AFASA: Beyond protection

The digital transformation of financial services in the Philippines has been both rapid and profound. From inclusive banking solutions reaching underserved communities to record-breaking adoption of e-wallets and digital credit, our fintech ecosystem has surged ahead, often faster than the regulations that aim to safeguard it.

But as innovation scales, so do the risks.

With the rise of cybercrime, particularly scams that exploit digital channels, the signing of the Anti-Financial Account Scamming Act (AFASA) into law in July 2024, and the subsequent release of the Bangko Sentral ng Pilipinas (BSP)’s implementing circulars in 2025, mark a critical turning point for the digital finance industry. This is not just about enforcement. It’s about ushering in a new era of trust, accountability, and shared responsibility in our financial ecosystem.

Let’s be clear: AFASA isn’t just a tool for punishing scammers. It is a legal recognition that financial cybercrime is economic sabotage. When scammers exploit unsuspecting Filipinos through money mules, fake accounts, or social engineering, they erode the very trust that underpins the digital economy.

The newly released BSP Circulars 1213, 1214, and 1215 represent a cohesive operational framework to turn this law into action. They address everything from the rules of inquiry into suspicious accounts, to the coordinated holding of disputed funds, to strengthening fraud detection through advanced IT risk management.

This is institutional muscle finally catching up to the velocity of digital crime. But it’s also a moment that demands reflection and reform from every player in the ecosystem, especially the private sector.

Circular 1214 enables the BSP to pierce the veil of bank secrecy when investigating suspicious accounts under AFASA. This is a game-changer in tackling layered scams involving identity fraud and synthetic accounts. It empowers competent authorities, including the PNP, NBI, AMLC and even other financial regulators, to collaborate in real time.

But collaboration won’t succeed without data interoperability and shared digital infrastructure. The secure sharing of account information, from transaction trails to KYC records, must be frictionless and privacy-compliant. This is a wake-up call for institutions still operating in digital silos.

Meanwhile, Circular 1215 sets the standard for coordinated fund holds across institutions. The 30-day maximum (plus 25 days of extended hold) gives just enough time for investigations without compromising the rights of legitimate users. However, it’s not just a procedural guideline, it’s a call to build shared response systems, akin to how countries have central fraud registries or real-time money movement alerts.

Perhaps the most forward-looking is Circular 1213, which modernizes IT risk management protocols for BSP-supervised financial institutions (BSFIs). It recognizes a truth the global fintech industry has long known: fraud is not just a risk, it’s an inevitability. What matters is how fast and how smartly we respond.

BSFIs are now being required to institutionalize real-time fraud detection using advanced tools like behavioral biometrics, machine learning models, device fingerprinting and adaptive authentication. This is no longer optional. OTPs, long the security staple of Philippine banks, are now considered insufficient and rightly so, given the spike in OTP phishing and SIM swap attacks.

The emphasis on “constant calibration” via audits, adaptive rules and AI echoes global best practices in fraud management. It’s time we move beyond rule-based detection toward dynamic, intelligence-driven systems.

But there’s a bigger insight here: security must be embedded into customer experience. Not as a hurdle, but as a layer of assurance.

Real-time descriptive alerts, seamless but strong authentication, and 24-hour cooling-off periods after account changes all serve one purpose, that is, restoring and reinforcing trust in digital channels.

Fintechs often see regulations as a constraint. AFASA challenges that thinking. It invites, even demands, the active co-creation of regulatory frameworks that are responsive to fast-changing digital behaviors.

As digital trailblazers, fintech companies are best positioned to detect anomalies, map fraud patterns and innovate security layers that traditional institutions might not envision. But with that advantage comes responsibility.

Fintech Alliance.PH, representing over 130 corporate members handling 95 percent of digital financial transactions in the country, is committed to spearheading a new era of industry-led fraud intelligence sharing. A national fraud bureau built with regulators, law enforcement and platform providers is now more than a concept. It’s a necessity.

If the AFASA represents the legal backbone, then the fraud bureau is the nervous system: sensing, reacting and adapting in real time to threats across institutions.

The biggest win under AFASA isn’t regulatory muscle. It’s consumer protection at scale.

No longer will fraud victims be dismissed as outliers or blamed for “clicking the wrong link.” The system now recognizes the sophistication of social engineering, the psychology of scams and the need for proactive prevention, not just reactive restitution.

This also means stronger education campaigns, especially in digital literacy. For every biometric scanner installed, we need a thousand consumers educated on phishing, spoofing and the digital hygiene basics that can stop fraud before it starts.

The implementation of AFASA is not a finish line. It’s the starting line for building a resilient, inclusive and fraud-resilient digital finance ecosystem. The fintech community must go beyond compliance checklists and begin designing trust by design.

If we fail to act decisively now, to modernize systems, to collaborate across sectors and to put the consumer at the center, we risk not only financial losses, but the erosion of confidence in a system we’ve all worked so hard to build.

In this digital economy, trust is the new currency. And like any currency, it must be earned, protected and reinvested every single day.

Lito Villanueva is the Philippines’ leading and award-winning thought leader in inclusive digital finance. As EVP and Chief Innovation and Inclusion Officer at RCBC, he has led several digital initiatives at scale. He is also the founding chairman of Fintech Alliance PH, overseeing 95 percent of the nation’s digital retail financial transactions. He is the first global chairman of the South Africa-based Alliance of Digital Finance Associations, a co-founder of the Asia FinTech Alliance, and a permanent council member of the Asia FinTech Forum. He has substantially impacted the fintech landscape in the Philippines through his leadership and innovative efforts. His contributions have been crucial in advancing the fintech ecosystem in the Philippines, making financial services more inclusive and efficient.