Environmental and Social Risk Management Framework

BANGKO SENTRAL NG PILIPINAS CORRECTED COPY CIRCULAR NO. II28 Series of 20.21 OFFICE OFTHE GOVERNOR subJect Environmental and soclal Rlsk Management Framework The Monetary Board, in its Resolution No. 1443 dated 2l October 2O21. approved the guidelines that shall govern the integration of environmental and social (E&S) risks in the enterprise-wide risk management frameworks of banks that shall amend the provisions of Section I53r of the Manual of Regulations for Banks (MORB) on the Sustainable Finance Framework. Sectlonl. Section 153 of the MORB as introduced by Circular No.lO85 dated 29 April 2O2O, on the Duties and Responsibilities of the Board of Directors and senior Management is hereby amended as foilows: "I53 SUSTAINABLE FINANCE FRAMEWORK xxx Duties and Pesponsibilities of the Mrd of Dirutorc and *nior Management Boad of Dirstors. Consistent with the expectations set out under Sec.l32 to promote the long-term financial interest of the bank and ensure that it has beneficial influence on the economy, the board of directors (or equivalent management committee in the case of foreign bank branches) shall: a. Institutionalize the adoption of sustainability principles, including those covering E&s risk areas in the bank, by incorporating the same in the corporate governance and risk management frameworks as well as in the bank's strategic objectives and operations, risk strategy, risk appetite and risk management policies and procedures. Moreover, the board shall: fl) Set strategic E&S objectives covering short, medium, and long-term horizons; 1si?cti:oq added.pqr Circulqr No- lO8S,.gri9s of 2e2O (dated 29 April ZO?OI l5S Waf ....;:;:;;;'.;:;.:...:..,.;..;-.;;:-.........-: ,-, r r 0.,.,,-..:.,:.-.'...-.:j::::_::_-:;_-_..'.';..;.:,::,.:-;;r;.,:i:;i;-'1;::::i;j::ii orn;+*r*u**$t__*

Ql Approve the risk appetite on specific risk areas that the bank is willing and capable to manage, results of stress testing exercises, and assessment of the timing and channels through which E&S risks may materialize; and (3) Ensure that material E&S risks are considered in the Internal Capital Adequacy Assessment Process (|CA.AP) or internal capital planning process. b. Promote a culture that xxx xxx xtu xxx Monitor the progress of the bank in meeting its E&S strategic objectives and targets and ensure that issues in meeting the same are addressed. g. Institutionalize a capacity building program for the Board of Directors, all levels of management, and personnel to equip the bank in identiffing, measuring, monitoring, and controlling E&S risks. The board of directors shall likewise ensure that key personnel shall possess adequate knowledge, skills, and expertise necessary to perform their work. h. Ensure that adequate resources are available rotx xxx xxx i. Adopt an effective communication strategyto inform both internal and externalstakeholders of the bank's E&S strategic objectives and targets. j. Ensure that the sustainability agenda is integrated xxx. &nlor Managemanf. The senior management shall be responsible for the overall implementation of the board-approved strategies and policies in relation to the sustainability objectives of the bank. lt shall: a. Assess on a periodic basis the effectiveness of implementation and continuing relevance of said policies considering the developments in the business environment; b. Facilitate the identification, assessment, monitoring, and mitigation of E&S risks. The senior management shall ensure that the bank takes a holistic approach in managing these risks aligned with the strategic objectives set by the board of directors; ,*

c. Ensure that bank activities are aligned with the overall E&S strategic objectives and targets; d. Ensure adoption of methodologies and tools that will effectively identiff, and quantiff/measure, monitor and control E&S risks; e. Ensure that policies, procedures, and processes are clearly and effiectively commu nicated across the orga n ization ; f. Asess consistency of operations and performance of personnel with the bank's sustainability objectives; snd g. Apprise the board of directors andlor relevant management committee, on a regular basis, on the bank's exposure to E&S risks, which shall include potential issues associated with both internal and external activities of the bank and the activities of its clients that may have material impact on the bank's portfolio or reputation. Moreover, the senior management shall report its progress in implementing the bank's sustainability policies and ESRMS. Environment and Social Risk Management System (ESRMS). The ESRMS shall be articulated xxx a. Define the levelof risk appetite xxx Xxx Crdlt Plsk Managoncnt gem. Banks shall consider environmental and social (E&S) risks in defining credit risk appetite. The type, quantity, and severigl of E&S risks shall be evaluated taking into account different factors such as the type of loan, location of the borrower, project and/or collateral, and industry of the borrower, among others. Duties atd Respnslbllltlx of the Wtd of Ditectors ard &nior Managem.ent B@rd of dircctorc. Consistent with the expectations set out under Section lt$ of the MORB and in relation to the management of E&S related risks, the board of directors (or equivalent management committee in the case of foreign bank branchesl shall set strategic E&S objectives and targets for the bank's credit operations covering short, medium, and long-term horizons to facilitate the integration of E&S principles in lending operations. These objectives may include progressively increasing targets on the proportion of the loan portfolio allocated for sustainable financing. In this regard, the board of directors shall: Paget of 13

a. Set out clear criteria involving decisions to finance high E&5 risk sectors during the said term horizons. The criteria shall consider the long-term financial interest of the bank and its role in contributing to the sustainable goals and growth of the economy; and b. Ensure comprehensive discussion of credit related E&S risks of the bank as well as deviations from strategic objectives and targets set. &nlorqanrytement The senior management shall be responsible for the overall implementation of the board-approved credit strategies and policies in relation to the adoption of sustainability principles. In this regard, senior management sha ll: a. Ensure effective implementation of policies, procedures, and processes to identiff, measure, monitor and control E&S risks arising ftom credit operations, both at the individual and portfolio levels. b. Consider E&S f,actors in the credit underwriting and loan pricing frameworks aswellas in determining allowance for credit losses. c. Report periodically to the board of directors the bank's exposure to E&S risks arising from tredit operations, which shall include, among others, potential issues associated with the activities of its borrowers that may have material impact and the corresponding control measures to mitigate such risks. Ctdlt Rlsk St6iteg6 In line with the guidelines provided under Section 143 of the MORB. a bank shall consider E&S factors in defining its credit strategy aligned with the objectives set out by the board of directors. The bank is expected to review the composition of the loan portfolio, which may have existing exposures in markets, sectors, or geographic areas vulnerabte to matlrial E&S risks. Resutts of stress testing and scenario analysis should be considered in setting credit strategy and risk appetite- The banl shall deftne activities that are eligible for financing based on its E&S objectives and shall be sensitive to potential changes in the business environment and promptly respond to E&S risks in its loan portfolio' Crdit pisk Matagement Sysam (CPMS). Consistent with the guidelines provided undir Sections 143 and 153 of the MORB, a bank shall iaopt a CittS that will enable it to effiectively identiff, assess, monitor, report, and manage E&S risks. fulicies, Ptocdurcs, and Ptocesses. A bank shall adopt robust and dynamic policies, procedures, and processes that reflect its risk appetite and ciedit risk strategy. These shall provide comprehensive guidance in ,9 Page 4 ofl3

managing E&S risks, that aligns with the E&S objectives of the bank, for all phases of the credit risk management q6tem. The board-approved policies, processes, and procedures shall: (i) cover the identification and assessment of E&S risks emanating from both the borrower and portfolio levels; (ii) provide appropriate metrics, targets, and limits to measure and control exposures; and (iii) clearly set out the duties and responsibilities of the three lines of defense. The board-approved policies, processes, and procedures shall be documented in sufficient detail, effectively communicated throughout the organization, and periodically reviewed and updated. Relevant discussions and decisions shall be appropriately documented. Adherence to policies, processes, and procedures shall be monitored and assessed periodically to ensure that E&S risks arising ftom credit operations are effectively managed. Deviations ftom policiea processes, and procedures shall be documented and approved by the appropriate level of management. Risk ldentlllcatlqr and Asessment A bank shall consider the economic sector and location of the borrower as well as the collateral for the loan, among others, to identiff the bank's exposures to E&S risks. These shall be done at both the counterpargr and portfolio levels. A bank shall conduct a constructive dialogue with borrowers/counterparties who are significant sources of E&S risks. In identiffing and assessing E&S risks in its credit operations, a bank shall, at a minimum: a. Conduct E&S due diligence on the borrower at the inception of the client relationship and on an ongoing basis as part of the assessment of the E&S risk profile and creditworthiness. The bank may consider the industry/sector and geographic location of the borrower in defining the scope and depth of its due diligence. Additional documents may be required from the borrower such as, among others, third party certifi cations and/or other envi ron menta I permits/certifi cates as req u i red by law particularly those involved in enterprises that are heavily engaged in the extraction of natural resources. the emission of carbon and poisonous gases or substances in the air, land and water, or other activities that are identified as harmful to the environment; b. Consider the ability, willingness, and track record of the borrower in introducing and implementing E&S risk mitigation measures; c. Cover on and off-balance sheet ltems in assessing exposure to E&S rlsks; and d. Solicit external expertise to assist in the risk identification and assessment process, when necessary. h Page 5 ofl3

Pisk Masurcmeng ivbnitoritg, Reptting and Conttol A bank shall measure and manage E&S risks relative to its credit operations. lt shall adopt measurement methodologies that capture, quantiff, and assess the most relevant E&S risks. These shall include stress testing exercises and scenario analysis aligned with the banks business model, risk appetite, and credit risk strategy, among others. At a minimum, a bankshall: a. Actively manage, monitor, and control E&S risks both at the borrower and portfolio levels; b. Adopt measurement methodologies and tools to quantiff, to the extent possible, physical and transition risks related to climate change as well as other E&S risk exposures. Stress testing exercises may include scenario analysis using plausible scenarios and forward-looking information to avoid underestimating potential E&S risks. The results of risk measurement exercise shall serve as input in the monitoring and assessment of borrower's account and/or loan portfolio, reports, and recommendations to the board of directors and/or senior management and review of relevant policies, procedures, as well as risk appetite and credit strategies; c. Integrate E&S risks in the bank's Internal Credit Risk Rating System (ICRRS), credit scoring model, and other credit risk measurements/methodologies. Adopt a methodology to translate the assessed E&S risks to potential impact on the cashflow of the borrower; d. Regularly engage with borrowers to inform assessment ol their continuing alignment with the bank's E&S strategic objectives and targets throughout the term of the loan or duration of the client relationship. E&S clauses shall be included in loan documentation, when necessary, The bank may conduct awareness ralslng sessions wlth clients. A bank may conduct site visits and/or validation review on the actual use of loan proceeds to ensure that credit granted was used for purposes applied furand consistentwith the banks assessmentof E&S risk. E&S risk monitoring at borrower's level typically involves the use of reports received from the borrower and other information including reports of relevant government agencies such as among others, those in relation to facility inspections. Results of monitoring as well and identified corrective actions on issues noted, including turn-around-time on the resolution of issues should be documented; Page 6 oflS

e. Incorporate E&S related factors in credit review process and loan classification in determining allowance fior credit losses; f. Adopt transition or deleveraging strategies for lending to activities/projects with high E&S risks, aligned with the bank's strategic objectives and risk appetite; and g. Regularly report to the board of directors and senior management the material E&S risks as these relate to the bank's risk appetite and credit strategies. Ensure that mechanisms are in place to escalate concerns, emerging issues, and complex or controversial cases, as well as to promptly address the same; Operational Pisk Managenent System. E&S risks events, in the context of operational risk, can cause severe disruption to a bank's operations. For instance, severe weather events could adversely impact business continui$t, including branch networks, offices, inftastructure, processes, and staff that could lead to financial losses. Meanwhile, social risk concerns such as public health issues, labor issues, and human rights violations can result to vacancies, absenteeism or affect personnel morale which can adversely impact operations. In this regard, a bank shall integrate E&S risk events in its operational risk management framework, consistent with its size, operational risk profile, and complexity of operations. Duties and Pespnsibilitix of the tuard of Dircctorc and *nior Management Board of Dlrcctots, Consistent with the expectations set out under Section 146 on the guidelines on operational risk management and in relation to the management of E&S risks under Section 153, the board of directors (orequivalent management committee in the case of foreign bank branches) shall: a. Ensure that E&S risks are integrated in the operational risk management ftamework. For this purpose, the identified potential sources of operational risk exposures of a bank shall include climate change, failure of climate change mitigation and adaptation strategies or initiatives, and other E&5 risks such as, among others, water crises, natural disasters, incidents related to pollution, and waste management, as well as those affecting customer and employee safety; and b. Ensure that the bank's policies and procedures include the extent of the bank's engagement with its counterparties, including suppliers and outsourced service providers, with regard to the adoption of sustainability principles, in accordance with its strategy. '4 PageT ofll

*nior Managemcnt The senior management shall be responsible for the overall implementation of the board-approved policies, processes, and systems fior managing operational risk arising ftom E&S risks consistent with the risk appetite set by the board of directors. In line with this, the Senior Management shall: a. Ensure that the reporting lines and the duties and responsibilities of personnel and offtcers in the bank with respect to the management of E&S risks related to operations are clear, well-defined, and adequately documented: b. Facilitate identification of E&S risks that may affect performance of key personnel and officers that could serve as a source of operational risk; and c. Conduct an assessment, at least annually or as frequently as necessary, of the vulnerability of the bank's systems, operations, and branches&ranch- lite units to physical risks and other disaster-related events. Such assessment may be conducted as part of the periodic assessment of the bank's business continuitlt plan. Opntional Plsk Manqemant $stem pnMg. Consistent with the guidelines provided under Section I45, a bank shall adopt an ORMS that will enable it to effectively identiff, assess, monitor, report, and manage E&S risks related to operations. fulicies, Prcces*a and Prcccdurcs A bank shall adopt policies, processes, and procedures to efiectively identiff, assess, monitor, report and manage operational risk arising from E&S factors considering the board- approved strategic objectives, risk appetite as well as the bank's operations, range of products and services, organizationalstructure, and risk profile. The board-approved policies, processes. and procedures shall: (i) cover measures to identiff and assess E&S risks emanating from failure of people, processes, systems, and external event fii) include enhancements in the business continuitlr plan considering the impact of the E&S risks; (iii) provide appropriate metrics, targets, and limits to measure and control exposures; and (iv) clearly set out the duties and responsibilities of the front, back, and middle offices in managing E&S risks related to operations as part of the internal control system. The board-approved policies, processes, and procedures shall be documented in sufficient detail, effectively communicated throughout the organization, and periodically reviewed and updated. Relevant discussions and decisions shall be appropriately documented. Adherence to policies, proce$;es, and procedures shall be monitored and assessed periodically to ensure that E&S risks related to operations are effectively managed. ,, -.y Page 8 ofl3

Deviations from policies, processes, and procedures shall be documented and approved by the appropriate level of management. Rlsk ldentlficatlon and as*ssment A bank shall assess, at least annually, the impact of physical and transition risks and other E&S risks, on its operations. This shall cover the assessment of the capability of the bank to withstand disruptions, quickly resume operations, and continue to provide financial services to its clients. Banks shall adopt appropriate processes and tools to obtain an understanding of the E&S risks related to its operations. In this respect, a bank shall: a. ldentiff the impact of E&S risks to its client base, processes, products, capability to deliver selices, personnel, and properties, among others. E&S risks shall be articulated in terms of their potential impact to the operational risk strategy and business objectives of the bank. The following factors may be considered in identiffing operational risk arising from E&S risk events: (i) nature of the risk; (ii) source of the risk; (iii) root cause of the risk; (iv) frequency of risk occurrence; (v) relevance of the risk to the business; (vi) business decisions that may be impacted by the risk; and (vii) areas which will be improved or enhanced by addressing the risk; b. Conduct a comprehensive assessment of its risk exposures, considering its operational risk profile and business activities. In developing relevant metrics, banks should not be confined to historical data but should also consider relevant information from publicly available sources or through collaboration with external organizations. Banks may adopt the following tools and metrics to identiff and assess E&S risks related to operations: fl) Trend analysis. This helps determine how the developments in the global and local environment or a social risk event might impact the bank's strategy and operations. (21 stakeholder engagement. This involves engaging relevant stakeholders through various modalities to help identiff E&S risks that are related to the broader group of stakeholders or those that have not been identified by management. The results gathered under items fi) and (2) may be supplemented by materiality assessments that are designed to gather insights on the relative importance of E&S issues. The significant issues identified through these assessments should be considered for their impact on the business. (3) SWOT Analysis. This tool identifies the E&S-related strengths, weaknesses, opportunities, and threats to a bank. z9 Page 9 ofl3

(4) lmpact and dependency mapping. This tool identifies the impacts and dependencies relating to the business model (inputs, business activities, outputs, outcomes ). (5) Catastrophe models. These models use hazard maps and bank asset exposures to estimate damages from events. The damage estimates may be entered into asset pricing models such as Discounted Cash Flow analysis to inform pricing decisions, or in cost-benefft analysis to assess the feasibility of retrofits or other resiliency measures. A bank may adopt other tools and metrics which it deems appropriate to identiff its risk exposures. lt may likewise adopt or enhance existing tools and metrics: Providd, Thatthese existing tools and metrics sufficiently cover material operational risks arising from E&S risk events, and that changes undergo the appropriate vetting and approval processes; c. Consider resilience to E&S factors in conducting due diligence of third- party service providers. In line with the outsourcing principles under Sec. ll2 of the MORB, a bank should have a clear view on which third parties play key roles in delivering the most important business services, as well as routinely evaluate how resilient those entities are to E&S risks related to operations; and d. Conduct scenario analysis using robust scenarios that are aligned with the bank's risk strategy and appetite in order to understand and quantiff the impact of E&S risks related to operations. In conducting scenario analysis, banks must be able to take a view on the scenarios to be tested, the assumptions to be used, as well as the interplay between macroeconomic and environmental fiactors over the short, medium, and long-term horizons, and translate the analysis into key financialvariables. Banks shall identiff management actions to mitigate the relevant risks and respond to opportunities for each scenario. Plsk monitorlng and rcprtfug. A bank shall integrate E&S risk factors in its regular monitoring process. The extent and frequency of monitoring should be commensurate with the extent of the bank's exposures, taking into account its business activities, products and services, and complexity of operations. The results of the monitoring activities shall be regularly reported to the board andlor relevant board committee (or equivalent management committee in the case of foreign bank branches). A bank shall ensure that the monitoring process is overseen by an appropriate unit in the organization to ensure that it remains effiective and shall: a. Use an appropriate operational risk limit structure or internal threshold levels to monitor progress against overall business strategy and risk Page lO oflS -g

appetite. The limits or thresholds shall be updated regularly to support decision making by the board and/or senior management. Depending on the outcomes of the monitoring activities, a bank shall identiff corrective actions including turn-around time for resolution. A bank shall likewise set out circumstances which would trigger a review of its strategy based on the results of monitoring activities; b. Provide the board of directors and/or relevant board committee with comprehensive information on the bank's exposure to operational risk arising fiom E&S risk events, including the results of monitoring activities. For example. the report may contain the results of scenario analysis and as necessary, the mitigating actions the bank should take within a deftned timeframe. The information should enable the board of directors and senior management to discuss, challenge, and take timely and appropriate decisions in managing related rislc; and c. Report aggregated risk data that conveys the impact of E&S risk events on the bank's business model, strategy, and operational risk profile, with a view to enable the board and senior management to make informed decisions. As such, a bank shall generate aggregated and up-to-date risk data in a timely manner. In line with this, a bank should enhance its management information systems to qystematically collect and aggregate the necessary data in order to assess exposures to E&S risks. Management is expected to identify opportunities for improving the quality of related data being reported. Plsk control and mltlgatlon. In line with the requirements under Section 146,162,163,436 and Appendix 17, a bank shall adopt a strong control environment to mitigate E&S risks related to operations. A bank shall: a. Establish an adequate and effective qystem of internal controls based on the degree of exposures and the potential risk of loss arising from E&S risks related to operations to promote operational resilience. In cases when the potential impacts of these risks are assessed to be material, a bank shall document how it will mitigate these risks and establish a plan or poliryfor managing the risk exposures. Plans should be reflective of the distinct elements of operational risk arising from E&S risks related to operations; b. Review and adjust insurance and bond coverages considering the potential impact of E&S risks related to operation; c. Adopt a sound ftamework for managing a crisis event, which may arise from extreme and extended weather disruption or natural disasters. In line with this, a bank shall: _-.9 Page ll ofl3

tl) Adopt a cohesive crisis or incident management plan that considers E&S risks related to operations. A bank shall ensure that the protocols, escalation paths, and processes, as well as triggers provided in the plan are consistent across the institution, and provide sufficient consideration for the safety of personnel and other stakeholders should the same be activated. The plan shall be periodically reviewed and updated to consider new risk factors as well as developments. The plan may be crafted as a separate document or may form part of the bankl BCP; (2) Periodically test its plan to assess operational feasibility and to facilitate smooth implementation in case of actual crisis. An eftctive testing exercise enables the bank to understand the roles and responsibilities of different units and personnel, and to establish the level of readiness to execute the plan, effectiveness of communication and coordination of the different parties involved, availability of needed reports, and the timeliness of actions, among others. Testing may be in the form of tabletop exercises, simulated exercises, or real-life tests to evaluate how the bank and its personnel would respond to major disruptions. The simulations should be conducted from the staff to senior management and board levels to promote awareness on the manner by which decisions are made during a crisis situation and how the related actions should be implemented across the institution. Third parties may likewise be covered in the simulations to ensure alignment of actions. A real-life resilience test may involve staffrelocating to back up f,acilities and conducting activities under a business-as-usual mode. The results of the periodic testing shall be reported to the Board or relevant board committee (or equivalent management committee in the case of fioreign bank branchesl d. Adopt a plan that can be executed if one or more of the third-party service providers become unavailable fior an extended period due to E&S risks related to operations. The outsourcing policy should provide for the engagement of a substitute provider in case the main provider is unable to deliver the seruices in the event of major disruptions. The policy shall likewise provide for the extent of access to information and other resources that may be given to the substitute provider and the timeframe for such access. The plan may be crafted as a separate document or may form part of the bankl BCP; and -y Page 12 oflS

e. Adopt a coherent communications strategy that the bank should implement in the event of a crisis. Internaland external communications across client and customer segments, regulators, employees, and other relevant stakeholders should be clear, concise, and provide sufficient guidance to stakeholders on the manner bywhich products and services may be accessed during the disruption. The bank is likewise expected to incorporate in its consumer protection framework a rnechanism thatwill allow clients to raise issues and concerns on E&S risks related to the bank's operations and services. lntcnpl Audlt and Compllatrce Functlon. xxx Dlsclosurc Pcqulrcnents Banks shall disclose xxx' Sectlon 3. This Circular shall take effect fifteen 05) calendar days following its publication either in the Official Gazette or in a newspaper of general circulation. FOR THE MONETARY BOARD: ?//' L-\ \ BENJAMIN E. DIOKNO Governor aL O.fr-dat 20.21 Page13 oflS