Commercial lenders in the Philippines are now legally required to reimburse victims of unauthorized financial transactions following the expiration of a grace period to deploy mandated fraud management systems—shifting the burden of security failures squarely onto financial institutions.

One year after the Anti-Financial Account Scamming Act (AFASA) took effect, the Bangko Sentral ng Pilipinas (BSP) has received over 500 fraud-related complaints referred by the Philippine National Police (PNP).

BSP General Counsel Roberto Figueroa clarified that this figure reflects reports from the PNP alone, speaking on the sidelines of a ceremonial signing for an information-sharing agreement with the Department of Justice (DOJ).

Domestic financial institutions were given until June 2026 to upgrade their infrastructure and establish robust security systems. Any scam cases arising after the deadline are now a cross banks must bear.

“If a depositor or bank client becomes a victim of an unauthorized transaction because the bank failed to comply with the requirements of AFASA, the bank will bear the consequences of that noncompliance,” Figueroa said. “This could include full restitution, meaning the bank may be ordered to reimburse the depositor for the full amount lost.”

This shift in liability places a heavier burden of proof on financial institutions, ending the era when banks could easily deflect responsibility by blaming client negligence for one-time password (OTP) security breaches. Under AFASA, banks are now mandated to implement multi-factor authentication (MFA), particularly for complex and high-value transactions.

“I guess the importance of that deadline is that banks can no longer use the defense that it was the customer who entered the OTP if they are still relying exclusively on OTP,” Figueroa said.

Beyond holding banks liable for client losses, the BSP previously signaled that regulators could go so far as suspending a bank's license if it fails to deploy a sophisticated fraud management system (FMS).

In addition to restitution, the law provides immediate “self-help” remedies to prevent stolen funds from being siphoned out of the financial system. Figueroa noted that lenders are now empowered—and required—to take action against suspicious activity without waiting for a court order.

“Under AFASA, banks are required to temporarily hold disputed transactions if they suspect any irregular activity. That is how powerful the law is—you no longer have to wait for the PNP to file a case before the funds can be frozen,” he said.

For victims seeking recovery without the drawn-out timelines of the judicial system, the Financial Consumer Protection Act (FCPA) offers a faster path.

Figueroa pointed out that the BSP’s Consumer Complaints Resolution Office (CCRO) can resolve disputes involving amounts up to ₱10 million through adjudication—a process that typically takes months rather than years.

“Under the FCPA, if your claim is worth no more than ₱10 million, you can file a complaint with the BSP and have it resolved through adjudication. It’s much faster,” he said.