The central bank is preparing to mandate that complex financial institutions undergo rigorous cybersecurity self-assessments, part of the broader push to insulate the local banking system from more sophisticated digital threats.

The Bangko Sentral ng Pilipinas (BSP) issued a draft circular seeking industry feedback until March 6 on the proposed rules. The central bank said the measure will require BSP-supervised financial institutions, known as BSFIs, to evaluate their cybersecurity maturity against global standards.

“This initiative aims to enhance the financial sector’s resilience against evolving cyber threats by enabling BSFIs to assess their cybersecurity maturity against established best practices and develop a roadmap toward their target maturity level,” the BSP said in its draft circular.

Central bank officials said the move marks a transition toward more proactive supervisory oversight. Rather than relying on reactive measures after a breach occurs, the central bank wants institutions to take direct responsibility for measuring their own readiness. The proposed mandate specifically targets institutions that the BSP classifies as having a moderate or complex information technology profile, ensuring that the most systemic players in the financial system face the highest level of scrutiny.

At the heart of the new regulation is a cybersecurity maturity framework that categorizes institutions into four distinct tiers. Lenders at the “foundational” level are those with only minimal security controls in place. The next step up is the “established” level, where institutions have implemented baseline protections that have been formally approved by their boards of directors.

Institutions that achieve the “managed” designation are those that have demonstrated full regulatory compliance and have integrated automation into their security workflows.

The highest tier, “optimized,” is reserved for industry leaders that use predictive tools and advanced analytics to combat emerging threats before they manifest.

These top-tier firms are also expected to actively share threat intelligence across the broader financial sector to improve collective resilience.

The BSP is integrating these self-assessments into its ASTERisC* platform, a cloud-based regulatory technology engine.

The shift to ASTERisC* replaces traditional, static paperwork with a digital compliance system that allows for real-time reporting and more granular data analysis by regulators.

By digitizing the process, the BSP aims to create a more responsive supervisory environment that can keep pace with the speed of modern cyberattacks.