RCBC 2023 Sustainability and Impact Report

Rizal Commercial Banking Corporation

Sustainability Report 2023

1

RCBC started operations in the province of Rizal and was incorporated on September 23, 1960 under the name Rizal Development Bank. RCBC received approvals from the Bangko Sentral ng Pilipinas (BSP) to operate as a commercial bank in 1963 under its present name and then as a universal bank in 1989. For over sixty years, the Bank has been a pillar of the banking industry in the Philippines with a wide range of services in investments, microfinancing and overseas remittances among many others.

RCBC is majority owned by a Filipino conglomerate known as the Yuchengco Group of Companies (YGC), a premier business organization in the Philippines covering over 60 businesses involved in a wide range of financial and non-financial services. YGC is recognized as one of the oldest and largest conglomerates in Southeast Asia.

RCBC solidified its position as the fifth largest private universal bank in the Philippines posting a consolidated net income of Php 12.22 billion in 2023 and total assets of over Php 1.2 trillion. The Bank also hit record high profits with customer loans increased by 15% year-on-year performing better than industry average. RCBC is a publicly-listed company (Stock Code: RCB) in the Philippine Stock Exchange. As of end 2023, the Bank had a total consolidated network of 458 branches and 1,460 ATMs.

As a diversified financial institution, RCBC serves corporate and individual banking needs through multiple customer channels offering innovative products and services to various markets. RCBC's inclusive financial business model expanded in 2010 when it ventured into the microfinance business via Rizal MicroBank (RMB, the thrift bank subsidiary) to serve the unbanked and underserved segments of the country's population. RMB is one of the more recent affiliates of YGC. RMB mainly provides loans to microenterprise and small business operators as well as agricultural value chain players.

RCBC aligns its business strategy to support the development needs of the environment and society, as articulated in the United Nations (UN) Sustainable Development Goals (SDGs) and the Paris Agreement

2

Materiality Process

Explain how you applied the materiality principle (or the materiality process) in identifying your

material topics.

Financial institutions provide an essential backbone towards the country's development. Intertwinedwith this responsibility are significant economic, environmental and social impacts which banks bear in terms of direct operations and financing different sectors. RCBC ranked as the fifth largest private universal bank in the country in 2022 and continues to expand through strategic partnerships in 2023. Asthe Bank continues to lead forward and energize the economy, focus on the following areas remain paramount in the way that RCBC conducts its business:

• Trailblazing Digital Transformation - Digital platforms provide avenues to meet the requirements of the underserved and the unserved communities while innovative products and services are made available to particular sectors such as micro entrepreneurs. These are anchored on cyber security and safeguards against fraudulent activities.
• Scaling Financial Inclusion - The Philippines remains to be among countries with unmet demands for financial services and low proficiency in terms of basic financial know-hows. The Bank continues its physical-digital approach through digital products and services and through the Rizal Microbank (RMB) focused mainly to microenterprises and small business operators such as those in the agricultural value chain.
• Leading in Business Continuity and Sustainable Finance - With emerging climate shifts, the Bank strengthens the Business Continuity Plan ensuring that operations are unhampered by natural calamities and even cyber-attacks. In the same manner, environmental and social (E&S) aspects of the Bank's activities and directions are paramount as detailed in the Bank's Environmental and Social Management System (ESMS) and the Sustainable Finance Framework. Awareness of climate-related risks and opportunities are regularly monitored along with the use of globally accepted tools.

This report covers the topics considered material to the Bank's operations with management approach to risks and opportunities detailed to the extent possible. The information provided substantively influences assessments and decisions of various stakeholders (including investors). Topics include the following:

• Compliance with BSP Circulars and applicable national and local regulations
• Bank policies on business ethics, code of conduct, supplier accreditation and vetting
• Information on data security, management against cyber security threats and fraudulent activities.
• Disclosures covering financial aspects (loan portfolio and concentration of credit), workforce readiness programs, talent acquisition and retention, training and development
• Strategy to invest in green and social projects, support to MSMEs
• Products, programs and initiatives including relationship with communities

Significant economic, environmental, and social impacts of the organization: The Philippines' post- pandemic recovery remains on course and this is echoed by agencies such as the International Monetary

Fund (IMF)1. RCBC continues to support this growth anchored on the following focus areas:

• Strategic digitalization and innovations. The Bank relentlessly pursued and launched digital product and service innovations for stronger customer experience, while safeguarding against cyber-security threats/fraud, and for sustaining operational efficiencies.

1 Department of Finance (DOF), News and View. "IMF lauds strong PH post-pandemic recovery." https://www.dof.gov.ph/imf-lauds-strong-ph-post-pandemic-recovery-growth-initiatives/

4

• Revitalizing financial inclusion model. RCBC continues to embrace a customer-centric culture and widen its reach while tapping advanced technology to make the RCBC banking experience more accessible to the agricultural communities (through RMB), to far-flung areas, and to micro- entrepreneurs throughout the country.
• Continuous improvement and striving for operational excellence. RCBC cultivated a transformational journey for its people through customer-centricand digitalization training programs, business continuity initiatives, sustainability eLearning materials which promote depth in understanding the UN SDGs, and the continual application of appropriate due diligence tools as well as the sharing of RCBC's sustainability practices in various platforms.

In this report, topics considered material are those relevant to and centered on the above significant impacts.

Information that substantively influences the assessments and decisions of stakeholders, including investors: Data on the following have remained essential as the economy continues to recover andbusinesses restore their pre-pandemicstrength:

• Information in fostering customer trust given the unabated dependence on digital banking. Examples are data on customer engagement/customer satisfaction, business continuity, customer privacy, upholding the rights of the customer, data security, risk management of cyber security threats/fraud, and business ethics.
• RCBC's transparency. This includes all of the Bank's disclosures (e.g. financial results, workforce readiness program, talent acquisition, training and development, technological advancements, risk management strategies, implementation of ESG best practices).
• RCBC's compliance. This covers documents / processes to address the requirements of BSP Circulars (including all subsequent updates on such) and all relevant laws and regulations.

Matters that substantively affect the organization's ability to create value over the short-, medium- and long-term:

• Adapting to evolving environment, its economic results and financial well-being;
• Ensuring the welfare of employees and investments in human capital;
• Developing innovations to respond to customer needs and circumstances; and
• Ensuring sustainability across the value chain (including lending units, suppliers and partners).

5

6

ECONOMIC

Economic Performance

Direct Economic Value Generated and Distributed

Which stakeholders are affected?

What is the impact and where does it occur? What is the organization's involvement in the impact?

The impacts are the following:

1. Value generation for stakeholders

1. Assurance on financial well-being for customers, employees

1. Benefits to the environment and society through lending activities2 o Promotion of fiscal growth through taxes contribution
   o Demonstration of resilience and stability in the banking sector

These occur in the primary business operations and supply chain, and are caused by the organization.

Management Approach to Impact

RCBC upholds an inclusive financial business model that effectively serves its stakeholders through:

1. revenue generated;
2. economic value deployed through employee wages and benefits, payments made to suppliers, dividends for stockholders, taxes paid to the government;
3. investments in local communities as well as core industries supporting the country's economic growth; and
4. expansion of banking access to the unbanked and underserved parts of the country

What are the risks identified?

Revenue generation may be challenged by the following risks:

1. Climate change-related calamities, public health crises and macroeconomic environment which influence customer behavior, constrain access to financial services (especially for the unbanked and underserved communities), or adversely affect employee well-being.
2. Cyber security/ information security attacks, breaches and fraud as the financial system has significantly expanded through online banking and digital finance - an offshoot of the lockdowns and prevalence of the COVID-19 pandemic. More high profile fraud and more sophisticated scams have proliferated alongside the development of innovative electronic channels and services. These may pose risk on the overall consumer confidence in the banking system and may lead to diminishing trust on digitalization / online banking as a secure and sound means of transacting with banks, as recognized by BSP Circular 1140.
3. Financing support to sectors with elevated environmental risks. This leads to vulnerability toward transition risk, as acknowledged by BSP Circulars 1085 and 1128.

Management Approach to Risks

RCBC: A Domestic Systemically Important Bank (DSIB)

As a Domestic Systemically Important Bank (DSIB), RCBC must demonstrate the capacity to maintain resilience against distress that will affect the financial system as a whole, and the economy at large. RCBC (like other DSIBs) needs to have higher loss absorbency (HLA). The HLA requirement is attained through the Bank's Common Equity Tier 1 (CET1) which establishes a maximum degree of effective loss absorbing capacity. In the event of any breach in the HLA capital requirement, concrete and reasonable recovery plans shall be implemented as

2 RCBC. Sustainability.https://www.rcbc.com/sustainability.

8

outlined in RCBC's Internal Capital Adequacy Assessment Process (ICAAP) document. The implementation of recovery plans is aimed at improving capital position and restoring financial condition to viable levels in cases ofsignificant deterioration under certain scenarios.

As of December 31, 2023, the Bank's CET1 ratio is 14.47% (solo) and 14.69% (consolidated), both of which are above the regulatory requirement.

Business Continuity Program

RCBC has a Crisis Management Team (CMT) headed by the President and CEO. The CMT oversees the implementation of the comprehensive Crisis Management Framework which equips the Bank in responding to anevent-led disruption in operations. The CMT's role is integral to the Bank's Business Continuity Program as it is responsible for synchronizing all measures for the Bank to contain losses and recover operations as quickly aspossible.

The Bank's Business Resiliency Department under the Risk Management Group (RMG) ensures preparedness for any disaster/crisis by coordinating with all teams in developing and maintaining a bank-wide Business Continuity Plan (BCP) and identifying critical products/services as well as required operational support to sustain operations. The BCP identifies the necessary resources (people, processes, IT systems, and other equipment)and includes contingency procedures to guide all units on how to respond, recover, resume, and restore operations following the disaster/crisis. The BCP complies with the BSP Circular 951 on Business Continuity and

business continuity management (BCM) standards such as ISO 22301 and BS25999.3

The BIG ONE

In a joint study with the Metropolitan Manila Development Authority (MMDA) and the Japan International Cooperation Agency (JICA), the Philippine Institute of Volcanology and Seismology (PHIVOLCS) looked at 18 earthquake scenarios to identify the greatest risk to Metro Manila. The three organizations selected threescenarios:

1. 7.2-magnitudeearthquake from the West Valley Fault
2. offshore 7.9-magnitude earthquake from the Manila Trench, and
3. 6.5-magnitudeearthquake hitting Manila Bay.

The first scenario, popularly known as the "Big One", is predicted to traverse a 100-kilometer fault that runs through six cities in Metro Manila and nearby provinces. Should it happen, it could result in a disaster of never- before-seen proportions.

The scenario is characterized by at least the following events:

• The collapse of 170,000 residential houses and the death of about 34,000 people. Another 114,000 individuals will be injured while 340,000 houses will be partly damaged;
• At least seven bridges will fall, while 10% of public buildings will be heavily damaged;
• The 4,615 kilometers of water distribution pipes will suffer 4,000 points of breakage. Thirty kilometers' worth of electric cables will be cut and 95 kilometers of communication cables will be disconnected. Cellular phone service will be congested and out of use;
• Several fires will originate from factories, hospitals and kitchens. The scenario, which is assumed to occur at nighttime, predicts the fires will burn 1,710 hectares of land, claiming 18,000 lives;

3 ISO 22301 is the international standard for business continuity management, and builds on the success of British Standard BS 25999 and other regional standards. It is designed to protect business from potential disruption, which includes extreme weather, fire, flood, natural disaster, theft, IT outage, staff illness or terrorist attack. BS25999, the world's first British standard for BCM has been developed to help minimize the risk of such disruptions.

9

• Ambulances will be unable to get through the streets and bodies will be lined along the road. The scenario is reminiscent of the horrors of Super Typhoon Yolanda; and
• The destruction, together with the losses that the economy will suffer, will constitute a national crisis.

As a preparation for the BIG ONE, the Bank officially inaugurated the newly constructed Angeles Alternate Site in 4Q2023. Angeles City, in the province of Pampanga is located in Central Luzon. The alternate site is strategically and safely situated in the north, away from the west valley fault. The alternate site will serve as the Bank's and Subsidiaries' back-upfor its critical functions in case the primary office in NCR Metro Manila becomesinaccessible or unsafe.

Disaster Preparedness: RCBC Response to Natural Calamities and Cyber Attacks

RCBC Senior Management has always been on top of disaster preparedness and response to natural, man-made,technological and pandemic threats and events. Comprehensive Disaster Recovery Plan, Crisis Management Planand Institutional Business Continuity Plan are in place and readily available upon activation. BCP Teams and BCP Leaders are equipped with all the training and preparation strategies for any contingency. Alternate sites, Data Center back-up site outside of Metro Manila, IT redundancy infrastructure, Buddy Branch system and contingency procedures are annually tested in order to ensure that infrastructure and BCP Teams execute theplans and validate efficiency and effectiveness in preparation for any threat on cyber incident or disaster occurrence.

Incorporating Environmental and Social (E&S) risk in the Bank's BCP and disaster preparation helps the institution

to formulate effective strategies to address its impacts. A data science-driven dashboard4 identifying personnel location and Bank facilities is in place, with the main objective of activating back-up strategies to safeguard employees and continue the critical services for the Bank's customers. Employees will be evacuated to government-providedstaging areas and/or Bank-providedfacilities in the event of relocation. The Industry-wideEarthquake Resiliency Plan documents the 30-dayrecovery of the Bank's critical cash services, ATM, andbusiness center operations post effect of the big one hitting Metro Manila. This is to address identified critical Bank services that will be available after the disastrous event.

Table top exercise on E&S has been conducted annually to gauge the BCP teams' knowledge, awareness and capacity in effectively managing an E&S incident. For 2023, the scenario focused on a category 5 super typhoonwith heavy rainfall warning causing massive flooding. The activity was participated by selected BCP Leaders, Support Groups and Management Teams who are the drivers of continuity of business and crisis management.There were no major natural or technological catastrophes in 2023 that could trigger a crisis management plan. However, awareness training, table top exercises and BCP testing are conducted annually to equip key peopleand responders on the updated guidelines and Bank strategies. Daily news alerts on weather forecast and volcanic movements are sent out to employees and subsidiaries twice during working days. The reports give an overview of bulletins published by reputable sources such as PAGASA (Philippine Atmospheric, Geophysical and Astronomical Services Administration) and PHILVOCS (Philippine Institute of Volcanology and Seismology), respectively. Emergency go bags and survival kits are available at each employee's work station and offices. Earthquake and fire drills were conducted in all Bank premises nationwide to further train all employees toquickly respond during these emergencies. Crisis communication via call tree system is performed every after a super typhoon or earthquake event to account employees and extend further help and quick assistance as necessary. A mandatory E-learningon business continuity and disaster preparedness is in place for all employees(from senior management to rank and file).

4 The dashboard is from the Bank's Data Science and Analytics Group.

10