THE PHILIPPINE CLEARING HOUSE CORPORATION _____AS PERSONAL INFORMATION PROCESSOR ___ Data Privacy Statement In the performance of its services as an Operator of a checks-clearing house and a funds-transfer electronic network of banks, the Philippine Clearing House Corporation (PCHC) gets to receive Personal Information which are processed by it to carry out the instructions of banks using its facilities (the “Bank Participants”). As a Personal Information Processor (PIP), PCHC is dedicated to protecting data privacy and safeguarding the Personal Information indicated on items transmitted to it by the Bank Participants for clearing and funds-transfer purposes. PCHC will comply with the obligations as a Personal Information Processor under the provisions of the Data Privacy Act (DPA) of 2012, its Implementing Rules and Regulations, issuances by the National Privacy Commission (NPC), and supporting laws and rules (collectively, the “Data Privacy Directives”) as regards any Personal Information that PCHC processes on behalf of the Bank Participants in connection with their availment of the following PCHC facilities : 1. Check Image Clearing System (CICS) 2. Philippine EFT System Operations Network (PESONet) 3. Project Abstract Security System (PASS 5) 4. Philippine Domestic Dollar Transfer System (PDDTS) Terms defined in the DPA of 2012 will have the same meaning herein. Procedures are put in place by PCHC to monitor compliance with the Data Privacy Directives and the obligations specified herein. I. Representations of PCHC a) The following data privacy principles apply to all Personal Information processed by PCHC: 1. Transparency Any information and communication relating to the processing by PCHC of Personal Information should be easy to access and understand. 2. Legitimate purpose The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. 3. Proportionality The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal Information shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. b) PCHC implements reasonable and appropriate organizational, physical and technical security measures to protect any Personal Information, accessed or processed by PCHC, against unlawful or accidental loss, destruction, alteration or disclosure. c) Personal Information are not to be retained longer than necessary. Data no longer needed shall be securely destroyed. d) PCHC takes reasonable steps to ensure the reliability and compliance to policies of its employees and third party service providers who may have access to the Personal Information processed as part of PCHC services. Employees and third party service providers are to operate under strict confidentiality, and this obligation will continue after termination of employment or contractual services. e) PCHC will provide assistance and information to the Bank Participants in connection with requests of their customers relative to the exercise of their rights. f) PCHC has designated an individual who functions as data protection officer or compliance officer to ensure compliance with Data Privacy Directives. II. Compliance, Awareness And Sanctions a) Compliance with the Data Privacy Directives is mandatory and will be strictly monitored. b) Employees will be subjected to disciplinary action if found to have permitted unauthorized disclosure or processing of Personal Information. PCHC and employees can face prosecution and penalties for breach of Data Privacy Directives or misuse of PCHC’s system or information. c) Data Privacy policies are disseminated to all PCHC employees and third parties through office memos, awareness trainings and other means of communication/reporting. III. Processing of Personal Information a) Collection As a Clearing House Operator for the banking industry, PCHC receives and processes Personal Information of/from clients of the Participating Banks. The types of Personal Information received by PCHC as a PIP are as follows: 1. Account Name 2. Account Number 3. Address 4. Contact Phone Number 5. Client’s signature -in transactions that require signature of Client for processing 6. Email address 7. Name of Contact Person 8. Tax Identification Number (TIN) - for some systems b) Use The Personal Information received by PCHC are processed by it for the following purpose and under the following systems and conditions: Name of Description of Personal Data Purpose Period of Retention* Processing System CICS Account Name Check Clearing 10 YEARS Account Number Specimen Signature PESONet Sender Account Name Electronic Payment or 10 YEARS Sender Account Number Fund-transfer Instruction Sender Address Receiver Account Name Receiver Account Number Receiver Address PAS5 Importer Name Electronic Payment or Fund- 10 YEARS transfer Instruction for collection duties at BOC PDDTS RTGS/PvP Sender Account Name Electronic Payment or Fund 10 YEARS Sender Account Number Transfer Instruction for USD Sender Address currency Receiver Account Name Receiver Account Number Receiver Address * Period of Retention is computed from date of Clearing of the Payment Demand or Fund-transfer Instruction, as the case may be. c) Storage 1. As a PIP, PCHC ensures that all transactions containing Personal Information from Participating Banks are stored in Information and Communications System or external storage devices which shall be retained for ten (10) years. 2. PCHC implements appropriate security measures in storing all received Personal Information. It ensures that Personal Information under its custody is protected against any accidental or unlawful destruction, alteration and disclosure as well as against any other unlawful processing. 3. Any document containing Personal Information either in hard copy or in electronic format is classified by PCHC as CONFIDENTIAL information which shall be protected in accordance with PCHC’s Information Security Policies and Management System. d) Disclosure 1. PCHC discloses Personal Information to its employees and to the drawee/receiving Bank Participants to the extent necessary to perform its services, and to its officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives on a “need-to-know” basis only. It directs its employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives to observe the confidentiality of the Personal Information and prohibits any unauthorized access, improper use, duplication, disclosure, alteration and destruction of any of the Personal Information in whole or in part. 2. Whenever PCHC discloses Personal Information to the employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives of PCHC, as needed, the said employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives of PCHC shall process and hold the Personal Information under strict confidentiality. This obligation shall continue even after termination of their employment or contractual relations with PCHC. 3. PCHC may disclose the Personal Information when so required by proper order of judicial, quasi-judicial or administrative authorities or as needed by an arbitration body or committee authorized by PCHC in aid of investigation provided that PCHC shall, to the extent legally permitted and if reasonably practicable, notify the Bank Participant concerned prior to such disclosure. IV. Security Measures a) PCHC recognizes the importance of protecting its information assets, especially of Bank Participants, from unauthorized access, disclosure, modification and destruction. Thus, PCHC has adopted information security policies to ensure the confidentiality, integrity and availability of information. b) The following information security principles govern the controls for security and management of information: 1. Information must be protected from unauthorized disclosure (confidentiality), maintained as complete, consistent and accurate (integrity), and made available to authorized users when required (availability). 2. Information within the business can take many forms – electronic (stored or in transit), physical (printed or written on paper) or discussed in conversations. Regardless of form, all users covered by this policy are responsible to protect and handle information in accordance with its degree of sensitivity or importance. 3. Information security policies have to be in compliance with legislative and regulatory requirements. 4. Information security awareness, education and training programs will be conducted to all concerned personnel, including their roles in protecting the company’s information assets from any threats. 5. Information will be protected against breach, loss or corruption. 6. Business continuity plans will be tested, maintained and improved. 7. All actual or suspected information security breaches will be reported to the appropriate officer(s) and will be thoroughly investigated. 8. Supporting guidelines, standards, controls and procedures will be implemented at all levels across the PCHC organization to support this policy. 9. Security measures include, but are not limited to, behavioral (good practices in personnel management and acceptable use of resources) or technical measures (e.g. passwords, firewall, system configurations, access controls, etc.). c. Organization Security Measures 1. PCHC has designated a Data Protection Officer; he was registered as such DPO with the NPC on September 6, 2017. He oversees the compliance of PCHC’s Data Privacy Directives and related policies, including the conduct of a Privacy Impact Assessment, implementation of security measures, Security Incident and Data Breach protocol, and inquiry and complaints procedure. 2. PCHC’s Information and Communication Systems /Data Processing System (Philippine Automated Clearing System or PACS) was registered with the NPC on February 20, 2018. 3. PCHC shall sponsor a mandatory training on data privacy at least once a year. For personnel directly involved in the processing of Personal Data, PCHC shall ensure their attendance and participation in relevant trainings and orientations as often as necessary. 4. The Data Privacy Manual of PCHC shall be reviewed and evaluated annually. Privacy and security policies and practices within PCHC shall be updated to remain consistent with current data privacy best practices. d) Physical Security Measures 1. PCHC office/work areas, storage/file rooms, and computer/server rooms are suitably protected from physical intrusion, theft, fire, flood and other environmental hazards. 2. Critical information processing facilities and other areas where sensitive information is processed or stored are housed in secure areas (e.g. data centers, network equipment rooms). 3. Personal Information in the custody of PCHC, which may be in digital/electronic format and paper-based/physical format, are stored in in a secured data room. 4. PCHC maintains appropriate safeguards against unlawful and unauthorized physical access. Only authorized personnel are allowed inside the data room. 5. The location of data centers and network equipment rooms are kept secure and confidential. These areas are not labeled to hide their location from visitors and guests passing by the area. 6. Data centers and network equipment rooms are equipped with air conditioners, temperature and humidity monitoring system, smoke detectors, fire alarms and fire suppression system to protect and monitor against environmental hazards or conditions. 7. Equipment or facilities critical in the operations of business are equipped with Uninterruptible Power Supply (UPS) system to ensure continuous operation in case of electrical interruption or fluctuation. 8. Photographic, video, audio or other recording equipment such as cameras in mobile devices, which may expose the equipment setup, are not allowed unless authorized. 9. All equipment are maintained in accordance to manufacturer’s specifications and maintenance schedule. Only authorized personnel may perform equipment repairs and maintenance services. 10. Transfers of Personal Information via electronic means are encrypted. Facsimile technology is not used for transmitting documents. e) Technical Security Measures 1. Information are protected throughout its life cycle from handling, storage or data-at-rest, transmission or data-in-transit, up to the disposal phase. 2. The following guidelines apply to security of electronic data: 2.1. Controls should be in place to guard against unauthorized access, alteration or data leakage. 2.2. Portable devices containing confidential data are also be secured. 2.3. Databases are properly configured, with effective preventive and detective controls, secured access and continuous monitoring. 3. Various channels used to transmit electronic data have appropriate safeguards. 4. Standards, guidelines and procedures are implemented to define and describe the minimum control requirements for data security. 5. In operations migrated to cloud computing platforms, PCHC ensures that the level of security and data privacy are in compliance with regulatory requirements and internal PCHC controls. PCHC Management shall exercise effective oversight and continuous monitoring as to security and performance of the cloud service providers. 6. Encryption is used to protect information where the risk of loss through theft or interception is high, and there is the potential for a major security breach should said information get into the hands of unauthorized persons. 7. PCHC reviews security policies, conducts vulnerability assessments and performs penetration testing on regular schedule. V. Breach and Security Incidents a) PCHC has formed a Data Breach Response Team which provides a 24x7 monitoring of security events to critical systems in the IT operations. On top of this Response Team is the Security Operations Center (SOC) managed by a third-party service provider. b) The Breach Response Team is responsible for ensuring immediate action in the event of a Security Incident or Personal Data Breach. There is a call tree that describes the details of response team members to support incident response processes. It shall conduct an initial assessment of the incident or breach in order to ascertain its nature and extent. c) Reporting of security incidents must be done immediately and quickly and containment measures must be implemented as applicable to mitigate and prevent further misuse or damage to other system. It shall execute measures to mitigate the adverse effects of the incident or breach. d) The members of the Data Breach Response Team are the same personnel assigned to the IT Recovery Team as defined in the Business Continuity Manual of PCHC. e) Measures to Prevent and Minimize Occurrence of Breach and Security Incidents: 1. PCHC’s Data Protection Officer shall regularly conduct a Privacy Impact Assessment to identify risks in the processing system, recommend risk treatment plan, monitor for security breaches and ensures vulnerability scanning of computer networks to be done regularly. 2. Personnel directly involved in the processing of Personal Information must attend training and seminars for capacity building. 3. Periodic review of policies and procedures being implemented have to conducted. f) Recovery and Restoration of Personal Data 1. PCHC always maintains a backup copy of file for all Personal Information under its custody. 2. In the event of a Security Incident or Data Breach, PCHC shall always compare the backup with the affected file to determine inconsistencies or alterations resulting from the incident or breach. g) Notification Protocol 1. The Head of the Data Breach Response Team shall inform PCHC Management of the occurrence of a Security Incident or Data Breach. PCHC shall notify the Bank Participant concerned about such occurrence within twenty-four (24) hours from actual discovery or from reasonable belief of the occurrence thereof. 2. PCHC shall provide the concerned Bank Participant every assistance necessary to enable it to comply with the notification requirement under the Data Privacy Directives. VI. Inquiries and Complaints a) If any request or complaint of a Data Subject is made directly with PCHC, PCHC will (a) promptly inform the concerned Bank Participant , and (b) advise the Data Subject to submit his/her request or complaint to the Bank Participant. PCHC shall not be responsible for responding to any Data Subject’s request or complaint. b) If the Participant Bank is unable to address a Data Subject’s request, PCHC shall, upon request of the Bank Participant, provide reasonable assistance to the Bank to respond to the Data Subject’s request to the extent PCHC is able to and only as required by the Data Privacy Directives. END-

THE PHILIPPINE CLEARING HOUSE CORPORATION ___AS PERSONAL INFORMATION PROCESSOR ___ In the performance of its services as an Operator of a checks-clearing house and a funds-transfer electronic network of banks, the Philippine Clearing House Corporation (PCHC) gets to receive Personal Information which are processed by it to carry out the instructions of banks using its facilities (the “Bank Participants”). As a Personal Information Processor (PIP), PCHC is dedicated to protecting data privacy and safeguarding the Personal Information indicated on items transmitted to it by the Bank Participants for clearing and funds-transfer purposes. PCHC will comply with the obligations as a Personal Information Processor under the provisions of the Data Privacy Act (DPA) of 2012, its Implementing Rules and Regulations, issuances by the National Privacy Commission (NPC), and supporting laws and rules (collectively, the “Data Privacy Directives”) as regards any Personal Information that PCHC processes on behalf of the Bank Participants in connection with their availment of the following PCHC facilities : 1. Check Image Clearing System (CICS) 2. Philippine EFT System Operations Network (PESONet) 3. Project Abstract Security System (PASS 5) 4. Philippine Domestic Dollar Transfer System (PDDTS) Terms defined in the DPA of 2012 will have the same meaning herein. Procedures are put in place by PCHC to monitor compliance with the Data Privacy Directives and the obligations specified herein. I. Representations of PCHC a) The following data privacy principles apply to all Personal Information processed by PCHC: 1. Transparency Any information and communication relating to the processing by PCHC of Personal Information should be easy to access and understand. 2. Legitimate purpose The processing of information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. 3. Proportionality The processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal Information shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means. b) PCHC implements reasonable and appropriate organizational, physical and technical security measures to protect any Personal Information, accessed or processed by PCHC, against unlawful or accidental loss, destruction, alteration or disclosure. c) Personal Information are not to be retained longer than necessary. Data no longer needed shall be securely destroyed. d) PCHC takes reasonable steps to ensure the reliability and compliance to policies of its employees and third party service providers who may have access to the Personal Information processed as part of PCHC services. Employees and third party service providers are to operate under strict confidentiality, and this obligation will continue after termination of employment or contractual services. e) PCHC will provide assistance and information to the Bank Participants in connection with requests of their customers relative to the exercise of their rights. f) PCHC has designated an individual who functions as data protection officer or compliance officer to ensure compliance with Data Privacy Directives. II. Compliance, Awareness And Sanctions a) Compliance with the Data Privacy Directives is mandatory and will be strictly monitored. b) Employees will be subjected to disciplinary action if found to have permitted unauthorized disclosure or processing of Personal Information. PCHC and employees can face prosecution and penalties for breach of Data Privacy Directives or misuse of PCHC’s system or information. c) Data Privacy policies are disseminated to all PCHC employees and third parties through office memos, awareness trainings and other means of communication/reporting. III. Processing of Personal Information a) Collection As a Clearing House Operator for the banking industry, PCHC receives and processes Personal Information of/from clients of the Participating Banks. The types of Personal Information received by PCHC as a PIP are as follows: 1. Account Name 2. Account Number 3. Address 4. Contact Phone Number 5. Client’s signature -in transactions that require signature of Client for processing 6. Email address 7. Name of Contact Person 8. Tax Identification Number (TIN) - for some systems b) Use The Personal Information received by PCHC are processed by it for the following purpose and under the following systems and conditions: Name of Description of Purpose Period of Processing System Personal Data Retention* CICS Account Name Check Clearing 10 YEARS Account Number Specimen Signature PESONet Sender Account Name Electronic Payment or 10 YEARS Sender Account Number Fund-transfer Instruction Sender Address Receiver Account Name Receiver Account Number Receiver Address PAS5 Importer Name Electronic Payment or 10 YEARS Fund-transfer Instruction for collection duties at BOC PDDTS RTGS/PvP Sender Account Name Electronic Payment or 10 YEARS Sender Account Number Fund Transfer Instruction Sender Address for USD currency Receiver Account Name Receiver Account Number Receiver Address * Period of Retention is computed from date of Clearing of the Payment Demand or Fund-transfer Instruction, as the case may be. c) Storage 1. As a PIP, PCHC ensures that all transactions containing Personal Information from Participating Banks are stored in Information and Communications System or external storage devices which shall be retained for ten (10) years. 2. PCHC implements appropriate security measures in storing all received Personal Information. It ensures that Personal Information under its custody is protected against any accidental or unlawful destruction, alteration and disclosure as well as against any other unlawful processing. 3. Any document containing Personal Information either in hard copy or in electronic format is classified by PCHC as CONFIDENTIAL information which shall be protected in accordance with PCHC’s Information Security Policies and Management System. d) Disclosure 1. PCHC discloses Personal Information to its employees and to the drawee/receiving Bank Participants to the extent necessary to perform its services, and to its officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives on a “need-to-know” basis only. It directs its employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives to observe the confidentiality of the Personal Information and prohibits any unauthorized access, improper use, duplication, disclosure, alteration and destruction of any of the Personal Information in whole or in part. 2. Whenever PCHC discloses Personal Information to the employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives of PCHC, as needed, the said employees, officers, directors, consultants, cloud platform provider, cloud management service provider, and authorized representatives of PCHC shall process and hold the Personal Information under strict confidentiality. This obligation shall continue even after termination of their employment or contractual relations with PCHC. 3. PCHC may disclose the Personal Information when so required by proper order of judicial, quasi-judicial or administrative authorities or as needed by an arbitration body or committee authorized by PCHC in aid of investigation provided that PCHC shall, to the extent legally permitted and if reasonably practicable, notify the Bank Participant concerned prior to such disclosure. IV. Security Measures a) PCHC recognizes the importance of protecting its information assets, especially of Bank Participants, from unauthorized access, disclosure, modification and destruction. Thus, PCHC has adopted information security policies to ensure the confidentiality, integrity and availability of information. b) The following information security principles govern the controls for security and management of information: 1. Information must be protected from unauthorized disclosure (confidentiality), maintained as complete, consistent and accurate (integrity), and made available to authorized users when required (availability). 2. Information within the business can take many forms – electronic (stored or in transit), physical (printed or written on paper) or discussed in conversations. Regardless of form, all users covered by this policy are responsible to protect and handle information in accordance with its degree of sensitivity or importance. 3. Information security policies have to be in compliance with legislative and regulatory requirements. 4. Information security awareness, education and training programs will be conducted to all concerned personnel, including their roles in protecting the company’s information assets from any threats. 5. Information will be protected against breach, loss or corruption. 6. Business continuity plans will be tested, maintained and improved. 7. All actual or suspected information security breaches will be reported to the appropriate officer(s) and will be thoroughly investigated. 8. Supporting guidelines, standards, controls and procedures will be implemented at all levels across the PCHC organization to support this policy. 9. Security measures include, but are not limited to, behavioral (good practices in personnel management and acceptable use of resources) or technical measures (e.g. passwords, firewall, system configurations, access controls, etc.). c. Organization Security Measures 1. PCHC has designated a Data Protection Officer; he was registered as such DPO with the NPC on September 6, 2017. He oversees the compliance of PCHC’s Data Privacy Directives and related policies, including the conduct of a Privacy Impact Assessment, implementation of security measures, Security Incident and Data Breach protocol, and inquiry and complaints procedure. 2. PCHC’s Information and Communication Systems /Data Processing System (Philippine Automated Clearing System or PACS) was registered with the NPC on February 20, 2018. 3. PCHC shall sponsor a mandatory training on data privacy at least once a year. For personnel directly involved in the processing of Personal Data, PCHC shall ensure their attendance and participation in relevant trainings and orientations as often as necessary. 4. The Data Privacy Manual of PCHC shall be reviewed and evaluated annually. Privacy and security policies and practices within PCHC shall be updated to remain consistent with current data privacy best practices. d) Physical Security Measures 1. PCHC office/work areas, storage/file rooms, and computer/server rooms are suitably protected from physical intrusion, theft, fire, flood and other environmental hazards. 2. Critical information processing facilities and other areas where sensitive information is processed or stored are housed in secure areas (e.g. data centers, network equipment rooms). 3. Personal Information in the custody of PCHC, which may be in digital/electronic format and paper-based/physical format, are stored in in a secured data room. 4. PCHC maintains appropriate safeguards against unlawful and unauthorized physical access. Only authorized personnel are allowed inside the data room. 5. The location of data centers and network equipment rooms are kept secure and confidential. These areas are not labeled to hide their location from visitors and guests passing by the area. 6. Data centers and network equipment rooms are equipped with air conditioners, temperature and humidity monitoring system, smoke detectors, fire alarms and fire suppression system to protect and monitor against environmental hazards or conditions. 7. Equipment or facilities critical in the operations of business are equipped with Uninterruptible Power Supply (UPS) system to ensure continuous operation in case of electrical interruption or fluctuation. 8. Photographic, video, audio or other recording equipment such as cameras in mobile devices, which may expose the equipment setup, are not allowed unless authorized. 9. All equipment are maintained in accordance to manufacturer’s specifications and maintenance schedule. Only authorized personnel may perform equipment repairs and maintenance services. 10. Transfers of Personal Information via electronic means are encrypted. Facsimile technology is not used for transmitting documents. e) Technical Security Measures 1. Information are protected throughout its life cycle from handling, storage or data-at-rest, transmission or data-in-transit, up to the disposal phase. 2. The following guidelines apply to security of electronic data: 2.1. Controls should be in place to guard against unauthorized access, alteration or data leakage. 2.2. Portable devices containing confidential data are also be secured. 2.3. Databases are properly configured, with effective preventive and detective controls, secured access and continuous monitoring. 3. Various channels used to transmit electronic data have appropriate safeguards. 4. Standards, guidelines and procedures are implemented to define and describe the minimum control requirements for data security. 5. In operations migrated to cloud computing platforms, PCHC ensures that the level of security and data privacy are in compliance with regulatory requirements and internal PCHC controls. PCHC Management shall exercise effective oversight and continuous monitoring as to security and performance of the cloud service providers. 6. Encryption is used to protect information where the risk of loss through theft or interception is high, and there is the potential for a major security breach should said information get into the hands of unauthorized persons. 7. PCHC reviews security policies, conducts vulnerability assessments and performs penetration testing on regular schedule. V. Breach and Security Incidents a) PCHC has formed a Data Breach Response Team which provides a 24x7 monitoring of security events to critical systems in the IT operations. On top of this Response Team is the Security Operations Center (SOC) managed by a third-party service provider. b) The Breach Response Team is responsible for ensuring immediate action in the event of a Security Incident or Personal Data Breach. There is a call tree that describes the details of response team members to support incident response processes. It shall conduct an initial assessment of the incident or breach in order to ascertain its nature and extent. c) Reporting of security incidents must be done immediately and quickly and containment measures must be implemented as applicable to mitigate and prevent further misuse or damage to other system. It shall execute measures to mitigate the adverse effects of the incident or breach. d) The members of the Data Breach Response Team are the same personnel assigned to the IT Recovery Team as defined in the Business Continuity Manual of PCHC. e) Measures to Prevent and Minimize Occurrence of Breach and Security Incidents: 1. PCHC’s Data Protection Officer shall regularly conduct a Privacy Impact Assessment to identify risks in the processing system, recommend risk treatment plan, monitor for security breaches and ensures vulnerability scanning of computer networks to be done regularly. 2. Personnel directly involved in the processing of Personal Information must attend training and seminars for capacity building. 3. Periodic review of policies and procedures being implemented have to conducted. f) Recovery and Restoration of Personal Data 1. PCHC always maintains a backup copy of file for all Personal Information under its custody. 2. In the event of a Security Incident or Data Breach, PCHC shall always compare the backup with the affected file to determine inconsistencies or alterations resulting from the incident or breach. g) Notification Protocol 1. The Head of the Data Breach Response Team shall inform PCHC Management of the occurrence of a Security Incident or Data Breach. PCHC shall notify the Bank Participant concerned about such occurrence within twenty-four (24) hours from actual discovery or from reasonable belief of the occurrence thereof. 2. PCHC shall provide the concerned Bank Participant every assistance necessary to enable it to comply with the notification requirement under the Data Privacy Directives. VI. Inquiries and Complaints a) If any request or complaint of a Data Subject is made directly with PCHC, PCHC will (a) promptly inform the concerned Bank Participant , and (b) advise the Data Subject to submit his/her request or complaint to the Bank Participant. PCHC shall not be responsible for responding to any Data Subject’s request or complaint. b) If the Participant Bank is unable to address a Data Subject’s request, PCHC shall, upon request of the Bank Participant, provide reasonable assistance to the Bank to respond to the Data Subject’s request to the extent PCHC is able to and only as required by the Data Privacy Directives. - END -

July 01, 2022 TO : All Clearing Banks/Institutions RE : NEW CLEARING PARTICIPANTS/BRSTN REGISTER UPDATES 1. With reference to various request letters/notices received from the clearing participant banks , we enumerate hereunder the following updates to the PCHC clearing participant banks/BRSTN Register and Operating Parameter, viz: 1.1. New Clearing Participants BANK/BRANCH BRSTN ADDRESS QUEEN CITY - LEON 08023-056-0 Lot 145-A Cabaluna St., Poblacion, Leon, Iloilo RCBC - COMMONWEALTH - 01028-248-1 L24 B157 Commonwealth Ave., Greater Lagro, Quezon AMBROGIO City RCBC - QUEZON AVE. - 01028-250-4 141 Quezon Avenue, Quezon City ARANETA RCBC - DON JESUS BLVD. 01028-253-3 Don Jesus Blvd., Brgy. Cupang, Muntinlupa City RCBC - BF RESORT 01028-254-6 BF Resort Drive, BF Resort Village, Talon Uno, Las Pinas City LBP - ELCANO 01035-116-3 #601 - 603 Elcano corner San Nicolas Sts., San Nicolas Manila LBP - STO. TOMAS (DAVAO DEL 03035-021-2 Purok 12, Feeder Road 4, Tibal-og, Sto. Tomas, Davao NORTE) del Norte BDO NB - SORSOGON - 16118-007-6 Sampaguita St., Cumadcad, Castilla, Sorsogon CASTILLA CITY SAVINGS - NAVOTAS 01124-010-5 M. Naval Street, Navotas City CITY SAVINGS - MARIKINA 01124-011-8 #3 G. Fernando Avenue, San Roque, Marikina City CITY SAVINGS - URDANETA 05124-003-9 Honaco Commercial Building, National Highway, Urdaneta City, Pangasinan CITY SAVINGS - BALANGA 06124-003-2 Don Manuel Banzon Avenue, Dona Francisca, Balanga City Bataan CITY SAVINGS - BAGUIO 12124-001-1 Ground Floor Insular Life Building, Abanao Extension, Corner Legarda Street, Baguio City, Benguet CITY SAVINGS - CABANATUAN 13124-003-0 701 Paco Roman St., Dimasalang, Cabanatuan City, Nueva Ecija CITY SAVINGS - MARILAO 13124-005-6 Ground Floor RL Building, McArthur Highway Abangan Norte Marilao, Bulacan CITY SAVINGS - BALIUAG 13124-006-9 Unit 5 & 6 R-Building DRT Hi-way, Pinagbarilan, Baliwag, Bulacan CITY SAVINGS - BALER 13124-009-8 Etcubanez Bldg., M.L. Quezon Highway, Brgy. Suklayin, Baler, Aurora CITY SAVINGS - SAN MIGUEL 13124-010-8 R Building Daang Maharlika Highway Sta Rita Matanda, San Miguel Bulacan CITY SAVINGS - LAOAG 17124-001-6 TRECE GRANDE Building, Brgy. 19, # 187 J.P. Rizal cor. Samonte Sts. Laoag City, Ilocos Norte CITY SAVINGS - TARLAC 22124-001-8 Plaza de Oro, Arcade, MacArthur Highway, Sto. Cristo, Tarlac City CITY SAVINGS - ABULUG 23124-002-4 Maharlika Highway, Barangay Libertad, Abulug, Cagayan CITY SAVINGS - APARRI 23124-003-7 Maharlika Highway, Macanaya, Aparri, Cagayan CITY SAVINGS - STA. ANA 23124-005-3 National Highway Centro, Sta Ana, Cagayan CITY SAVINGS - AURORA 26124-004-9 National Highway San Jose Aurora Isabela CITY SAVINGS - CAUAYAN 26124-006-5 Rizal Avenue Corner Canciller Avenue Cauayan City Isabela CITY SAVINGS - ILAGAN 26124-008-1 National Highway Baligatan, City of Ilagan, Isabela CITY SAVINGS - NAGUILIAN 26124-009-4 Magsaysay District, Naguilian, Isabela, 3302 CITY SAVINGS - RAMON 26124-011-7 Purok 1, National Highway, Bugallon Proper, Ramon, Isabela CITY SAVINGS - ROXAS, ISABELA 26124-012-0 Don Mariano Marcos Avenue Bantug Roxas Isabela CITY SAVINGS - SAN MATEO 26124-013-3 Alicia Road Barangay 1, San Mateo, Isabela CITY SAVINGS - SANTIAGO 26124-014-6 Ground Floor Insular Life Building, Maharlika Highway, Santiago City, Isabela CITY SAVINGS - OLONGAPO 28124-001-6 PNRC Building, Magsaysay Drive, Olongapo City, Zambales CITY SAVINGS - UBAY 33124-002-1 Ground Floor Rogelio Inn Building, Colonel Marciano Garces Street, Poblacion, Ubay, Bohol CITY SAVINGS - ANTIQUE 69124-001-7 C.R. Building, T.A. Fornier St., San Jose, Antique CITY SAVINGS - SAN CARLOS 71124-001-0 Doors 2-4 Heritage Bldg. 1, F.C. Ledesma Ave., San Carlos City 1.2. Relocation/Change in Branch Name and/or Address BRSTN BANK/BRANCH NAME FROM TO 31010-003-0 CBC – SM City - Sta. Rosa G/F SM City Sta. Rosa, Barrio Unit EXP 1154-1156 GF Tagapo, Sta. Rosa, Laguna SM City Sta. Rosa, Bo. Tagapo, Sta. Rosa, Laguna 03026-012-4 Metro – Davao - Panabo National Highway, Panabo, Lot 9, Block 13, National Davao del Norte Highway, Barangay Santo Nino, Panabo City 19033-003-3 PVB Talisay – Unit 101/102 Paseo San. Tomas – Unit 2D, De San Guillermo, Club Balai Plaza Veridad, President Isabel, Talisay, Batangas J.P. Laurel Highway, Brgy. San Roque, Sto. Tomas, Batangas 03035-003-4 LBP – Bajada J.P. Laurel Avenue, Bajada, LBP Davao Corporate Center, Davao City #7 Palm Drive, corner Olive Road, Barangay Buhangin, Bajada, Davao City, Davao del Sur 01072-001-1 JPMorgan Chase Bank 31/F Philam Tower 8767 25F JPMorgan Chase & Co – Manila Paseo de Roxas, Makati City Tower, Manila 9th Avenue corner 38th Street, Uptown Bonifacio, Bonifacio Global City, Taguig, Philippines 1635 01118-001-6 BDO NB Makati Ave. – G/F and Makati – G/F, BDO Plaza, Mezzanine, BDO North Tower 8737 Paseo de Roxas St., 7899, Makati Ave., Makati City Makati City 39118-001-1 BDO NB – Leyte - Ormoc 2F, CMC Center, Real St., Ormoc UG 103 Upper G/F, City Chinatown East Gate, Lilia Ave., Brgy. Cogon, Ormoc City 06122-002-3 PSBC Dau Mabalacat 13122-015-7 PSBC – Hagonoy - Del Pilar St., Poblacion Centro Felimon Building, Bulacan Hagonoy, Bulacan Poblacion Hagonoy, Bulacan 1.3. Deletion of the following branch/es BANK BRANCH NAME BRSTN LBP - DOLE Phils. 24035-006-0 2. Pursuant to CICS OM No. 17-004 dated 18 January 2017, the aforementioned updates will be implemented effective July 01, 2022. 3. For your information and guidance.

Check Image Clearing System (CICS) Rules and Regulations Version 2020 is the last version of clearing rules. Its only difference with the 2018 version is the additional description under the Return Reason Code "F" (Conservatorship/Receivership Order) and the inclusion of the covering Operating Memo (OM No. 20-032)

June 16, 2022 TO : All Clearing Banks/Institutions RE : NEW CLEARING PARTICIPANTS/BRSTN REGISTER UPDATES 1. With reference to various request letters/notices received from the cl earing participant banks , we enumerate hereunder the following updates to the PCHC clearing participant banks/BRSTN Register and Operating Parameter, viz: 1.1 New Clearing Participants BANK/BRANCH BRSTN ADDRESS CITY SAVINGS - ANTIPOLO 01124-013-4 Unit 105 Rikland Center Marcos Highway Mayamot Antipolo City, Rizal CITY SAVINGS - MANDAUE 02124-004-3 Unit 3 & 4 Citybridge Plaza, AC Cortes Avenue corner P. Burgos St., Brgy. Alang-alang, Mandaue City, Cebu CITY SAVINGS - CARCAR 02124-005-6 WPT Bldg., Esperanza Village, Awayan Poblacion III Carcar City, Cebu CITY SAVINGS - DIGOS 03124-003-3 Door 6, 7, 8 , USPD Building , Rizal Avenue, Barangay Zone 3, Digos City CITY SAVINGS - DAGUPAN 05124-002-6 Rudel Building, Perez Boulevard, Corner Guilig Street, Dagupan City, Pangasinan CITY SAVINGS - BAYAMBANG 05124-004-2 Corner Juan Luna St. Rizal Avenue, Poblacion Sur, Bayambang, Pangasinan CITY SAVINGS - BATANGAS 19124-003-8 RL Building National Highway Kumintang Ilaya, Batangas City CITY SAVINGS - SURIGAO 21124-001-5 Parkway Mall, KM 3, Barangay Luna, Surigao City CITY SAVINGS - DIFFUN 23124-004-0 Purok 7 National Hiway Andres Bonifacio, Diffun, Quirino CITY SAVINGS - ALICIA 26124-003-6 National Highway Barangay Magsaysay Alicia Isabela CITY SAVINGS - CABATUAN 26124-005-2 Purok 2 Centro Cabatuan, Isabela CITY SAVINGS - ECHAGUE 26124-007-8 Garfunkel Fine Properties Bldg. National Highway, San Fabian Echague, Isabela CITY SAVINGS - BANTAY 32124-002-8 Zone 2 National Highway Corner Real St. Brgy. 1 Bantay Ilocos Sur CITY SAVINGS - SOGOD 39124-002-9 Corner Concepcion and Mangkaw Streets, Barangay Zone 1 Sogod, Southern Leyte CITY SAVINGS - TAGAYTAY 41124-003-5 One Tagaytay Place Galleria Tagaytay Calamba Road Sungay West,Tagaytay City,Cavite CITY SAVINGS - MATI 56124-001-1 Andrada Building #56 Rizal St., Mati City, Davao Oriental CITY SAVINGS - CALBAYOG 68124-001-4 Salcor Bldg., Rosales Blvd., Calbayog City, Samar 1.2 Relocation/Change in Branch Name and/or Address BRSTN BANK/BRANCH NAME FROM TO 01035-917-8 LBP – Basco National Road cor. Santana St., Ground Floor, Manpower Kaychanarianan, Basco, Batanes Development Center and National Agencies Building, Provincial Capitol Compound, Barangay Kayhuvokan, Basco Batanes 01107-030-4 RBC - Antipolo D. Jesus - Ancloti Commercial Bldg., Basement 002, Robinsons Place 182 P. Oliveros St., Antipolo Antipolo, Sumulong Hi-way, Circumference Avenue, Brgy. Dela Paz, Antipolo City 02107-008-0 RBC Cebu NuStar – Cebu City Cebu NuStar Financial Center – Upper Ground Unit UG03, The Mall at NuStar Resort and Casino, Kawit Island, South Road Properties, Cebu City, Cebu 54127-003-0 1st Valley-Kabacan Kabacan, North Cotabato National Highway, Brgy. Osias, Kabacan North Cotabato 06140-011-5 BOF Dau Mabalacat 2. Pursuant to C ICS OM N o. 17-004 dated 18 January 2017, the aforementioned updates will be implemented effective June 16, 2022. 3. For your information and guidance.

June 13, 2022 T O : All PESONet Participant Banks/Institutions R E : PARTICIPATION OF RURAL BANK OF SAGAY IN PESONET 1. We are pleased to announce the participation of Rural Bank of Sagay, Inc. (RBSI) in the Phil. EFT System Operation Network (PESONet) effective June 20, 2022. 2. RBSI’s business address is as follows: National Highway, Poblacion II, Sagay City, Negros Occidental 3. It has an assigned BRSTN 04171-001-6 and will use BIC ‘RUSYPHM2XXX’. 4. RBCI has successfully completed the required User Acceptance Test (UAT) using the available Front-end Application and has likewise submitted its Sign-Off to be included in production. 5. Kindly include the said bank in your respective PESONet participants’ directory and disseminate to your respective branches/offices. 6. Please be guided accordingly.

June 9, 2022 T O : ALL CLEARING BANKS / INSTITUTIONS R E : CICS-AWS IMPLEMENTATION UPDATES 1. Please be informed that the VPN Facility to connect to CICS-AWS is now available. Banks that prefer to use this facility may follow the steps described in the attached document (CICS AWS VPN Client Endpoint Setup). For clarifications, you may get in touch with the following officers, to wit: Name Email Landline Mobile Noel Quitlong noelquitlong@pchc.com.ph 8537-2712 0917-8387056 Johndale Regalado johndaleregalado@pchc.com.ph 8537-2708 0917-5921578 2. At this time, most of the acquired PBM servers were already distributed to the different shareholder and associate member banks. As such please find below the target timelines of the next steps that will be performed. Activities Target Schedule 1. PBM Server Setup Installation/Configuration/Setup of the new PBM server and Until June 17, 2022 connectivity testing 2. Test Activities Normal Processing Simulation (Outward Processing)* June 20– June 24 Normal Processing Simulation (Inward Processing)* June 27 – July 01 Exception Processing Simulation* July 04 – July 08 Holiday Declaration July 04 Clearing Suspension July 06 Resumption of Normal Clearing July 07 Parallel Testing July 11 – July 15 3. Implementation (“Big Bang” Approach) Target ‘LIVE’ Date (exact date to be determined subject Q3 - 2022 to the readiness of all the banks) * - Test Scripts will be provided via email before the scheduled date. 3. As of June 09, 2022, the following banks were noted to have completed setup of the new PBM application and were able to send transactions successfully to the CICS-AWS backend host, to wit: Code Bank Name Code Bank Name 004 BANK OF THE PHILIPPINE ISLANDS 069 CTBC BANK (PHILIPPINES) CORP. 007 CITIBANK N A 071 KEB HANA BANK 008 PHILIPPINE NATIONAL BANK 072 JPMORGAN CHASE BANK 009 PHILIPPINE TRUST COMPANY 076 BDO PRIVATE BANK INC 010 CHINA BANKING CORPORATION 078 FIRST CONSOLIDATED BANK 014 SECURITY BANK CORPORATION 082 MALAYAN SAVINGS AND MORT BANK 022 MAYBANK PHILS INC 100 BANK ONE SAVINGS CORPORATION 023 QUEEN CITY DEVELOPMENT BANK 102 ASIA UNITED BANK 029 UNITED COCONUT PLANTERS BANK 103 CITYSTATE SAVINGS BANK INC 033 PHILIPPINE VETERANS BANK 112 CHINA BANK SAVINGS INC 035 LAND BANK OF THE PHILIPPINES 113 YUANTA SAVINGS BANK INC 036 AL-AMANAH ISLAMIC INVEST BANK 114 BANK OF CHINA HONG KONG LIMITED 039 BPI FAMILY BANK 118 BDO NETWORK BANK 046 MUFG BANK LTD 120 WEALTH DEVELOPMENT BANK CORP 049 UCPB SAVINGS BANK 124 CITY SAVINGS BANK 053 BANCO DE ORO UNIBANK INC 126 LUZON DEVELOPMENT BANK 054 BPI - DIRECT SAVINGS BANK 129 ALLBANK A THRIFT BANK 059 DEVELOPMENT BANK OF THE PHILS. 130 SHINHAN BANK 062 EAST-WEST BANKING CORPORATION 131 INDUSTRIAL BANK OF KOREA 064 MIZUHO BANK LTD 153 DUMAGUETE CITY DEVELOPMENT BANK INC 4. Meanwhile, listed below are the participant banks that are currently working on the installation and configuration of their PBM server: Code Bank Name Code Bank Name 005 THE STANDARD CHARTERED BANK 096 EQUICOM SAVINGS BANK INC 011 PHIL BANK OF COMMUNICATIONS 097 PHILIPPINE BUSINESS BANK 026 METROPOLITAN BANK AND TRUST CO 107 ROBINSONS BANK CORPORATION 028 RIZAL COMMERCIAL BANKING CORP 119 STERLING BANK OF ASIA INC 044 BANK OF COMMERCE 121 BANK OF MAKATI 051 CENTURY SAVINGS BANK 122 PRODUCERS SAVINGS BANK CORP 056 MEGA INTL COMML BANK CO LTD 123 PENBANK 060 RCBC SAVINGS BANK 128 SUMITOMO MITSUI BANKING CORP 066 ING BANK N V 132 CATHAY UNITED BANK CO LTD 095 ISLA BANK INCORPORATED 5. Lastly, PCHC highly encourage the following banks to already install and configure the new PBM Application on their server and perform connectivity testing in order to participate in the scheduled test activities so that they may meet the 3rd Quarter Live Implementation Target Date: Code Bank Name Code Bank Name 003 BANGKO SENTRAL NG PILIPINAS 070 AUSTRALIA - NEW ZEALAND BANK 006 HK AND SHANGHAI BANKING CORP. 089 HSBC SAVINGS BANK PHILS INC 012 BANK OF AMERICA NATL ASSN 127 1ST VALLEY BANK 027 UNITED OVERSEAS BANK PHILS 133 HUA NAN COMMERCIAL BANK LTD 041 UNION BANK OF THE PHILS 134 FIRST COMMERCIAL BANK LTD 047 PHILIPPINE SAVINGS BANK 139 GUAGUA RURAL BANK INC 065 DEUTSCHE BANK 147 INDUSTRIAL & COMM'L BANK OF CHINA LTD 067 BANGKOK BANK PUBLIC CO LTD 6. Please be guided accordingly.

June 08, 2022 MEMO TO : All CICS AND PAS5 participating banks/Institutions SUBJECT : DATA CENTER POWER SHUTDOWN ON JUN 25, 2022 1. Please be advised that there will be a power shutdown from 6:00AM of June 25, 2022 (Saturday) until 6:00AM of June 26, 2022 (Sunday) at the PCHC-Manila Data Center to give way for the scheduled electrical maintenance activities of the data center’s main power supply. 2. Relative to this, both the backend hosts of CICS and the PAS5 applications will not be accessible during the said period. 3. Meanwhile, banks that are open on weekends may still continue to process their outward check clearing transactions. The generated outward ICL files will just be accumulated in the bank’s PBM server and will automatically be sent to PCHC once the CICS backend host is back online. 4. PCHC shall issue SMS and email blast once the maintenance activities are done and both the CICS and PAS5 applications are ready to accept transactions from the participants. 5. Please be guided accordingly.

June 3, 2022 T O : All Clearing Banks/Institutions R E : EMERGENCY ACCESS TO THE PCHC OFFICE LOCATED AT BSP MANILA DURING WEEKENDS/HOLIDAYS 1. As part of the security policy of the Bangko Sentral ng Pilipinas (BSP), all personnel and/ or 3rd party providers of member banks/institutions that require access to the PCHC Data Center inside the BSP complex in Malate must apply and secure an entry permit prior to the scheduled visit. 2. PCHC was able to seek permission of the BSP to allow entry/access of banks’ personnel and their solutions provider during emergency situations, especially on weekends and holidays without the required pre-approved permit. 3. Kindly see the attached procedures indicating detailed activities that must be accomplished by the corresponding party and PCHC contact details for reference. 4. Please be guided accordingly.

June 1, 2022 T O : All PDDTS Participant Banks/Institutions R E : PARTICIPATION IN THE PDDTS END-OF-DAY NETTING OPERATIONS 1. Further to PDDTS MC No. 22-76 dated May 24, 2022, please be informed that Standard Chartered Bank advised that the termination date of their participation in the PDDTS End-of-Day (EOD) Netting Operations has been changed. 2. In its letter dated May 25, 2022, the bank informed that they are extending their participation in the PDDTS-EOD until December 31, 2022, instead of June 30, 2022, as earlier announced. 3. Kindly disseminate to the concerned unit/s of your bank.