BSP Regulations on Financial Consumer Protection; Guidelines and Procedures Governing the Consumer Assistance and Management System of BSP-Supervised Financial Institutions; and Amendments to the Manual of Regulations for Banks and Non-Bank Financial Inst

BANoKo SenrnaL No Prurptras OFFICE OF THE GOVERNOR ctRcutAR No. 1048 Series of 2OL9 Subject: BSP Regulations on Financial Consumer Protection; Guidelines and Procedures Governing the Consumer Assistance and Management System of BSP-Supervised Financial lnstitutions; and Amendments to the Manual of Regulations for Banks and Non-Bank Financial lnstitutions The Monetary Board, in its Resolution No. 1282 dated 22 August 2Ot9, approved the amendments/deletions of certain provisions in the Manual of Regulations for Banks (MORB) and Manual of Regulations for Non-Bank Financial lnstitutions (MORNBFI). Section 1. Section 1001/41001Q/4701N/4401S and its Subsections are hereby amended to read as follows: Sec. 1001/4100tQl47OLN144015 Financial Consumer Protection Framework (Framework). Policy Stotement The Framework is in line with the responsibility of the Bangko Sentral ng Pilipinas under Section 3 of Republic Act No. 7653, as amended by Republic Act No. LL?LL, to promote broad and convenient access to high quality financial services and consider the interest of the general public. Bangko Sentral aims to ensure that financial service providers conduct ethical business practices and do not engage in practices that may cause harm to the consumer as well as consider consumer outcomes in the conduct of their business. Practices that harm consumers introduce risks not only at the level of the financial institution but also to the overall health of the financial sector particularly through decreased public trust and confidence. A well- informed and protected consumer can better benefit from the financial services received and be a more responsible client. The Framework establishes the guidelines and expectations from Bangko Sentral supervised financial institutions (BSFls) to institutionalize consumer protection as an integral component of corporate governance and culture as well as risk management. The objective of the Framework is for BSFIs to manage the risks of financial loss that are detrimental to the financial consumers or consumer protection risks inherent to the BSFIs' operations that, if not properly managed, would affect other relevant risks, such as compliance, reputational, legal, operational and credit risks.

Scope ond Applicobility.The Framework applies to all BSFIs in the conduct of their business. The BSFIs' adoption of the Framework shall be proportionate to their asset size, structure, nature of products and services, and complexity of operations. Consumer protection risk management system (CPRMSI. A BSFI should have a CPRMS that is integrated into the BSFI's enterprise-wide risk management processes and risk governance framework. The CPRMS includes the governance structure, policies, processes, measurement and control procedures to ensure that consumer protection risks are identified, measured, monitored, and mitigated. A carefully devised, implemented, and monitored CPRMS provides the foundation for ensuring the BSFI's adherence to consumer protection standards of conduct and compliance with consumer protection laws, rules and regulations, thereby, ensuring that identified risks to the BSFI and associated risk of financial harm or loss to consumers are properly managed. Consume r Protection Oversight. a. Responsibilities of the Board of Directors (Boord). The Board shall be primarily responsible for approving and overseeing the implementatlon of the BSFI's CPRMS. The Board's responsibilities shall include the following: (1) Approve the CPRMS and consumer assistance mechanism (CAM) that takes into consideration the BSFI's business model, market, product lines, and relationships with third parties that may give rise to consumer protection risks; (21 Promote a culture of ethical behavior and adherence to the highest standards of fair and responsible dealing with consumers; (3) Ensure that adequate information and actions taken are reported on a regular basis in terms of the measurement of consumer protection related risks, reports from the CAM, as well as other material consumer related developments that will impact the BSFI; (4) Ensure the adequate provision of resources and effective implementation of personnel training and competency requirements; (5) Approve remuneration and compensation packages structured to encourage responsible business conduct, fair treatment and avoidance/mitigation of conflicts of interest; and (5) Review periodically the implementation and effectiveness of the CPRMS including how findings are reported and whether the audit mechanisms are in place to enable adequate oversight, and put in place a regular mechanism to review the relevance of the CPRMS in case of changes in the BSFI business model and/or operating environment. Page2 of t2

b. Responsibilities of Senior Monagement. The Senior Management shall be responsible for ensuring that the practices of the BSFIs are aligned with the approved consumer protection policies and risk management system and consistently displayed throughout the BSFI's place of business particularly across all business units that deal directly with consumers. In this regard, the Senior Management shall: (1) Ensure that approved CPRMS and CAM policies and procedures are clearly documented, properly understood and appropriately implemented across all levels and business units. (21 Establish an effective monitoring and management information system to regularly measure, aggregate, and analyze consumer related issues to determine the level of consumer protection risk. An appropriate and clear reporting and escalation mechanism should also be integrated in the risk governance framework. The management information system should be able to: (a) Provide adequate information on the performance and quality of the BSFI's CAM that allows for identification of emerging consumer issues and root cause analysis; (b) Determine the level of consumer protection risk exposure through assessment of its implementation of the Consumer Protection Standards of Conduct (i.e. transparency and disclosure, protection of client information, fair treatment, effective recourse and financial learning and awareness); (c) ldentify and monitor, in a timely manner, consumer protection risk exposures approaching risks of loss to financial consumers, legal and reputational risk, as well as other related risks; (d) ldentify and assess emerging or increasing consumer risks that affect the BSFI such as through social media monitoring and market monitoring; (3) Ensure that adequate systems and controls are in place to promptly identify issues that affect the consumer across all phases of the relationship with the consumer; (4) Ascertain that weaknesses in the consumer protection practices or consumer protection emerging risks are addressed and corrective actions are taken in a timely manner; and (s) Ensure observance of expectations and requirements prescribed under relevant regulations on compliance and internal audit.

Section 2. Section L002/4IOO2a/4702N/44025 and its Subsections are amended to read as follows: Sec. 1002/4LOO2Q|47O2N|44O2S Policies ond Procedures, Consumer Protection Stondords of Conduct. The CPRMS and CAM should ensure systematic application of policies and procedures, including the Consumer Protection Standards of Conduct (Standards). The Standards should reflect the core principles, which BSFIs must observe at all times in their dealings with financial consumers: Provided, further, That these Standards should be embedded into the corporate culture of the BSFI, enhancing further its defined governance framework while addressing conflicts that are inimical to the interests of the financial consumer. Disclosure ond transparency.t BSFIs must ensure that their consumers have a reasonable holistic understanding of the products and services which they may be acquiring or availing. In this context, full disclosure and utmost transparency, to the extent allowed under applicable laws and regulations, are the critical elements that empower the consumer to make comparisons and informed financial decisions. This is made possible by providing the consumer with ready access to information that accurately represents the nature and structure of the product or service, its terms and conditions, as well as its fundamental benefits and risks. The BSFI demonstrates adherence to appropriate and adequate disclosure and transparency when: a. The manner of disclosure, whether in advertising materials, terms and conditions, and other forms of communication, are clear, concise, accurate, understandable and not misleading. b. Information are disclosed before, during and after a sale of a financial product or service and during key stages of the relationship with the consumer; especially if there are any changes in the terms and conditions. c. Terms and Conditions contain all significant provisions of the financial product or service giving prominence to key features/facts. lt includes the following with specific details relating to the type of product or service being offered: (1) lnformation on risks, return, possible warnings, any waiver of rights and limitations of liabilities, consumer's rights and responsibilities, I This Section should be read in conjunction with existing regulations related to disclosure and transparency of key information on loan and investment products and services, regulations on the conduct of treasury and trust activities of BSFIs and regulations g'overning fees on retail- bank producE/serwices and dormant, deposit accounts.

consequences of failure to meet obligations, rights and responsibilities of the BSFI, involvement of authorized agents, any conflict of interest by BSFI staff, cancellation and product portability, among others; (21 The full price or cost to the consumer including all interest, fees, charges, and penalties. The terms and conditions must clearly state whether interest, fees, charges, and penalties can change over time. The method for computing said interest, fees, charges, and penalties shall be disclosed consistent with existing regulations; and (3) For more complex products, such as investment products, the key features as well as costs and risks shall be highlighted in a key facts statement or Product Highlight Sheet (PHS). The PHS shall enable comparison with other products and shall be provided at no additional cost. Before the consumer signs any contract, the BSFI should ensure that the consumer has freely signed a statement to the effect that the consumer has duly received, read, and understood the PHS. d. Advertising materials are not false, misleading, or contain deceptive statements or omit key information that may materially and/or adversely affect the decision of the consumer to avail of a service or acquire a product. BSFIs are responsible for all the statements made in said advertising materials. e. The terms and conditions, advertising materials and other communications contain the following: (1) Contact and information of the BSFI's internal complaints handling unit; and (2) Statement that the BSFI is a regulated entity and contact information of the regulator. f. Communication of the BSFI staff is conducted in such a manner that clients can understand the terms of the contract and their rights and obligations, taking into consideration client segments that may have financial literacy limitations. g. Adequate time is given to consumers to review, ask questions and receive information to fully understand the terms and conditions prior to signing the contract or executing the transaction. BSFI should ensure that documents signed by the consumer are completely filled out and have no blank terms. The consumer should be given a copy of each of the documents he/she signed (including, but not limited to the contract) with all terms and conditions. The consumer should also be provided with proof of the transaction, whether printed or in electronic copy at the option of the consumer, immediately after the transaction has been completed.

h. Statements of Account or Billing Statements are provided regularly in a convenient manner to the consumer, or through the channel through which the product was sold, commensurate to the type of product and terms. i. Notifications in writing (or electronic form) and through other channels are provided to the consumer with regard to any of the key features and terms of the product, the nature and extent of the change and its potential impact on the consumer. This notification requirement also apply to similar changes to any condition/s specified in the contract. Nonetheless, this does not cover financial products that have been identified at the inception to be subject to floating interest rate all throughout their life cycle as long as basis has not changed. The principles of the above standards for disclosure and transparency shall be applicable even to products and services offered electronically as well as to products catering to different market segments with particular consideration for segments that may have limited financial literacy. Protection ol Client Informotion.2 Financial consumers have the right to expect that their financial transactions, as well as relevant personal information disclosed in the course of a transaction, are kept confidential and are secured. Towards this end, BSFIs must ensure that they have well-articulated information security guidelines, well-defined protocols, a secure database, and periodically re-validated procedures in handling the personal information of their financial consumers. This should be an end- to-end process that should cover, among others, the array of information that will be pre-identified and collected, the purpose and manner of gathering each information, the lnformation Technology (lT)-security infrastructure of the BSFI, and the protocols for disclosure, both within the BSFI and especially to third parties. The BSFI demonstrates the ability to protect client information if it is able to: a. Have a written privacy policy to safeguard its consumer's personal information. This policy should govern the gathering, processing, use, distribution, storage, and eventual disposal of client information and the identification of levels of permissible access to consumer's data for employees. The BSFI should ensure that privacy policies and sanctions for violations are implemented and strictly enforced. b. Ensure that privacy policies are regularly communicated throughout the organization. c. Have appropriate systems in place to protect the confidentiality and security of the personal data of its consumers against any threat or hazard to the security or integrity of the information and against unauthorized access. This includes a written information security plan that describes its program to protect consumer This Section should be read in conjunction with existing regulations on IT Risk Management System and Iaws and regulations on data privacy.

personal information. The plan must be appropriate to its size and complexity, nature and scope of its activities, and the sensitivity of consumer information it handles. d. Have a strong lT System in place to protect the confidentiality, security, accuracy, and integrity of consumer's personal information. This includes network and software design, as well as information processing, database storage, transmission, retrieval, and disposal. Security must be maintained throughout the life-cycle of consumer information, from data entry to disposal, and provide clear policies and procedures on data breaches including mechanisms to compensate consumers. e. Subject to the provisions of existing laws and regulations on data privacy, send written communication to its consumers informing and explaining how it will use and share the consumer's personal information. Obtain the consumers' written consent, unless in situations allowed as an exception by law or Bangko Sentral-issued regulations on confidentiality of consumer's information, before sharing consumers' personal information with third parties such as credit bureau, collection agencies, marketing and promotional partners, financial technologies that use a varied range of consumer data and other relevant external parties. g. Provide access to consumers to the information shared and allow consumers to challenge the accuracy and completeness of the information and have these amended as appropriate. FairTreatment This principle ensures that financial consumers are treated fairly, honestly, and professionally at all stages of its relationship with the BSFI. BSFIs shall adopt mechanisms to safeguard the interest of their consumers which shall include rules regarding ethical staff behavior, acceptable selling practices, fair and equitable terms and conditions, provision of products and services appropriate to the capacity and risk appetite of the consumers, among others, and incorporate the same in their policies and procedures, control functions and agreements with outsourced third parties. The BSFI demonstrates the principle of fair treatment towards financial consumers if the policies and practices observe the following: a. Terms and conditions are not unfair in that there is significant imbalance in the parties' rights and obligations arising under the contract, to the detriment of the consumer. b. Product and services are offered with skill, due care and diligence and shall consider the consumers' financial situation, needs, capabilities and overall risk profile. Adequate product suitability and affordability mechanisms shall be in place PageT of 12

subject to existing rules and regulations. lf the requested products are of higher risk rating than a consumer's risk tolerance assessment results, the BSFI should draw the consumer's attention to the risk mismatch and provide a written disclosure of consequences which is accepted by the client. Product bundling should also take into consideration the product suitability and should not unduly limit consumer choice. Adequate product approval are in place to ensure that products and services are fit for the targeted consumer. Product development, review, distribution and after sales process shall take into consideration the risks to consumers. d. BSFIs do not unduly limit a consumer's ability to cancel or transfer the product to another provider as disclosed in the terms and conditions. As may be appropriate, BSFIs shall provide the consumer who is a natural person with a cooling off period subject to the following conditions: (1) The "cooling-off' period shall be for a reasonable number of days, of at least two (2) banking days, immediately following the submission of any agreement or contract, particularly for financial instruments with a remaining term of at least one (1) year: Provided, fhat consumers with aggregate investment size of P500 thousand and above are excluded from invoking the cooling off period: Provided, further, That securities "traded" or "to be traded" are exempt from the coverage of the cooling-off period. (21 Consumers may be permitted to cancel the agreement without penalty of any kind upon his or her written notice to the BSFI during the cooling-off period. The BSFI may however collect or recover reasonable amount of processing fees. Conditions and fees for products with automatic right to cooling off must be appropriately determined, discussed and explained to consumers. e. BSFI staff treats consumers with professional competence and in a manner that is fair and responsible. The BSFI shall: (1) Incorporate in its Code of Conduct (Code) the values and standards that uphold protection of consumers and embed the Consumer Protection Standards of Conduc$ and have processes in place to detect, respond to and enforce sanctions on violations thereof. (21 Align its recruitment and training policies around professional, fair and responsible treatment of clients, for instance: (a) BSFI staff receives adequate training suitable for the complexity of the products or services they sell and are able to explain the key

features of the product, including statutory and regulatory requirements. (b) BSFI staff does not use deceptive or high pressure/aggressive sales techniques and should not force clients to sign contracts or rush into a financial deal without the benefit of shopping around. (c) BSFI staff involved in collections, as well as agents contracted for the purpose, receives training in acceptable debt collection practices and loan recovery procedures consistent with existing relevant regulations. (d) BSFI staff does not employ practices that discriminate or take advantage of difficulties faced by, vulnerable groups such as the low-income earners, and persons with disability. (e) Establish policies and procedures that aim to protect consumers' deposits and other assets against internal or external fraud or misuse and have mechanisms in place to manage and resolve actual conflicts of interest with respect to compensation policies that arise in the interaction between their staff and agents and their consumers and potential consumers. (3) Include ethical behavior, professional conduct, and quality of interaction with consumers as part of staff performance evaluations. (4) Ensure that the remuneration structure for staff of BSFI and authorized agents is in a manner that encourages responsible business conduct, fair treatment and avoidance/mitigation of conflicts of interest. (s) Perform appropriate due diligence before selecting the authorized agents/outsourced parties taking into account the agents' integrity, professionalism, financial soundness, operational capability and capacity, and compatibility with the Fl's corporate culture and implement controls to monitor the agents' performance on a continuous basis. Effective Recourse. Financial consumers should be provided with accessible, affordable, independent, fair, accountable, timely, and efficient means for resolving complaints with their financial transactions. BSFIs should have in place mechanisms for complaint handling and redress, and may employ various modalities or technological innovations. The BSFI demonstrates the ability to provide effective recourse if it is able to:

Establish an effective Consumer Assistance Management System (CAMS) designed to receive, record, evaluate, resolve, monitor and report consumer complaints, concerns, inquiries or requests to be implemented by a designated officer, unit, group or department commensurate to the size, structure, nature of products and services, and complexity of operations, ensuring that there is no conflict of interest. b. Establish, maintain and implement internal policies and practices for a reasonable and prompt handling of consumer concerns. c. Make available a wide range of channels in which consumers can conveniently lodge their complaints, inquiries and requests; and put in place a dedicated helpdesk or hotline for the said purpose. d. Maintain a management information system for the complaints from consumers that allows for consolidation, comparison and analysis on a regular basis including investigating whether complaints indicate an isolated issue or a more widespread issue for consumers. This analysis and reports of consumer complaints must have clear reporting and escalation structure within the BSFI's risk governance framework. The complaints reports shall be submitted in accordance with the existing regulations. e. Establish clear policies on investigation, resolution and restitution of complaints and making the process clear to the consumer. f. Ensure that information on the consumer assistance channels and applicable timelines for handling concerns are published in the following: (1) Terms and Conditions of a BSFIs product or service; (2) Various channels of service delivery; and (3) Conspicuous places within the premises of BSFIs and their branches/other offices. g. Provide for adequate resources to handle financial consumer complaints efficiently and effectively. Staff handling complaints should have appropriate experience, knowledge, and expertise. Depending on the BSFI's size and complexity of operation, a Senior staff member should be appointed to be in charge of the complaint handling process. Financial Educotion and Awareness. Financial education initiatives give consumers the knowledge, skills, and confidence to understand and evaluate the information they receive and empower them to make informed financial decisions. Because BSFIs deal directly with financial consumers, they have the reach, expertise, and established relationships ideal to deliver financial education, distinct

and separate from information about their products. BSFIs should provide basic information on consumers' and the BSFI's rights and responsibilities. BSFIs should demonstrate efforts at financial education, which may include digital literacy for products offered electronically, with the presence of programs whether as specific initiatives or as aspects embedded in their regular interface with consumers. Section 3. Section 1003/41003O/4703N/4403S are hereby amended to read follows: tOOSl41.OO3Q/4703N l44O3S. Enforcement Actions. Consistent with Sec. 002/4009Q, the Bangko Sentral may deploy enforcement actions to promote adherence to the Bangko Sentral Regulations on Financial Consumer Protection. Section 4. Considering the consolidation and re-numbering of the provisions of the above Sections and Subsections, reference to the renumbered provision is correspondingly amended/deleted as shown: Appendix With cross-reference On the: New Section Appendix 113 Appendix 115 EMV Card Fraud roo2 Liability Shift Framework Appendix 115 of the MORB, Appendix Q-64, Appendix N-12, and Appendix S-10 of the MORNBFI on the Guidelines and Procedures Governing the Consumer Assistance and Management System (CAMS) of BSP-supervised Financial lnstitutions are hereby deleted. Section 5. Section 4LOTC|4401P on Bangko Sentral Regulations on FinancialConsumer Protection is hereby added to the C and P Regulations of the MORBNBFI as follows: Section 4t0z0l44O1P Bangko Sentral Regulations on FinancialConsumer Protection. Credit card issuers/Pawnshops shall adopt a system for promptly addressing the complaints of their customers. The Financial Consumer Protection Framework of the Bangko Sentral ng Pilipinas as stated under Part Ten of the MORNBFI-Q Regulations shall be adopted insofar as these are applicable to credit card/pawnshop operations. Consistent with Section 4009Q, the Bangko Sentral may deploy enforcement action to promote adherence to the Bangko Sentral Regulations on Financial Consumer Protection. Section 6. Section 4904T of the T Regulations of the MORNBFI is hereby amended, as follows: Section 49O4T Applicable Regulations on Trust Corporations. Trust operations and investment management activities of trust corporations shall be subject to the

applicable regulations xxx Eight (Anti-Money Laundering Operations) and Ten (Financial Consumer Protection Framework)including the provisions of Section 4009Q (Enforcement Actions)of the MORNBFl, unless otherwise provided in this Manual. Section 7. The following transitory provision shall be incorporated as footnote to Sec. L00 1./4 100 LQ/ 47 OLN / 4 4OLS / 4IO2C/ 4 4OLP, a s f o I ows : I BSFIs shall be given six (6) months from the effectivity of this Circular to: (1) perform a gap analysis of their current consumer protection practices vis-i-vis this Section and (2) propose an action plan duly approved by the Board of Directors to achieve full compliance within a reasonable period of time but in no case longer than one (1) year from the effectivity of this Circular. Section 8. This Circular shall take effect fifteen (15) calendar days following its publication either in the Official Gazette or in a newspaper of general circulation. FOR THE MONETARY BOARD: al. \r' BENJAMIN E. DIOKNO Governor ( s"p."rber 2019 Page t2 of t2