Transition of the Cash Service Alliance (CSA) Web Application Access to the BSP Virtual Private Network (VPN)

Reference No. ROSS-2026-03-0053 BANGKO SENTRAL NG PitlPINAS OFFICE F THE DENrv GOVERNOR I REGIONAL OPERAnoNS AND ADVOCACY SECroR MEMORANDUM No. 2026-013 For All Authorized Agent Banks (AABs) Subject Transition of the Cash Service Alliance ItsA1 Web Application Access to the BSP Virtual Private Network 01PN I In line with the Bangko Sentral rig Pillpinas' (BSP) continuing frorts to enhance operational esiliency and promote a more secure, reliable, an efficient digital workspace. this is to inform all AABs that the BSP's Information Technology Infrastructure and Op rations Department (ITIOD) is initiating the transition of the CSA access from Citri to a VPN-based platform with a scheduled cutover date on 08 May 2026. In view of the foregoing. AABs are hereby instructed to undertake necessary actions and participate in the following activities to facilitate the smooth transition of access to CSA from Citrix to VPN; A PreparatoryActivities I. AABs shall submit to the designated local system administrators of BSP Regional Offices and Branches (ROBS). the updated and dulyaccomplished VPN Regist ation Forms in PDF format riot later than 08 May 2026. The approp iate VPN Registration Form to be accomplished shall depend on the AAB's IT infrastructure capability. Accordingly, AABs are advised to coordinate with their respective IT departments to determine the correct VPN form t be completed. Copies of t e forms are provided in the Remote VPN Form (Annex A1 and Site-to-Site VPN Form (Annex B). Alternatively, the forms may be downloaded from the following links: a. Remote VPN Form d. f b. Site-to ite VPN Form SI^^ Should there be any VPN concerns/queries and/or need for further assistance our BSP IT Support may be reached through email at 2. AABs sha I assign responsible point persons to ensure efficient coordinati n during enrollment, configuration. and testing activ'ties. . O 88.1. TBSP 0277) @ ESPmall@bsp. gov. ph @ bsp. gov. ph ^ A. Mahinl St. Malate 1004 Manila. Philippines Classification: GENERAL

CSA Con, ^9,411;, bn and tosting I. The IT departments of AAB Head Offices shall coordinate with their respective ranch offices on the configuration and activation of their VPN connectivit to ensure access to the CSA sites: a. Primary Site b, Second ry Site 2. AABs' authorized CSA users shall actively participate in the testing activities that will be conducted by the ITIOD team, 3. During the parallel testing phase. AABs shall access CSA through both Citrix and the CSA Web Portal via VPN. Given the use of two (2) portals, intermittent access issues may be encountered. Nonetheless the BSP assures that appropriate measures will be implemented to minimize operational disruptions. As part of the on tingency protocol, should VPN access issues arise, the AABs shall be advised by BSP ROBS' local system administrators, upon confirmation from IT100, to temporarily revert to Citrix access. Nori-compliance with the VPN on boarding requirements by the cutover date may lead to loss of system access and may disrupt operational processes dependent on the CSA ROB application. The cooperat on and timely participation of all AABs are critical to the successful implementation of this endeavor. Any changes to the above activities will be communicated accordingly Should there be further clarifications to the aforementioned activities. your designated representative/s may coordinate with the designated local system administrators of the BSP ROBS or via e-mail at For guidance and appropriate action. BERNADETrE -PUYAT Deputy r r 31 March 2026 Aha: AIS Cmssification: GENERAL

BANGKO SENTRAL NG PILIPINAS VIRTU L PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) Company/Institution Name IRegistrant) Complete Address Includezp code/ Date of Request Registrant's UsedRepresentative Position Title Business Email Address Business Contact No. icest Name, First Name, M, Department!'Office/Unit ise/ect one . Accounting . Information Technology . Trade Services . Treasury Backroom . Cash Operations . Remittance . Treasury I. Trust Remote Access VPN . New VPN User . Existing VPN User . Reset VPN Password I. Delete VPN Account Two Factor Authentication 12FA) Details . New Device . Retire Device . Reset PIN . 7^b/et . 7;^b/et . Sri 78rt Phone . Smart Phone . Desktop .Desktop . Laptop . Laptop Device Operating System: Clickor tap here to enter text. Terms and Conditions: I. The requested VPN access to BSP is provided for the exclusive use of Registrant to allow access in PhilPaSS Plus Participant Browser and STP The re ues~ is accom lished b the Registrant's authorized UsedRepresentative and approved and signed by the Registrant's Authorizing Officer. 2. The Registrant shall . conform to all the technical requirements of the BSP; . be responsible for any upgrades on hardware/software, configuration and troublesnooting to establish and support the VPN connectivity. as may be required: . Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users o any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP may revoke, block, or permanently disallow the use of this service without prior notice due to reasons that may compromise internal security. 4. Anyissues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP Payments and Settlements Department IPSD) through the contact details provi In t Is orm. Agreement 11, Authorized by I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings onto unauthorized users/computers. Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. (Signature over Printed Namej Date Isignature over Printed Name) Date Registrant's UsedRepresentative Registrant's Authorizing Officer TDIO Form No. 04-006 ' Version O ' U dated 27 Sep 2021 File/Ref. No. ' Pagel of 3

a I -A. BANGl<O SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) 444***;***;;;;**$***!*>%*^:^$!^%\\,'-u* ..*J ' ';" \': ' I' I:.',.-: * ' *'\ ,.;*** **,*.., * . , \*v*\ *****.*\:.*t \ ;;* .'*.: .*,**,,. it, , ~ . *4. ' . . . t*$*; 111. Operational/Business Recommending Approval: V!, Processed by: . Endorsed . Denied (Signature over Printed Name) Date Isignature over Printed Name) Date Head I Approving Officer Authorized Staff BSP Endorsing Department/Unit Technology and Digital Innovation Office IV. Recommending Approval: Action/s Taken: . Endorsed . Denied isignature over Printed Namej Date Authorized Officer Technology and Digital Innovation Office V. Approval: Isignature over Printed Name) Date Authorized Approver Technology and Digital Innovation Office TDIO Form No. 04-006 ' version O ' Up dared 27 Sep 2021 File/Ref. No ' Page 2 of 3

BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK 01PN) CONNECTIVITY REGISTRATION FORM (Remote AccessVPN) REMINDERS I, Filling-up the VPN Connectivity Registration Form IRemoteAccessVPN) I. Application with incomplete/Inaccurate Information leg. , name of Participant user, IP address for Remote ACce^ VPN details. applicable Application Name, etc. .) will be returned to the Participant Institution. 2. The Participant Institution must accomplish one (1) VPN Connectivity Registration Form (Remote Access VPN) per user 11. Guidelines A Assistance may be requested from the IT Personnel (Network/Sealriq/) of the Participant Institution accomplishing this section. I. Requirements for Remote Access VPN Connectivity a. Internet AccessService IMinimum 2Mbps) b. Workstation c. VPN client Ito be provided by BSP) B. Complete the Remote Access VPN and'orTwo FactorAuthentication (2FAj details . Only one device can be registered. . For new VPN request, tick the "New VPN User"' and specify the New Device Information for 2FA. . For replacement of device for2FA request, tick the ""Existing VPN User" and fillout the New and Retile Device Information for2FA . For reset of VPN password request, tick the "ResetVPN Password" . For deletion of an existing VPN account request, tick the "Delete VPN Account' C. Dormant or idle accounts for 90days shall be deactivated D. If request for reactivation is not received, the account shall be deleted after being dormant for another thirty (30) days from date of deactivation. E. Requests for reactivetion of dormant accounts shall use the VPN Registration Form. For further clarifications and inquiries, contact the concerned BSP Department 1/1. BSP End-UserDeparrrrient Contact Details asp End-User Department Application/System EmailAddress Contact No. Payments and PhilPaSS Participant Browser Payments_unit@bspgov. ph 8400-7071 Settlements Department PhilPaSS Third Party Sysaem 8400-7024 ipso) 8400-7073 PhilPaSS Plus Participant Browser and STP Foreign Loan Approval and Registration System (FLAReS) Personal Equity and Retirement Account IPERA) Financial Markets - Monetary Operations System BSPTD-MMOS@bsp. gov. ph 8708-7020 Domestic Market IMOS) 8708-7042 Operations Department Liqu dity Forecasting System 8708-7038 ILFS 8708-7047 8708-7024 Greater Manila Regional Cash Services Portal ICSPy CSd_icms-gp@bsp. gov. ph 9884-8286 Office ICMROj Integrated Currency CSa@bsp. gov. ph 8988-4853 Management System 11CMS) 8708-7452 Cash Service NIIanceICSA) Department of Supervisory Financial Stability Coordinating tsf-eis@bsp. gov. ph 306.2889 Analytics IDSAj Council- Information Sharing Department of Loans and Loans and Credit Management e, ?S@bsp. gov. ph TL: 8708-7701 Credit Information System (LCMIS) ICmis@bspgov. ph Loc 2807 or 2351 Cyber Security Group ICSG) Governance Risk and CIOng-iko@bsp. gov. ph 87087701 IOC. 2113 CompliancelGRCj System Technology Risk and in piabasan@bsp. 90v. ph 87087701 IOC. 2135 Innovation Supervision macatangayds@bsp. gov. ph De artment TRISD TDIO Form No. 04006 'Version O ' Updated Sep 2021 Flier Ref. No. ' Page 3 of 3

BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) Company/Institution Name (Reg trant) Complete Address 11nc/udez, ;>code/ Date of Request Registrant's UsedRepresentative Position Title Business Email Address Business Contact No. 11.85r Name, First Name. M, Department/Office/Unit Ise/ect one/ . Accounting . Information Technology . Trade Services . Treasury Backroom . Cash Operations . Remittance . Treasury . Trust Site-to-Site VPN . Delete IP Address . Add IP Address Prei^?fled Date of Delet/bn. ' A. Primary VPN Gateway A. Primary VPN Gateway Client/Host IP Address Client!'Host IP Address B. Secondary VPN Gateway B. Secondary VPN Gateway Client/Host IP Address Client/Host IP Address C. DR VPN Gateway C. DR VPN Gateway Client/Host IP Address Client/Host IP Address D. Test VPN Gateway D. Test VPN Gateway Client/Host IP Address Client/Host IP address Terms and Conditions I. The requested VPN access o BSP is provided for the exclusive use of Registrant to allow access In PhilPaSS Plus Participant Browser and SFP The request is accomplished by the Registrant's authorized User/Representative and approved and signed by the Registrant's Authorizing Officer 2. The Registrant shall . conform to all the technical requirements of the BSP; . be responsible for any upgrades on hardware/software. configuration and troubles hooting to establish and support the VPN connectivity, as may be required; . Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP .may revoke. block, or permanently disallow the use of this service without prior notice due to reasons that may compromise Internal security. 4. Any issues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP Pa merits and Settlements Department IPSD through the contact details provided in this form. Agreement 11, Authorized by I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings onto unauthorized users/computers. Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. (Signature over Printed Namej Date Isignature over Printed Namej Registrant's UsedRepresentativ Registrant's Authorizing Officer TDIO Form No. 04007 ' Version O ' U ated 27 Sep 2021 Filer;?e, . No. Pa

\ ,\. BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK tvPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) fly, ***;$44***,****$7^;^^;$^^;,,^?@;,!;\@y*""*' ***\**;*\$*** 111. Operational/Business Recommending Approval: Vl. Processed by: . Endorsed . Denied Isignature over Printed Namel Date Isignature over Printed Name) Date Head I Approving Officer Authorized Staff BSP Endorsing Department/Unit Technology and Digital Innovat;on Office IV. Recommending Approval: Action/s Taken: . Endorsed . Denied Isignature over Printed Name) Date Authorized Officer Technology and Digital Innovation Office V. Approval: isignature over Printed Namej Date Authorized Approver Technology and Digital Innovation Office TDIO Form No. 04007 ' Version O ' Updated 27 Sep 2021 File/Ref. NG ' Page 2 of 3

BANGKO SENTRAL NG PILIPINAS VIRTUAL PRIVATE NETWORK (\/PN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) REMINDERS I. Filling-up the VPN Connectiv y Registration Form Isite-to-Site VPN) Application with incomplete/Inaccurate information Ie. g. , name of Participant user, IP address for Site- to-Site VPN, applicable Application Name. etc. I will be returned to the Participant Institution. 2. The Participant Institution may use one (1) VPN Connectivity Registration Form for all the end-users P addresses Use separate sheet for additional IP addresses as necessary. 11. Guidelines A Assistance may be reque ted from the IT Personnel (Network/Security) of the Partic'pant institution accomplishing this section I. Requirements for Site-to-Site VPN Connectivity a. Internet Access Services (Minimum 2Mbps) b. Static Public IP address provided by Internet Service Provider c. Enterprise firewall or an IPSECNPN-capable router B. Complete the Site-to-Site VPN details I. Indicate the static Public IP address of your Primary. Secondary and DR VPN Gateway. 2. Specify the static Public IP address assig ned to your institution or assig n one (1) Private IP address for all the participants of the system. Please refer to table below. 10,000 -10,2552S5.254 Private IP address range 172,601 -1723/255.254 192.168.0.1 -, 92,168,255254 For further clarifications and inquiries, contact the concerned BSP Department 111. Ssp End-User Department Co tact Details BSP End-User Department Application/System EmailAddress Contact No. Payments and Phi Pass Participant Browser Payments_unit@bsp. gov. ph 8400-7071 Settlements Department Phi ass Third Party System 8400-7024 (Psoj 8400-7073 Phi Pass Plus Participant Browser and SrP Foreign Loan Approval and Registration System IFLAReS) Personal Equity and Retirement Account IPERA) Financial Markets - Monetary Operations System BSPTD-M MOS@bsp. gov. ph 8708-7020 Domestic Market IMOS) 8708-7042 Operations Department Liquidity Forecasting System 8708-7038 ILFS) 8'708-7047 8708.7024 Greater Manila Regional Cash Services Portal ICSP)/ CSd_icm5-gp@bsp. gay. ph 9884-8286 Office IC M RO) Integrated Currency CSa@bsp. gov. ph 8988-4853 Management System ticMSj 8'708-7452 Cash Service Alliance ICSA) Department of Supervisory Financial Stability Coordinating tsf-eis@bsp. gov. ph 306,2889 Anal^ics IDSA) Council-Information Sharing Cyber Security Group ICSG) CIOng-Iko@bsp. gov. ph 8708770110c. 2113 Technology Risk and Governance Risk and 87087701 IOC. 2135 in PIabasan@bsp. gov. ph Innovation Supervision Compliance (CRC) System macatangayds@bsp. gov. ph Department ITR!SD) TDIO Form No. 04-007 'Version O ' Updated 275ep 2021 File!'Ref. No ' Page 3 or s