BSP mulls liability shifts as banks move beyond OTPs

MANILA, Philippines —  The Bangko Sentral ng Pilipinas (BSP) is preparing to shift liability onto banks that rely on outdated one-time passwords (OTPs) for digital authentication as more robust biometric verification systems gain traction in the financial sector.

In an interview with The STAR, BSP Deputy Governor Mamerto Tangonan said that following the enactment of the Anti-Financial Account Scamming Act (AFASA), financial institutions have started to explore and adopt stronger authentication methods beyond OTPs.

He said some banks are now leveraging the Philippine Statistics Authority (PSA)’s national ID verification service, requiring facial recognition both at account onboarding and for certain high-risk transactions.

Tangonan said this transition to biometric authentication not only strengthens consumer protection but may also influence how accountability is assigned in fraud cases.

“Later on, we will look into shifting liability to banks that continue to use weak authentication mechanisms,” Tongonan  said, adding that “when authentication is weak, and the customer challenges a transaction, we may hold the bank liable.”

“But if a strong authentication method like facial recognition is in place, it becomes much harder to repudiate the transaction,” Tangonan said.

The BSP’s push aligns with its broader efforts under the AFASA to encourage stronger user verification across the financial ecosystem. While OTPs have long been the default method for confirming transactions, their vulnerability to phishing and SIM-swapping attacks has become a growing concern.

He cited one unnamed bank that already verifies customers through facial scans matched against the PSA database during account opening and uses the same image for transaction verification.

“That bank isn’t even a major player. If they can do it, why can’t others?” he said.

Some institutions have adopted fingerprint authentication, though some are not yet connected to the PSA’s real-time ID verification service.

Tangonan said that as these technologies become more accessible, BSP expects industry-wide adoption to accelerate, especially as authentication standards affect where liability falls in fraud cases.

The deputy governor also gave updates on Project Agila, the BSP’s pilot program on central bank digital currencies (CBDCs). While the pilot proved the viability of wholesale CBDCs for cross-border payments and securities settlement, Tangonan said the central bank is now turning to the industry for direction.

“We have the technology. We know how to operate it. But we need to hear from the industry – do they want to use it? I want to discuss this with bank CEOs on what they want to do with CBDCs,” he said.

Tangonan is currently reviewing the BSP’s assessment report on Project Agila and plans to publish it on the BSP’s website within the year to initiate broader industry discussions.

Meanwhile, Project Nexus, the BSP’s international payments initiative with its regional partners and the Bank for International Settlements, has reached a significant operational milestone.

Tangonan confirmed that a Singapore-based company has already been incorporated to run Nexus, which the BSP will co-own and operate. The next steps are hiring a CEO and selecting a technology provider.