Central Bank of the Philippines implements the Anti-Financial Account Scamming Act through new IT risk, account inquiry and disputed funds rules

The Central Bank of the Philippines has issued implementing rules for the Anti-Financial Account Scamming Act (AFASA), operationalising new requirements and supervisory powers aimed at preventing and responding to financial-account scams and related cyber-enabled fraud. Three circulars implement the framework. Updated information technology risk management rules strengthen obligations on BSP-supervised institutions (BSIs) to prevent and detect fraud, including enhanced security features, transaction verification, and consumer protection controls to reduce unauthorised transactions. Separate rules on financial account and information sharing set out the BSP’s authority to inquire into financial accounts linked to scams, limiting inquiries to cases with a clear and substantial basis for an AFASA offence and providing for information sharing with competent authorities under a formal agreement while balancing bank secrecy and data privacy considerations. A third set of rules establishes a coordinated verification process for disputed transactions, allowing BSIs and clearing switch operators to temporarily hold disputed funds for up to 30 days, work jointly to verify the transaction, and return funds to victims where warranted. BSIs and clearing switch operators are required to deploy a real-time or near-real-time automated system to track disputed transactions within one year from the start of the regulation. AFASA targets misuse of financial accounts arising from scams such as phishing and vishing, and covers offences including social engineering schemes and money muling, including conduct enabled by new technologies.