BSP tightens rules on reporting threats

Banks must report incident within 24 hours

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) is now requiring banks and financial institutions to report any significant incident related to money laundering, terrorism and proliferation financing within 24 hours.

In a circular signed by BSP Deputy Governor Bernadette Romulo-Puyat on April 29, the Monetary Board has amended certain sections of the Manual of Regulations for Banks (MORB) and Manual of Regulations for Non-Bank Financial Institutions (MORNBFI) as part of its risk-based anti-money laundering and countering terrorism and proliferation financing supervision.

Under the new rules, BSP-supervised financial institutions (BSFIs) are now required to submit a risk event report to the central bank within 24 hours from date of knowledge of any significant money laundering, terrorism financing and proliferation financing risk event.

“This report shall enable the BSP to promptly identify and respond to emerging risks and supervisory concerns as well as calibrate supervisory risk assessments, strategies, and activities, among others,” the central bank said.

The regulator also said the identification and management of money laundering risks are critical in ensuring the resilience and integrity of the financial system as well as the safety of BSFIs.

The BSP defined a risk event as any incident related to money laundering as well as terrorism and proliferation financing that may harm the BSFI, the stability of the financial system, or erode public confidence.

“A critical component of a covered person’s risk assessment and management process is the timely collection and analysis of relevant data, including risk events,” the BSP said.

A risk event is reportable if the amount involved represents one percent or more of the BSFI’s total capital or if, based on the BSFI’s assessment, the incident has a material impact on a significant number of customers or counterparties, with cross-border elements or those that may be covered in adverse media reports.

The risk event report should contain the date of the discovery and a brief description of the incident such as its nature, type of transaction or product, delivery channel used and the amount involved.

The risk event report should also contain the initial root cause of the incident, if determined, as well as the response or action taken by the BSFI. The report should include the impact of the event to the BSFI based on initial assessment as well.

The central bank may require the BSFI to provide additional information, documents or updates as necessary. The BSP may also conduct examinations to verify the root cause of the event, assess the impact and identify areas of improvement.

“Non-compliance with the reporting requirements on risk event report will be subject to applicable monetary penalty pursuant to sections 1102/1102-Q as amended,” the BSP said.

Furthermore, the regulator said it could deploy its range of enforcement actions to promote adherence to the requirements and bring about timely corrective actions.

The Philippines has failed to exit the gray list or list of jurisdictions under increased monitoring by global dirty money watchdog Financial Action Task Force after falling short in addressing the remaining concerns on its anti-money laundering and counter-terrorist financing regime.

Being placed on the gray list since June 2021 has tangible consequences for the country’s economy and financial system as this restricts cross-border transactions particularly remittances from overseas Filipino workers, leading to difficulties in obtaining credit and limiting inward foreign investments.