New regulations to empower authorities, and protect consumers in fight against financial fraud and cybercrime.
In a decisive move to combat the growing threat of financial fraud and cyber-enabled scams, the Bangko Sentral ng Pilipinas (BSP) has officially issued the implementing rules and regulations (IRR) of the Anti-Financial Account Scamming Act (AFASA), a pioneering law aimed at safeguarding consumers and restoring public trust in the financial system.
Signed into law by President Ferdinand R. Marcos Jr. in July 2024, AFASA empowers the BSP and financial institutions to more effectively detect, prevent, and penalize digital financial scams, including phishing, vishing, money muling, and other technology-enabled fraud tactics that have surged in recent years.
“This marks a milestone in our fight against cybercrime,” said BSP Governor Eli M. Remolona, Jr. “The AFASA’s implementing rules go beyond being a legal tool — they represent our commitment to secure the financial ecosystem, protect the banking public, and bolster confidence in the integrity of digital transactions.”
BSP’s three-pronged regulatory approach
To operationalize the law, the BSP released three key circulars targeting different aspects of financial security and consumer protection:
1. Information Technology (IT) Risk Management Regulations
These updated regulations reinforce the responsibility of BSP-supervised institutions (BSIs)—including banks, digital wallets, and other fintech players — to invest in robust fraud prevention mechanisms. Institutions must enhance transaction verification processes, upgrade security protocols, and deploy tools that empower consumers to report and prevent unauthorized account activities.
The goal, BSP said, is to proactively counter fraudulent transactions by ensuring that institutions are technologically equipped to detect and respond to threats in real time.
2. Rules on Financial Account Inquiry and Information Sharing
This provision strengthens the BSP’s authority to investigate financial accounts suspected to be linked to fraud, provided there is a “well-founded belief” that a violation of AFASA has occurred. The rules carefully balance the right to privacy and bank secrecy laws with the needs of law enforcement by allowing data sharing with government agencies under formal agreements.
This step is seen as crucial in tracking complex scams that often involve multiple fake accounts or coordinated social engineering efforts.
3. Regulations on Temporary Holding of Disputed Funds
To further protect victims, the BSP now allows BSIs to temporarily hold disputed funds for up to 30 days while transactions are verified. Institutions must establish a real-time or near-real-time automated tracking system for disputed transactions within 12 months from the circular’s effectivity. If fraud is confirmed, the funds can be returned to affected consumers.
This development offers a tangible safety net for customers who may otherwise lose hard-earned money to increasingly sophisticated cybercriminals.
Addressing modern threats
AFASA’s reach extends beyond conventional fraud, introducing new legal definitions and penalties for social engineering, money muling, and identity theft schemes that leverage new technologies. Many of these tactics had previously existed in legal grey areas, beyond the scope of older cybercrime legislation.
The law is also seen as a strong deterrent to syndicates exploiting unsuspecting individuals to open and “rent” out bank accounts — known as mule accounts — which are then used to launder proceeds from scams.
Consumer vigilance still critical
While regulators and financial institutions gear up for stricter enforcement, the BSP is urging the public to stay alert. Consumers are advised to protect their personal and banking credentials, avoid sharing sensitive data online, and report suspicious activity immediately to their bank or to the proper authorities.
“This is a shared responsibility,” said Remolona. “AFASA equips us with the tools we need, but it is only through collaboration — between regulators, institutions, and consumers — that we can create a truly secure financial environment.”
The full text of the implementing rules is available on the BSP website. The central bank will also be conducting stakeholder forums and awareness campaigns to ensure compliance and consumer education.