Regulatory Sandbox Framework

'J 14 * BANGl<O SENTRAL NG PILIPINAS OFFICE OF THE GOVERNOR CIRCULAR No. 1153 Series of 2022 Subject: Regulatory Sandbox Framework The Monetary Board, in its Resolution No. 1217 dated 18 August 2022, approved the institutionalization of the Regulatory Sandbox Framework. which shall be incorporated as Section 1/5 of the Manual of Regulations for Banks (MORB) and Sections 1/2-or115-Sins-PATS-Trios"NII41-CC of the Manual of Regulations for Nori-Bank Financial Institutions (MORNBFl). Section I. Section 115 of the MORB and Sections 1/2-or115-SII15-Pins- Trios-NA41-CC of the MORNBFl are hereby created to read as follows: Section '15/1/2-Q/115-5/1/5. Pm3. Trio3-NII4, -CC- GUIDELINES FOR THE REGULATORY SANDBOX PolicyStatement, It is the policy of the Bangko Sentra! to foster an enabling environment for responsible innovation to promote the development of an inclusive digital financial ecosystem that is complemented by a sound risk management system. In this light. the Bangko Sentral has welcomed transformative and game-changing technologies over the years under the "test-and-learn" approach. The institutionalization of this approach by adopting the regulatory sandbox framework aims to promote a more active. evidence-based, and results-driven assessment of new and emerging financial solutions. The sandbox is not intended and cannot be used to circumvent existing laws and regulations under the guise of proposing new and innovative products/services. In order for all sandboxes to operate within a safe and secure environment, Participants are required to adhere to the eligibility standards and operational guidelines set in this framework. Coverage. The Regulatory Sandbox Framework applies to all Bangko Sentral rig Pilipinas (BSP)-Supervised Financial Institutions (BSFls), third-party service providers of BSFls. other BSP-registered institutions, and new players that intend to offer or use an emerging or new technology' to deliver financial products/services pertaining to activities that could fall under the regulatory purview of the Bangko Sentral. Proposed innovations that are determined to be within the scope of existing regulations will be evaluated in accordance with the established registration/licensing regimes. ' A new or emerging technology that supports the delivery of financial products and services may include the use of artificial intelligence/machine learning (AllML). Internet-of-Things (10T). 5C. Cloud Computing. Robotics Process/Business Automation (RPNRBA). Quantum Computing, or , , ' Decentralized Ledger Technologies (DLTl. among others' , Pagel of 10 , * , , , , . . - , , , *',,"" , .,.

Definition of Terms. The terms used in this Section are defined as follows: a. App/Itent shall refer to an entity that intends to test its financial solution within the Regulatory Sandbox Framework. the Bangko Sentral to assess the entities applying to be part of the regulatory sandbox c. Partic/;Dentshall refer to an entity that has been assessed as eligible to take part in the regulatory sandbox. d. ^egu/ato01 Sandbox shall refer to a controlled, time-bound, live testing environment. which may feature regulatory waivers at the regulators' discretion. The testing environment may involve limits or parameters within which Participants must operate. 2 e. Test/hg Parameters shall refer to the rules or guidelines agreed upon by the Bangko Sentral and the Participant in implementing the testing exercise. The testing parameters shall include metrics to assess the viability of the solution being offered, f. Test/n9 Periodshall refer to the time duration of the testing phase of the regulatory sandbox. g. themat^^ Cohort shall refer to a regulatory sandbox implementation strategy wherein the regulator may define the sandbox parameters and/or set the innovation theme of financial solutions or experiment at ions to be deployed in the sandbox. h, Non-parti'<'110antshall refer to any external legal entity that is riot a regulatory sand box participant. Non-participants may also refer to supervised financial institutions that access customer- permissioned data residing in the Participant, or those that may access customer information and/or data within the regulatory sandbox environment. Eligibility Standards. Applicants should meet the following criteria to be able to participate in the regulatory sandbox: a. The financial solution: (1) uses new or emerging technology or utilizes an existing technology in an innovative manner. The applicant shall provide justification (e. g. , business case/market research) that shall support the mentioned characteristic in the proposed solution: or (2) bridges a market gap in the delivery of financial products/services, This shall be supported by research that shall be part of the documents submitted to the Bangko Sentral; b. The applicant must demonstrate its capability to deploy the proposed solution through a roll-out plan or strategy: ' Appaya. Sharmista. at al. The World Bank Group. 2020, Global Experiences from Regulatory Sandboxes

c. The applicant shall provide an initial test plan, which includes test case scenarios and expected outcomes of the experiment; d. The applicant must be able to identify significant risks. including money laundering and terrorist financing (ML/FF) risks. IT and cybersecurity. data integrity and data privacy. market acceptabi!ity, consumer protection, and project implementation/execution. relevant to the innovation and the corresponding proposed safeguards and risk mitigation strategies; e. The applicant must be able to identify Key Performance Indicators (KPls) or other metrics in monitoring the progress of the pilot implementation; and f. The applicant shall provide an acceptable exit and transition strategy once the experimentation is completed regardless of the outcome. The applicant should submit to the appropriate supervising department of the Bangko Sentral the documents supporting compliance with the foregoing criteria. Conditions of Approval A Participant that has been granted an approval to perform a sandbox or become part of a cohort sandbox activity shall, at all times, comply with the following conditions: a, Oversee the sandbox activities through an appropriate top-level committee; b. Integrate the sandbox in its overall strategic plan to ensure that the products/services being tested do not put undue strain on its systems. financial performance. and risk management ca pability: and c, Ensure that the sandbox activities satisfy the legal and regulatory requirements for Anti-Money Laundering/Combating Terrorism and Proliferation Financing (AML/CFF); d. Comply. to the extent possible. with the relevant regulations on payments, information technology 11T) risk management, Electronic Products and Financial Services (EPFS), business continuity management, and consumer protection and market conduct. among others; e. Implement the sandbox for a period no longer than twelve (12) months from the go-live date; f. After the sandbox period, submit a report summarizing the activities, accomplishments, and recommendations. The report must include discussions/information on. but not limited to, the following: (1) Outcome evaluation - the degree to which the sandboxed products/services are appropriate to their target market segment/s and other relevant stakeholders: the extent to which the sandbox stated objectives are achieved: and the assessment of growth or change. measuring the results across different levels IParticipant's customers, the Participant. the Bangko Sentral; (2) Viability evaluation - investigation of the value proposition's sustainability. including lessons learned to make the business grow and last: and (3) Recommendations - recommended action plans for the sandboxed product/service. and recommended policy

issuances or amendments to address risks arising from the public launch of the sandboxed product/service; g. Provide the necessary customer assistance in addressing issues/concerns that may arise during the sandbox period; h. If the sandboxed product/service is delivered through an API- based distribution and servicing models, ensure that the internal and security controls supporting its delivery shall be subjected to independent security assessments and a report on the same shall be provided to Bangko Sentral. when requested; and i. Submit to the Bangko Sentral, through TRISD for evaluation, any enhancements or changes to services offered in the sandbox. within thirty (30) calendar days prior to the date of roll-out. OversightFramework. The regulatory sandbox operates within a supervisory and monitoring oversight framework and structure that ensures the sound implementation of the guidelines set in this circular, The oversight framework enables the formation and/or designation of relevant units within the Bangko Sentral. This unit shall be called the Sandbox Oversight Team. which shall act as the central point of contact for each sandbox activity. It shall oversee the various stages of the sandbox implementation. The framework establishes the specific roles and responsibilities of the units to be created and/or assigned for the appropriate management and oversight of all regulatory sandbox endeavors and their related activities. The oversight activities shall include, but are not limited to, the implementation of the regulatory sandbox and its guidelines. evaluation of applications, and provision of technical advisory or assistance to the participants. Operational Guidelines. Each regulatory sandbox shall undergo a four-stage process: Application. Evaluation, Testing, and Exit Stage. This approach ensures that all applicants are assessed according to established criteria: a, Application Stage. Applicants shall submit, at the minimum, the following to the Bangko Sentral: (1) Letter of Intent signed by the president or officer of equivalent rank, Appendix 1511Q"95 (Annex A) (2) Corporate secretary's certificate on the approval of the board of directors of the intention to apply for a sandbox (or a local/regional management committee. in case of foreign applicants) (3) Accomplished Regulatory Sandbox Application Form Appendix152/Q-96 (Annex B) (4) Eligibility Self-assessment Checklist Appendix153/Q-97 (Annex C) (5) Test Plan Appendix154/Q-98 (Annex D) Additional requirements/documents, aside from the aforementioned contents, may be requested by the Bangko Sentral to aid in its evaluation of the application. The Applicant may likewise submit other information it deems fit for the prudential assessment of the Bangko Sentral. b. Evaluation Stage. The Bangko Sentral shall evaluate the documents submitted by the applicant as to completeness. correctness, and suitability based on eligibility standards set out in this Section. The Bangko Sentral reserves the right to reject an application based on the merits of the submitted documents and representations.

All applicants shall be informed of the result of their application. Eligible applicants shall be informed of the su bsequent steps for the experimentation. Applicants who did not meet the eligibility standards shall be notified of the reason/s for the rejection of their application without prejudice to the filing of a new application after a cooling-off period of six (6) months from the release of the result of the notification. c. Testing Stage. Eligible applicants. which shall be called Participants, shall proceed to the testing stage. This stage shall ultimately determine the viability of the proposed solution, The testing stage is divided into two phases:(i) testing design phase and Iii) testing implementation: (1) Test/hg Des/!g. n Phase. The Participant shall present the proposed innovation to the Bangko Sentral, The presentation shall cover the overview of the solution. the proposed products or services created by the use of the solution, financial projections on the expected revenues and expenses and the assumptions used, operational/systems flow, and the test and roll-out plan, The Bangko Sentral shall approve the test plan to be utilized during the experiment at ion period and issue a Letter to Proceed with the Test Implementation. The design of the test plan shall be suited to the foatures of the proposed solutions, which shall, at a minimum. contain the following: (a) Overall timeline and budget (b) Testing performance metrics (c) Testing methodologies and/or scripts (d) Customer acquisition plan (e) Customer communications (f) Minimum safeguards (such as information secu rity, consumer dispute resolution/redress mechanism. AML/CFF safeguards) (9) Specific regulatory requirements, if any, to be relaxed during the testing period (h) Exit plan upon completion of the sandbox activity or in case there is any serious concern on the continued implementation of the sandbox activity, as may be determined by the Bangko Sentral (i) Testing deliverables (2) Testing Implementation Phase. Once the test plan is approved. the Participant/s shall proceed with the test implementation. This marks the start of the initiative, which the Bangko Sentral shall monitor. Testing duration can range from 3 to 12 months from the go- live date, depending on the complexity of the proposed solution, The participant shall submit to the Bangko Sentral any proposed adjustments in the duration or changes to the roster of participants and/or services offered. Extension of and/or Adjustment on the Terms of the Experiment ation. The Participant shall submit for evaluation to the Bangko Sentral any proposed adjustments in the duration of sandbox activity or features of the proposed solution being tested. Application for extension/adjustment should be filed at least 30 calendar days before the expiration of the sandbox testing period. The Participant shall propose the duration of the extension. which

should riot exceed 12 months. The testing extension request shall undergo necessary evaluation by the Sandbox OversightTeam. No further extension shall be allowed after granting the initial request to prevent the perpetuity of sandbox experiments. d. Exit Stage. After the testing stage. a comprehensive evaluation of the whole experiment at ion shall take place as part of the exit procedures, A final report shall be prepared by the Participant, which details the end-to-end result of the experimentation as well as the exit scenario. The Participant shall request the Bangko Sentral's approval of the final report and exit scenarioidentified. The exit procedures shall be triggered in any of the following instances: (1) Upon completion of the sandbox activity as evidenced by either of the following: (a) Expiration of the approved test implementation time!ine; or (b) Attainment of the objectives of the experimentation as indicated in the test plan regardless of the timeiine. (2) At the discretion of the Participant. Testing may be stopped at any time if the Participant becomes incapable of continuing with the testing activities (i. e. . if there are issues with its service provider or if the Participant does riot have the internal skills or expertise to continue with the testing) orifit wishes to do so (i. e. . if strategic direction has altered the course of the product roadmap). In this respect, the Participant shall notify the Bangko Sentral at least 30 calendar days prior to exit. The Participant shall ensure that it fulfills any existing obligations to its customers as a consequence of offering the financial service before exiting or discontinuing the experiment. Authority to Operate Participant/s whose sandbox activities are assessed as successful and whose products or services are deemed fit for public consumption shall be issued an authority to operate. The Participant shall formally submit to the Bangko Sentral an application to operate and offer for public use and consumption the proposed product or service that was subjected to the sandbox activity. including any proposed new regulations or changes to existing regulations. The Sandbox Oversight Team shall endorse for approval by the appropriate approving authorities within the Bangko Sentral the product or service that resulted in a successful sandbox testing. The pertinent requirements and processing timelines for the issuance of an authority to offer Electronic Products and Financial Services (EPFS) shall apply for this purpose. Despite the successful sandbox testing, the approving authorities reserve the right to approve or disapprove the proposed product or service, Participants with disapproved application shall be notified accordingly on the reasons for the denial. Revocation of the Regulatory Sandbox Approval or Terminatibn of the Sandbox Activity The Bangko Sentrai may revoke the authority of entities to participate in the sandbox or Page 6 o. 0

the Participants may voluntarily terminate the sandbox activity, Certain conditions may trigger the revocation/termination of the sandbox. which may fall under two categories: (1) sandbox implementation-related condition; and (2) entity-related condition. a. Sandbox implementation-related conditions. The following scenarios related to the implementation of the sandbox may trigger the revocation of the regulatory sandbox approval: (1) The Participant is unable to deliver the approved product/service features or has materialIy deviated from the approved activities within the sandbox; (2) The Participant has failed to develop and implement the appropriate and required safeguards: (3) The Participant has provided falsified. misleading. or in accurate information, or has concealed or failed to disclose material facts in the application; (4) The Participant has committed significant breaches on data protection. information security, and AML/CFT protocols in undertaking sandbox experimentation: (5) The Participant has failed to effective Iy address any technical defects or vulnerabilities in the proposed solution, which gives rise to recurring service delivery concerns or fraudulent activities; or (6) Any other significant concern as may be determined by the Bangko Sentral. b. Entity-related conditions. The following scenarios related to the operational and/or business conditions of the participant may trigger the revocation of the sandbox approval: (1) The Participant is undergoing or has gone into liquidation or similar financial standing; (2) The Participant has been subjected to supervisory enforcement action/5' that may have direct adverse impact on the continuity of the sandbox experiment: (3) The Participant has operated the sandbox activity in a detrimental manner that negatively affects customers or the industry or poses safety and soundness concerns to individual financial institutions or the financial system; or (4) Any other significant concern as may be determined by the Bangko Sentral. Due process shall be observed prior to the revocation of the approval to participate in the regulatory sandbox. Participants whose sandbox has been revoked may request reconsideration. The Bangko Sentral, at its discretion, may allow reconsideration only in extraordinary circumstances. This is to ensure that all sandbox applications and all active sandbox activities are given the appropriate attention to develop and grow, The Bangko Sentral also reserves the right to revoke the approval without prior notice if there is an urgent need to protect the financial system, the Participant, its consumers, or the general public. In case of voluntary termination or withdrawal from the sandbox activity, the Participant should notify the Bangko Sentral through a 'Applicable only to existing Bangko Sentral rig Pilipinas Supervised Financial Institutions (BSFlsj or their technology service providers.

formal Withdrawal Letter citing the date of termination and the reasons thereof. Upon revocation or voluntary termination/withdrawal, the Participant should: a. Immediately execute its exit plan to cease the operation or the provision of the product, activity. or service; b. Notify the customers of the cessation of the product. activity. or service and their rights to redress where relevant: c. Comply with requirements of the Bangko Sentra! to securely store or dispose of all confidential information, including customer personal information collected during testing pursuant to Section 1002/100Z-Q/'702-SI602-PI7'02. N on Consumer Protection Standards and Section 148h47-or145. Sri42-PA26-N on Information Technology Risk Management. and other relevant Bangko Sentral rules and regulations; d. Compensate customers who have suffered financial losses. if any. during the testing period in accordance with the safeguards submitted by the participant pursuant to Section 1002/1002- Q/702"SI602-Ply02-N of the MORB and MORNBFl on Consumer Protection Standards and other relevant Bangko Sentral rules and regulations: and e. Submit a report. within 30 calendar days, to the Bangko Sentral on the actions taken after the revocation or termination. Reportor, ;,/Requirements* Participants shall submit (i) interim and (ii) final reports to the Bangko Sentral to facilitate monitoring of the progress of the regulatory sandbox and the attendant risks. and assessment of the success of the experiment ation. In the test design phase. the Bangko Sentral and the Participant shall agree on the details of the reports to be submitted such as the content, frequency, and schedule of reporting, among others, The interim report serves as the status update of the experimentation, which should contain the following at the minimum: a. Status of Sandbox in relation to key milestones and timelines. budget, key performance indicators, and key product/service risks and mitigation plans; b. Key issues such as misconduct, fraud, or operational incident (e. g. . network/connectivity issues, database issues, internal and external interface issues). if any, and measures taken by the Participant to address such incidents; c. Actions or steps taken to address customer complaints. emerging risks, or other emerging regulatory policy issues that should be brought to the Bangko Sentral's attention: d. Changes/Planned changes in the Participant's key personnel. management, leadership. and business plan, or any concerns on financial solvency; and e. Any other matter deemed relevant by the Participant or other information prescribed by the Bangko Sentrai. The final report contains the final results of the experiment ation. It should present the complete set of necessary information on the testing. At the minimum, the final report should contain the following information: Page 8 o. 0

a. Key outcome and performance indicators (time!ine, budget. scope. and financial metrics); b, Full account of all incident reports and resolution of customer complaints; c. In the case of a failed test, lessons learned from the test; d. In the case of a successful test. the Participant's plan for the transition of the product. solution. or service to commercial scale; and e. Key insights from the sandbox activity for possible consideration of the Bangko Sentral in its policy formulation. The Participant should submit the final report to the Bangko Sentral within 60 calendar days from the end of the sandbox activity. Consumer Protection. Participants shall adopt measures to protect the rights and interests of consumers in implementing sandbox experiment ation to ensure that customers are well-informed and protected in availing of the product or service being tested. Customers should be informed that the product or service being offered is under the regulatory sandbox platform and that their availment is part of the pilot implementation. Moreover, customers should be informed of all the possible risks associated with the product. The Participant shall ensure that the customers fully understand the risks and their potential implications. Customers should also be informed of the related complaints handling and dispute resolution procedures. in this regard, Participants shall ensure that adequate, prompt. and effective mechanisms or procedures for handling and resolving disputes covering regulatory sandboxissues are in place. Data Privacy and Data Protection. All regulatory sandbox experiment at ion shall follow the rules and guidelines on data sharing, data privacy, and data protection in all implementation phases. All customers participating in the experimentstion should be informed that they own the data being collected and processed through the transaction. and that they have all the rights enumerated under Philippine data privacy laws. otherwise known as Republic Act 10/73 or the Data Privacy Act of 2012. The rights of the Participants and non" participants to control the use of customer data are limited to the boundaries of the consent provided by the customer in availing the product or service. Restrictib"s of Sandbox Approval The Bangko Sentral's approval of the live deployment of the proposed solution shall be limited to the agreed terms and conditions of the regulatory sandbox plan and shall not be construed as a means to circumvent any legal or regulatory requirements in offering of products/services. ThematIC Cohort, The Bangko Sentral may launch a sandbox implementation in the form of a cohort in pursuit of a regulatory agenda on innovative technologies or financial solutions. The Bangko Sentral shall set the innovation themes for the cohort sandbox activities to set the impact of a solution orinnovation on the financial sector in relation to its regulatory agenda or digitalization initiatives, The Bangko Sentral shall establish the sandbox parameters based on its objectives in undertaking the sandbox experimentation. The cohort's duration may vary depending on the initiative's objectives. scope, and/or complexity.

Regulatory Sandbox Lite. Applicants for regulatory sandbox experimentation may be advised to use a simplified approach known as the "regulatory sandbox lite". This approach intends to accelerate the end-to-end process of the testing period and is generally shorter than the entire regulatory sandbox process. The "regulatory sandbox lite" shall be limited to BSFls to encourage digitalization and/or participation in the electronic offering/delivery of financial products/services that are already within the scope of existing regulations. The regulatory requirements and expectations that will be temporarily lifted shall be identified by the Bangko Sentral on a case-by-case basis, taking into account the merits of the proposed activity as well as the associated risks. Section 2, Appendix' 755 of the MORB and Appendix Q-99 of the MORNBFl (Annex E of this Circular) on the regulatory sandbox end-to-end process map is hereby created to provide an overview of the entire process flow in the implementation of the regulatory sandbox. Section 3. Effectivity. This Circular shall take effect fifteen (15) calendar days following its publication in the Official Gazette or any newspaper of general circulation. FOR THE MONETARY BOARD: EDUARDO BIER Officer-in- arge o~C'September 2022

. *. . ANNEX A Appendix 757Q-95 SAMPLE FORMAT OFTHE LETrER OFiNTENT IDATEi INAMEl tPOSITIONj tDepartment. in-Chargel Bangko Sentral rig Pilipinas A. Mabini Street corner P. Ocampo Street 1004 Malate, Manila Dear [Addressee], tStatement of intention to participate in Bangko Sentral's regulatory sandboxl IProvision of overview of the company and the proposed innovationl iprovision of other pertinent details such as attached requirements/documents and contact detailsl Sincerely yours, [signature] NAMEl tPOSITION I [COMPANY] Page I of I

. L . ANNEX B Appendiir152/12-96 REGULATORY SANDBOX APPLICATION FORM Date of A Iication Name of A Iicant Address Contact Person Mobile and Landline Number Email Address Sandbox Name Please provide the information requested below. This requirement shall be submitted as an attachment to the Letter of Intent, duly signed by the president or officer of equivalent rank in the entity, to participate in the regulatory sand box. Part I, Company Profile I, Company Overview 2. Form of Business Organization and Organizational Structure 3. Board of Directors, Key Officers and Personnel 4, Financial standing of the company (i. e. , latest audited or interim financial statement) 5. Regulatory Licenses or registrations with the Bangko Sentral (if applicable) Part 11. Proposed Innovation Details I. Proposed Innovation and its Value Proposition a. Innovative characteristics (includes market research or proof of genuine innovation ) b. Problem statement and/or the existing gap being solved in the financial ecosystem c. Why and how the proposed innovation will solve the problem or will provide benefits to the consumers and/or the industry 2. Product features and/or functionalities 3. Customer Terms and Conditions and Data Privacy Agreement 4. Total Budget and Source of funding or capitalization 5. Target Market and Market Projections. including operational expenses 6. Operational Workflow/End-to-end Customer Journey 7. Consumer complaints handling/redress mechanism process 8, ITlnfrastructure Ii, e. , system architecture, network diagram. etc. ) 9. Business Continuity Plan and Disaster Recovery Setup 10, Identified Risks and Safeguards/Security Controls/Risk Management Tools ( 11. Third-party service/outsourcing partners (if any) Part 1/1. Sandbox Proposed Test Details I. Test Duration and Parameters Z. List of Test Metrics and Reportoria! Requirements 3. Initial Test Plan 4. High Level Milestones and Expected Outcomes/Results 5. Key Personnel/Officers Involved in the Experimentation 6. General Exit and Transition Strategy === NOTHING FOLLOWS === Page I of I

. , . , ANNEX C Appendix 1537'Q. 97 REGULATORY SANDBOX ELIGIBILITY SELF-ASSESSMENT CHECKLIST Complied Provide an overview or indicate reference to the specific Eligibility Criteria provision in the submitted documents/ ro OSal Yes No I. The financial solution: a. uses new or emerging technology or utilizes an existing technology in an innovative in a rine r. The applicant shall provide justification (e. g. , market research ) that shall support the mentioned characteristic in the proposed solution; or b. bridges a market gap in the delivery of financial products/services. This shall be supported by research that shall be part of the documents submitted to the Bangko Sentrai 2. The applicant demonstrates capability to deploy the proposed solution through a pilot roll-out plan or strategy; 3. The applicant provides an initial test plan. which includes test case scenarios and expected outcomes of the experiment; 4. The applicant is able to identify significant risks. including money laundering and terrorist financing (ML/TF) risks, IT and cybersecurity, data integrity and data privacy, market acceptability, consumer protection. and project implementation/execution. relevant to the innovation and the corresponding proposed safeguards and risk mitigation strategies; 5. The applicant has identified Key Performance Indicators (KPls) or other metrics in monitoring the progress of the pilot implementation; and 6, The applicant has designed an acceptable exit and transition strategy once the experimentation is completed regardless of the outcome. Page I. of a.

. . . , ANN Ex D Appendix154Q. 98 REGULATORY SANDBOX TEST PLAN FORMAT The details that are required to be indicated in the test plan are, but not limited to, the following: I. Overall timeline/test duration and budget Z, Milestones or key activities 3. Test activities/methodologies and its details 4. Planned start and completion date 5. Actual start and completion date 6. Test performance metrics 7, Customer acquisition and communications plan 8. Test deliver ables Shown below is a sample format for the test plan schedule, Note that this may change based on the agreed test plan between the Bangko Sentral and the participant, which takes place upon the approval of the applicant to join the regulatory sandbox. In- Planned Planned Actual Actual Remarks char e Start Coin letion Start Coin letion Milestone/Ke Activit I Test Activit I Test Detail I Test Detail2 Test Details Test Activit 2 Test Detail I Test Detail 2 Test Details Test Activit 3 Test Detail I Test Detail2 Test Detail3 Milestone/Ke Activi 2 Test Activi Test Detail I Test Detail2 Test Detail3 Test Activit 2 Test Detail I Test Detail2 Test Details Test Activit 3 Test Detail I Test Detail2 Test Details Page I of I

., , AN N Ex E Appendix. 1557Q. 99 REGULATORY SANDBOX END-TO-END PROCESS MAP ,-.~ Start -+ Testing Completed B \~ +, = Is ,-\ U \ Submit applicat;o I A a Testing Stage Testing Discontini, ed a. requirements < \..,, , I-~ , h Testing Extended C . \-~. Yes I Reject Application Evaluation and ,, \ No ,,-...\ \ \^ a. .,. A LA Eineibj, ,ty Eligible? , \ Co Assessiitenl I' \- , \\ , \ ,, ~, Endorse for alternative approach IC; \. ,. Yes Improve Solution or I' ' C I Business Case , .~,., ^ C ,, U I I \, I IP '\'\ NO a I~ * a. Pursue , < iAi *. Application? I , ~\ I' \ \^-, , \ \ I ,/ ,/-^ ,I~\ , No ' No .. B; Issue AUIho, itY to IAI '7' I Operate \-./ ,1' 1"^. I , 1.1 .. a. co co Exit Evaluation I' Experiment *, I' Fitfor \ ^ End I\, , Stage *,*,' "' I Propose revision or creation o1 regulations Notes: I. On the process of the endorsement for an alternative approach, the BSP shall advise the applicant that the innovation shall be tested using an alternative regulatory approach 2. Prior to the Testing Stage proper, the Applicant's Sandbox Team and the Ssp's Sandbox Oversight Team shall discuss and agree on the testing plan and the parameters of the testing experiment and environment 3. Following the agreed notification requirements, the testing can be discontinued at any time by the participant Ivoluntary) or by the BSP tinvoluntary). 4. Participants can request for extension up to a maximum of I year to complete the test plan and its objectives, subject to prior BSP approval 5. If the product/'service is assessed as not fit for public consumption, the applicant could either improve its business proposition or decide not to pursue the offering of the product/service. Pagel on