BSP Memorandum No. 42 (2026)

.. To Subject BANGKO SENTRAL NG PILIPINAS OFFICE OF THE GOVEA NOR MEMORANDUM NO. M-2026-O42 All Concerned BSP-Supervised Financial Inst itutions Guidelines for t he Grant and Implementation of the Rural Bank Strengthening Program (RBSP) Digitalization Technical Assistance The Monetary Board. in its Resolution No. 81 dated 18 January 2024. approved the RBSP Technical Assistance (TA). which consists of Digitalization, Financial Advisory, and Capacity Building components intended to accelerate t he digital t ransformation of rural banks (RBs) and enhance t heir operations. capacity. and competitiveness. The RBSP TA shall serve as t he deployment mechanism for the incentives and support to qualified RBs under the RBSP. The provision of incentives and support is in line with Memorandum No. M-2022-024 dated 5 May 2022. which provides the RBSP overview. and Memorandum No. M-2022-040 dated 13 September 2022. which outlines the Guidelines on the Implementation of the RBSP. One of the key components under the RBSP TA is the RBSP Digitalization TA (the 'T A"'), which aims to support RBs in the migration from legacy information technology (IT) systems to cloud-based or Software-as-a-Service (Saas) Core Banking Systems (CBS ). For purposes of these guidelines. a Saas CBS is a cloud-hosted core banking system operated by an external provider and accessed by the bank over secure electronic channels on a subscription or usage basis and is treated as outsourcing of IT systems under BSP regulations. The TA shall include assistance for the acquisition and subscription to a Saas CBS for a limited period to enable enhancements in the operational efficiency. operational resilience. business continuity. cybersecurity. and regulatory compliance capabilities of RBs. In the long run. the TA likewise aims to support the viability and competitiveness of RBs amid the increasing digitalization in the financial system. These Guidelines set forth the scope. qualification requirements. documentary requirements. procedures. and other governing rules for the grant and implementation of the TA. as fol lows:

I. Scope and Duration The TA shall provide qualified banks with support for t he implementation and multi-year subscription to a Saas CBS. subject to the BS P's evaluation and approval in accordance with these Guidelines. The support shall include the services necessary to implement and operationalize the CBS. such as system configuration. data migration, system integration. testing. user training. commissioning. cloud infrastructure. technical support. system updates. and maintenance services.

The TA shall cover the following periods:

• an Implementation Period of six (6) months maximum. reckoned from the date of issuance by the Bangko Sentral ng Pilipinas (BSP) to the Service Provider of the deployment notic:e1 covering the Recipient RB. The Implementation Period shall cover the deployment of the CBS up to successful full system Go·Live2; and • a fixed Subscription Period of thirty-six (36) months from the end of the Implementation Period. The Subscription Period shall cover the continued access to and operation of the CBS and related support services upon successful system Go-Live.

II. Definitions For purposes of th is TA:

• Implementation refers to the activities necessary to deploy the CBS up to successful system Go-Live. including system configuration, data migration. system integration. testing, and training of the Recipient RB's personnel.

• Subscription refers to the ongoing provision of system access. cloud infrastructure. security and compliance, technical support. maintenance services. and system updates and related training following system Go-Live.

• Recipient RB refers to an RB whose application for the RBSP Digitalization TA has been approved by the BSP and has duly executed the RBSP Digitalization TA Agreement with the BSP.

Ill. Documentary Requirements The following documentary requirements shall be submitted for their application for the TA:

a. Letter of Application addressed to the Deputy Governor, FSS and signed by the President or an equivalent officer of the bank. The letter shall express the bank's interest to avail of the RBSP Digitalization TA and briefly discuss how the TA aligns with or supports the bank's long-term strategic, operational. digitalization, or financial inclusion initiatives;

b. Corporate Secretary's Certificate on the Board of Director's (BOD) approval of the Bank's application for the RBSP Digitalization TA. The bank may also attach supporting documents, where available, such as strategic plans, digitalization roadmaps, information technology plans. business plans, or similar internal documents:

c. Certificate of Compliance, including its capital computation. with the minimum capital requirements under Circular No. 1151. as of latest available cut-off date5 at the time of the application for the TA using the template attached as Annex A; 1 The deployment schedule for each recipient bank may vary depending on the date of submission of the bank's TA application. completion of the BSP evaluation and approval process. and execution of the TA Agreement between the BSP and the recipient bank. 2 Full system Go-Live shall be determined upon completion of the required implementation activities or milestones. in accordance with the Terms of Reference (TOR] and issuance by the BSP. in coordination with the recipient bank. of the Certificate of Completion and Acceptance (CCA), indicating that the Saas CBS is ready and available for production use. 3 Latest quarter-end reference cut-off date [e.g., 31 December 2025. 31 March 2026) Page 2of7

d. Certification from the President or an equivalent officer of the bank that t he bank has no existing subscription to a Saas CBS platform at the time of the application for t he TA:

e. Accomplished self-assessment checklist (Annex B) signed by the President or an equivalent officer of the bank: and f. Accomplished IT Outsourcing Questionnaire (Annex C).

IV. Qualification Criteria To be eligible for the TA, the applicant bank must meet the following criteria:

a. The bank submitted an application or a Letter of Intent. for any of the following RBSP Tracks during the program's availability period (21 September 2022 to 21 September 2025): Merger/Consolidation. Acquisition or Third-Party Investment. Upgrade of Banking License. or Capital Build-Up Program:

b. The bank's adjusted capital as of latest available Financial Reporting Package (FRP) cut-off date immediately preceding the date of application for t he TA is compliant with the minimum capital requirements under Circular No. 1151. dated 24 Aug ust 2022: and c. The bank does not have an existing subscription to a cloud-based or Saas CBS at the time of application for the TA. The BSP shall also consider the bank's overall risk profile, latest supervisory assessment. outsourcing risk management framework. information technology (IT) readiness. and operational capacity to support the prudent deployment. implementation. and sustainability of the TA.

V. RBSP Digitalization TA Agreement The RBSP Digitalization TA Agreement (or TA Agreement) shall contain the general terms and conditions governing the availment and implementation of the TA. The BSP. through the handling FSD. shall notify the bank and furnish a copy of the TA Agreement to be executed between the BSP and the Recipient RB upon favorable evaluation of the bank's application. The bank's acceptance of the TA Agreement shall be approved t hrough a Board Resolution authorizing the bank's availment of the TA. execution of the TA Agreement. and designation of the authorized signatory. The signed TA Agreement shall be notarized by the respective notary public of the Recipient RB and the BSP. The designated BSP signatory shall sign the TA Agreement only upon receipt of t he bank's signed and notarized TA Agreement. Failure of the bank to submit the signed and notarized TA Agreement within ten (10) banking days from receipt of notification of favorable evaluation from the BSP, may be considered as non-conformity with the subject TA agreement.

VI. Conduct of Self-Assessment Prior to Application The successful implementation and sustainability of the TA require the commitment and active participation of recipient RBs. Prior to submitting their applications. applicant banks shall conduct a self-assessment of their readiness and suitability to avail of the TA. The self-assessment shall consider key operational. organizational. and sustainability factors relating to the implementation and utilization of t he Saas CBS. Page 3 of7

In this regard, applicant banks shall accomplish and submit. together w ith other documentary requirements. the Self-Assessment Checklist provided in Annex B, duly signed by the bank's President or its equivalent officer. The actual terms. conditions, roles. and responsibilities rel ating to the availment and implementation of the TA shall be governed by the TA Agreement. should the bank's application be approved.

VII. Application and Evaluation Procedures Step 1: Submission of Application The applicant bank shall address its Letter of Application to the Deputy Governor. Financial Supervision Sector (FSS ). copy furnished to the head (i.e .. Director/Acting Director/Officer-in-Charge) of the bank's handling Financial Supervision Department (FSD). All documentary requirements. under Section Ill of these Guidelines, shall be scanned and submitted via email to fssmail@bsp gov ph. copy furnished to the TWG-RBSP through 1llll9.: rbsp@bsp QPY ph. Consistent with Memorandum No. M-2024-044 on the amended guidelines on the submission of reports/documents and communication through the BSP FSS mail-in account. the email subject shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application> The FSS Unit refers to the bank's handling FSD. For subsequent submissions relating to deficiencies. additional documents. or clarification. the email subject shall follow the prescribed format for the subj ect line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Additional Submission> Step 2: Completeness Validation Within five (5) banking days from receipt of the application and documentary requirements, the BSP shall acknowledge receipt thereof and inform the applicant bank whether the submission is complete; or additional documents. information, or clarification are required. If the BSP determines that the submission is complete. t he BSP shall inform the applicant bank accordingly and proceed w ith the evaluation of the TA application. On the other hand, applications with incomplete documentary requirements shall be returned and not be considered as officially received until all identified deficiencies have been fully complied with. Step 3: Evaluation of Application The BSP shall evaluate the application based on the qualification criteria under

Section IV of these Guidelines. Additional information may be requested by the BSP, as necessary, for purposes of evaluating the application. Page 4 of7

Considering that the TA involves support for the adoption of a Saas CBS. which constitutes a material IT outsourcing arrangement. TA applications shall likewise be evaluated in accordance with applicable BSP regulations on outsourcing, technology, and related risk management requirements. For purposes of this TA, the applicable regulatory requirements and processes may be streamlined or calibrated, taking into account the unique nature and implementation arrangements of the TA, without prejudice to the BSP's assessment of the bank's readiness and capacity to effectively implement and manage the Saas CBS. The BSP shall complete the evaluation within twenty-five (25) banking days from determination of completeness of documentary requirements under Step 2. If the application is recommended for approval. the BSP. through the FSD handling officer, shall inform the bank accordingly via email and provide the following:

a. A copy of the proforma TA Agreement: and b. An acknowledgement template indicating the estimated or indicative cost of the TA to be allocated to the bank. On the other hand. if the bank's application is not recommended for approval. the BSP shall return the application without further processing and inform the Bank accordingly of the results of the evaluation. as may be appropriate. The Bank may submit a new application once the identified deficiencies or concerns have been addressed. subject to the availability of the TA. Step 4: Execution of the TA Agreement by Bank The bank shall review the terms and conditions under the RBSP Digitalization TA Agreement. If acceptable. the bank shall sign t he same through its President or authorized signatory and have the document notarized. The bank shall submit the following:

a. Signed and notarized TA Agreement:

b. Corporate Secretary's Certificate of the BOD's approval of the bank's availment of the TA: the execution of a notarized TA Agreement: and the designation of the authorized signatory: and c. Copy of the acknowledgement form indicating the estimated or indicative value of the TA allocated to the bank, duly signed by the bank's authorized signatory. Within ten (10) banking days from receipt of the BS P's notification under Step 3. the bank shall submit the following:

• Scanned copies of the said three (3) documents. to be submitted via email to fssmail@bsp QOY pb. copy furnished to the TWG-RBSP through ~ rbsp@bsp ~ov ph. The email is addressed to the Deputy Governor, FSS, copy furnished to the head (i.e .. Director/Acting Director/Officer-in-Charge) of the bank's handling FSD. The email transmitting the said documents shall follow the prescribed format for the subject line as follows: <FSS Unit Acronym><space><BSFI Acronym><RBSP Digitalization TA Application-Submission of TA Agreement> Page 5 of7

• The original hard copies of the said three (3) documents shall be submitted to the BSP via courier/mail. The accompanying transmittal letter shall be addressed to the Deputy Governor, FSS, with copy furnished to the head (i.e., Director/Acting Director/Officer-in-Charge) of the bank's handling FSD, as follows: LYN I. JAVIER Deputy Governor Financial Supervision Sector Bangko Sentral ng Pilipinas A Mabini St., Malate Manila. Philippines Copy furnished: [Name of FSD Head] [Designation] [Financial Supervision Department] Bangko Sentral ng Pilipinas For purposes of determining timeliness of submission, the date of receipt by the BSP of the email containing the scanned copies shall be the basis. Failure to submit the required documents within the prescribed period may be considered a waiver or refusal of the TA. Step 5: Approval and Execution of the TA Agreement by the BSP Upon receipt and review of the bank's signed and notarized TA Agreement, the BSP shall formally approve the application and cause the execution and notarization of the TA Agreement by the authorized BSP signatory. The BSP, through the FSD handling officer, shall furnish the bank with the complete set of signed and notarized TA Agreements within ten (10) banking days, or such longer period as may be necessary, from availability of duly notarized and BSP-signed TA Agreement. Scanned copies of the signed and notarized TA agreements shall be transmitted by the BSP via email to the bank's signatory and focal person: while hard copies of the same documents shall be transmitted via courier/regular mail to the bank's registered address with the BSP, or, if requested. received in person by t he bank. Upon receipt thereof, the bank shall officially be considered a Recipient RB of the RBSP Digitalization TA. Step 6: Pre-deployment Activities Upon transmittal by the BSP of the complete set of signed and notarized TA Agreements via email. the TWG-RBSP shall coordinate with the Recipient RB and the Service Provider regarding the conduct of pre-deployment activities and other implementation arrangements necessary for the TA deployment.

VIII. Application Period The BSP shall begin accepting applications for the TA one (1) month from the issuance of these Guidelines. During the interim period, the BSP may conduct briefing sessions, orientations, or other information dissemination activities to guide RBs on the TA and facilitate their self-assessment and application preparations. Page 6 of 7

The deadline for the submission of applications shall be announced separately by the BSP through its official communication channels.

IX. Amendments and Supplemental Guidelines The BSP may amend. supplement. clarify. or issue additional guidelines. procedures. or instructions as may be necessary for the effective implementation of the TA. The BSP may likewise extend or adjust the timelines, submission periods. processing periods, or other procedural requirements under these Guidelines. as may be deemed necessary or appropriate. taking into consideration the availability of t he TA.

X. Communications and Announcements Notices. announcements. clarifications. supplemental guidelines. and other issuances relating to the TA shall be communicated by the BSP through official channels. including memoranda. circular letters. press releases. industry meetings. and other BSP communication platforms. For questions and clarifications. concerned banks may send electronic mail to their handling FSD. copy furnished. twg -rbsp@bsp gIDLpb. For guidance and implementation. / L.-._ L---, Y ELi M. REMOLONA. JR. Governor /2. August 2026 Page 7 of7

ANNEXA <Bank Letterhead> CERTIFICATION This certifies that <Name of Bank>. with capital of fl:<amount> as of <date month and y:ear of latest available cut-off date>. as supported by the attached capital computation. and with <number of> branches. complies with the minimum capital requirement of P<amount> for rural banks. pursuant to Section 8.3 of Republic Act No. 8791 (The Genera! Banking Law of 2000), as implemented by Section 121 of the Manual of Regulations for Banks. and as amended by Circular No. 1151 dated 24 August 2022. This further certifies that the Board and the Bank's stockholders have been informed and fully understand that should the Bangko Sentral determine that the Bank does not comply with the aforesaid minimum capita! requirement. the Bank"s relevant RBSP Technical Assistance application shall be returned without further processing. Signed this_ day Qf <month> 2026 at the <location>. Att: As stated <NAME AND SIGNATURE OF PRESIDENT> Position4 4 The signatory may be the President or an equivalent officer of the bank. Pagel of2

<Name of Rank> CAPITAL COMPUTATION As of <month> 2026 Particulars A. Unimpaired Paid-in Capital Surolus Undivided Profits B. Add: Deposit for Stock Subscription recognized as eauitv pursuant to Section 123 of the MORB C. Deduct:

1) Treasurv stock 2) Unbooked allowance for probable losses (which includes allowance for credit losses and impairment losses) 3) Total outstanding unsecured credit accommodations, both direct and indirect, to DOSRI granted by the bank proper: Provided, That in the case of government-owned or -controlled banks, the adjustment shall not include the unsecured peso-denominated credit accommodations to the Philippine National Government 4) Total outstanding unsecured loans, other credit accommodations and guarantees granted to su bsid ia ries 5) Total outstanding loans, other credit accommodations and guarantees granted to related parties that are not at arm's length terms as determined by the appropriate supervising deoartment of the Banako Sentral 6) Deferred tax assets that rely on future profitability of the bank to be realized, net of (a) any allowance for impairment and (bl associated deferred tax liability, if the conditions cited in PAS 12 on Income Taxes are met: Provided, That. if the resulting figure is a net deferred tax liability, such excess cannot be added to net worth 7} Reciprocal investment in equity of other banks/enterprises, whether foreign or domestic, the deduction shall be the lower of the investment of the bank or the reciprocal investment of the other bank or enterprise 8) Government counterpart equity, except those arising from conversion of arrearages under the Banoko Sentral rehabilitation program TOTAL CAPITAL Note: Supporting documents may be attached to this Annex Amount Page2of2

ANNEXB

RBSP Digitalization Technical Assistance (TA) Self-Assessment Checklist Name of Bank: ----------------- Date Accomplished: _ ____________ _ Please check(✓) the box to confirm that the following areas have been considered in the bank's self-assessment: Ell Self-Assessment Area II Assessed I Remarks/Comments (if any) D The bank has assessed the alignment of the TA LIi with its strategic, operational. digitalization. and/or financial inclusion initiatives. ~ The bank has assessed the readiness of its □ personnel. processes, systems, and operational arrangements to support the implementation and utilization of the Saas CBS. - The bank has assessed the availability of adequate connectivity, IT infrastructure. and 3 other relevant operational support □ arrangements necessary for the implementation of the Saas CBS. The bank has considered the need to designate capable personnel (e.g., focal person. 4 digitalization champion) who will actively □ coordinate w ith the BSP and Service Provider throughout the implementation and subscription periods of the TA. ~ D The bank understands that availment of the TA □ entails compliance with applicable terms and conditions. including subsequent monitoring and reporting requirements of the BSP. D The bank has assessed its ability to sustain and □ maximize the utilization of the Saas CBS during and, where feasible. beyond the TA period. - The bank has considered its willingness and capacity to assume accountability and 7 responsibility over the continued use □ (subscription). maintenance, administration. renewal, and modification (if any) of the Saas CBS upon completion of the TA period. ~ The bank has considered other operational, DI financial. or organizational factors relevant to its digital transformation initiatives. Page 1 of2 I I

We confirm that [Name of Bank] has conducted an internal self-assessment and has considered the foregoing areas in determining its readiness and suitability to apply for the RBSP Digitalization TA We acknowledge that the actual terms. conditions, roles, and responsibilities relating to the availment and implementation of the TA shall be governed by the RBSP Digitalization TA Agreement. should the Bank's application be approved. [Name and Signature of Presidents Position: _______ _ Date: ________ _ 5 The signatory may be the President or an equivalent officer of the bank. Page 2 of2

Annexe IT OUTSOURCING QUESTIONNAIRE FOR BSFI Note: This self-assessment should be maintained by high-level officers who have direct understanding of the institution's outsourcing arrangements. The BSFl's President or equivalent officer must review and sign-off prior to submission to BSP Please indicate specific references (e.g., index, page, section, or title) to supporting documents.

NAME OF BANK: DAT E ACCOMPLISH ED: ____ _ IT OUTSOURCING CONCERNS/RISKS IMPLEMENTED CONTROLS/COMPLIANCE

(Indicate N.A. if Not Applicable) Determine the extent of compliance with the following:

1. Legal and Regulatory Compliance, Governance and Risk Management, and Due Diligence a. Law on Secrecy of Deposits (R.A. No. 1405) b. Foreign Currency Deposit System (R .A. 6426) C. Anti-Money Laun dering Act (RA. No. 9160, as amended). particu larly on data/ file retention d . Electronic Commerce Act (RA. 8792 ) e. Data Privacy Law (R.A. 10173) f. Cybercrime Prevention Act (R.A. 10175) g. General Banking Law (R.A. 8791) h. Electronic Banking Services (BSP Circular 1033) i. Consumer Protection (BSP Circular 1048) 2. Governance and Risk Manaqement a. Adoption of written, board -approved outsourcing policy. Please provide details on policy title, Board approval and last review date, if already available b . Risk assessment procedure. resu lt s and justification in pursuing a technology outsourcing engagement C . BSFl's internal audit role/i nvolvement prior to and after the engagement of a TSP 3. Vendor Management, Performance and Suooort a. BSFl's monitoring process to manage t he outsourced IT service b . Process to audit TSP to assess its compliance with entity 's policy, procedures, security cont ro ls and re gulatory requirements Pagel of 2

IT OUTSOURCING CONCERNS/RISKS

c. BSFl's procedures in identifying, re p orting, and responding to security incidents and violations d . BSFl's contingency plan for replac ing the TSP in the event of its cessation 4. Security and Privacy a . Information security policies and initiatives to incorporate activities outsourced to TSP and risks pertaining to compromise of confidential/sensitive information p rocessed and/or stored by the TSP b. A comprehensive data inventory and a suitable data classification process to facilitate TS P's implen1entation of identity and access controls c. Monitoring and management fo r integrity checking, compliance checking, security monitoring, comprehensive incident response methodolog ies. and network performance d. Procedures established to securely destroy or remove the data when the need arises (e.g ., upon contract termination, either on expiry or prematurely) 5. Business Continuity Planning a. Responsibilities and procedures for availability, data backup. incident response and recovery, Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO). a n d Recovery Point Objectives (RPO) of systems or applications outsourced b. Frequency of business continuity and disaster recovery tests, validation process and testing methodology c. Contingency plan for replacing the TSP in the event of its cessation IMPLEMENTED CONTROLS/COMPLIANCE (Indicate N.A. if Not Applicable) Page 2 of 2