Status Report on EMV Migration Activities/EMV Compliance

BANEKO SEXTNNL NE PILIPINAS OFFICE OF THE DEPUTY GOVERNOR SUPERVISION AND EXAMINATION SECTOR MEMORANDUM NO. M-2016-iLa To : ALL BSP-SUPERVISED FINANCIAL INSTITUTIONS (BSFlslW|TH DEBIT CARD1 AND CREDIT CARD ISSUING AND ACQUIRING FUNCTIONS Subject : Status Report on EMV Migration Activities/EMV Compliance As part of its continuing efforts to strengthen the electronic retail payment network and to protect the public against payment card fraud, the Bangko Sentral ng Pilipinas (BSP), through the issuance of Circular No. 808 dated 22 August 2013 and Circular No. 859 dated 2 November 20L4, required all BSFIs with card issuing and acquiring functions to migrate their entire payment card network to the more secure EMV technology by l JanuarV 2QL7. ln view of the fast-approaching EMV implementation timeline, all concerned BSFIs are required to submit a status report of their EMV migration activities/EMV compliance together with a Certification duly notarized and signed by the authorized officials of the reporting BSFI, using the attached prescribed templates. The report shall be submitted on a quarterly basis commencing on 30 September 2016 until full compliance, within fifteen (15) banking days from end of reference quarter, to the Core Information Technology Specialist Group at 9th Floor Multi-Storey Building, BSP Complex, A. Mabini St., Malate Manila 1004. For compliance. il -,t TENY I. SILVESTRE ;" Sector-in-Charge (-f September 2016 Att.: A/5 1 Debit card refers to a payment card issued by a duly authorized BSFI in the Philippines, whether co- branded with international payment network or proprietary, linked to a deposit or prepaid/electronic (e-money) account. A. Mabini st., Malate 1004 Manila, Philippines o (63217o877OL. www.bsp.gov.ph . [email protected]

Attachment I <Name of BSP-supervised financial institution (BSF|l> Status Report on EMV Migration Activities/EMV Compliance As of <quarter end> Timeline Status/ Remarks Activities Upgrade/En hancement/Replacement of Back-end Systems (i.e. Switch, HSM, Host Processor, card management system, etc. <please specify>) o BSFI with card issuing function r BSFI with card acquiring function Host Certification (e.g. ATM, Credit Card <please specify>) r with BancNet (for proprietary debit/prepaid cards) r with other payment networks (for co-branded debit/prepaid and credit cards) Upgrade/Replacement of ATM Terminals Uperade/Replacement of Point-of-Sale (PoS) Terminals ATM Terminal Certification (indicate level of terminal compliance testing and certifying body) POS Terminal Certification (indicate level of terminal compliance testing and certifying body) Chip card vendor selection Chip Card Personalization Validation Certification o Proprietary Debit/Prepaid cards r Co-branded Debit/Prepaid cards r Co-branded Credit Cards EMV cards Production o Proprietary Debit/Prepaid cards o Co-branded Debit/Prepaid cards r Co-branded Credit Cards lssuance of new EMV-compliant cards o Proprietary Debit/Prepaid cards o Co-branded Debit/Prepaid cards r Co-branded Credit Cards Replacement of all magnetic stripe cards with EMV cards r Proprietary Debit/Prepaid cards r Co-branded Debit/Prepaid cards o Co-branded Credit Cards Others (olease enumerate)

Attachment 1 Electronic Channels Number 1. ATMs Onsite Offsite Totol Number of ATMs deploved EMV compliance: EMV-certified ATMs (indicate total number of terminals whose terminal profiles have been certified) EMV-ready ATMS (awaiting certification) For both On-us and Off-us transactions For On-us transactions only Non-EMV-compliant ATMs (unable to process EMV transactions) 2. Point-of-Sale (POSI Devices for Payment transactions POS that accept proprietary cards only POS that accept all other pavment cards Total Number of POS deployed EMV compliance: EMV-certified POS ((indicate total number of terminals whose terminal profiles have been certified) EMV-readv {awaitine certification) For both On-us and Off-us transactions For On-us transactions onlv Non-EMV-compliant POS (unable to process EMV transactions) 2. Point-of-Sale (POSI Devices for Cash-Out transactions POS devices that accept proorietarv cards onlv POS devices that accept all other payment cards Totol Number of POS deploved EMV compliance: EMV-certified POS (indicate total number of terminals whose terminal profiles have been certified) EMV-readv (awaiting certification) For both On-us and Off-us transactions For On-us transactions onlv Non-EMV-compliant POS (unable to process EMV transactions)

Attachment 1 3. I Other card-accepting devices: <Please specifv> EMV complionce: EMv-certified terminals (indicate total number of terminals whose terminal profiles have been certified) E MV-readv (awaitins certification) For both On-us and Off-us transactions For On-us transactions only Non-EMV-compliant terminals (unable to process EMV transactions) Number Tvpe of Card lnstruments 1. ATM Debit Cards Card Schemes: Proprietary Co-branded (please specify) Totol Number of Debit Cards issued EMV complionce: EMV-compliant ATM debit cards Non-EMV-compliant ATM debit cards 2. Prepaid Cards (Cash Cards/Electronic Money! Cord Schemes: Proorietary Co-branded ( please specify) fotul Number of Prepoid csrds issued EMV compliance: EMV-compliant Prepaid Cards Non-EMV-compliant Prepaid Cards 3. Credit Cards Cord Schemes: Proprietary Co-branded (please specify) Totol Number of Credit Cords issued EMV complionce: EMV-compliant Credit cards Non-EMV-compliant Credit Cards

Attachment 2 <Name of Bank> CERTIFICATION This is to certify that the attached Status Report on EMV Migration Activities/EMV Compliance contains accurate description of the status of the Bank's EMV migration activities/EMV compliance as of <quarter end>. Authorized Signing Officer Authorized Signing Ofticer sUBScR|BEDANDSWoRNToBEFoREMETH|sdayof-20,affiant exhibiting to me their: NOTARY PUBLIC Until December 31, 20 PTR No. Doc. No. Page No. Book No. Series of