Philippine Businesses Prepare for New Security Authentication Mandates
Philippine Businesses Prepare for New Security Authentication Mandates
Updated at: June 9, 2026 at 01:15 AM
The Philippines is witnessing a major transformation in digital security.
To combat a 35% rise in online fraud and sophisticated scams, the Bangko Sentral ng Pilipinas (BSP) has introduced strict mandates under the Anti-Financial Account Scamming Act (AFASA).
A pivotal change is the phase-out of SMS and email-based One-Time Passwords (OTPs) for high-risk transactions.
By June 30, 2026, financial institutions must replace these vulnerable methods with more robust, phishing-resistant alternatives.
The new standards prioritize server-side biometrics, such as facial recognition, and FIDO-certified passwordless authentication.
However, regulators recognize that biometrics alone are not enough; institutions are required to adopt a layered defense strategy, including device binding and behavioral analysis.
This shift is also a matter of financial accountability.
With supporting regulations like Circulars 1213 and 1232, the focus is clear: cybersecurity is no longer just an IT concern, but a core business priority.
