BSP revamps capital rules for banks’ fraud, cyber risks

MANILA, Philippines —  The Bangko Sentral ng Pilipinas (BSP) has adopted a new framework for determining how much capital banks must maintain against losses from fraud, cyberattacks and operational failures, with full implementation set for December 2027.

Under Circular 1241, the central bank will implement the Basel III New Standardized Approach (NSA) for calculating capital requirements against operational risk, or potential losses arising from failed internal processes, human errors, system breakdowns and external events.

The new framework seeks to strengthen banks’ ability to absorb unexpected losses, while aligning Philippine regulations with international standards designed to make financial institutions more resilient.

The rules cover universal, commercial and digital banks, including their subsidiary banks and quasi-banks.

Unlike the existing methods, the NSA takes into account both a bank’s business activities and its historical experience with operational losses, allowing capital requirements to better reflect the risks faced by individual institutions.

The framework replaces the Basic Indicator Approach and the existing Standardized Approach, which banks currently use to calculate their operational risk capital requirements.

Under the new methodology, banks will calculate their capital charges using a business indicator derived from financial statement items, including interest income and expenses, service-related earnings and financial transactions.

The calculation generally considers financial data covering three consecutive years.

This amount is then adjusted using an internal loss multiplier, which reflects the bank’s historical operational losses over the previous 10 years.

Banks with relatively heavier operational losses may be required to maintain more capital, while those with lower losses may face reduced requirements under the new calculation.

However, institutions must maintain accurate and comprehensive historical loss records to qualify for the adjustment.

Banks that fail to meet the BSP’s data quality requirements will be assigned a neutral multiplier of one, while those with significant deficiencies in internal controls may face higher capital requirements.

The BSP also requires covered institutions to maintain robust systems for identifying, recording and verifying operational losses, including those arising from internal fraud, external fraud, business disruptions and technology failures.

To facilitate the transition, covered banks will undergo a monitoring period during which they must submit capital adequacy ratio reports using both the existing and new methodologies.

The capital adequacy ratio measures a bank’s available regulatory capital against its risk-weighted assets, indicating its capacity to absorb potential losses.

Existing methodologies will remain the basis for determining compliance with minimum capital requirements during the transition.

However, banks that demonstrate adequate readiness may adopt the NSA ahead of schedule, subject to prior notification and subsequent verification by the BSP.

Full implementation will begin with the end-December 2027 reporting period, while the central bank will issue separate guidelines on the start of parallel reporting.

Meanwhile, stand-alone thrift, rural and cooperative banks will continue using the modified Basic Indicator Approach under the existing Basel 1.5 framework.