This guide ties together our AFASA series. For the bigger picture, read AFASA Compliance Is the Floor, and for what it looks like when it's running, AFASA-compliant authentication in production. For what has changed since the deadline and what the BSP is drafting next, read What AFASA Has Changed So Far.
In this piece. The end-June 2026 deadline under BSP Circular 1213 has come and gone, and the conversation has changed. It is no longer "are we ready?" It is "if a fraud happens tomorrow, are we covered?" This guide sets out what AFASA and its three implementing circulars require of BSP-supervised institutions today, answers the question we hear most (can we still use SMS OTP?), and ends with a 10-point checklist your team can run in an afternoon.
The Anti-Financial Account Scamming Act (Republic Act No. 12010) was signed on 20 July 2024. The BSP put it into practice through three circulars issued in 2025, and each one does a different job:
Circular 1213's fraud management requirements apply to institutions that offer complex electronic products and services and handle high aggregate values: an average of at least ₱75 million in monthly network value over the last six months. That typically includes the larger banks, digital banks and e-wallets. Its broader rules, including limiting interceptable OTPs and a 24-hour pause on transactions after key account changes, apply to all BSP-supervised institutions. The compliance deadline was one year from the circular's effectivity, which fell at the end of June 2026.
Not as the main safeguard. Circular 1213 says BSFIs "should limit the use of authentication mechanisms that can be shared to, or intercepted by, third parties unrelated to the transaction," and names SMS and email OTPs as examples. When the deadline arrived in June 2026, the BSP confirmed that lower-risk transactions may still use SMS OTPs, while high-risk ones need the stronger methods.
In March 2026 the BSP went further in a draft on server-side biometrics, released for comment: OTPs could still verify a registered mobile number, while biometrics would take over authorising transactions. The reason is simple. An SMS code can be read aloud to a scammer, typed into a fake site or caught through a SIM swap. We wrote about why that matters for the people on the other end in The End of the OTP.
Circular 1213 lists the stronger alternatives: biometric authentication (fingerprint, facial recognition or voice), behavioural biometrics, passwordless methods such as FIDO, and adaptive authentication. For most Philippine institutions, face authentication is the most practical path, because the customer's face is already captured at onboarding.
The BSP's March 2026 draft on server-side biometrics sets out what would come with it:
Check the final version on bsp.gov.ph before you build to it. Even as a draft, though, the last point is where most of the real work sits. A face check that works on a flagship phone in Makati and fails on a four-year-old Android in a provincial branch is not one your customers will trust. TrustVision transaction verification was built for that range of devices, with liveness certified to ISO/IEC 30107.
The most common gap we see is scope. Circular 1213 doesn't stop at account opening. It requires:
The BSP's draft on server-side biometrics goes further, covering high-risk transactions and critical account changes. Institutions that planned only for onboarding often find the gap months later, when re-authentication has to be retrofitted into flows that are already live. The same face registered at onboarding can be the one checked at each of these moments, so the customer enrols once.
Authentication is only half of Circular 1213. The other half is a fraud management system that is automated and works in real time, not in an end-of-day batch. For covered institutions, it must at minimum look at:
This is also where money mule detection lives. Mule accounts often look normal at onboarding and only show themselves in how money moves through them. TrustVision Fraud Prevention covers this layer.
This is the part that changed the conversation in boardrooms. Before AFASA, liability for digital banking fraud was often argued over. Now the law is clearer: an institution that fails to put adequate controls in place, or to exercise the highest degree of diligence, is liable to restore the customer's funds, and a criminal conviction isn't needed first. An institution the BSP finds compliant isn't liable.
BSP Deputy Governor Elmore Capule put the regulator's view plainly in January 2026: "…'pag lumang technology ka pa rin at nakalusot, sorry ka dahil ang presumption, you are negligent." And: "'Pag may loss, they will pay for it." In other words: if you're still on old technology and something slips through, expect to be treated as negligent, and expect to pay.
Answer yes or no. Every "no" is worth a conversation with your compliance and digital teams this week.
Want a faster read on where you stand? Our AFASA Compliance Assessment takes about three minutes.
It is a working summary of what AFASA and BSP Circulars 1213 to 1215 ask of supervised institutions, and of where the BSP's draft guidance on biometrics is heading, written for the teams who have to put it into practice.
It is not legal advice. Your compliance team and the circulars themselves on bsp.gov.ph are the final word, and the BSP may issue further guidance as the rules mature.
The deadline was the easy part to track. What matters now is whether every high-risk moment in your customer journey is covered, on the phones your customers actually use. If you can answer yes to all ten questions above, you're in a defensible position. If not, now is a better time to find out than after the next complaint.