BSP tightens rules on bank IT systems

MANILA, Philippines -  The Bangko Sentral ng Pilipinas (BSP) is drafting a new regulation which will provide a more enhanced and holistic framework for information technology security management in the local banking sector.

During a forum with the Financial Executives Institute of the Philippines, BSP Deputy Governor Nestor Espenilla said the central bank is eyeing to issue in July a new circular which would introduce amendments to Circular 808 series of 2013.

The old circular, according to Espenilla, is the BSP’s main framework which lays out guidelines on information technology risk management for all banks and other BSP-supervised institutions.

“We are leveling up and incorporating the latest standards in this proposed circular on information security,” Espenilla said.

“It covers not just cybersecurity, but even the use of cloud computing, so it’s broader. Similar to Circular 808, it is an upgraded IT risk management framework. It enables the use of newer technologies and it also upgrades the cybersecurity standards,” he said.

According to Espenilla, the amendments to be introduced in the new circular would present a more holistic information technology security management, integrated with the own information security programs and risk management system of banks.

“In response to concerns, the amendments highlight the need to integrate cybersecurity controls and measures into the information security program,” Espenilla said.

Espenilla said the circular, which would be released in July, is undergoing review from the private sector.

“It is under exposure right now, we are geting industry comment. We found that we need the inputs of the private sector to create a regulation that is actually useful,” he said.

According to Espenilla, there is a need to address threats of cybersecurity amid the rapidly transforming Philippine banking landscape, brought about by digital trends, such as social media, cloud computing, big data and artificial intelligence.

However, Espenilla said the real challenge is in determining how to strike a balance between encouraging the use of technology, and ensuring the security and safety in the financial sector amid these innovations.