long-term strategic, operational. digitalization, or financial inclusion initiatives; b. Corporate Secretary's Certificate on the Board of Director's (BOD) approval of the Bank's application for the RBSP Digitalization TA. The bank may also attach supporting documents, where available, such as strategic plans, digitalization roadmaps, information technology plans. business plans, or similar internal documents: c. Certificate of Compliance, including its capital computation. with the minimum capital requirements under Circular No. 1151. as of latest available cut-off date 5 at the time of the application for the TA using the template attached as Annex A; 1 The deployment schedule for each recipient bank may vary depending on the date of submission of the bank's TA application. completion of the BSP evaluation and approval process. and execution of the TA Agreement between the BSP and the recipient bank. 2 Full system Go-Live shall be determined upon completion of the required implementation activities or milestones. in accordance with the Terms of Reference (TOR] and issuance by the BSP. in coordination with the recipient bank. of the Certificate of Completion and Acceptance (CCA), indicating that the Saas CBS is ready and available for production use. 3 Latest quarter-end reference cut-off date [e.g., 31 December 2025. 31 March 2026) Page 2of7

d. Certification from the President or an equivalent officer of the bank that t he ban k has no existing subscription to a Saas CBS p latfo rm at the time of the application for t h e TA: e. Accomplished self-assessment checklist (Annex B) signed by the President or an equivalent officer of the bank: and f. Accomplished IT Outsourcing Questionnaire (Annex C). IV. Qualification Criteria To be e ligible for the TA, the applicant bank must meet the following criteria: a. The bank submitted an appl ication or a Letter of Intent. for any of the following RBSP Tracks during the program's avai la bility period (21 September 2022 to 21 September 2025): Merger/Consolidation. Acquisition or Third-Party Investment. Upgrade of Banking License. or Capital Build-Up Program: b. The bank's adjusted capita l as of latest available Financial Reporting Package (FRP) cut-off date immediately preceding the date of application for t he TA is compliant with the minimum capita l requirements under Circular No. 1151. dated 24 Aug u st 2022: and c. The bank does not have an existing subscription to a cloud-based or Saas CBS at the time of application for the TA. The BSP shall also consider the bank's overall risk profi le, latest supervisory assessment. outsourcing risk management framework. information technology (IT ) readiness. and operational capacity to support the prudent deployment. implementation. and sustainability of the TA. V. RBSP Digitalization TA Agreement The RBSP Digital ization TA Agreement (or TA Agreement) shall contain the general terms and conditions governing the availment and implementation of the TA. The BSP. through the handling FSD. shall notify the bank and furnish a copy of the TA Agreement to be executed between the BSP and the Recipient RB upon favorable evaluation of the bank's application. The bank's acceptance of the TA Agreement sha ll be approved t hrough a Board Resolution authorizing the bank's availment of the TA. execution of the TA Agreement. and designation of the authorized signatory. The signed TA Agreement shall be notarized by the respective notary public of the Recipient RB and the BSP. The designated BSP signatory shall sign the TA Agreement only upon receipt of t he bank's signed and notarized TA Agreement. Fai lure of the bank to subm it the signed and notarized TA Ag reemen t within ten (10) banking days from receipt of notification of favorable evaluation from the BSP, may be considered as non-conformity with the subject TA agreement. VI. Conduct of Self-Assessment Prior to Application The successful implementation and sustainability of the TA require the commitment and active participation of recipient RBs. Prior to submitting their applications. applicant banks shal l conduct a self-assessment of their readiness and suitability to avail of the TA. The self-assessment shal l consider key operational. organizational. and sustainability factors relating to the implementation and uti lization of t he Saas CBS. Pag e 3 of7

In this regard, applicant banks shall accomplish and submit. together w ith other documentary requirements. the Self-Assessment Checklist provided in Annex B, duly signed by the bank's President or its equivalent officer. The actual terms. conditions, roles. and responsibilities rel ating to the availment and implementation of the TA shall be governed by the TA Agreement. should the bank's application be approved. VII. Application and Evaluation Procedures Step 1: Submission of Application The applicant bank shall address its Letter of Application to the Deputy Governor. Financial Supervision Sector (FSS ). copy furnished to the head (i.e.. Director/Acting Director/Officer-in-Charge) of the bank's handling Financial Supervision Department (FSD). All documentary requirements. under Section Ill of these Guidelines, shall be scanned and submitted via email to fssmail@bsp gov ph. copy furnished to the TWG-RBSP through 1llll9.: rbsp@bsp QPY ph. Consistent with Memorandum No. M-2024-044 on the amended guidelines on the submi ssion of reports/documents and communication t hrough the BSP FSS mail-in account. the email subject shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application> The FSS Unit refers to the bank's handling FSD. Fo r subsequent submissions relating to deficiencies. additional documents. or clarification. the email subject sha ll follow the prescribed format for the subj ect line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Additional Submission> Step 2: Completeness Validation Within five (5) banking days from receipt of the application and documentary requirements, the BSP shall acknowledge receipt thereof and inform the applicant bank whether the submission is complete; or additional documents. information, or clarification are required . If the BSP determines that the submission is complete. t he BSP shall inform the applicant bank accordingly and proceed w ith the evaluation of the TA application. On the other hand, applications with incomplete documentary requirements shall be returned and not be considered as officially received until all identified deficiencies have been fully complied with. Step 3: Evaluation of Application The BSP shall evaluate the application based on the qualification criteria under Section IV of these Guidelines. Additional information may be requested by the BSP, as necessary, for purposes of evaluating the application. Page 4 of7

Considering that the TA involves support for the adoption of a Saas CBS. which constitutes a material IT outsourcing arrangement. TA applications shall likewise be evaluated in accordance with applicable BSP regulations on outsourcing, technology, and related risk management requirements. For purposes of this TA, the applicable regulatory requirements and processes may be streamlined or calibrated, taking into account the unique nature and implementation arrangements of the TA, without prejudice to the BSP's assessment of the bank's readiness and capacity to effectively implement and manage the Saas CBS. The BSP shall complete the evaluation within twenty-five (25) banking days from determination of completeness of documentary requirements under Step 2. If the application is recommended for approval. the BSP. through the FSD handling officer, shal l inform the bank accordingly via email and provide the following: a. A copy of the proforma TA Agreement: and b. An acknowledgement template indicating the estimated or indicative cost of the TA to be allocated to the bank. On the other hand. if the bank's application is not recommended for approval. the BSP shall return the application without further processing and inform the Bank accordingly of the results of the evaluation. as may be appropriate. The Bank may submit a new application once the identified deficiencies or concerns have been addressed. subject to the availability of t he TA. Step 4: Execution of the TA Agreement by Bank The bank shall review the terms and conditions under the RBSP Digitalization TA Agreement. If acceptable. the bank shall sign t he same through its President or authorized signatory and have the document notarized. The bank shall submit the following: a. Signed and notarized TA Agreement: b. Corporate Secretary's Certificate of the BOD's approval of the bank's availment of the TA: the execution of a notarized TA Agreement: and the designation of the authorized signatory: and c. Copy of the acknowledgement form indicating the estimated or indicative value of the TA allocated to the bank, duly signed by the bank's authorized signatory. Within ten (10) banking days from receipt of the BS P's notification under Step 3. the bank shall submit the following: • Scanned copies of the said three (3) documents. to be submitted via email to fssmail@bsp QOY pb. copy furnished to the TWG-RBSP through ~ rbsp@bsp ~ov ph. The email is addressed to the Deputy Governor, FSS, copy furnished to the head (i.e.. Director/Acting Director/Officer-in-Charge) of the bank's handling FSD. The email transmitting the said documents shall follow the prescribed format fo r the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Submission of TA Agreement> Page 5 of7

• The original hard copies of the said three (3) documents shall be submitted to the BSP via courier/mail. The accompanying transmittal letter shall be addressed to the Deputy Governor, FSS, with copy furnished to the head (i.e., Director/Acting Director/Officer-in-Charge) of the bank's handling FSD, as follows: LYN I. JAVIER Deputy Governor Financial Supervision Sector Bangko Sentral ng Pilipinas A Mabini St., Malate Manila. Philippines Copy furnished: [Name of FSD Head] [Designation] [Financial Supervision Department] Bangko Sentral ng Pilipinas For purposes of determining timeliness of submission, the date of receipt by the BSP of the email containing the scanned copies sha ll be the basis. Failure to submit the required documents within the prescribed period may be considered a waiver or refusal of the TA. Step 5: Approval and Execution of the TA Agreement by the BSP Upon receipt and review of the bank's signed and notarized TA Agreement, the BSP shall formally approve the application and cause the execution and notarization of the TA Agreement by the authorized BSP signatory. The BSP, through the FSD handling officer, shall furnish the bank with the complete set of signed and notarized TA Agreements within ten (10) banking days, o r such longer period as may be necessary, from availability of duly notarized and BSP-signed TA Agreement. Scanned copies of the signed and notarized TA agreements shall be transmitted by the BSP via email to the bank's signatory and focal person: while hard copies of the same documents shall be transmitted via courier/regular mail to the bank's registered address with th e BSP, o r, if requested. received in person by t h e bank. Upon receipt thereof, the bank shall officially be considered a Recipient RB of the RBSP Digitalization TA. Step 6: Pre-deployment Activities Upon transmittal by the BSP of the complete set of signed and notarized TA Agreements via email. the TWG -RBSP shall coordinate with the Recipient RB and the Service Provider regarding the condu ct of pre-deployment activities and other implementation arrangements necessary for the TA deployment. VIII. Application Period The BSP shall begin accepti ng applications for the TA one (1) month from the issuance of these Guidelines. During the interim period, the BSP may conduct briefing sessions, orientations, or other information dissemination activities to guid e RBs on the TA and facilitate their self-assessment and application preparations.

The deadline for the submission of applications shall be announced separately by the BSP through its official communication channels. IX. Amendments and Supplemental Guidelines The BSP may amend . supplement. clarify. or issue additional guidelines. procedures. or instructions as may be necessary for the effective implementation of the TA. The BSP may likewise extend or adjust the timelines, submission periods. processing periods, or other procedural requirements under these Guidelines. as may be deemed necessary or appropriate. taking into consideration the availability of t he TA. X. Communications and Announcements Notices. announcements. clarifications. supplemental guidelines. and other issuances relating to the TA shall be communicated by the BSP through official channels. including memoranda. ci rcular letters. press releases. industry meetings. and other BSP communicatio n platforms. For questions and c larifications. concerned banks may send electronic mai l to their handling FSD. copy furn ished. twg -rbsp@bsp gIDLpb. For guidance and implementation. / L.-._ L---, Y ELi M. REMOLONA. JR. Governor /2. August 2026 Page 7 of7

ANNEXA <Bank Letterhead> CERTIFICATION This certifies that <Name of Bank>. with capital of fl:<amount> as of <date month and y:ear of latest available cut-off date>. as supported by the attached capital computation. and with <number of> branches. complies with the minimum capital requirement of P<amount> for rural banks. pursuant to Section 8.3 of Republic Act No. 8791 (The Genera! Banking Law of 2000), as implemented by Section 121 of the Manual of Regulations for Banks. and as amended by Circular No. 1151 dated 24 August 2022. This further certifies that the Board and the Bank's stockholders have been informed and fully understand that should the Bangko Sentral determine that the Bank does not comply with the aforesaid minimum capita! requirement. the Bank"s relevant RBSP Technical Assistance application shall be returned without further processing. Signed this_ day Qf <month> 2026 at the <location>. <NAME AND SIGNATURE OF PRESIDENT> Position 4 Att: As stated 4 The signatory may be the President or an equivalent officer of the bank. Pagel of2

<Name of Rank> CAPITAL COMPUTATION As of <month> 2026 Particulars Amount A. Unimpaired Paid-in Capital Surolus Undivided Profits B. Add: Deposit for Stock Subscription recognized as eauitv pursuant to Section 123 of the MORB C. Deduct: 1) Treasurv stock 2) Unbooked allowance for probable losses (which includes allowance for credit losses and impairment losses) 3) Total outstanding unsecured credit accommodations, both direct and indirect, to DOSRI granted by the bank proper: Provided, That in the case of government-owned or -controlled banks, the adjustment shall not include the unsecured peso-denominated credit accommodations to the Philippine National Government 4) Total outstanding unsecured loans, other credit accommodations and guarantees granted to su bsid ia ries 5) Total outstanding loans, other credit accommodations and guarantees granted to related parties that are not at arm's length terms as determined by the appropriate supervising deoartment of the Banako Sentral 6) Deferred tax assets that rely on future profitability of the bank to be realized, net of (a) any allowance for impairment and (bl associated deferred tax liability, if the conditions cited in PAS 12 on Income Taxes are met: Provided, That. if the resulting figure is a net deferred tax liability, such excess cannot be added to net worth 7} Reciprocal investment in equity of other banks/enterprises, whether foreign or domestic, the deduction shall be the lower of the investment of the bank or the reciprocal investment of the other bank or enterprise 8) Government counterpart equity, except those arising from conversion of arrearages under the Banoko Sentral rehabilitation program TOTAL CAPITAL Note: Supporting documents may be attached to this Annex Page2of2

ANNEXB RBSP Digitalization Technical Assistance (TA) Self-Assessment Checklist Name of Bank: - - - - - - - - -- - - - - -- - Date Accomplished: _ _ _ _ _ _ _ _ _ _ _ _ __ Please check( ✓ ) the box to confirm that the following areas have been considered in the bank's self-assessment: Ell Self-Assessment Area II Assessed IRemarks/Comments (if any) D LIi I The bank has assessed the alignment of the TA with its strategic, operational. digitalization. and/or financial inclusion initiatives. ~ □ The bank has assessed the readiness of its personnel. processes, systems, and operational arrangements to support the implementation and utilization of the Saas CBS. - The bank has assessed the availability of adequate connectivity, IT infrastructure. and 3 other relevant operational support □ arrangements necessary for the implementation of the Saas CBS. The bank has considered the need to designate capable personnel (e.g., focal person. digitalization champion) who will actively 4 □ coordinate w ith the BSP and Service Provider throughout the implementation and subscription periods of the TA. ~ D □ The bank understands that availment of the TA entails compliance with applicable terms and conditions. including subsequent monitoring D and reporting requirements of the BSP. □ The bank has assessed its abil ity to sustain and maximize the util ization of the Saas CBS during and , whe re feasible. beyond the TA period. - The bank has considered its willingness and capacity to assume accountability and responsib ility over the continued use 7 □ (subscription). maintenance, administration. renewal, and modification (if any) of the Saas CBS upon completion of the TA period. ~ DI I The bank has considered other operational, financial. or organizationa l factors relevant to its digital transformation initiatives. Page 1 of2

We confirm that [Name of Bank] has conducted an internal self- assessment and has considered the foregoing areas in determining its readiness and suitability to apply for the RBSP Digitalization TA We acknowledge that the actual terms. conditions, roles, and responsibilities relating to the availment and implementation of the TA shall be governed by the RBSP Digitalization TA Agreement. should the Bank's application be approved. [Name and Signature of Presidents Position: _ _ _ _ _ _ __ Date: _ _ _ _ _ _ _ __ 5 The signatory may be the President or an equivalent officer of the bank. Page 2 of2

Annexe IT OUTSOURCING QUESTIONNAIR E FOR BSFI Note: This self-assessment should be maint ained by high-level officers who have direct understanding of the institution's outsourcing arrangements. The BSFl's President or equi valent officer must review and sign-off prior to submission to BSP Please indicate specific references (e.g., index, page, secti on, or title) t o supporting documents. NAME OF BANK: DAT E ACCOMPLISH ED: _ _ _ __ IT OUTSOURCING CONCERNS/RISKS IMPLEMENTED CONTROLS/COMPLIANCE (Indicate N.A. if Not Applicable) Determine the extent of compliance with the following: 1. Legal and Regulatory Compliance, Governa nce and Risk Management, and Due Diligence a . Law on Secrecy of Deposits (R.A. No. 1405) b. Foreign Currency Deposit System (R .A. 6426) C. Anti-Money Lau n dering Act (RA. No. 9160, as amended). particu larly on data/ file retention d . Electronic Commerce Act (RA. 8792 ) e. Data Privacy Law (R.A. 10173) f. Cybercrime Prevention Act (R.A. 101 75) g . General Banking Law (R.A. 8791) h . Electronic Banking Services (BSP C i r cular 1033) i. Consumer Protection (BSP Ci rcular 1048) 2. Governance and Risk Manaqement a. Adoption of wri tten , board -approve d outsourcing policy. Please provide details on policy title, Board approval and last review date, if already available b . Risk assessment procedure. resu l t s and justification in pursuing a technology outsourcing engagement C . BSFl's internal audit role/i nvolveme nt prior to and after the engagement of a TSP 3. Vendor Management, Performance and Su o oort a. BSF l's monitoring process to manage t he outsourced IT service b . Process to audi t TSP to assess its compliance with entity 's policy, procedures, security con t ro ls and r e gulatory requirements Pagel of 2

IT OUTSOURCING CONCERNS/RISKS IMPLEMENTED CONTROLS/COMPLIANCE (Indicate N.A. if Not Applicable) c. BSFl's procedures in identifying, re p orting, and responding to security incidents and violations d . BSFl's contingency plan for replac i ng the TSP in the event of its cessation 4. Security and Privacy a . Information security policies an d initiatives to incorporate activities outsourced to TSP and risk s pertaining to compromise of confidential/sensitive information p rocessed and/or stored by the TSP b. A comprehensive data inventory and a suitable data classification process to facilitate TS P's i mplen1entation of identity and access controls c. Monitoring and management fo r integrity checking, compliance checking, security monitoring , comprehensive incident response methodolog ies. and network performance d. Procedures established to securely destroy or remove the data when the need arises (e.g ., upon contrac t termination, either on expiry or prematurely) 5. Business Continuity Planning a. Responsibilities and procedures for availability, data backup. incident response and recovery, Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO). a n d Recovery Point Objectives (RPO) of systems or app l ications outsourced b. Frequency of business continuity and disaster recovery tests, validation process and testing methodology c. Contingency plan for replacing th e TSP in the event of its cessation