When people talk about the Anti-Financial Account Scamming Act, they often treat it as one event. It is really three.
The law took effect on August 13, 2024, as the Bangko Sentral ng Pilipinas noted in a 2024 memorandum. The BSP's implementing rules followed on June 25, 2025. And the hardest part, moving away from SMS one-time passwords and running real-time fraud monitoring, only became mandatory on June 25, 2026, after the one-year transition set in BSP Circular 1213.
That distinction matters when you ask whether AFASA is working. Enforcement has been running since August 2024. The stronger security rules have only applied since June 2026. Here is what the record shows so far.
Last updated: November 2026.
What has changed
More scammers are being caught. The PNP Anti-Cybercrime Group recorded 527 AFASA-related cases in 2025, and about 447 had been solved or cleared, the BSP told a Senate budget briefing, BusinessMirror reported in September 2026. Police said they had arrested more than 90 money mules between January and April 2026, and a regional trial court convicted four people for buying or selling financial accounts, one of the first convictions under the law (BusinessMirror).
The cost of weak security has moved to institutions. Under Section 6 of the law, a bank or e-wallet that fails to put adequate controls in place, or to exercise the highest degree of diligence, is liable to return a scam victim's money, and no criminal conviction is needed first. An institution the BSP finds compliant is not liable. After the June 2026 deadline, the BSP's general counsel was direct about it: for high-value transactions, relying on an OTP alone is no longer a defence (BusinessMirror).
The OTP is being retired for high-risk moments. Institutions with at least ₱75 million in average monthly online transactions can no longer rely on SMS or email codes for high-risk transactions and major account changes. The BSP said many had already switched before the June 2026 deadline, and codes are still allowed for low-risk activity (BusinessWorld).
More people are using their rights. The BSP received more than 120,000 consumer complaints in 2025, up 72.6% from 70,112 in 2024. It attributes the rise partly to greater awareness of its complaint channels and of the new consumer-protection laws (BusinessWorld).
Recorded scam cases fell, with a caveat. The PNP logged 4,509 online scam cases in the first half of 2026, compared with 5,526 in the first half of 2025, an 18.4% drop. Fewer recorded cases do not necessarily mean fewer victims, because many scams go unreported (The Manila Times).
What hasn't changed
Exposure remains high. A 2026 Global Anti-Scam Alliance survey estimated that 84% of Filipino adults had encountered a scam attempt in the previous year, with losses of about ₱121.8 billion. These are survey estimates, not confirmed incidents. The BSP and the Bank Marketing Association of the Philippines have spoken of halving scam losses, but the baseline for that goal had not been agreed as of October 2026 (The Manila Times).
Where the BSP drafts stand (last checked: November 2026)
Two drafts released for comment in 2026 show where the rules are heading. As of our last check, neither had been issued as a final rule. The BSP's own site, bsp.gov.ph, has the current status.
Server-side biometrics (draft released March 2026). The BSP's exposure draft would recognise server-side biometric authentication, where a customer's face or fingerprint is checked against a template the institution holds rather than only on the phone, as a strong and acceptable control for high-risk transactions and critical account changes, provided its risks are addressed. Adopting it would count when the BSP judges whether an institution's controls were adequate, and so would bear on liability under AFASA.
The draft is just as clear about the risks: a central biometric database is a valuable target for attackers, weak liveness checks can be beaten by spoofs and deepfakes, poor enrolment checks let fraudsters register in someone else's name, and error rates can fall unevenly across groups of customers. It proposes baseline safeguards, including encrypted templates instead of raw images, liveness and deepfake detection, human review of flagged cases, equally strong fallback methods, monitoring of false acceptance, false rejection and performance across customer groups, and designs that work for elderly users, people with disabilities and customers on lower-end phones (see also BusinessWorld's coverage).
The National ID at onboarding (draft released August 2026). A separate BSP draft would require banks, e-wallets and other supervised institutions to verify customers through the Philippine Statistics Authority's National ID authentication service when they open or update accounts. A successful check would replace the need to present a physical or printed National ID for first-time customers, and other IDs would remain acceptable on a risk basis. Major retail-facing institutions, such as retail banks, digital banks and e-money issuers, would have three months from the memorandum's issuance, and the rest of the sector six months from its effectivity (BusinessWorld).
Together, the two drafts point the same way. Identity is checked properly once, at the start, and then re-checked with something harder to steal than a code at every moment that matters.
When did AFASA take effect?
The Anti-Financial Account Scamming Act (Republic Act No. 12010) took effect on August 13, 2024. The BSP's implementing rules took effect on June 25, 2025, and the stronger security requirements under BSP Circular 1213 became mandatory on June 25, 2026.
Can banks and e-wallets still use SMS OTP?
For low-risk activity, yes. For high-risk transactions and major account changes, institutions with at least ₱75 million in average monthly online transactions are expected to use stronger methods such as biometric, behavioural, adaptive or passwordless authentication.
Who pays when a scam succeeds?
Under Section 6 of AFASA, an institution that fails to put adequate controls in place, or to exercise the highest degree of diligence, is liable to restore the customer's funds, and a criminal conviction is not needed first. An institution the BSP finds compliant is not liable.
What is the BSP drafting next?
Two drafts were released for comment in 2026: one recognising server-side biometric authentication as a strong control for high-risk transactions, and one requiring institutions to verify customers through the National ID authentication service at onboarding. As of November 2026, neither had been issued as a final rule.
The takeaway
AFASA's enforcement side is producing arrests, cases and early convictions. Its security side is newer, in force since June 2026, and the next layer is still being written. For anyone working in banking, lending or payments, the useful question is no longer whether the rules apply. It is whether every high-risk moment in a customer's journey is covered.
If you want to check that against the rules in force, our plain-English AFASA compliance checklist covers what Circulars 1213 to 1215 require. For how face authentication replaces the OTP at high-risk moments, see TrustVision Transaction Verification.
Related reading: AFASA Compliance After the Deadline: A Checklist for Banks · The End of the OTP · The Pulse of the Mule
This article summarises public sources and is not legal advice.
Sources
- Bangko Sentral ng Pilipinas. (2024). Memorandum No. M-2024-029: Reiterating the guidelines on risk management systems and controls to protect financial accounts in relation to Section 6 of Republic Act No. 12010. bsp.gov.ph
- Bangko Sentral ng Pilipinas. (2025). Circular No. 1213, Series of 2025. bsp.gov.ph
- Bangko Sentral ng Pilipinas. (2026). Exposure draft: Adoption of server-side biometric authentication and other key controls for high-risk transactions and critical account changes in financial applications. bsp.gov.ph
- Chan, K. K. (2026, March 5). BSP wants banks to use server-side biometrics to combat financial fraud. BusinessWorld. Link
- Chan, K. K. (2026, June 25). Many banks and e-wallets have phased out OTPs for authentication, BSP says. BusinessWorld. Link
- Chan, K. K. (2026, August 7). BSP wants banks to use National ID authentication in KYC processes. BusinessWorld. Link
- Chan, K. K. (2026, August 10). Bank consumer complaints rise amid tighter regulations. BusinessWorld. Link
- Fernandez, B. (2026, April 28). Afasa impact seen with arrest of crooks. BusinessMirror. Link
- Fernandez, B. (2026, September 3). BSP credits Afasa law in gains vs financial fraud. BusinessMirror. Link
- Republic Act No. 12010. (2024). Anti-Financial Account Scamming Act. Lawphil
- San Juan, A. E. (2026, July 23). Banks now liable to victims of OTP scams, says BSP counsel. BusinessMirror. Link
- Toral, J. (2026, October 18). Measuring what matters in the fight against scams. The Manila Times. Link
Check where you stand.
Talk to our team about where your AFASA setup stands and the gaps worth closing first.
