The Bangko Sentral ng Pilipinas (BSP) has released the implementing rules of Republic Act No. 12010 or the Anti-Financial Account Scamming Act (AFASA), a landmark law that aims to curb financial scams.
Signed in July 2024, the law takes effect with the release of the implementing rules. The BSP led the drafting in coordination with relevant stakeholders.
According to BSP Governor Eli M. Remolona Jr., “The issuance of AFASA’s implementing rules marks a milestone in our fight against cybercrime. Beyond serving as a powerful tool against evolving financial scams, these rules also enhance consumer protection and boost confidence in the domestic financial system.”
The BSP has issued three circulars to implement AFASA:
- Information Technology (IT) Risk Management Regulations — These regulations reinforce the responsibility of BSP-Supervised Institutions (BSIs) to strengthen fraud prevention and detection. BSIs are required to enhance security features, transaction verifications, and consumer protection tools, among others, to curb unauthorized transactions.
- Rules on Financial Account Inquiry and Information Sharing — These rules outline the BSP’s authority to inquire into financial accounts linked to scams. Inquiries require a well-founded belief of a violation under AFASA, ensuring balance between bank secrecy, data privacy, and law enforcement needs. The BSP may share financial data obtained during an inquiry with competent authorities under formal agreements.
- Regulations on Temporary Holding of Disputed Funds and Coordinated Verification Process — These regulations mandate BSIs, including clearing switch operators, to implement a real-time or near-real-time automated system to track disputed transactions within one year of the regulations’ effectivity. BSIs can hold disputed funds for up to 30 days, coordinate verification of transactions, and return disputed funds to defrauded consumers when warranted.
The new legislation seeks to prevent the misuse of financial accounts in fraud and scams like phishing and vishing.
It also defines and penalizes social engineering schemes, money muling activities, and related offenses. These include those committed using advances in technology, which were previously not covered by existing cybercrime laws in the Philippines.
