Regulatory Reporting Standards for Operators of Payment System (OPS)

BANGKO SENTRAL NG PILIPINAS OFFICE OF THE GOVERNOR CIRCULAR No. 11^_, Series of 2022 Subject : Regulatory Reporting Standards for Operators of Payment System lops) The Monetary Board, in its Resolution No. 196 dated 10 February 2022 approved the following regulatory reporting guidelines for Ops. Section I. The following Sections are hereby created in the Manual of Regulations for Payment Systems (MORPSj: Section 401. Reporting Governance Framework for Operators of Payment System lops) Policy Statement. The Bangko Sentral recognizes that relevant* complete, accurate, and timely reports are necessary for the effective oversight of the national payment system. Reports of such qualities accordingly support the Bangko Sentral's determination of appropriate oversight tools, approaches, and interventions. Thus, the Bangko Sentral adopts this reporting framework which shall govern the submission of reports of an ops. Reporting Stundords. Reports submitted to the Bangko Sentral must be accurate, complete, and timely to be considered compliant with the Bangko Sentral reporting standards. Inputs to the reports shall be validated by the Ops prior to submission to the Bangko Sentral to ensure accuracy. completeness and integrity of information submitted therein. The reports shall reflect all the information required by the Bangko Sentral. Reports with incomplete schedules or attachments shall be considered non- compliant with the reporting standards prescribed in this Section. Moreover, submission of reports shall be made within the timeline and in accordance with reporting templates prescribed by the Bangko Sentral. 49 , , . , , , , , . . . . ..'.'.'.. . .'.. .*'..' ..'. ' o. 00 ' " ' ' ' ' ""' "" -..., . . ._. ._. . . . 0.0. . . . ,. .

To be able to comply with these reporting standards, an Ops must have in place a reporting system that has at least the following functionalities under both business-as~usual and stressed conditions: Generates accurate, complete and reliable information required by the Bangko Sentral and other regulatory bodies; 2. Aggregates all material data across various business lines, entities, services, instruments and other groupings that are relevant to regulatory reporting; and 3. Produces in a timely manner, regular, on-demand, and ad hoc reports particularly those required by the Bangko Sentral and other regulatory bodies. For the purpose of this Section, a stressed condition shall refer to emergency conditions for Ops such as a crisis, national or public health emergencies, weather-related events, or sudden closures of markets and/or clearing agencies the transactions therein are processed through an Ops for eventual settlement. Reporting Govern^rice. The Board and senior management shall be responsible for respectively adopting policies on and implementing an effective reporting system that generates accurate, complete, and timely reports to the Bangko Sentral. In this regard, the Board and senior management of an Ops shall establish regulatory reporting procedures that ensure adherence to the reporting standards set by the Bangko Sentral. An effective reporting system shall have the following components: I. A management information system, data architecture and technology infrastructure: That are coinmensurate to the nature, scope, operational complexity and systemic importance of the Ops' business activities; b. That fully support reporting requirements; and C. That facilitate internal independent validation prior to submission of reports. ,.:^;^

2. Documented policies and procedures, which should include, at a in In Imum: Processes for generating required reports which meet the standards prescribed by the Bangko Sentral; Procedures to implement modifications in reporting processes, in order to incorporate corrective measures and/or enhancements for the purpose of addressing weaknesses identified during periodic reviews, responding to changes in operating environment, or complying with new regulatory reportorial requirements; Protocols that ensure timely reporting to the Board and senior management of significant or unusual transactions, events, or activities that have material impact on the quality of reports; and Standards and procedures for maintaining adequate back- up copies of essential business information, software and relevant documents that are necessary for restoration of critical operations, 3. Periodic independent review of reporting processes and procedures to ensure their continuing reliability and effectiveness. The appropriate frequency of such review shall mainly depend on the systemic importance, risk profile and business complexity of the Ops as well as the extent of recurrence of control weaknesses that cause reporting exceptions. Such assessment shall be conducted by an independent unit within the Ops (i. e. . internal audit) or an independent external party contracted by the Ops for such purpose. with expertise in relevant information technology 11T), data management, and regulatory reporting. Data Retention. Ops shall likewise adopt a policy requiring data and report retention period of no less than five (5) years unless the Ops become a subject of an investigation, a special examination of the Bangko Sentral or a criminal, civil, or administrative case has been filed in a competentjudicial or administrative body where the Ops is involved as a party to the investigation. In such cases, the relevant information shall be preserved beyond the five (5)-year period until such time that a final judgment has been reached by the Bangko Sentral or by the judicial or administrative body. In cases where specific laws or Bangko Sentral issuances require a different retention period. the longer retention period shall be observed. ,^9

Saneti^"s for Non-Compliance with the Reporting Standards, The following guidelines shall govern the imposition of sanctions to an Ops for non-compliance with the reporting standards: a. Definitions I. Erroneous Report - A report that was submitted within the prescribed deadline. but is found to be nori-compliant with the Bangko Sentral reporting standards described in this Section shall be classified as "Erroneous". Submission of an Erroneous Report shall be considered as willful failure to comply with the regulation. 2. Delayed Report - A report that is compliant with the Bangko Sentral reporting standards but was submitted after the prescribed deadline shall be classified as "Delayed". Submission of a compliant report beyond the deadline prescribed by the Bangko Sentral shall be considered as willful delay in the submission of reports. 3. Unsubmitted - A report that was not submitted, or was submitted but do not comply with the Bangko Sentral reporting standards by the time the next report becomes due or upon lapse of thirty (30) business days from the report's submission deadline. whichever comes first. shall be classified as "Unsubmitted". Non. submission of required reports shall be considered as willful refusal to comply with the regulation. Table I shall be used as reference for the defined number of business days after a report's submission deadline for such report to be considered "Unsubmitted". Tablel - Number of days of delayed submission for a report to be considered as "Unsubmitted" Reporting Frequency Defined number of business days after report's submission deadline to be considered "Unsubmitted" Dail Weekl 7 Monthl uarterl Seinestral 30 Annual Event. based Ad hoc* *This refers to reports that the Ops are required to submit upon the occurrence of an event/incident or upon request by the appropriate oversight department of the Bangko Sentral for the purpose of conducting surveillance of the payment system, ,. 9. .

b. Monetary Penalties The applicable monetary penalty shall be based on a prescribed fine for each occurrence (in case of Erroneous reports) or for each day (in case of Delayed reports) shown in Table 2. The penalties will accumulate until such time that the report has been determined compliant with the prescribed reporting standards. Table 2 - Prescribed fines for re ortin violations ops Prima Re orts Seconda Re orts PS that are banks Universal/Commercial Php 3,000.00 Php 600.0 . Banks (U/KBs) hrift Banks (TBs) 1,500,00 300.0 . Rural Banks/Coop Banks (RCBs) 450.00 150.0. on-bank Ops 300.00 60.0. For the purpose of this regulation. a non-bank Ops shall include non-bank electronic money issuers (EMI-NBFl), clearing switch operators. and other non. BSFls that are registered with the Bangko Sentral as such. Primary reports are those which shall be required of ODPS such as, but not limited to. periodic surveillance reports which shall be due for daily, monthly or quarterly submission to the Bangko Sentral. Meanwhile, Secondary ^eports are those that shall be required of nori-designated Ops such as semi-annual payment services report. Secondary reports shall also include Annual Reports which shall be submitted by all Ops, For Erroneous I?eports. the penalty shall be computed by multiplying the prescribed fine by the number of times the subject report was submitted before being considered compliant, For Delayed Reports, the penalty shall be computed by multiplying the prescribed fine by the number of calendar days delayed. For Erroneous and Delayed Reports, the penalty shall be based on the sum of the penalty for being Erroneous and the penalty for being Delayed For Unsubm/'tted Reports; the penalty shall be based on the amounts to be prescribed in the oversight intervention and enforcement policy for all Ops which shall be the subject of a separate issuance. For the purpose of implementing the rules in this Section, the submission deadline is considered moved to the next business day ^;z

should it fall on a nori-working day in the locality where the reporting Ops is located or on a working day when the operations in government were suspended due to typhoon. flood or other similar fortuitous events. Failure to submit a report on time due to fortuitous events such as fire, natural calamities, public disorders, or national emergencies shall riot be considered as willful delay or willful failure. c. Non-monetary Sanctions In addition to the monetary penalties that may be imposed based on the preceding Subsection, the following nori-monetary sanctions shall likewise be imposed for Unsubm/tted ^eports: (1) First Offense; warning on the Chief Executive Officer (CEO) and the board of directors; (2) Second Offense: reprimand on the CEO and the board; (3) Third Offense: suspension of the CEO for at least one (1) month but riot more than one a ) year, depending on the nature and gravity of the violation or irregularity; (4) Further Offense/s: Possible disqualification of the CEO and/or the members of the board. In the case of an erring Operator of Designated Payment System (ODPS), the Monetary Board may designate a manager to take over the operations of the ODPS, upon determination of the appropriate oversight department that the reporting deficiencies result in a threat to the safety. efficiency, and reliability of the designated payment system, pursuant to Section 17 of Republic Act (R. A. ) No. 11/27 or the National Payment Systems Act (NPSA). The designated manager shall determine within the period prescribed by the Monetary Board, but not to exceed one (I ) year from the designation, whether the ODPS is able to address the significant reporting deficiencies and whether the same may be permitted to resume operations. The determination for resumption of management of the ODPS shall be subject to prior approval of the Monetary Board. The extent of sanctions to be imposed under items "(3)" and "(4)" shall depend on the following factors and the circumstances accompanying the non. submission of required reports: . The nature and significance of the unreported reportable items; . The duration and habitual ity of the delinquency; and Page 6 of a

Whether the non-disclosure of the required information has caused delay on an urgent oversight, supervisory assessment or investigation (i. e. . for on-demand or ad hoc reports). Pursuant to Section 19 of R. A, No. 11/27 (The National Payment Systems Act) and Section 37 of R. A. No. 7653 (The New Central Bank Act). as amended. the administrative sanctions and other penalties in connection to non-compliance with the Bangko Sentral's regulatory reporting requirements for Ops, whether banks or non- banks. are subject to review and approval by the Monetary Board or by the Governor, as applicable. The resignation or termination from office shall not exempt the erring director or officer from administrative or criminal sanctions under Section 19(b) of R. A. No. I 1/27. Bangk'@ Sentral^^ Assessment of the Reporting system. The oversight department of the Bangko Sentral shall conduct an assessment of the quality of the reporting system of an Ops in order to ascertain the accuracy, completeness and integrity, as well as the timeliness of their regulatory reports. If the Bangko Sentral finds significant deficiencies (i. e. , material deviations from reporting standards) in the reporting system or evaluates habitual reporting exceptions (i. e. , frequent submission to the Bangko Sentral of erroneous or delayed reports). the Ops concerned shall be required to submit a time-bound, Board. approved action plan that shall articulate measures to address the noted deficiencies that are acceptable to the Bangko Sentral. The failure of the Board and senior management of an Ops to implement the required corrective measures within the specified timeframes shall be a ground to subject the Ops, and/or its directors, responsible officers and employees, to enforcement actions described in the succeeding Subsection. Report@rinl Requirements, The specific reportorial requirements. including the report categories, signatories, frequencies. deadlines, and manner of submission to the Bangko Sentral, shall be covered in a separate issuance by the Bangko Sentral. Enforcement Action. The Bangko Sentral may deploy enforcement actions to promote adherence to the requirements set forth in this policy and bring about timely corrective actions. Any violation of this policy shall subject an Ops, and/or its directors, officers, and/or employees to the sanctions set forth in Sections 36 and 37 of R. A. No. 7653 (The New Central Bank Act). as amended. and Sections 19 and 20 of R. A, No. 11/27 (The National Payment Systems Act), as appropriate. ,. 9

In connection thereto. the provisions on Supervisory Enforcement Policy under Section 002 of the MORB and Section 002-orOOl-N of the Manual of Regulations for Non-Bank Financial Institutions (MORNBFl) shall apply for Ops that are BSP-supervised financial institutions (BSFls) such as banks and nori"bank financial institutions, as appropriate. Likewise, monetary penalties may be imposed on these BSFls and/or their erring directors, officers and/or employees pursuant to Section 1102 of the MORB and Section 1.02-or806-N of the MORNBFl. as appropriate. Section 2. Efreetlvity'. This Circular shall take effect fifteen (15) calendar days from its publication either in the Official Gazette or in a newspaper of general circulation. FOR THE MONETARY BOARD: < c'. <,. BENJAMIN E. DIOKNO Governor 61 March 2022 Page a of a