AFASA Compliance After the Deadline: A Checklist for Banks

This guide ties together our AFASA series. For the bigger picture, read AFASA Compliance Is the Floor, and for what it looks like when it's running, AFASA-compliant authentication in production. For what has changed since the deadline and what the BSP is drafting next, read What AFASA Has Changed So Far.

In this piece. The end-June 2026 deadline under BSP Circular 1213 has come and gone, and the conversation has changed. It is no longer "are we ready?" It is "if a fraud happens tomorrow, are we covered?" This guide sets out what AFASA and its three implementing circulars require of BSP-supervised institutions today, answers the question we hear most (can we still use SMS OTP?), and ends with a 10-point checklist your team can run in an afternoon.

What is in force now

The Anti-Financial Account Scamming Act (Republic Act No. 12010) was signed on 20 July 2024. The BSP put it into practice through three circulars issued in 2025, and each one does a different job:

• Circular 1213: authentication and fraud management. Amends the BSP's IT risk management rules. It tells institutions to limit authentication that can be shared or intercepted, such as SMS and email OTPs, and requires covered institutions to run an automated, real-time fraud management system.
• Circular 1214: the BSP's power to look into accounts. Sets the rules for how the BSP, through its Consumer Account Protection Office, inquires into financial accounts linked to scams and shares that information with authorities such as the NBI and the PNP, under formal information-sharing agreements.
• Circular 1215: holding disputed funds. Requires institutions to temporarily hold funds in a disputed transaction while a coordinated verification process runs: up to 5 days at first, extendable to a maximum of 30.

Circular 1213's fraud management requirements apply to institutions that offer complex electronic products and services and handle high aggregate values: an average of at least ₱75 million in monthly network value over the last six months. That typically includes the larger banks, digital banks and e-wallets. Its broader rules, including limiting interceptable OTPs and a 24-hour pause on transactions after key account changes, apply to all BSP-supervised institutions. The compliance deadline was one year from the circular's effectivity, which fell at the end of June 2026.

Can banks still use SMS OTP?

Not as the main safeguard. Circular 1213 says BSFIs "should limit the use of authentication mechanisms that can be shared to, or intercepted by, third parties unrelated to the transaction," and names SMS and email OTPs as examples. When the deadline arrived in June 2026, the BSP confirmed that lower-risk transactions may still use SMS OTPs, while high-risk ones need the stronger methods.

In March 2026 the BSP went further in a draft on server-side biometrics, released for comment: OTPs could still verify a registered mobile number, while biometrics would take over authorising transactions. The reason is simple. An SMS code can be read aloud to a scammer, typed into a fake site or caught through a SIM swap. We wrote about why that matters for the people on the other end in The End of the OTP.

Replacing SMS OTP with face authentication

Circular 1213 lists the stronger alternatives: biometric authentication (fingerprint, facial recognition or voice), behavioural biometrics, passwordless methods such as FIDO, and adaptive authentication. For most Philippine institutions, face authentication is the most practical path, because the customer's face is already captured at onboarding.

The BSP's March 2026 draft on server-side biometrics sets out what would come with it:

• Liveness and deepfake detection, so a photo, a replayed video or an AI-generated face can't pass.
• Biometric templates stored as encrypted mathematical representations, not raw images, and encrypted at rest and in transit.
• Accuracy that is measured and reported: false acceptance rates, false rejection rates, and bias across different groups of customers.
• Accessibility designed in, so elderly customers, people with disabilities and customers on lower-end phones can get through.

Check the final version on bsp.gov.ph before you build to it. Even as a draft, though, the last point is where most of the real work sits. A face check that works on a flagship phone in Makati and fails on a four-year-old Android in a provincial branch is not one your customers will trust. TrustVision transaction verification was built for that range of devices, with liveness certified to ISO/IEC 30107.

It covers the whole customer journey, not just onboarding

The most common gap we see is scope. Circular 1213 doesn't stop at account opening. It requires:

• A 24-hour pause on transactions after a customer changes their registered mobile number, email or device
• Strong authentication to change transaction limits or to unlock money-locked funds
• A notification to the customer when a new fund-transfer recipient is enrolled

The BSP's draft on server-side biometrics goes further, covering high-risk transactions and critical account changes. Institutions that planned only for onboarding often find the gap months later, when re-authentication has to be retrofitted into flows that are already live. The same face registered at onboarding can be the one checked at each of these moments, so the customer enrols once.

The fraud management system has to work in real time

Authentication is only half of Circular 1213. The other half is a fraud management system that is automated and works in real time, not in an end-of-day batch. For covered institutions, it must at minimum look at:

• Transaction velocity
• Changes to the customer's mobile device or account information
• Geolocation
• Blacklist screening
• Behavioural anomalies

This is also where money mule detection lives. Mule accounts often look normal at onboarding and only show themselves in how money moves through them. TrustVision Fraud Prevention covers this layer.

Who pays when something goes wrong

This is the part that changed the conversation in boardrooms. Before AFASA, liability for digital banking fraud was often argued over. Now the law is clearer: an institution that fails to put adequate controls in place, or to exercise the highest degree of diligence, is liable to restore the customer's funds, and a criminal conviction isn't needed first. An institution the BSP finds compliant isn't liable.

BSP Deputy Governor Elmore Capule put the regulator's view plainly in January 2026: "…'pag lumang technology ka pa rin at nakalusot, sorry ka dahil ang presumption, you are negligent." And: "'Pag may loss, they will pay for it." In other words: if you're still on old technology and something slips through, expect to be treated as negligent, and expect to pay.

Your 10-point AFASA readiness checklist

Answer yes or no. Every "no" is worth a conversation with your compliance and digital teams this week.

1. Have we limited SMS and email OTP, so it's no longer the only safeguard on high-risk transactions?
2. Do we pause transactions for 24 hours after a customer changes their mobile number, email or device?
3. Does our authentication use one of the stronger methods Circular 1213 lists, such as face authentication?
4. If we use biometrics (per the BSP's draft guidance): does our liveness check also detect deepfakes and injected video, not just printed photos?
5. If we use biometrics: are templates stored encrypted, as mathematical representations rather than images?
6. If we use biometrics: do we track false acceptance, false rejection and bias across customer groups, and could we show those numbers to the BSP?
7. If we use biometrics: does authentication work for elderly customers and on lower-end phones?
8. Do changes to transaction limits and unlocking money-locked funds require strong authentication, and are customers notified when a new recipient is enrolled?
9. Does our fraud management system screen transactions in real time for velocity, device and account changes, geolocation, blacklists and behavioural anomalies?
10. Can we hold disputed funds and take part in coordinated verification under Circular 1215?

Want a faster read on where you stand? Our AFASA Compliance Assessment takes about three minutes.

What this guide is, and what it isn't

It is a working summary of what AFASA and BSP Circulars 1213 to 1215 ask of supervised institutions, and of where the BSP's draft guidance on biometrics is heading, written for the teams who have to put it into practice.

It is not legal advice. Your compliance team and the circulars themselves on bsp.gov.ph are the final word, and the BSP may issue further guidance as the rules mature.

The bottom line

The deadline was the easy part to track. What matters now is whether every high-risk moment in your customer journey is covered, on the phones your customers actually use. If you can answer yes to all ten questions above, you're in a defensible position. If not, now is a better time to find out than after the next complaint.