Rapid digitalization of the Philippine financial system has transformed how consumers transact, save, invest, and manage money. However, as online banking becomes more deeply embedded in everyday life, cyber threats have grown more sophisticated, more frequent, and more damaging.
The Bangko Sentral ng Pilipinas (BSP) is now asking a critical question: how secure is the Philippine financial system against digital threats?
The central bank’s latest directives, ranging from stronger authentication requirements to mandatory cybersecurity self‑assessment, shows transition to a proactive, risk‑based digital security.
With social engineering schemes accounting for 76 percent of fraud losses in the Philippines last year, and frontier AI systems capable of automating multi‑stage cyberattacks emerging globally, the BSP is demanding that banks demonstrate not only compliance but true cyber resilience.
The central bank is now pushing banks to adopt continuous monitoring, advanced authentication technologies, and rigorous self‑assessment frameworks that reflect the evolving threat landscape. The question of online safety is no longer theoretical—it is central to financial stability, consumer trust, and the integrity of the digital economy.
Attacked or Might Be Attacked? Report Either Way
The BSP has issued Memorandum M-2026-047 which requires banks and financial institutions to assess, document, and report cybersecurity vulnerabilities, threats, and incidents directly to the BSP through the Cybersecurity Controls Self-Assessment (CCSA) report.
Instead of waiting for cyberattacks to escalate into consumer harm or operational disruption, the BSP is mandating proactive disclosure. The logic is simple: you cannot fix what you cannot see.
Requiring institutions to report cyber weaknesses and attacks helps the BSP build a national cybersecurity picture that allows regulators to identify patterns, anticipate threats, and intervene before vulnerabilities become crises.
The issuance directs all BSP‑supervised financial institutions (BSFIs)—including banks, e‑wallet operators, remittance companies, and other financial entities—to submit detailed cybersecurity posture reports.
These reports must include assessments of vulnerabilities, documentation of cyberattacks, descriptions of attempted intrusions, and updates on remediation plans. The memorandum emphasizes that institutions must not only report successful breaches but also attempted attacks, suspicious activities, and weaknesses discovered during internal audits or penetration tests.
Financial institutions must adopt a culture of transparency and continuous monitoring. Cybersecurity can no longer be treated as an internal matter or a technical issue confined to IT departments. It is now a regulatory obligation, a governance priority, and a consumer protection requirement.
The BSP expects institutions to demonstrate awareness of their digital risks and to show that they are actively addressing them.
Regulators in the United States, Singapore, and the European Union have adopted similar reporting frameworks, recognizing that cyber threats are systemic and require coordinated oversight.
Through mandated disclosure, the central bank levels the Philippines alongside jurisdictions that treat cybersecurity as a core component of financial stability.
Rising Cyber Threats for Philippine Digital Banks, E-Wallets
BSP’s directive comes at a time when cyber threats against Philippine financial institutions are intensifying.
Social engineering schemes, phishing attacks, SIM swapping, account takeovers, and malware campaigns have become more sophisticated. Fraudsters increasingly use AI‑generated messages, deepfake audio, and automated scripts to deceive consumers and infiltrate systems.
The BSP has previously reported that social engineering accounted for 76 percent of fraud losses in the Philippines, highlighting the human element as a major vulnerability.
Transcending consumer‑level attacks, institutions face deeper risks: ransomware campaigns targeting core banking systems, credential harvesting targeting administrators, and distributed denial‑of‑service (DDoS) attacks aimed at disrupting digital services.
The emergence of frontier AI cyberattacks—capable of autonomously scanning systems, identifying vulnerabilities, and executing multi‑stage intrusions—adds another layer of complexity. These threats can overwhelm traditional defenses and exploit weaknesses faster than institutions can detect them.
Amidst this digital crisis, the BSP’s requirement for reporting vulnerabilities and attacks is not merely procedural—it is essential. Without visibility, regulators cannot help institutions defend against threats that evolve daily.
Why Transparency Matters in Cybersecurity
Cybersecurity has traditionally been shrouded in secrecy. Institutions often hesitate to disclose vulnerabilities or attacks due to reputational concerns, fear of regulatory penalties, or uncertainty about how information will be used.
But secrecy creates blind spots. When institutions hide incidents, regulators cannot detect patterns, consumers remain unaware of risks, and attackers exploit weaknesses that remain unaddressed.
Transparency changes this dynamic. When institutions report vulnerabilities and attacks, regulators gain visibility into emerging threats. They can identify common attack vectors, issue sector‑wide advisories, and coordinate defensive measures.
Transparency also encourages institutions to adopt stronger controls, knowing that weaknesses will be scrutinized.
The central bank recognizes that cyber threats are not isolated events—they are interconnected. Attackers often target multiple institutions using similar techniques.
Without reporting, these patterns remain invisible. With reporting, regulators can detect coordinated attacks, anticipate escalation, and intervene before damage spreads.
Transparency also strengthens consumer trust. When institutions demonstrate that they are monitoring threats and reporting them to regulators, consumers gain confidence that their financial data and digital transactions are protected. In a digital economy, trust is currency.
Why Filipino Consumers Should Care About Cybersecurity Reporting
Cybersecurity reporting directly benefits consumers. When institutions report vulnerabilities and attacks, regulators can intervene before issues escalate into consumer harm. Reporting helps prevent unauthorized transfers, account takeovers, identity theft, and financial loss.
Consumers rely on banks and financial institutions to protect their money and personal information. The BSP’s directive ensures that institutions take this responsibility seriously. Reporting creates accountability, encourages stronger controls, and reduces the likelihood of breaches.
In a digital economy where consumers increasingly use online banking, e‑wallets, and digital payments in their daily lives, cybersecurity reporting becomes a form of consumer protection.
Who Your E-Wallet Provider Is Matters
Choosing the right e-wallet provider wisely because the provider you select becomes the gatekeeper of your financial identity, your transactions, and your money.
A BSP‑licensed e-wallet follows strict rules on customer verification, regulation compliance, sanctions screening, and anti‑money laundering controls—protections that unlicensed platforms simply do not offer.
With regulated e-wallet providers, financial consumers safeguard their funds, reduce exposure to fraud, and ensure that every money transfer is handled with rigor and security.
DOPAY, a BSP-licensed e-wallet and crypto wallet, allows you to receive and send money and crypto safely and with security.
With DOPAY’s crypto wallet, you can gain crypto rewards for every trade under our Trade & Earn program. Not just that, with DOPAY’s Refer & Earn program, Filipinos can unlock new doors for earning possibilities with every successful referral.
Download the DOPAY app today!
