BSP enforces stricter rules vs scammers

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) has rolled out tighter regulatory rules to help financial institutions detect, prevent and act on account-related scams, following the enactment of the Anti-Financial Account Scamming Act (AFASA) last year.

Through Circulars 1213, 1214 and 1215 issued in May, the BSP laid out the coordinated measures that banks, e-wallets and other financial institutions must take to combat mule accounts, phishing schemes as well as other forms of digital fraud.

“These amendments are designed to fortify the existing regulatory framework and ensure more effective compliance with the provisions of the AFASA,” the central bank said in Circular 1213.

Under Circular 1213, the BSP amended its information technology risk management rules to require stronger fraud detection systems and blacklist screening.

Banks must now “implement automated and real-time fraud monitoring and detection systems to identify and block disputed, suspicious or fraudulent online transactions.”

Institutions handling large volumes of online transfers must also adopt a robust fraud management system capable of “monitoring the frequency of incoming and outgoing transactions within a specific time frame to detect unusually rapid activity,” including bot-driven attacks and zero-day exploits.

Other required tools include device fingerprinting, geolocation monitoring and behavioral anomaly detection.

The regulator also encouraged the use of “kill switch” and “money lock” functions or allowing account holders to freeze their accounts or secure portions of their funds.

Circular 1215, meanwhile, introduces the framework for freezing funds linked to suspicious or disputed transactions for up to 30 days, with any extension requiring a court order. If no funds were held, the coordinated verification process must still be completed within 30 days, extendable to a maximum of 60 days under meritorious circumstances.

The central bank said that the process applies to all supervised institutions and “shall apply to electronic transfer of funds from one financial account to another financial account.”

Once a red flag is raised, all parties – from the remitting bank to the clearing switch operators (CSOs) and any involved third-party providers – must coordinate.

“All CSOs involved in fund transfers related to a disputed transaction shall actively participate in the coordinated verification process,” the BSP said.

In cases where funds are deemed linked to scams, such as phishing or money muling, the BSP said that institutions may refuse to release the money to the recipient.

Disputed funds may be withheld if “the transaction has no underlying economic purpose” or if the funds are “derived from social engineering schemes.”

To ensure accountability, the central bank clarified that “no administrative, criminal or civil liability shall be imposed” on financial institutions that hold funds in good faith.

However, the BSP warned of stiff consequences for malicious or baseless reports. “Any person who… files completely unwarranted or false information… shall be liable under Section 11, in relation to Section 16(e), of the AFASA.”

Financial institutions must also submit a new monthly “Report on Temporarily Held Funds” starting this year.

AFASA criminalizes the unauthorized use or creation of bank and e-wallet accounts for the purpose of laundering stolen funds. It imposes penalties ranging from fines to imprison