Amendments to Section 911/911-Q of the (MORB)/Manual of Regulations for Non-Bank Financial Institutions (MORNBFI) – Money Laundering (ML)/Terrorist Financing (TF)/Proliferation Financing (PF) Risk Reporting and Notification Requirements

BANGKO SENTRAL NG PILIPINAS OFFICE OFTHE GOVERNOR CIRCULAR NO. 1193 Series of 2o.24 Subject: Amendments to Section 9ll/9ll-Q of the Manual of Regulations for Banks (MORB)/Manual of Regulations for Non-Bank Financial Institutions (MORNBFI) - Money Laundering (Ml)fierrorist Financing fffllproliferation Financing (PF) Risk Reporting and Notification Requirements The Monetary Board, in its Resolution No. 428 dated 18 April 2024, approved the amendments to the provisions of Section 9'll of the Manual of Regulations for Banks (MORB) and Section 9ll-Q of the Manual of Regulations for Non-Bank Financial Institutions (MORNBFII covering the MLfiF/PF risk reporting and notification requirements for BSP-supervised financial institutions (BSFls). This shall enable the Bangko Sentral to have timely and accurate information on significant risk events arising from MlfiF/PF-related activities and/or transactions, as part of its risk-based anti-money laundering and countering the terrorism and proliferation financing (AMUCTPF) supervision. Section l. Sections 9ll/911-Q of the MoRB/MoRNBFl, as amended by BSP Circular Nos. n54 and 1182, Series of 2o.22 and2o.23, respectively, are hereby amended to read as follows: ,II/gII-Q RISK MANAGEMENT All covered persons shall develop sound risk management policies and practices to ensure that risks associated with money laundering (ML)/terrorist financing (TF)/proliferation financing (PF), such as reputational, operational. and compliance risks, are identified, assessed, monitored, mitigated and controlled, as well as to ensure effective implementation of this Part, to the end that covered persons shall not be used as a vehicle to legitimize proceeds of unlawful activiry or to facilitate or finance terrorism, proliferation of weapons of mass destruction, and PF. This shall include, among others, the adoption of proportionate mechanisms aligned with covered person's risk profile to timely detect significant threats or key sources of MLfiF/PF risks events which maywarrant reporting/notification to the Board of Directors and/orSenior Management and to the Bangko Sentral. xxx PiskAssessnoent x x x New products ond business proctices risk ossessment. x x x Pisk Peporting ond Notificotion Pequirements The sound identification and management of ML/|F/PF risks are critical in ensuring the sustained resilience and integrity of the financial system, in general, as well as the safety and soundness of the covered persons, in particular. A critical component of a covered person's risk assessment and management process is the timely collection and analysis of relevant data, including risk events. In this regard, covered persons shall submit a report covering data and information on significant risk events arising from VLfiF/PF-related incidents rln relation to Sections 60l-SAOI-P/6OI-NiOt-T of the MORNBFt.

or activities that may have a material effiect to the covered person and/or the financial system. This report shall enable the Bangko Sentral to promptly identiff and respond to emerging risks and supervisory concerns as well as calibrate supervisory risk assessments, strategies, and activities, among others. a. Reporting requirements. Covered persons are required to submit MLfiF/PF Risk Event Report to the Bangko Sentral within twenty-four (24) hours from the date of knowledge or discovery of occurrence (i.e., from the time the event has been known or should have been known by the covered person) of any significant t"tUff/pf rist< event. An MLfiF/PF Risk Event refers to Ml.fiF/PF-related incident that may present material and/or adverse impact to the covered person, the financial system's posture, or erode public confidence therein. In determining whether an MLIF/PF risk event is significant and reportable, the following shall be considered: (1) The amount involved represents one (1) percent or more of the covered person's total qualirying capital; or (2) Regardless of the amount involved, the covered person has determined that the ML,/IF/PF-related incident has a material impact on the covered person and/or the financial system, such as those affecting significant number of customers or counterparties, with cross-border element, or those covered/may be widely covered in adverse media reports. b. Procedures for reporting to Bangko Sentral. The ML/|F|PF Risk Event Report shall contain, at a minimum, the following information: ) date of knowledge or discovery of occurrence of the event or incident; fl (2) brief description of the evenVincident, such as nature, type of the transaction/product, delivery channel used, and amount involved; (3) initial root cause of the eventfincident, if determined, and response/actions taken/to be taken by the covered person thereto; and (4) impact to the covered person based on initial assessment (i.e., in terms of fi nancial/operational/reputational losses). The Bangko Sentral may require the covered person to provide additional information, documents, and/or updates. as necessary. The Bangko Sentral may also conduct special or overseeing examination, as warranted, to veriff, among others, the root cause of the incident, assess the impact to the covered person and/or the financial system, if any, and identiff areas for improvement to strengthen the overall MUIF/PF risk management framework. c. Compliance with other risk reporting and notification requirements. Compliance with MLITFIPF risk event report shall not preclude covered persons from complying with other existing regulations of the Bangko Sentral on reporting crimes and losses and event-driven reporting and notification pursuant to Sections 1T3l1l2- Qn62-sn6] -Plgol-Nn83-T (Report on Crimes and Losses) and Sections148ll47-Q1145- Sn42-Pll26-N (Reporting and Notification Standards), respectively. In case the MUTFIPF risk event also qualifies as a major cyber-related incident, the submission of event-driven reporting and notification to the Bangko Sentral will be considered compliance with MLfiF/PF risk event report. On the other hand, MUrFIPF risk event report covering an incident which also qualifies fior reporting under operational risk event report2 and/or reputational risk report3, shall no longer require separate 2 Sections l46n46-Q,n25-Nn65-T (Notification and Reporting to Bangko Sentral) 3 sections l55n5l-Qn48-sn45-Pn29-Nn28-T (Risk Monitoring and Fleporting), pursuant to BsP circular No. lll4, Series of 2O2l Page 2 of3

reporting for both operational and reputational risks notification pursuant to existing regulations. d. Supervisory Enforcement Actions. Non-compliance with the reporting requirements on Flisk Event Report will be subject to applicable monetary penalty pursuant to Sections llO2nIO2-Q, as amended. Further, consistent with Sections OO2|OO2-Q/OO2-S/OO2-PIOO]-N IOOZ-T, the Bangko Sentral may deploy its range of enforcement actions to promote adherence to the requirements set forth in this Section and bring about timely corrective actions. Section 2. Appendix 7lQ-3lS-2lP-ilN-1lT-4 of the MORB/MORNBFI is hereby amended to include the following: Category Form No. MOR Report Title Frequency Submission Submission Ref. Deadline Procedure/ e-mailAddress B Unnumbered Sections MLfiF/PF RISK As risk event/ Within twenty- fsid- er]/eil-Q/ Event Report incident four (241 hours [email protected] 601-s/ occurs from knowledge so]-P/ or discovery of 60r-N/ occurrence lo]-T thereof Section 3. Effectivity. This Circular shall take effect fifteen (15) calendar days following its publication either in the Official Gazette or in a newspaper of general publication. FOR THE MONETARY BOARD: !1 April2o24