Guidelines on the submission of gap analysis and Board-approved action plan in compliance with the transitory provision of Circular No. 1160 Series of 2022

CORRECTED COPY BANGKO SENTRAL NG PILIPINAS oFFlcE oF THE DEPUW COVERNOR I REGIONAL OPERATTONS AND ADVOCACY SECTOR M EMORAN DU M NO" M.2O23-O33 To All Bangko Sentral-Supervised Institutions Subject Guidelines on the submission of gap analysis and Board- approved action plan in compliance with the transitory provision of Circular No. 116O Series of 2022 Section 6 of Circular No. '1160 requires all BSP Supervised Institutions (BSl) to perform a gap analysis of their current Consumer Protection Risk Management System (CPRMS), Financial Consumer Protection Assistance Mechanism (FCPAM), and related financial consumer protection practices vis-a-vis the provisions of the Circular; and implement an action plan dr-rly-approved by the BSI's Board of Directors to achieve full compliance, within a reasonable period of time but not longerthan one (1)yearfrom the effectivity of the Circular, which is 20 Decerrber 2022. BSls are also reouired to show their plan of action with specific timelines, as well as status of the initiatives being undertaken to fully comply with the provisions of the Circular, upon request of the Bangko Sentral. Pursuant to the above, all BSls shall observe the following Guidelines in the submission of their gap analysrs and action pian status reports: l. All BSls sha!l submit a Certification (Template, Annex A) signed by the President or officer of equivalent rank, affirming the completion of the BSI's gap analysis; that the Board of Directors noted the gaps and approved an action plan to address those gaps; and that the BSI is committed to implement the action plan in a timely manner to achieve full compliance with the provisions of BSP Circular No. 1160 series of 2A22. The deadline for submission of the duly-signed Certification shall be on or before the following dates: lndustry Desdline of Submission a. Universal and Cornmercial Banks 2l December 2023 b. Digital Banks 2l December 2023 c. Non-Bank Electronic Monev lssuers 2l December 2Q23 d. Non-Bank Credit Card lssuers 2l December 2023 e. Thrift Banks 3l Januaw 2024 f. Rural and Cooperative Banks 31 Januaw 2024 S. Pawnshops 3l Januarv 2024 h. Virtual Asset Service Providers 3l Januarv 2024 i. All other BSls 29 Februarv 2024 Submission of the Certification may be on a group-wide, consolidated basis, provided that all Presidents or officers of equivalent rank of each BSI belonging to the group shall sign the Certification.

CORRECTED COPY 2. The BSls identified in ltem Nos. l.a to l.d above shall submit the following documents, together with the duly-signed Certification, on or before 2l December 2023: a. Summary Table providing a concise summary of the BSI's observed gaps, the corresponding Board-approved action plan, the target completion date of the action plan, and the status of its implementation, which shall not be later than 2l December 2023 (Template, Annex B); b. Digital, password-protected copies of the BSI's CPRMS and FCPAM policies, procedures, manuals, or equivalent documents that are in effect as of the time of reporting; and c. Digital, password-protected copy of the Board-approved action plan, inclusive of the date of approval. 3. The BSls identified in ltem Nos. l.e to l.h shall submit only the duly-signed Certification together with the Summary Table, as described in ltem No. 2.a, on or before 3I January 2024. The BSls identified in ltem No. l.i shall submit only the duly-signed Certification together with the Summary Table, as described in ltem No. 2.a, on or before 29 February 2024. 5. Notwithstanding the submission deadlines cited above, all BSls are expected to have implemented their Board-approved action plans not later than 21 December 2023, one (1) year from the effectivity of Circular No. 1160 Series of 2022,in accordance with Section 6 thereof. 6. Submission of the above documents shall be in accordance with the following Droceoures: All BSls must consolidate the signed Certification with the Summary Table into one pdf file, with a filename format as follows: BS/ Nome Acronym_Cll6O Aop Anolysis-Dote Month Yeor of Submission. BSls that are required to submit copies of their CPRMS, FCPAM and Board- approved action plans must consolidate these documents into one pdf file, with filename format as follows: BS/ Nome Acronym_CPRMS-FCPAM-Action_Dote Month Yeor of Submission The above pdf document must be submitted together with ltem No. 6.a. All pdf documents for submission must be password-protected, and emailed to the Consumer Protection and Market Conduct Office (CPMCO) at C P M C [email protected]. Document passwords must be emailed separately to [email protected]. All email submissions, including emailed passwords, must bear the subject: BS/ Nome Acronym_Cll6o Cop Anolysis_Dote Month Yeor of Submission. e. All emailsubmissions must be sent usinq the BSI's official email address.

CORRECTED COPY 7. Submission of the above documents shall be without prejudice to requests for additional information, should the BSp CpMCO deem necessary. 8. Queries regarding this Memorandum to All BSls, BSP Circular No. 116o dated 28 November 2027, and related financial consumer protection rules and regulations should be sent to [email protected] For guidance and compliance. BERNAD 19 October 2023

ANNEX A S ingle Entity Su bm issio n INSTITUTION NAME AND LOCO (LETTERHEAD OF BSp SUPERVTSED |NST|TUT|ON) CERTIFICATION I hereby certify that the (Full Legal Name of BSP Supervised Institutionl has completed the gap analysis of its Consumer Protection Risk Management System, Financial Consumer Protection Assistance Mechanism, and related financial consumer protection practices. I further certify that an action plan, approved by the Board of Directors on has been implemented to address the identified gaps. The Board and Senior Management is committed to ensure full compliance with the provisions of Circular No. Il60 Series of 2022. This certification, together with attachments, are submitted in compliance with Section 6 of Circular No. lI60 Series of 2022 and the Memorandum to All Bangko Sentral- Supervised Institutions No. M-2O23- (Signature over Printed Name) (Position Title) (Date Signed)

ANNEX A C rou p- Wide, Co nso I i d a ted S u bm iss io n GROUP NAME AND LOGO (GROUP LETTERHEAD, IF ANY) CERTIFICATION We hereby certify that the BSP Supervised Institutions (BSl) under (Group Namel have completed the gap analysis of their Consumer Protection Flisk Management System, Financial Consumer Protection Assistance Mechanism, and related financial consumer protection practices. We further certifu that the action plans, approved by the Board of Directors of these BSls, have been implemented to address the identified gaps. The Board and Senior Management of these BSls are committed to ensure full compliance with the provisions of Circular No. ll60 Series of 2022. I. Full Legal Name of BSI ,3, (Add rows as necessary-) This certification, togetherwith attachments, are submitted in compliance with Section 6 of Circular No. ll60 Series of 2C22 and the Memorandum to All Bangko Sentral- Supervised I nstitutions No. M-2O23- _. (Signature over Printed Name) (Signature over Printed Name) (Position Title) (Position Title) (BSl Name) (BSl Name) (Date Signed) (Date Signed) (Signature over Printed Name) (Signature over Printed Name) (Position Title) (Position Title) (BSl Name) (BSl Name) (Date Signed) (Date Signed)

; .,t ANNEXB lNameof Btill Summaryof Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 November 20.22 Key p rovisi ons/reg u i re m en ts u n de r lden ti fy spec i fic ga p/s vis - d " vis the Provide specifrc action plan to lndicate the target completion Circular No. 116O dated 28 November 2022 reg u I a to ry req u i reme n t/s address the observed gap/s date and status ofthe action plan/s as of 2l December 2O23, regardless of the date of submission of this Summa4t DUTTES OF BSIs AND AUTHORfZED THIRD PARTIES Consumer Protection Risk Management System (CPRMS). A BSI should have a CPRMS that is integrated into the BSI'S enterprise-wide risk management processes and risk governance framework. The CPRMS includes the governance structure, policies, processes, measurement and control procedures to ensure that Financial Consumer protection-related risks are identified, measured, monitored, and mitigated. A carefully devised, implemented, and monitored CPRMS provides the foundation for ensuring the BSI's adherence to Consumer Protection Standards of Conduct (Standards) in reference to Sec. lOosf OO3-Q of this Circular and compliance with the FCPA and relevant laws, rules and regulations, thereby, ensuring that identified risks to the BSI and associated risks of financial harm or loss to Financial Consumers are properly managed. The CPRMS and Financial Consumer Protection Assistance Mechanism (FCPAM), in returence to Sec. |OO3IOO3-Q of this Circular should ensure systematic application of policies and procedures, including the Standards. Board and Senior Management Oversight The Board of Directors (Board ) and the members of Senior Management of BSls shall provide which thev shall identifo. measure. monitor. and Page I of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Cornpliance with Section 6 of BSP No. ll60 dated 28 November 2Q22 mitigate Financial Consumer Protection (FCP) risks inherent in their operations, in accordance with the Standards and all other applicable laws, rules and regulations. a. Responsibilities of the Board. The Board shall be primarily responsible for approving and overseeing the implementation of the BSI's CPRMS. The Board's responsibilities shall include the following: (l) Approve the CPRMS and FCPAM that take into consideration the BSI's business model, market, product lines, and relationships with third parties that may give rise to risks to Financial Consumers; (2) Promote a culture of ethical behavior and ensure adherence to the Standards and all relevant laws and regulations; (3) Provide adequate resources and adopt policies to effectively implement training and competency requirements for officers and personnel, authorized representatives or any other party acting on behalf of the BSI; (4)Approve a policyon remuneration and compensation packages structured to encourage responsible business conduct, fair treatment and avoidance/mitigation of conflicts of interest and performance review which includes provisions for incentives on positive reviews/assessment that could also serve as basis for renewal of contract of third-party service providers; Page 2 of36

ANNEXB lNameof Blill Summaryof Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No..1160 dated 28 Novernber 2o.22 (5) Approve product oversight and governance mechanisms designed to ensure that financial products or services meet the needs of Financial Consumers in target markets or market segments, as well as universal products which are simple to access so as not to exclude vulnerable groups; (6) Adopt a policy on the imposition of any fees and/or charges of the BSI's financial product or service which shall include among others, the basis and quantitative support for the setting of the fees/charges and rationalization of the fiee structure or amount; (7) Approve and periodically review a Code of Conduct applicable to all BSI directors, offtcers, staff and third-party agents. The Board shall define the BSI's corporate culture and values. lt shall establish standards of conduct and ethics and shall institutionalize a system that will allow reporting of concerns or violations to an appropriate body; and (8) Review periodically the implementation and effectiveness of the CPRMS, including how findings are reported and whether the audit mechanisms are in place to enable adequate oversight; and put in place a regular mechanism to review the relevance of the CPRMS in case of changes in the BSI's business model and/or operating environment. b. Responsibilitleg of Senior Manryement. The Senior Management shall be responsible for ensuring thatthe practices of the BSI and their third-party agents/representatives are aligned with the BSI's approved FCP policies and risk management systern; and consistently displayed Page 3 of36

ANNEXB lNameof BSll Summaryof Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. llSO dated 28 November 20.22 units that deal directly with Financial Consumers. ln this regard, the Senior Management shall: l) Ensure that approved CPRMS and FCPAM policies and procedures are clearly documented and appropriately implemented across all levels and business units. This includes the responsibility of identiffing the officer which will head the internal complaints handling unit or handle the implementation and regular reporting of consumer-related issues to the Board: (2) Establish an effiective monitoring and management information system to promptly identiff, regularly measure, aggregate, and analyze FCP-related issues to determine the level of Financial Consumer risks. An appropriate and clear reporting and escalation mechanism should also be integrated in the risk governance framework from any area of the BSI to Senior Management and/or from Senior Management to the Board. The management information system should be able to: (a) Provide adequate information on the performance and quality of the BSI's FCPAM and other internal processes that can provide relevant information that allows for identification of emerging Financial Consumer issues and root cause dhalysis; (b) Determine the level of FCP risk exposure through assessment of its implementation of the Standards; (c) ldentiff and monitor, in a timely manner, risks that may Page 4 of36

ANNEX B lNameof BlSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 5 of BSP.No. 116o dated 28 Novernber 2o.22 consumer detriment. Financial Consumer complaints, data from consumer redress mechanisms and reports of fraud are kev indicators to monitor such risks: and (d) ldenti& and assess emerging or increasing FCp-related risks that affiect the BSI's Financial Consumers such as social engineering schemes, social media monitoring and market monitoring. (3) Ascertain that weaknesses in the FCP practices or emerging risks are addressed and corrective actions are taken in a timely manner (4) Ensure observance of expectations and requirements prescribed under relevant regulations on compliance and internal audit; and (5) Ensure that adequate information and actions taken are reported to the Board on a regular basis in terms of the measurement of FCP-related risks, reports from the FCPAM, compliance with the Standards and requirements, as well as other material FCP-related developments that will impact the BSI's Financial Consumers. This includes the responsibility to put in place an effiective q/stem where reporting lines are established to promptly detect, anallze, and respond to Financial Consumer concerns and serious infractions. CONSUMER PROTECTION STANDARDS OF CONDUCT Disclosure and Transparency xxx xxx Page 5 of56

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.ll60 dated 28 November 20.22 The BSI demonstrates adherence to appropriate and adequate disclosure and transparency when: a. The manner of disclosure, whether in advertising materials, terms and conditions, and other forms of communication, is clear, concise, accurate. understandable and not misleading. Sufficient product disclosure must be provided before the contracting of the financial product or service to give the Client enough basis and time for review. At the pre-contractual stage, information on the type and amount of fees, charges and interests, as well as the standard terms and conditions, must be made available to the client through various kinds of communication channels, including all digital channels. Disclosure of information on financial products or services should be available to the public through printed materials, mass media, websites or digital platforms. For digital financial products and services, the manner of disclosure should be easily accessible, especially where the terms and conditions tend to be deeply embedded and hard to access without scrolling or clicking through multiple screens. Information should be disclosed and properly documented before and during a sale of a financial product or service and during key stages of the relationship with the Financial consumer. BSls must provide the most upto-date information at the stages that information will be most useful for their Client. This requirement includes information provided in advertisements during the pre-contractual stage, at the point of enterinq a contract and durinq the term of Page 6 of56

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 terms and conditions must clearly state whether interest, fees, charges, and penalties can change over time. clients should also be effectively notified of any changes or amendments to the terms and conditions at least sixty (60) days prior to such amendments by public notice, unless the amendments are directed by the Bangko sentral to take effect immediately or unless otherwise provided in existing laws, rules and regulations. Complementary individual notices to a Client shall also be sent within the same period if the amendments pertain to or will result to fees to be paid or charged on the account of the Client. The method for computing said interest, fees, charges, and penalties shall be disclosed consistent with existing laws, rules regulations. Clients may be allowed to pre-terminate the contract on the financial products or services availed if they do not agree with the significant amendments to the terms and conditions as initiated by the BSl, or if they fail to receive any proper notice on the changes in terms and conditions. c. Terms and conditions must contain allsignificant provisions of the financial product or service giving prominence to key featuresfacts. The terms and conditions should contain the following details and possess these characteristics: (l) Information on risks, return, caveat about the financial product or service, any waiver of rights and limitations of liabilities except the rights mentioned under Section .12 of the FCPA, after-sales service, Financial Consumers' rights and of failure to meet Page 7 of36

ANNEXB [Nameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 November 20.22 rights and responsibilities of the BSl, involvement of authorized agents, any conflict of interest by BSI staff, cancellation and product portability, among others. (2) The above minimum required disclosures shall always be in writing or available by electronic means. They shall follow a standard format and written in plain language to provide the Financial consumers key information and disclosures that will facilitate better understanding and comparison among the products offiered by different BSls A BSI shall require its Client to sign the written or electronic disclosure statement as affirmation of the client's receipt and understanding of the disclosure statement. A BSI may use any methodology or procedure that allows the Client to indicate the intention of authenticating, approving, or accepting an electronic document, consistent with R.A. No. 8792or the Electronic Commerce Act of 2OOO, and other relevant laws, rules, and issuances of the Bangko Sentral. A BSI may opt to draft an individual or separate disclosure statement for its Client or incorporate the same in the main transaction agreement/contract. (3) For more complex products, such as but not limited to investment products, the key features as well as costs and risks shall be highlighted in a key facts statement or product Highlight Sheet {PHS). The PHS shall enable comparison with other financial products and shall be provided at no additional cost. Before the signing ofany contract, the BSI should ensure that the Financial Consumer has Page 8 of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 the effect that said Financial Consumer has duly received, read, and understood the PHS d. Advertising materials shall not be false, misleading, or contain deceptive statements or omit key information that may materially andlor adversely affect the decision of the Financial Consumer to avail or acquire a financial product or service. BSls are legally responsible for all statements made in the marketing and sales materials that they produce relative to their financial products or services. e. In their advertising materials, BSls shall disclose the contact information of their FCPAM or appropriate internal consumer assistance unit handling Financial Consumer concerns or complaints. BSls shall also disclose that they are regulated, and the advertising materials must identiflr the Bangko Sentral as financial regulator. The terms and conditions, public notices and other communications to Clients must contain the following: O) Contact information of the BSI's FCPAM or appropriate internal consumer assistance unit handling Financial Consumer complaints or concerns; and (21 Statement that the BSI is a regulated entity by the Bangko Sentral and Bangko Sentral's contact information. f. Communication of the BSI officers, staff, authorized agents or any other party acting on the BSI's behalf is conducted in such a manner that Clients can understand the terms of the contract and their rights and obligations. Client segments that may have financial literacy limitations or subject to certain disabilities or infirmities preventing them from reading or Page 9 of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 November 2Q22 clearverbal explanation of the terms and conditions, as well as its features, risks and costs, in a language they can understand. Adequate time is given to Financial Consumers to review, ask questions and receive information to fully understand the terms and conditions prior to signing the contract or agreement or executing the transaction. BSls should ensure that documents signed by the Financial Consumer are completely-filled out and have no blank terms provided, that the Financial Consumer is not precluded from readily availing of the BSI's financial product or service and accepting the BSI's terms and conditions, signing the contract or agreement, or executing the transaction upon his/her sole discretion. The Financial Consumer should be given a copy of each of the documents he/she signed including, but not limited to the contract, with all terms and conditions and/or proof of the transaction, whether printed or in electronic copy, at the option of the Financial Consumer, or in the manner or channel through which the product or service was accessed, immediately after the contract or agreement was executed or transaction was com pleted. h. Statements of Account or Billing Statements are provided regularly in a convenient manner to the Financial Consumer, or through the channel through which the product was sold, commensurate to the type of product and terms. The statement must bear an official seal and/or include the letterhead of the BSl. In general, statements for transaction loan accounts, with reqard to the Page lO of36

ANNEX B lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 November 2o22 covered, and depending on the type of product, should include the following information: (l ) the opening and closing balances; (2) any transactions made during the period, such as but not limited to deposit, withdrawal, fund transfer, investment, remittance and/or payment; (3) the merchant or counterpart of each transaction, if any; (4) details of the interest rate applied to the account, if any; (5) details of the fees, exchange rate and other charges incurred by the customer in each transaction, if any; and (6) any changes applied to the interest rates, charges or fees, if any Responsible pricing. BSls should establish and follow internal policies and procedures for setting prices for their products and services, based on, among others, the principle of responsible pricing. Pricing procedures and documentation should provide the rationale for why and how prices have been set. Pricing procedures must consider publicly available information on competitive pricing, except in special instances of tailor-fit and/or pioneering products and/or services, the cost to provide the financial product or service and affordability to Clients, and the reasons for setting the price of each financial product or service must be duly-documented. The BSI's pricing mechanism or policy shall adhere to existing laws, rules and regulations of the Bangko Sentral. BSls may also opt to have their product governance mechanism assess whether algorithms that influence or determine pricing may be unfairly biased toward certain groups of Page ll of36

ANNEX B lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 Fair treatment. xxx The BSI demonstrates the Standard of fair treatment towards Financial Consumers if its policies and practices observe the followinq: a. Terms and conditions are not unfair when there is no significant imbalance in the parties' rights and obligations under the contract, to the detriment of the Financial Consumer. Except where expressly permitted by law, in any agreement with a Financial Consumer, a term should be deemed as unfair if it exempts or absolves a BSI from acting with skill, care, diligence, or professionalism toward the Financial Consumer in connection with the provision of any product or service, and/or any liability for failing to do so. Ambiguities in contractual terms and conditions should be construed in favor of the Financial Consumer. Aterm and/orcondition isdeemed unfairwhen it includes, but is not limited to, the following circumstances: (l) it amends the terms of the contract without adequate notice and/or without speciffing the circumstances in which this may occur and/or does not provide a right of termination when such amendment occurs; (2) it renews a fixed term contract without reasonable notice or conversely, terminates an open - ended contract uate notice to the Financial Consumer; Page I2 of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.ll60 dated 28 November2o22 (3) it permits the BSI to unilaterally determine whether the contract has been breached or imposes an unreasonable penalty for a breach of the contract; (4) it binds the Financial Consumers to other terms that the Financial Consumers cannot realistically familiarize themselves with before the contract is executed, (5) or it permits the BSI to assign the contract to the detriment of the Financial Consumers without their consent. BSls are prohibited from employing abusive collection or debt recovery practices against Financial Consumers. BSls or their collection agencies, counsels and other third-party agents may resort to all reasonable and legally permissible means to collect amounts due them. However, in doing so, they must observe good faith and reasonable conduct and refrain from engaging in unscrupulous or untoward acts. BSls shall adhere to existing Bangko Sentral guidelines on outsourcing, as well as relevant laws, rules and regulations. BSls shall ensure that all data being handled, processed, and/or stored through an outsourcing arrangement are included in its data inventory and data classification process. To this end, BSls shall retain exclusive ownership of its Client records and data already referred to its collection agencies, counsels and other authorized third-party agents. BSI's external collection agencies, counsels or other authorized third-party agents are indispensable parties in complaints involving unfair collection practices. The BSI staff and authorized third-party agents or representatives must treat Financial Consumers with professional competence and in a manner that is fair and Page 13 of36

ANNEX B lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.ll60 dated 28 November 20.22 The BSI shall: ('l) Establish a Code of Conduct applicable to all BSI directors, officers, staff and third-party agents, setting forth the organizational values and standards of professional conduct that uphold protection of Financial Consumers, appropriate to its structure, operations, and risk profile. (2)Align its recruitment and training policies around professional, fair and responsible treatment of clients, compliance with FCP requirements, and mitigation of consumer risks, for instance: (a) BSI staff and third party-agents or representatives must receive adequate training suitable forthe complexityof the fina ncial prod ucts or services they sell to ensure u nderstanding of their key features, risks, terms and costs, relevant FCP standards and requirements, including statutory and regulatory requirements and related internal policies and procedures that might impact their Financial Consumers, including those pertaining to consumer risks arising from cybersecurity and/or digital financial products and services. Aside from trainings for frontline service personnel, trainings shall also be made available to compliance and internal audit officers and staff. (b) BSI staff, as well as authorized third-party agents or representatives contracted for sales and marketing purposes, do not use deceptive or high pressure/aggressive sales techniques and should not Page l4 of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1l60 dated 28 November 20.22 contracts or rush into a financial deal without the benefit ofshopping around. (c) BSI staff involved in collections, as well as authorized third party agents or representatives contracted for the purpose, receive training in acceptable debt collection practices and loan recovery procedures, consistent with existing relevant regulations. (d) BSI staff, as well as authorized third-party agents or representatives, do not employ practices that discriminate or take advantage of difficulties faced by vulnerable groups. (e) Establish policies and procedures that aim to protect Financial Consumers' deposits and other assets, against internal or external fraud or misuse. (3) Ensure that the performance evaluation, remuneration structure and compensation practices for staff of BSI and authorized third-party agents or representatives encourage responsible business conduct, fair treatment, and avoidance/mitigation of confl icts of interest. (4) Have in place mechanisms to manage ind resolve actual conflicts of interest with respect to compensation or remuneration policies that arise in the interaction between their staff and agents and their Financial Consumers and potential Clients. This is demonstrated when the staff or authorized agent: Page 15 of36

ANNEXB lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 (a) Discloses properly to the Financial Consumer prior to the execution ofthe transaction that the BSI or its staff/agent has an interest in a direct/cross transaction with a Financial Consumer. (b) Discloses the limited availability of products to Financial Consumers when the BSI only recommends products which are issued by their related companies, subsidiaries or affiliates, particularly when commissions or rebates are the primary basis for recommending the particular product to Financial Consumers. (c) Discloses the basis on which the BSI is remunerated at the pre-contractual stage. (d) Ensures that adequate systems and controls are in place to promptly identiff issues and matters that may be detrimental to a Client's interest, for instance: cases in which advice may have been given merely to meet sales targets or may be driven bv financial or other incentives. Develop and adopt a risk-focused screening process for its preemployment or background screening based on factors like the position to be filled, responsibilities associated with such position, reputational and FCP risk implications. Such process may, among others. involve: (a) Inclusion of ethical behavior, professional conduct, and quality of interaction with Financial Consumers as part of Page l6 of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 Novernber 2022 (b) Conduct of appropriate due diligence before selecting the authorized agents/outsourced parties, taking into account the agents' integrity, professionalism, fi nancial soundness, operational capability and capacity, compatibility with the BSI's corporate culture, and ability to implement controls to monitor the agents' performance on a continuous basis. The criteria for selection of authorized agents/outsourced parties should include the presence of an established mechanism to address Clients'complaints against an authorized agent/representative. Liabilityof o BSI on theactsoromissionsof itsauthorized agents and representatives. The BSI shall be responsible for the acts or omissions of its directors, trustees, officers, employees, or agents, in offering, marketing and transacting with Financial Consumers for its financial products or seruices. The BSI shall be solidarily-liable with the accredited or authorized agents, representatives or third-party service providers for their acts or omissions in marketing and transacting, which may include, but not limited to debt collection. with Financial Consumers fior its financial products or services. Privacy and protection of client data. BSls must ensure that they adhere to the general data privacy principles of transparency, legitimate purpose and proportionality under R.A. No. lOl73 or the Data Privacy Act of 2Ol2 and its lRRs. The principles include having well-articulated privacy notices and policies, speciffing and declaring and criteria beinq relied on as the lawful Page 17 of36

ANNEXB lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll6O dated 28 November 20.22 basis for processing Client data, ensuring that the processing is necessary and not excessive in relation to the purpose, and implementing reasonable and appropriate information security measures and well-defined protocols for upholding data subject rights, among others. Procedures in handling the personal information of the Financial Consumers should be periodically evaluated. This should be an end- to-end process that should cover, among others, the array of information that will be pre-identified and collected, the purpose and manner of gathering each information, and the Information Technology (lT)-security infrastructure of the BSls. Protocols for processing and disclosure shall be strictly observed and implemented both within the BSI and to third parties in accordance with the Data Privacy Act, its IRR and other applicable rules and regulations on data privacy. Provided, that, the criteria for lawful processing of information and protocol for storage, destruction, disclosure, both within the BSI and to third parties, are in accordance with the Data Privacy Act and other applicable laws, rules, and regulations. Protection of Client lnformation xxx xxx The BSI demonstrates the ability to protect Financial Consumers' information when, among other things, it is able to. Page l8 of36

ANNEXB lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll60 dated 28 November 2Q22 Have a declared and published privacy policy to safeguard its Financial Consumers' personal information. This policy should govern the collection, processing, use, distribution, storage, and eventual disposal of Client information, and the identification of levels of permissible access to Clients' data for BSls' employees and their third-party service providers. BSls should ensure that privacy policies and sanctions for violations are implemented and strictly enforced. BSls shall ensure the accessibility of their external privacy notice on their website and other official communication channels and digital platforms Ensure that privacy policies are regularly observed, periodically reviewed and updated, and communicated throughout the organization. Privacy policies shall be subject to regular review to ensure that these are attuned to the current processing activities, taking into account the use of new technologies and changes in the pertinent standards and/or legal requirements, where applicable. c. Have appropriate systems or risk mitigation measures in place to protect the confidentiality and security of the personal data of its Financial Consumers against any threat or hazard to the security or integrity of the information, and against unauthorized access. This includes a detailed written security plan, based on the results of the Privacy lmpact Assessment (PlA) conducted to identiff risks in the processing of personal data. Such plan must also include a system for responding to possible security vulnerabilities and/or breaches. The plan must be proportionate to their asset size, structure, nature of Page 19 of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with. Section 6 of BSP No. ll60 dated 28 November 2A22 products and services, complexigr of operations and sensitivity of Financial Consumer information that they handle. These security measures should be regularly evaluated, monitored, and updated by BSls to ensure effectiveness. Adopt and implement information security standards and privacy by design principles to ensure the safety and protection of the privacy, confidentiality, integrity, availability, authenticity and non-repudiation of Clients' information and financial transactions. End-to-end security protocols, such as but not limited to encryptions and/or security-by default, between Clients and the internal systems of the BSI should be implemented. ln addition to existing applicable regulations, the Bangko Sentral may prescribe additional minimum information security standards for compliance by BSls. This may include network and software design, as well as information processing, database storage, transmission, retrieval, and disposal. Security must be maintained throughout the life-cycle of Financial Consumers' information, from data acquisition to disposal. BSls should have clear policies and procedures on data breaches includinq mechanisms to address external threats and internal threats, including those coming from BSI personnel or agents that unlawfully access Client data. e. subject to the provisions of existing laws, rules and regulations on data privacy, communicate to its Financial consumers the extent of personal information to be used and purpose for which they are to be processed, the recipients to whom they Page 20 of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Cornpliance with Section 6 of BSP No. 1160 dated 28 November 2o22 stored. Financial Consumers shall be given an opportunity to retract or cancel their consent, for purposes other than those that are governed by existing laws, rules and regulations. Give Financial Consumers opportunity to exercise all their rights as data subjects by implementing mechanisms which enable the free exercise of the same through procedures which are clear, simple, straightforward, and convenient. Data subjects' rights include the right to be informed, right to access their information, right to object, right to rectification or to challenge the inaccuracy and completeness of the information, and right to have their information amended or corrected as appropriate, right to request for deletion or blocking, right to file a complaint, and right to data portability. clients have the right to review their own data to ensure that inaccuracies or deficiencies are corrected or amended, refuse the sharing of their information to a third party, and request the removal of their data from the BSI's system if they wish to be excluded from receiving advertisements and other notifications, or they no longer wish to use the BSI'S services, subject to certain limitations. This is without prejudice to compliance with existing laws, rules and regulations on data retention. BSls must provide Financial consumers with information on how they may request to be deleted from the BSI'S database, or to be excluded from receiving advertisements and other notifications. S. Notifo Financial Consumers, as soon as practicable, when privacy breaches occur, that may leave their data vulnerable; Page 2l of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2012 respond to privacy breaches. BSls must ensure that when data is shared across authorized parties, the data is transferred securely and used in a manner consistent with their privacy policy and relevant rules and regulations. BSls must provide clear policies and procedures on addressing data breaches, from discovery of breaches or detection of security incidents, its evaluation and investigation, documentation, notification to affected Financial Consumers, compensation to Financial Consumers, and compliance with the reportorial requirements of regulatory bodies, including the National Privacy Commission. Effective Recourse. xxx xxx Financial Consumer Protection Assistance Mechanism (FCPAM). Each BSI must establish a single FCPAM, commensurate to the size, structure, nature of products and services, and complexity of operations, to provide free assistance to Financial Consumers on their concerns about the BSI's financial products, services and/or transactions. This shall include handling of complaints, inquiries and requests. The BSI's FCPAM is a first-level recourse mechanism for Financial Consumers who are dissatisfied with the financial product or service of a BSI or its third-party agent or representative. Financial Consumers are first required to report their complaints, . inquiries or requests, through the FCPAM of the concerned BSl. As the first-level recourse, BSls shall adopt simplified requirements and procedures for the availment of their FCPAM by Financial Consumers. The of each BSl. includinq the turn-around Page22of36

ANNEX B lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.ll60 dated 28 November 2o22 time (TAT), must be proportionate to their asset size, structure, nature of products and services and complexity of operations. Each BSI shall provide in detail the steps necessary to complete the complaints- handling process, including a flow chart indicating the end-to-end process, with the TAT for each step. BSls shall ensure adequate manpower and resources to carry out the FCPAM. Each BSI shall also provide Financial Consumers with information on the status and final resolution of their ' complaints, inquiries or requests. Financial Consumers who are dissatisfied with the BSI's handling of their complaints, inquiries or requests, may escalate their concerns with the Bangko Sentral Consumer Assistance Mechanism (CAM). Reporting the concern with the BSI's FCPAM is a condition precedent to the filing of a complaint to initiate the Bangko Sentral CAM. A BSI shall: Establish an effective internal complaints-handling unit or FCPAM designed to receive, record, evaluate, resolve, monitor and report consumer complaints, concerns, inquiries or requests to be implemented by a designated officer, unit, group or department, commensurate to the size, structure, nature of products and services, and complexitlr of operations, ensuring that there is no conflict of interest. b. Establish, maintain, and implement formalized, written internal policies and processes, procedures, and practices for reasonable and prompt handling of consumer concerns. This includes clear policies on investigation, resolution and restitution of complaints. Page 23 of36

ANNEX B lNameof BSII Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSF No. ll60 dated 28 November 2022 c. Make available multiple channels or platforms for lodging complaints, inquiries, and requests; taking into consideration Financial Consumer needs to be served; and put in place a dedicated helpdesk or hotline for the said purpose. Channels or platforms shall be functional, accessible, and efficient. The complaints handling service should be free of charge to Financial Consumers, and enable a complaint to be submitted via oral, written or digital formats. A simple and easy-to-use guide about the procedures should be made available to Financial Consumers, either on request or when they want to make a complaint. The procedures should be accessible and be made available to clients via website, social media, marketing materials in printed or digital form. d. Ensure that channels or platforms for submitting complaints are adapted to Financial Consumer needs (i.e. level of literacy, accessibility) and local specifications (i.e. language or dialect). Channels used to submit complaints can include telephone, fax, email, complaint/suggestion ' boxes, web presence, mobile phone apps, and in person. To the extent possible and employing a proportionate approach, BSls should make available a toll-free number, free-response SMS texting or free data for apps or live-chat to encourage access. A dedicated 2417 customer-care telephone line, especially for fraud-related concerns should be put in place. For BSls with simple operations, tickets through email and/or other same are addressed or a Page24 of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 1160 dated 28 November 2022 their complaint messaging modes provided that the by the BSI within 24 hours. Maintain a management information system for the complaints from Financial Consumers that allows for consolidation, comparison and analysis on a regular basis, including investigating whether complaints indicate an isolated issue or a more widespread issue for Financial Consumers. This analysis and reports of Financial Consumer complaints must have clear reporting and escalation structure within the BSI's risk governance framework and covered in its CPRMS. The complaints reports shall be submitted to Banqko Sentral in accordance with relevant regulations. Obtain the Financial Consumers' consent to share personal information and details of their complaints, evidenced by written, electronic or recorded means, subject to requirements under the FCP Framework, the Data Privacy Act and its lRR, and other relevant rules and regulations on data privacy, personal information processing, and rights of data subjects, among others. For Financial consumers from vulnerable groups who might not be able to give informed consent, BSls shall ensure reasonable accommodations for their easy access to the FCPAM. Protection of Consumer Assets Against Fraud and Misuse. To mitigate the risks of fraud and misuse faced by Financial Consumers, to the extent allowed bv existinq laws, rules, and Page 25 of56

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.ll60 dated 28 November2Q22 must provide necessary assistance, including the provision of relevant information relating to fraudulent or unauthorized transactions. Further, BSls must provide clear information on the actions taken or to be taken on a complaint, inquiry or request from a Financial Cohsumer involving fraudulent or unauthorized transactions. BSls shall adequately inform Financial Consumers of their responsibilities, as users of financial products and services, and provide timely transaction notifications which are essential in curtailing and detecting fraudulent or unauthorized transactions. Claims assessment and investigation. A BSI should evaluate any claim made by any accountholder in relation to any disputed transaction for purposes of resolving the claim or assessing the parties' liability in accordance with the FCP Framework, and other existing laws, rules and regulations. BSls should resolve a claim in a fair and reasonable manner. The claim resolution process should also be communicated to the accountholder in a timely and transparent manner. Fraud-related concerns should be given utmost priority and should be resolved within a reasonable time commensurate to the complexity of the circumstances. Reporting Channels. BSls should provide its Clients with a free and active reporting channel/s which may consist of a manned phone line, -mobile number online portal, email, chatbot, instant messaging, or other closely-monitored communication channels which should be avaif abfe on a 24h basis. Any Financial Consumer who contacts the reporting channel should receive an immediate written Unauthorized Transactions. Concerns or disputes about fund transfers or alleged unauthorized transactions shall be filed with the Page 26 of36

ANNEX B lNameof BSII Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 Originating Financial Institution (OFl). The OFI is primarily responsible for providing assistance and redress to its Clients. Upon receipt of fund transfer disputes or alleged unauthorized transactions, the OFI shall immediately inform and provide relevant details to the Receiving Financial. Institution (RFl). OFls and FlFls should then implement the following, pending the result of the investigation of the dispute or allegation: a. Suspend the imposition of interest, fees or charges, if applicable; b. Hold the disputed funds, if still intact, in compliance with BSI policies, existing Bangko Sentral rules and regulations, or industry conventions; c. Provide reasonable accommodations to the Financial Consumer, such as a non-withdrawable provisional credit of the disputed amount or temporary hold of the disputed amount within a given period as determined by the BSI; and d. Perform such other necessary actions to protect the Financial Consumer's interest and/or assets, such as but not limited to, account blocking or freezing of funds. Within three (3) banking days from the conclusion of the investigation, the BSI must inform the Client formally of the result. The information should include, among others, a notification of debiting the provisionally credited amount if there is sufficient proof that no unauthorized or erroneous transaction occurred. lf after the investigation, the disputed transaction is found to be an unauthorized or fraudulent transaction, the BSI should immediately: Page27 of36

ANNEXB lNameof BSll Summary of Obseryed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll60 dated 28 November 2022 a. Correct or reverse the transaction found to be fraudulent, including any related interest, charges thereon: and/or b. Make permanent the provisionally credited amount, if any. Subject to proportionality principle, BSls should implement fraud test mechanisms or measures under their CPRMS to distinguish fraudulent from legitimate transactions. Liability for losses arising from unauthorized transactions. In determining liability for losses, BSls may consider, among others, the following factors: a. Actions of the accountholder before, during and after the unauthorized transaction; b. Acts or omissions of the BSl, its employees, third-party agent, outsourced entity or service provider acting on behalf of the BSI; and/or c. Non-compliance by the BSl, its employees, agents or service providers, with any requirement under the FCP Framework and other existing rules and regulations applicable to the BSI's of anv financial product or service: Erroneous Transactions. In case an accountholder transfers funds to a payee account other than the intended recipient account, he/she should immediately report the error to the OFI with the followinq details: a. Name, contact number, and other credentials of the payor; b. Account from which the payment was made; c. Payee account details; Page 28 of36

ANNEXB lNameof BSll Summaryof Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.116o dated 28 November 2o.22 e. Transaction date and time. In case the OFI and RFI involved in an erroneous transaction are different BSls, the OFI must immediately inform the RFl. Both the OFI and RFI should make reasonable efforts to recover the sum sent in error in accordance with existing regulations and industry conventions. IOO4AOO4.Q APPROPRIATE DESIGN AND DELIVERY OF FTNANCIAL PRODUCTS AND SERVICES xxx xxx BSls shall implement the following measures: a. Affordability and suitability assessments - BSls should have written procedures for determining whether a particular financial product or service is suitable and affordable for their Clients. This shall include the determination of whether the amount and terms of the offered financial product or service allow various Clients to meet their respective obligations with a low probabilityof a serious hardship, and that there is a reasonable prospect that the financial product or service will provide value to the Client. For the purpose of extending credit, this assessment should include measures to prevent over-i ndebted ness. When making a recommendation to a Financial Consumer: 'l) BSls that will conduct suitability assessment should inform their Clients, clearlv and simplv. about the suitabil Page 29 of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No.1160 dated 28 November 2022 assessment, its purpose, and the BSI's responsibility to conduct the assessment under relevant regulations so that Clients understand why they are asked to provide certain information. BSls should encourage Clients to provide accurate and sufficient information about their knowledge, experience, financial situation, financial capability, ability to bear losses, investment objectives, and risk tolerance, 2) BSls should offer products or services that are in line with the risk profile and/or preferences of their Clients. The BSls should allow Clients to choose from a range of available products and services that are most suitable to their needs, requirements or preferences. This may include preferences on payment dates, loyalties or average balances. BSls should provide sufficient and accurate information to enable their Clients to select the most suitable and affordable product or service. 3) BSls should advise their Clients that in case of incomplete information or misrepresentations made in the suitability assessments, the BSI is not in a position to accurately determine whether the product or service is appropriate for them. This advice may be provided in a standardized format. lf the requested products do not match a Client's risk tolerance assessment results, the BSI should draw attention to the risk mismatch and provide a disclosure of consequences, either in digital or written format, for acceptance by the Client. Page 30 of36

ANNEXB lNameof BSII Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. 116O dated 28 November 2022 Product bundling. When bundling products and services, BSls should also take into consideration product suitability and should not unduly limit consumer choice. When Financial Consumers are required by a BSI to purchase a product, such as a checking account or an insurance policy, as a precondition for receiving a loan, they should be free to choose the provider of the secondary product, subject to reasonable standards set by the BSl. which shall be disclosed and made available to their Clients. Information regarding the bundled product and the right of choice should be made known to clients during the shopping and pre-contractual phases. The BSI should not sway or pressure its Clients toward a particular provider on the basis of its own commercial agreement with that provider. When a choice among different providers for the secondary product is unavailable, the BSI shall not be prohibited from offering the bundled products, but all key fuatures, including the identity of the provider of the secondary product, should be fully-disclosed to the Client. BSls should offer product bundles with market-based pricing. BSls must focus on accelerating their digitization strategies to better understand customer preferences and behavior and offer personalized, relevant, flexible and intuitive bundled product offers. b. Cooling-off period - BSls must set in place a cooling-off poticy for and services. based on Page 3l of36

ANNEXB lNameof BSll Summary of Obserued Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll60 dated 28 November 2o,22 reasonable time that allows a Client to consider the costs and risks of a financial product or service, free from pressure of the BSI sales team and/or its third-party agents and service providers. Financial Consumers shall be allowed to terminate, withdraw or return the product/service contract anytime within the cooling off period immediately following the execution of any agreement or cbntract entered into for the availment of any such product or service covered by mandatory cooling-off period. Provided that such a policy includes a mandatory cooling-off period of a minimum of two (2) banking days for products and services that are marketed, offered or sold in retail to Financial Consumers who are: (I) individuals, regardless of income, or (2) Micro or Small Enterprises, as defined in applicable Department of Trade and Industry (DTl) regulations, and which possess any of the following characteristics: (a) Are consumer credit and retail banking products sold to or entered into by the above Financial Consumers for the first time, such as but not limited to credit cards; loans; pawning; trust products and other financial instruments; (b) Are marketed, offered or sold via remote means and/or subjected to high-pressure sales or marketing; (c) Are governed by contracts with a term or duration of more than onefl)year;or (d ) Have other features that may be specified by the Bangko Sentral; Provided, further, That, in the case of bancassurance, the mandatory cooling-off period prescribed by the Insurance

ANNEXB lNameof BSII Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Cornpliance with Section 6 of BSP No.ll60 dated 28 November 2022 In their cooling-off policy, BSls may speciff products and services that have a cooling-off period of more than the minimum requirement of two (2) banking days, up to a maximum of 15 banking days, following the principle that the more complex and long-term the product or seryice is, the longer the cooling-off period should be. Products and services with any of the following features are exempt from the cooling-off period: l) Products and services marketed, offered or sold to a BSI'S corporate clients, and medium-sized enterprises, as defined in applicable DTI regulations; 2) Financial instruments with a remaining term of less than one (l ) year; 3) Financial instruments with aggregate investment size of P 5OO,OOO and above: 4) Securities "traded" or "to be traded"; or 5) Short-term and one-off transactions, such as but not limited to foreign currency exchange, remittances, fund transfers, or payments and similar transactional products/services. ln cases when a Financial Consumer withdraws or returns a product/service contract, the BSI must refund or return to the Financial Consumer the amounts paid or invested, including documents submitted, without undue delay and within a maximum period of fifteen (15) banking days after receipt of notice to withdraw or return. The BSI mav charqe and withhold from the refund due to Page 53 of56

ANNEXB lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll60 dated 28 Novernber 2o22 the Financial Consumer, the fees or charges that are not greater than the actual or reasonable approximation of costs incurred by the BSl. Further, the BSI should provide the Financial Consumers with clear and comprehensible information at pre-contractual and contracting stages regarding the availabilityof cooling-offrights, the period within which these rights can be exercised, practical instructions on how they may be exercised, the amounts of charges or fees which may be required if exercising them, and the consequences of not exercising them. BSls must provide FinancialConsumers with appropriate, easily accessible means or channels to communicate their exercise of cooling-off rights. c. Prepayment of loons and other credit accommodations - BSls shall allow a borrower, at any time prior to the agreed maturity date, to prepay in whole or in part, the unpaid balances of a loan or other credit transactions; Provided, That costs or fees charged to the borrower for such pre-payment, if any, shall be disclosed in accordance with the Standard of Transparency and Disclosure, and responsible pricing principles, as required under this Section, and subject to such reasonable terms and conditions as may be agreed upon between the BSls and the borrower. Disclosure must be given before the contract is signed, at the time of contract signing, and during the life of the contract. BSls may charge reasonable administrative costs for the early payment of fixed and variable interest rate loans. Page 34 of36

ANNEX B lNameof BSll Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll6O dated 28 November 20.22 Further, for fixed rate loans, BSls may separately charge costs to recover losses based on the difference between the annual percentage rate and the current market rate. For loans with variable interest rate, BSls are not permitted to charge foregone futu re i nterest. A BSI should be able to show how it calculated or determined the amount of prepayment charges, consistent with the relevant restrictions under this Framework. 'The BSI would need to take into account factors such as the amount being prepaid, the remaining term of the loan, the fixed interest rate (or rates, if multiple rates apply), and the current relevant market rates. roosnoos-Q ENFORCEMENT AND ADM|NISTRATIVE SANCTTONS xxx No Waiver of Rights. No provision of a contract for a financial product or service shall be lawful or enforceable if such provision waives or otherwise deorives a Client of a legal right to sue the BSl, receive information, have their complaints addressed and resolved, or have their Client data protected. Such a waiver may cover agreements/contracts that limit the following the BSI'S liability for the acts or omissions of its directors, trustees or officers, employees or agents; obligations of the BSI; or the right of the Financial Consumer to exercise any rights under the FCPA, its IRR or any relevant laws, rules and regulations. Page 35 of36

ANNEX B lName of BSII Summary of Observed Gaps and Corresponding Board-Approved Action Plan in Compliance with Section 6 of BSP No. ll6O dated 28 November 2O22 Page 36 of36