Integrated Currency Management System (ICMS) Rollout to the BSP Regional Offices and Branches (ROBs)

OFFICE OF THE DEPUTY GOVERNOR I REGIONAL OPERATIONS AND ADVOCACY SECTOR MEMORANDUM NO. M-2023-_____ 034 For : All Authorized Agent Banks (AABs) Subject : Integrated Currency Management System (ICMS) Rollout to the BSP Regional Offices and Branches (ROBs)1 In connection with our previous advisory on the subject dated 20 August 2021 (Annex A) and in line with the BSP’s continuing efforts to provide a more resilient, effective, and efficient digital workspace to its stakeholders by leveraging on digital technology, we inform that the Regional Operations Sub-Sector (ROSS) is carrying out a project that will update its existing currency management system in the countryside. The ICMS, which is the currency management system being used by the BSP Greater Manila Regional Office (GMRO) since 29 Aril 2019, will be rolled out by batches to the provincial BSP ROBs to replace the Integrated Regional Information System (IRIS)2. The activities relative to the ICMS pilot testing in the BSP Lucena Branch are underway. The rollout will continue in the remaining 23 ROBs and is targeted to be completed by Q2-2024. The ICMS rollout is scheduled to commence in January 2024. Attached, for reference, is the rollout schedule (Annex B). In view of the foregoing, AABs are hereby instructed to undertake necessary actions and participate in the following ICMS rollout activities to facilitate the smooth transition from IRIS to ICMS and ensure completion of the project within timelines: A. Before the ICMS rollout 1. Submit to the ROBs’ designated email address (Annex C), in pdf format, by 30 November 2023, the copy of the updated and duly accomplished VPN registration forms, as applicable to its current VPN setup (Annexes D and E). Alternatively, the forms may be downloaded from the following links. a. Remote VPN Form https://www.bsp.gov.ph/PaymentAndSettlement/VPNForm(Rem ote).pdf b. Site-to Site VPN Form https://www.bsp.gov.ph/PaymentAndSettlement/VPNForm(Site- to-site).pdf 2. The IT departments of AAB Head Offices shall coordinate with their respective branch offices on the configuration and activation of their VPN connectivity to ensure access to the following sites: 1 Except the BSP Greater Manila Regional Office (GMRO) 2 IRIS is the currency management system being used in the BSP ROBs, except the BSP GMRO. It is a Lotus Notes-based legacy (outdated) system that has been in use since 2002. It is nearing its end of support as certain systems/technical support will be discontinued by 2024. Page

a. Test https://cashportal-test.bsp.gov.ph/ https://csp-test.bsp.gov.ph/ b. Production https://cashportal.bsp.gov.ph/ https://csp.bsp.gov.ph/ The VPN configuration shall be completed 3 based on the attached rollout schedule (Annex B). Should there be any VPN concerns/queries and/or need for further assistance, our BSP IT Support may be reached through email at [email protected]. 3. Submit to the ROBs’ designated email address (Annex C), in pdf format, by 30 November 2023, the duly accomplished Cash Services Portal (CSP) User Registration (Annex F) and CSP Client Registration Form (Annex G) for location and user profile creation. B. During the ICMS Rollout The ICMS rollout to the ROBs will be done in two (2) phases. The first week is allotted for the user’s training while the second week is for the conduct of a parallel run. 1. Training The AAB’s authorized ICMS users shall attend the user’s training and participate in the training activities that will be conducted by the ICMS team. The respective ROBs will communicate the schedule of said training to their client banks. An ICMS user’s guide will also be provided in advance as a training/reference material. 2. Parallel run During the parallel run, AABs shall encode their transactions with the BSP both in IRIS and ICMS. Given that two (2) systems will be used during this period, it is anticipated that delays may be encountered in the processing of banks’ transactions. Nonetheless, we assure that appropriate measures will be undertaken to minimize the impact on operations. C. After the ICMS Rollout AABs shall continue to encode their transactions with the BSP both in IRIS and ICMS. The ICMS team will conduct post-rollout activities, which include assessment of the readiness of both the ROB and its client banks to implement the new system. Once the ROB is cleared to “go-live”, it will mark the formal adoption of the ICMS as its currency management system. Henceforth, all banks’ transactions will be encoded and processed through the ICMS only. 3 For the AAB Branches in Lucena City, VPN connection shall be configured by 30 November 2023 for the necessary pilot testing activities that may be undertaken therein.

However, as part of the transition period, AABs will be allowed to use the designated workstations in the BSP ROBs to encode their transactions with the BSP for a maximum of ten (10) working days after the ICMS go- live date. As the BSP intends to complete the ICMS rollout to the BSP ROBs within the prescribed timelines, AABs’ participation is crucial to the successful and timely completion of this endeavor. Changes in the schedule will be communicated to the AABs, if there will be any. For guidance and appropriate action. Digitally signed by Guerrero Rosabel Bernardo Date: 2023.11.09 18:23:45 +08'00' ROSABEL B. GUERRERO Sector-in-Charge 9 November 2023 ___ Atts: A/S

Annex A

Annex B Schedule of Integrated Currency Management System Rollout to the BSP Regional Offices and Branches Target Go-Live VPN Completion BSP ROB Rollout Schedule Date Date* Lucena, Butuan, Cotabato, 08 to 19 January 2024 29 January 2024 12 January 2024** Dumaguete, Ozamiz, Roxas, San Fernando (La Union) Batac, Dagupan, Legazpi, 05 to 16 February 2024 26 February 2024 09 February 2024 Naga, North Luzon Regional Office (Baguio), Zamboanga Bacolod, Cabanatuan, General 04 to 15 March 2024 25 March 2024 08 March 2024 Santos, Puerto Princesa, San Fernando (Pampanga), Tacloban Cagayan de Oro, Iloilo, 01 to 12 April 2024 22 April 2024 05 April 2024 Mindanao Regional Office (Davao), Tuguegarao, Visayas Regional Office (Cebu) * All banks’ transactions with the BSP will be encoded and processed only through the ICMS. ** For the AAB Branches in Lucena City, VPN connection shall be configured by 30 November 2023 for the necessary pilot testing activities that may be undertaken therein.

Annex C BSP Regional Offices and Branches Contact Information BSP Regional Office/Branch Contact Person E-mail Address Jansen C. Dugenia [email protected] BSP North Luzon Regional Office Marimar L. Doloiras [email protected] Geely Joy L. Pida-oc [email protected] Fleurdeliz D. Damaso [email protected] BSP Batac Branch Ray Osmon S. Riñopa [email protected] Janella S. Syyap [email protected] BSP Cabanatuan Branch Anabelle F. Belizario [email protected] Lorena T. Nalapo [email protected] BSP Dagupan Branch Leslie D. Melgar [email protected] Chezter Edgar C. Munar [email protected] BSP La Union Branch Fe Bernadine R. Siapno [email protected] Claireborne Y. Basilio [email protected] BSP San Fernando (Pampanga) Branch Jasmin Q. Flores [email protected] Ma. Cristina B. Quilang [email protected] BSP Tuguegarao Branch Emilson U. Jimenez [email protected] Claire Therese N. Berja [email protected] BSP Legazpi Branch Arlene V. Lunas [email protected] Danica Mae T. Jusay [email protected] BSP Lucena Branch Joy-Ann G. Español [email protected] BSP Naga Branch Sharon B. Moyano [email protected] BSP Puerto Princesa Branch Sharry Wisa P. Ang [email protected] Grace Hernando-Dinopol [email protected] BSP Visayas Regional Office Ruel R. Ancot [email protected] BSP Bacolod Branch Grace Ann Z. Gumban-Badiana [email protected] Angelique M. Lumaya [email protected] BSP Dumaguete Branch Novey G. Piao [email protected] Vern D. Yanson [email protected] BSP Iloilo Branch Mary Micah Grace P. Erispe [email protected] Karen Jane T. Ignacio [email protected] BSP Roxas Branch Ma. Christina B. Del Rosario [email protected] BSP Tacloban Branch Cheryl Ann S. Aldaba [email protected] Monica Marie Jalandoni-Bernales [email protected] BSP Mindanao Regional Office Gerard Patrick T. Jocson [email protected]

BSP Butuan Branch Jonalyn D. Sanchez [email protected] Anthony Jocille Q. Lacuin [email protected] BSP Cagayan de Oro Branch Gary T. Ocampo [email protected] Donnah Mae B. Garcia-Descalo [email protected] BSP Cotabato Branch Krsha Renzy T. Villariza [email protected] BSP General Santos Branch Rowena A. Purugganan [email protected] BSP Ozamis Branch Princess L. Heruela [email protected] BSP Zamboanga Branch Nino Cris S. Patiño [email protected]

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) Company/Institution Name (Registrant) Complete Address (Include zip code) Date of Request Registrant’s User/Representative Position Title Business Email Address Business Contact No. (Last Name, First Name, MI) Department/Office/Unit (Select one) Accounting Information Technology Trade Services Treasury Backroom Cash Operations Remittance Treasury Trust Remote Access VPN New VPN User Existing VPN User Reset VPN Password Delete VPN Account Two Factor Authentication (2FA) Details New Device Retire Device Reset PIN Tablet Tablet Smart Phone Smart Phone Desktop Desktop Laptop Laptop Device Operating System: Terms and Conditions: 1. The requested VPN access to BSP is provided for the exclusive use of Registrant to allow access in < Application Name >.. The request is accomplished by the Registrant’s authorized User/Representative and approved and signed by the Registrant’s Authorizing Officer. 2. The Registrant shall • conform to all the technical requirements of the BSP; • be responsible for any upgrades on hardware/software, configuration and troubleshooting to establish and support the VPN connectivity, as may be required; • Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users o any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP may revoke, block, or permanently disallow the use of this service without prior notice due to reasons that may compromise internal security. 4. Any issues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP < through the contact details provided in this form. I. Agreement II. Authorized by: I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings onto unauthorized users/computers. Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. (Signature over Printed Name) Date (Signature over Printed Name) Date Registrant’s User/Representative Registrant’s Authorizing Officer TDIO Form No. 04-006 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 1 of 3

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) To be accomplished by BSP III. Operational/Business Recommending Approval: VI. Processed by: Endorsed Denied (Signature over Printed Name) Date (Signature over Printed Name) Date Head / Approving Officer Authorized Staff BSP Endorsing Department/Unit Technology and Digital Innovation Office IV. Recommending Approval: Action/s Taken: Endorsed Denied (Signature over Printed Name) Date Authorized Officer Technology and Digital Innovation Office V. Approval: (Signature over Printed Name) Date Authorized Approver Technology and Digital Innovation Office TDIO Form No. 04-006 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 2 of 3

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Remote Access VPN) REMINDERS I. Filling-up the VPN Connectivity Registration Form (Remote Access VPN) 1. Application with incomplete/inaccurate information (e.g., name of Participant user, IP address for Remote Access VPN details, applicable Application Name, etc..) will be returned to the Participant Institution. 2. The Participant Institution must accomplish one (1) VPN Connectivity Registration Form (Remote Access VPN) per user. II. Guidelines A. Assistance may be requested from the IT Personnel (Network/Security) of the Participant Institution accomplishing this section. 1. Requirements for Remote Access VPN Connectivity: a. Internet Access Service (Minimum 2Mbps) b. Workstation c. VPN client (to be provided by BSP) B. Complete the Remote Access VPN and/or Two Factor Authentication (2FA) details: • Only one device can be registered. • For new VPN request, tick the “New VPN User” and specify the New Device Information for 2FA. • For replacement of device for 2FA request, tick the “Existing VPN User” and fill out the New and Retire Device Information for 2FA. • For reset of VPN password request, tick the “Reset VPN Password” • For deletion of an existing VPN account request, tick the “Delete VPN Account”. C. Dormant or idle accounts for 90 days shall be deactivated. D. If request for reactivation is not received, the account shall be deleted after being dormant for another thirty (30) days from date of deactivation. E. Requests for reactivation of dormant accounts shall use the VPN Registration Form. For further clarifications and inquiries, contact the concerned BSP Department. III. BSP End-User Department Contact Details BSP End-User Department Application/System Email Address Contact No. Payments and PhilPaSS Participant Browser [email protected] 8400-7071 Settlements Department 8400-7024 PhilPaSS Third Party System (PSD) 8400-7073 PhilPaSS Plus Participant Browser and STP Foreign Loan Approval and Registration System (FLAReS) Personal Equity and Retirement Account (PERA) Financial Markets (FM) - Monetary Operations System [email protected] 8708-7020 Domestic Market (MOS) 8708-7042 Operations Department Liquidity Forecasting System 8708-7038 (DMOD) (LFS) 8708-7047 8708-7024 Regional Operations (RO) Cash Services Portal (CSP)/ [email protected] 9884-8286 Integrated Currency [email protected] 8988-4853 Management System (ICMS) 8708-7452 Cash Service Alliance (CSA) Department of Supervisory Financial Stability Coordinating [email protected] 306-2889 Analytics (DSA) Council – Information Sharing Department of Loans and Loans and Credit Management [email protected] TL: 8708-7701 Credit (DLC) Information System (LCMIS) [email protected] Loc 2807 or 2351 Technology Risk and Governance Risk and [email protected] TL: 87087701 Innovation Supervision Compliance (GRC) System [email protected] Loc. 2135 Department (TRISD) VPN-related concerns [email protected] DL: 5302-4190 TL: 8811-1277 Loc. 2113 Cybersecurity-related incidents/concerns [email protected] (24x7) DL: 5306-1599 TDIO Form No. 04-006 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 3 of 3

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) Company/Institution Name (Registrant) Complete Address (Include zip code) Date of Request Registrant’s User/Representative Position Title Business Email Address Business Contact No. (Last Name, First Name, MI) Department/Office/Unit (Select one) Accounting Information Technology Trade Services Treasury Backroom Cash Operations Remittance Treasury Trust Site-to-Site VPN Delete IP Address Add IP Address Preferred Date of Deletion: A. Primary VPN Gateway A. Primary VPN Gateway Client/Host IP Address Client/Host IP Address B. Secondary VPN Gateway B. Secondary VPN Gateway Client/Host IP Address Client/Host IP Address C. DR VPN Gateway C. DR VPN Gateway Client/Host IP Address Client/Host IP Address D. Test VPN Gateway D. Test VPN Gateway Client/Host IP Address Client/Host IP address Terms and Conditions: 1. The requested VPN access to BSP is provided for the exclusive use of Registrant to allow access in < >. The request is accomplished by the Registrant’s authorized User/Representative and approved and signed by the Registrant’s Authorizing Officer. 2. The Registrant shall • conform to all the technical requirements of the BSP; • be responsible for any upgrades on hardware/software, configuration and troubleshooting to establish and support the VPN connectivity, as may be required; • Inform the BSP Business Department for o the list of active IP addresses and authorized VPN users o any changes in the VPN configuration five (5) days in advance to avoid disruption of the services. 3. The BSP may revoke, block, or permanently disallow the use of this service without prior notice due to reasons that may compromise internal security. 4. Any issues/errors encountered in the system, breach or compromise in the aforementioned application services shall be immediately relayed to BSP < > through the contact details provided in this form. s I. Agreement II. Authorized by: I hereby agree to the above terms and conditions. I also agree to keep confidential all information regarding the VPN. I will not disclose and/or copy the VPN settings onto unauthorized users/computers. Propagating BSP VPN configuration is considered a security breach and is ground for the termination of the account. (Signature over Printed Name) Date (Signature over Printed Name) Date Registrant’s User/Representative Registrant’s Authorizing Officer \\ TDIO Form No. 04-007 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 1 of 3

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) To be accomplished by BSP III. Operational/Business Recommending Approval: VI. Processed by: Endorsed Denied (Signature over Printed Name) Date (Signature over Printed Name) Date Head / Approving Officer Authorized Staff BSP Endorsing Department/Unit Technology and Digital Innovation Office IV. Recommending Approval: Action/s Taken: Endorsed Denied (Signature over Printed Name) Date Authorized Officer Technology and Digital Innovation Office V. Approval: (Signature over Printed Name) Date Authorized Approver Technology and Digital Innovation Office TDIO Form No. 04-007 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 2 of 3

VIRTUAL PRIVATE NETWORK (VPN) CONNECTIVITY REGISTRATION FORM (Site-to-Site VPN) REMINDERS I. Filling-up the VPN Connectivity Registration Form (Site-to-Site VPN) 1. Application with incomplete/inaccurate information (e.g., name of Participant user, IP address for Site- to-Site VPN, applicable Application Name, etc.) will be returned to the Participant Institution. 2. The Participant Institution may use one (1) VPN Connectivity Registration Form for all the end-users IP addresses. Use separate sheet for additional IP addresses as necessary. II. Guidelines A. Assistance may be requested from the IT Personnel (Network/Security) of the Participant Institution accomplishing this section. 1. Requirements for Site-to-Site VPN Connectivity: a. Internet Access Services (Minimum 2Mbps) b. Static Public IP address provided by Internet Service Provider c. Enterprise firewall or an IPSEC/VPN-capable router B. Complete the Site-to-Site VPN details: 1. Indicate the static Public IP address of your Primary, Secondary and DR VPN Gateway. 2. Specify the static Public IP address assigned to your institution or assign one (1) Private IP address for all the participants of the system For further clarifications and inquiries, contact the concerned BSP Department. III. BSP End-User Department Contact Details BSP End-User Department Application/System Email Address Contact No. Payments and PhilPaSS Participant Browser [email protected] 8400-7071 Settlements Department 8400-7024 PhilPaSS Third Party System (PSD) 8400-7073 PhilPaSS Plus Participant Browser and STP Foreign Loan Approval and Registration System (FLAReS) Personal Equity and Retirement Account (PERA) Financial Markets (FM) - Monetary Operations System [email protected] 8708-7020 Domestic Market (MOS) 8708-7042 Operations Department Liquidity Forecasting System 8708-7038 (DMOD) (LFS) 8708-7047 8708-7024 Regional Operations (RO) Cash Services Portal (CSP)/ [email protected] 9884-8286 Integrated Currency [email protected] 8988-4853 Management System (ICMS) 8708-7452 Cash Service Alliance (CSA) Department of Supervisory Financial Stability Coordinating [email protected] 306-2889 Analytics (DSA) Council – Information Sharing Technology Risk and Governance Risk and [email protected] 87087701 loc. 2135 Innovation Supervision Compliance (GRC) System [email protected] Department (TRISD) VPN-related concerns [email protected] DL: 5302-4190 TL: 8811-1277 Loc. 2113 Cybersecurity-related incidents/concerns [email protected] (24x7) DL: 5306-1599 TDIO Form No. 04-007 * Version 0 * Updated 27 Sep 2021 File/Ref. No. ______________________ * Page 3 of 3

REGIONAL OPERATIONS SUB-SECTOR Cash Services Portal User Registration Form Date: _______________ NAME OF BANK: Name of Client Location: ______________________________________________________________ User Access *Name of Bank Personnel Official Email Address Office Contact Number Route: COINS NOTES  BSP  POLY  NGC  NGC  BSP and NGC  POLY and NGC Portal Service:  Withdrawal  Deposit  Both I further acknowledge that in affixing my signature, I am binding myself to the rules governing the use of the CSP account. The requested portal access to BSP is provided for the exclusive use of CSP users. In case your account has been compromised, kindly report the incident immediately to the BSP- ROSS through [email protected]. Signature: (Signature Over Printed Name) Approved by: (Signature over Printed Name) (Signature over Printed Name) Authorized Bank Signatory Authorized Bank Signatory *Submit this form together with a photocopy of your Employee ID to Currency Operations Division. (To be accomplished by BSP) Authenticated by: Approved by: Processed by: 1. _________ __________________________ Date (Signature over printed name) __________ ____________________________ __________ __________________________ Date Department Head Date ICMS Administrator (Signature over printed name) (Signature over printed name) 2. _________ _________________________ Date (Signature over printed name)

SAMPLE FORM REGIONAL OPERATIONS SUB-SECTOR Cash Services Portal User Registration Form Date: 10/10/2023 NAME OF BANK: Land Bank of the Philippines Name of Client Location: Land Bank of the Philippines - Lucena User Access *Name of Bank Personnel Juan Dela Cruz Official Email Address [email protected] Office Contact Number 8988-8888 Route: COINS NOTES  BSP  POLY  NGC  NGC X BSP and NGC X POLY and NGC Portal Service:  Withdrawal  Deposit X Both I further acknowledge that in affixing my signature, I am binding myself to the rules governing the use of the CSP account. The requested portal access to BSP is provided for the exclusive use of CSP users. In case your account has been compromised, kindly report the incident immediately to the BSP-ROSS through [email protected]. Signature: Juan Dela Cruz (Signature Over Printed Name) *Insert Bank Signatory’s name *Insert Bank Signatory’s’ name Approved by: and sign* and sign* (Signature over Printed Name) (Signature over Printed Name) Authorized Bank Signatory Authorized Bank Signatory *Submit this form together with a photocopy of your Employee ID to Currency Operations Division. (To be accomplished by BSP) Authenticated by: Approved by: Processed by: 1. _________ __________________________ Date (Signature over printed name) __________ ____________________________ __________ __________________________ Date Department Head Date ICMS Administrator (Signature over printed name) (Signature over printed name) 2. _________ _________________________ Date (Signature over printed name)

REGIONAL OPERATIONS SUB-SECTOR Integrated Currency Management System Cash Services Portal (CSP) Client Location Registration/Update Form Date: ___________________ BSP BRANCH: __________________________ NAME OF BANK: ___________________________________ New Location 1. 2. 3. 4. 5. Disable Location (Please indicate reason) Reason: Location Update From:__________________________________________ To: _____________________________________________ We hereby certify that the information provided above is true and correct. Approved by: (Signature over Printed Name) (Signature over Printed Name) Authorized Bank Signatory Authorized Bank Signatory Note: Submit this form to Currency Operations Division or Office of the Regional/Area Director. (To be accomplished by BSP) Validated by: Approved by: Processed by: 1 Date (Signature over printed name) Date RO/Branch Head Date ICMS System (Signature over printed Administrator 2 name) (Signature over printed Date (Signature over printed name) name) File/Ref. No.: _______________

SAMPLE FORM REGIONAL OPERATIONS SUB-SECTOR Integrated Currency Management System Cash Services Portal (CSP) Client Location Registration/Update Form Date: ___________________ BSP BRANCH: BSP Lucena NAME OF BANK: Land Bank of the Philippines New Location 1. Land Bank of the Philippines - Lucena 2. 3. 4. 5. Disable Location (Please indicate reason) Reason: Location Update From:__________________________________________ To: _____________________________________________ We hereby certify that the information provided above is true and correct. Approved by: *Insert Bank Signatory’s name *Insert Bank Signatory’s name and sign* and sign* (Signature over Printed Name) (Signature over Printed Name) Authorized Bank Signatory Authorized Bank Signatory Note: Submit this form to Currency Operations Division or Office of the Regional/Area Director. (To be accomplished by BSP) Validated by: Approved by: Processed by: 1 Date (Signature over printed name) Date RO/Branch Head Date ICMS System (Signature over printed Administrator 2 name) (Signature over Date (Signature over printed printed name) name) File/Ref. No.: _______________