Guidelines on the Submission of the Comprehensive Credit and Equity Exposures (COCREE) Report through the BSP Financial Institution (FI) Portal

MEMORANDUM NO. M-2022-__ 018 OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR To : ALL UNIVERSAL/COMMERCIAL BANKS AND THEIR THRIFT BANK/NON-BANK FINANCIAL INSTITUTION WITH QUASI-BANKING FUNCTIONS/TRUST CORPORATION SUBSIDIARIES, AND DIGITAL BANKS Subject : Guidelines on the Submission of the Comprehensive Credit and Equity Exposures (COCREE) Report through the BSP Financial Institution (FI) Portal Pursuant to Circular No. 1131 dated 13 December 2021 and in line with Memorandum No. M-2021-070 dated 22 December 2021, the following guidelines shall be observed for the submission of the COCREE Report through the Financial Institution (FI) Portal: 1) Effective immediately, all COCREE Reports, whether for purposes of pilot testing or upon live implementation, shall only be submitted through the BSP Financial Institution (FI) Portal. The corresponding User Guide for navigating the COCREE Module of the FI Portal is attached as Annex A. The FI Portal can be accessed at https://fiportal.bsp.gov.ph. 1 2) Pilot testing shall continue up to May 2022 while the live implementation beginning with reporting period 31 March 2022 shall be on 06 June 2022 in accordance with the schedule prescribed under Memorandum No. M-2021-070. 3) The COCREE Report shall be encrypted when submitting to the BSP. To facilitate the encryption process, the accomplished Encryption Management Form (EMF attached as Annex B) in PDF as duly signed by the authorized official of the BSP-Supervised Financial Institution (BSFI) shall be emailed to [email protected] , following the prescribed e-mail subject format of [COCREE-EMF] <BSFI Name> . 4) Guidelines on the registration of authorized officers of the BSFI allowed to access the FI Portal shall continue to be observed in 1 As provided in the FI Portal Manual, compatible web browsers shall be at least Chrome 51/Win7, Firefox 31.3.0 ESR/Win7, Firefox 46/Win 7, Internet Explorer 11/Win 7, Edge 13/Win 10.

accordance with Memorandum Nos. M-2017-028 dated 11 September 2017 and M-2020-073 dated 25 September 2020. Such authorized officers allowed to access the FI Portal need not be the same representatives designated in the EMF referred in item no. 3. Discretion is accorded to the BSFI to duly designate the responsible officers. Queries on the guidelines and others related to the COCREE Report can be emailed to [email protected]. For compliance. Digitally signed by Chuchi G. Fonacier Date: 2022.03.28 22:41:19 +08'00' CHUCHI G. FONACIER Deputy Governor ___ 28 March 2022

Annex A Bangko Sentral ng Pilipinas Comprehensive Credit and Equity Exposures Report Financial Institution Portal User Guide

Annex A BSP Financial Institution Portal This document shall be applicable only to Universal/Commercial Banks and their Thrift Banks, Non-bank Financial Institutions with Quasi-Banking Functions, and Trust Corporation subsidiaries, as well as Digital Banks, pursuant to BSP Circular No. 1131 and Memorandum no. M-2021-070 on the Comprehensive Credit and Equity Exposures (COCREE) Report. Covered BSP-supervised Financial Institutions (BSFIs) shall electronically submit the COCREE Report and its corresponding Control Prooflist (CP) through the Financial Institution (FI) Portal.1 COCREE Report Module A new module in the FI Portal, the “COCREE Report” tab, is dedicated for the electronic submission and processing of COCREE Report. 1. The “COCREE REPORT” module displays the “Uploading” and “Monitoring” tabs. 2. To begin the submission process, click on the “Uploading” tab. This tab will direct the BSFI to a page which contains the following: a. Select Reference Date – This is a dropdown list of monthly reference dates. b. Upload Zip File – This is the tab to upload the compressed file containing the COCREE-XML. The COCREE-XML should be compressed to .zip, .rar, or .7z format and should be encrypted with the BSFI nominated Password.2 It can be observed that directly compressing the folder containing the COCREE-XML files will result in an error upon the FI Portal’s extraction/decryption of the submitted report. In this regard, the BSFI shall select/highlight the COCREE-XML files (instead of 1 The FI Portal can be accessed at: https://fiportal.bsp.gov.ph/. 2 Refer to Encryption Management Form (EMF) COCREE FI Portal User Guide ver 1.0 Page 1 of 7

Annex A BSP Financial Institution Portal the folder) and compress them into one (1) file using the preferred compression format. c. Upload Control Prooflist – This is the tab to upload the Control Prooflist (CP) in PDF format. The CP shall be uploaded separately and shall not be encrypted. d. Status Table – This shows the upload progress of the last one hundred (100) submissions, status as follows: · Pending – compressed file is on queue for extraction/decryption · Ongoing/Processing - extraction/decryption of the compressed file is ongoing · Uploaded – file is already extracted/decrypted. In this stage, the validation status is already available in the Monitoring page. a b c d The following error messages may be encountered in the upload: · Unable to continue. Uploaded file is not a valid compressed file. This shall prompt if the compressed file is not in .zip, .rar, and .7z format. · Unable to continue. No valid Prooflist file found. This shall prompt if the Control Proofilst is not in PDF format. · Extraction error occured. No file/s to extract. This shall prompt if the compressed file has no content. COCREE FI Portal User Guide ver 1.0 Page 2 of 7

Annex A BSP Financial Institution Portal · Extraction error occured. Uploaded compressed file contains an invalid file. This shall prompt if the compressed file contains a file that is not in XML format. · Extraction error occurred. Either XML file is unreadable or has no data(0KB). This shall prompt if the compressed file contains a corrupted XML file. · Extraction error occurred. Invalid structure, zip file cannot contain folder. This shall prompt if the XML files are not properly compressed, such as if the folder was compressed instead of the XML file/s. Other error messages, which are Password-related, are as follows: § Extraction error occured. Password is expired. § Extraction error occured. Invalid password. § Extraction error occured. Please set a password. 3. Click the “Select Reference Date” to choose the reporting period referred in the submission. 4. Click on “Upload Zip File” to attach the encrypted and compressed file. It must be noted that the size of the compressed file for uploading is capped at 500MB. The size of the individual XML file contained in the compressed file can exceed 500MB. COCREE FI Portal User Guide ver 1.0 Page 3 of 7

Annex A BSP Financial Institution Portal Next, click on the “Upload Control Prooflist” to attach the CP in PDF format. The file naming convention for the compressed file is <COCREE_YYYYMM_UploadX.zip> where “YYYYMM” is the reference year and month, and the “X” after Upload is the number of submission attempt (e.g., COCREE_202203_Upload1.zip). The naming convention for the individual XML file is <COCREE_YYYYMM_X_BankAcronym_1ofN.xml> where “YYYYMM” is the reference year and month, X is the number of submission attempt, and the N in “1ofN” is the total number of XML files for submission in the reference period, sample as shown below: a. For a single-XML file Submission: COCREE_202203_1_ABC_1of1.xml b. For a three-XML file Submission: COCREE_202203_1_ABC_1of3.xml COCREE_202203_1_ABC_2of3.xml COCREE_202203_1_ABC_3of3.xml The file naming convention for the Control Prooflist is <COCREE_YYYYMM_<Bank acronym>_Control Prooflist.pdf> (e.g., COCREE_202203_ABC_Control Prooflist.pdf). COCREE FI Portal User Guide ver 1.0 Page 4 of 7

Annex A BSP Financial Institution Portal 5. Uploading will only proceed if both “Upload Zip File” and “Upload Control Prooflist” have the correct file attachments. Once relevant files are attached, click Submit. It is advised that all COCREE-XML files are compressed into one file as the BSFI can only proceed to the uploading of another compressed file once prior submission has been validated. For instance, for the reference month 202203, Bank A has 2 compressed files with the size of 100 MB each. Bank A can only upload compressed file #2 once compressed file #1 has been validated. 6. Results of validation can be tracked in the “Monitoring” page. This page contains the following tabs: COCREE FI Portal User Guide ver 1.0 Page 5 of 7

Annex A BSP Financial Institution Portal a. Bank Code and Bank Name; b. Search; and c. Monitoring Table. a b c 7. The Monitoring Table contains the following: a. Trans # - This displays the system-assigned transaction ID number of each XML file. b. Reference Date – This displays the monthly reference date. c. Filename – This displays the file name of each COCREE-XML file. d. Status – This displays the status of the validation as: On process, Stage 1 Failed, Stage 2 Failed, and Passed. e. Submitted Date – This shows the date and time of submission. f. Action – This allows the BSFI to download the validation results (“Download the Validation Result”), as well as the submitted file (“Download the file”): COCREE FI Portal User Guide ver 1.0 Page 6 of 7

Annex A BSP Financial Institution Portal The Monitoring Table can also be sorted by clicking the specific header, as shown below. Additional Information How to Download the XSD file 1. Access the BSP Template Portal through www.bsp.gov.ph/SES/reporting_templates. 2. Right-click the "COCREE_1.1.xsd" then choose "Save link as", instead of directly opening the link. 3. Once the XSD is downloaded, open the file in any application that can read .xsd format such as Notepad and Notepad++ COCREE FI Portal User Guide ver 1.0 Page 7 of 7

$QQH[% CREDIT REPORTING SYSTEM UNIT (CRSU) Comprehensive Credit and Equity Exposure (COCREE) Report PART I: GENERAL GUIDELINES 1. This Encryption Management Form (EMF) is specifically for the Comprehensive Credit and Equity Exposures (COCREE) Report pursuant to BSP Circular No. 1131 dated 13 December 2021. 2. The BSP-supervised Financial Institution (BSFI) shall always take all the necessary and adequate security and precautionary measures in the preparation and submission of the COCREE Report to ensure compliance with Republic Act No. 10173 (Data Privacy Act) and all pertinent laws or regulations. 3. The BSFI, through its authorized official, shall designate four (4) registrants – which shall be split into two (2) pairs, each pair with one (1) primary and one (1) alternate – who are authorized to provide the BSP with the nominated Password. The authorized official of the BSFI shall endorse the nomination of registrants by affixing his/her signature in the EMF. 4. The duly accomplished EMF of the BSFI shall be transmitted to CRSU, through [email protected], following the prescribed e-mail subject format of [COCREE-EMF] <BSFI Name>. 5. Each authorized registrant shall nominate the respective Password to encrypt the COCREE Report following the instructions in Part II below. 6. The BSFI and its authorized registrants shall ensure the confidentiality of the Password and COCREE Report. 7. For changes in the authorized primary and/or alternate registrant/s, the BSFI shall submit the duly accomplished EMF reflecting the corresponding change/s in accordance with Part I.4. PART II: INSTRUCTIONS ON THE PASSWORD SUBMISSION 1. A strong password for the encryption of the COCREE Report shall be used with at least 10 characters, containing upper and lowercase letters, at least one (1) number, and at least one (1) special character. 2. Password shall be split into two. Each pair of registrants shall nominate either the 1st half (“left”) or the 2nd half (“right”) side of the Password. It is understood that the registrants shall keep confidential their respective half of the Password. 3. After receiving the accomplished EMF from the BSFI, the CRSU shall coordinate with the authorized registrants to provide the medium for the Password submission. 4. The authorized registrant/s shall immediately inform the CRSU, through [email protected], of any change in the BSFI’s nominated Password. CRSU Form No. 01-001 * Version  * Updated 28 March 2022 Page 1 of 2

$QQH[% CREDIT REPORTING SYSTEM UNIT Comprehensive Credit and Equity Exposure (COCREE) Report ENCRYPTION MANAGEMENT FORM Institution Name (Left Password) Registrant Position Title Department/ E-mail Address Name Office/Unit/ Group (Last Name, First Name M.I.) (Left Password) Alternate Position Title Department/ E-mail Address ªƵǐǞȺɈȲƊȁɈyƊǿƵ Office/Unit/ Group (Last Name, First Name M.I.) (Right Password) Registrant Position Title Department/ E-mail Address Name Office/Unit/ Group (Last Name, First Name M.I.) (Right Password) Alternate Position Title Department/ E-mail Address Registrant Name Office/Unit/ Group (Last Name, First Name M.I.) Type of Request: Registration Change Profile This is to certify that all personnel involved, whose personal information appears above, have been duly notified of their responsibilities relative to the submission of the COCREE Report. This is to further certify that all information supplied in the EMF are complete, truthful, and valid. Signature over Printed name of Authorized Official Date Signed: ____________ CRSU Form No. 01-001 * Version  * Updated 28 March 2022 Page 2 of 2