Bangko Sentral ng Pilipinas (BSP) has issued a new set of risk‑based capital rules that will take effect in 2027, a significant update to the country’s prudential framework in recent years.
Outlined in BSP Circular No. 1241, s. 2026, the new rules respond to a rapidly evolving threat landscape where cyberattacks, operational disruptions, and digital vulnerabilities pose risks not only to individual institutions but to the stability of the financial system as a whole.
BSP’s new capital framework is designed to ensure that banks have sufficient buffers to absorb losses arising from cyber incidents and operational failures.
The spotlight is pinned on integrating technology‑related risks into capital adequacy standards, recognizing that digital transformation, while essential, introduces new forms of systemic exposure.
With Philippine banks accelerating their adoption of artificial intelligence (AI), cloud computing, and digital channels, the BSP’s updated rules aim to strengthen resilience, improve risk measurement, and align local standards with international best practices.
In an era where hackers can disrupt operations, steal data, or compromise systems, capital is not just a financial buffer, it is a cybersecurity buffer.
Inside Circular No. 1241
BSP’s new rules require banks to hold additional capital against operational risks, including cyberattacks, fraud, system failures, and technology‑related disruptions.
The updated framework, aligned with the Basel III New Standardized Approach (NSA) on the computation of capital charges for operational risk, is part of the BSP’s effort to modernize prudential regulation and ensure that banks remain resilient amid rising digital threats.
It also outlines enhanced methodologies for calculating operational risk capital charges, requiring banks to adopt more granular assessments of loss events, risk drivers, and exposure levels. The rules also introduce new reporting requirements, internal control expectations, and supervisory review mechanisms.
The framework mandates an end-December 2027 report date adoption, giving banks time to adjust their systems, recalibrate risk models, and strengthen internal controls.
The central bank expects institutions to conduct impact assessments, update operational risk management frameworks, and ensure that capital planning incorporates technology‑related risks.
Why Updating Operational Risk Capital Rules is Necessary
BSP’s decision to update its operational risk capital rules roots from concerns on cyberattacks, which have become more frequent, sophisticated, and costly.
Financial institutions worldwide have experienced data breaches, ransomware attacks, and system outages that resulted in financial losses, reputational damage, and regulatory penalties.
Digital transformation has expanded the attack surface. Banks now rely on cloud infrastructure, APIs, mobile apps, and third‑party service providers, creating interconnected systems that can be vulnerable to exploitation.
Moreover, AI adoption introduces new risks, as while AI enhances efficiency and decision‑making, it can also be used maliciously to automate attacks, bypass controls, or exploit vulnerabilities.
Global regulatory standards are also evolving, with international bodies such as the Basel Committee on Banking Supervision have emphasized the need for stronger operational risk capital frameworks that reflect modern threat environments.
The central bank’s updated rules align the Philippines with these global standards, ensuring that local banks maintain adequate buffers to absorb losses arising from operational disruptions.
Cyber Risk as a Capital Concern
A global pattern observed is the growing recognition that cyber risk is not merely an IT issue, it is a capital issue. Cyberattacks can result in financial losses, operational disruptions, and reputational damage that affect a bank’s solvency and stability.
Operational risk capital serves as a buffer against these losses. By requiring banks to hold additional capital against cyber risk, the BSP ensures that institutions can absorb shocks arising from data breaches, ransomware attacks, and system failures.
Regulators worldwide are integrating cyber risk into capital frameworks, recognizing that digital threats pose systemic risks to financial stability.
Operational Risk in a Digital Banking Environment
Operational risk has evolved significantly in recent years. Traditional risks such as fraud, human error, and process failures remain relevant, but digital transformation has introduced new forms of exposure.
Banks now rely on complex digital ecosystems that include cloud infrastructure, APIs, mobile apps, and third‑party service providers. These systems can be vulnerable to exploitation, creating risks that are difficult to measure and manage.
BSP’s updated rules require banks to adopt more granular assessments of operational risk, incorporating technology‑related factors such as system reliability, cybersecurity controls, and third‑party risk management.
Can AI Help Operational Risk Management?
AI can be connected to operational risk management. On one hand, AI enhances risk detection, fraud prevention, and anomaly identification. On the other hand, AI introduces new risks, including model errors, data quality issues, and potential misuse.
BSP Circular No. 1241 requires banks to ensure that AI systems are subject to robust governance, validation, and monitoring. Institutions must demonstrate that AI models are reliable, transparent, and aligned with risk management objectives.
Impact on Banks: Capital Planning and Risk Management
The updated rules will have significant implications for banks. Institutions must conduct impact assessments to determine how the new capital requirements affect their capital adequacy ratios, risk profiles, and business strategies.
Banks may need to increase capital buffers, strengthen internal controls, and enhance operational risk management frameworks. They must also update risk models, improve data quality, and ensure that reporting systems can capture detailed operational risk information.
BSP expects banks to incorporate operational risk considerations into capital planning processes, ensuring that capital buffers reflect the institution’s true risk profile.
The updated operational risk capital rules are part of a broader regulatory agenda aimed at strengthening financial stability. The central bank has issued several regulations in recent years to enhance cybersecurity, digital governance, and operational resilience.
These include guidelines on IT risk management, outsourcing, business continuity planning, and cyber incident reporting. The updated capital rules complement these guidelines, ensuring that operational risk is adequately reflected in capital adequacy frameworks.
DOPAY, as a BSP‑licensed e‑wallet and crypto wallet, supports digital resilience by offering secure, low‑cost, and fully compliant financial services.
For our beloved OFWs, with DOPAY, you can be assured that you can send money to the Philippines safely and at low cost.
Simply top-up your DOPAY wallet from anywhere in the world and send that to someone in the Philippines through DOPAY, and they will receive pesos in their DOPAY wallet; all within the app!
With DOPAY’s crypto wallet, you can gain crypto rewards for every trade under our Trade & Earn program. Not just that, with DOPAY’s Refer & Earn program, Filipinos can unlock new doors for earning possibilities with every successful referral.
Download the DOPAY app today!
