Banks told to strengthen cybersecurity protocols

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) has ordered banks and financial institutions to strengthen their cybersecurity protocols by shifting to “zero-trust” operational model amid the rise in cybercrimes.

In an online press conference, BSP Governor Benjamin Diokno said access to the resources of BSP-supervised financial institutions (BSFIs) would be continuously verified and authorized by implementing security protocols to include multi-factor authentication or biometric technologies.

“As BSFIs adopt technology that is practically borderless, protecting data becomes even more crucial. BSFIs should evaluate whether implementing zero trust identity can address cyber risks in the post COVID-19 setup,” Diokno said.

Strengthening data protection is in line with the BSP’s efforts to boost the industry’s cyber resilience by establishing an environment conducive to digital innovation and employing robust cybersecurity measures and consumer protection mechanisms.

“These were pursued side by side with policy issuances urging BSFIs to augment their existing capabilities and implementing appropriate strategies to address the increasing demand for digital financial services,” Diokno said.

The central bank has granted regulatory reliefs to include relaxed know-your-customer requirements to pave the way for more convenient digital onboarding of clients.

Furthermore, the BSP chief said the regulator also waived applicable license fees for those who wish to offer electronic payment and financial services.

The BSP has reinforced collaboration and active engagement with key stakeholders including law enforcement government agencies to manage cyberthreats.

“While cyber surveillance intensified, policy issuances put a stronger emphasis on vigorous and multi-layered cyber security controls to ward off evolving threats,” Diokno said

Likewise, the central bank also embarked on focused cybersecurity awareness campaigns to alert and warn financial consumers on emerging cyberthreats and scams.

The BSP has also directed BSFIs to ramp up their customer service and redress mechanisms to protect consumers and minimize fraud losses.

Aligned with the BSP’s efforts to pivot to financial technology, Diokno said the central bank has parallel initiatives on ensuring cybersecurity and the value of a risk-based and targeted-approach.

“This is to ensure that strategies, controls and responses are commensurate to the nature, degree and magnitude of threats,” Diokno said.

The BSP chief said cybersecurity is no longer confined to an institution’s technology infrastructure as it now extends to one’s home amid the flexible work arrangements due to the COVID-19 pandemic.

Melchor Plabasan, director of the BSP’s Technology Risk and Innovation Supervision Department, said the regulator is closely monitoring the compliance of banks and financial institutions to the provisions under Circular 982.

The BSP issued enhanced guidelines on information security management in 2017 amid the rapidly evolving technology and cyberthreat landscape in the country.

“These regulations are patterned after international standards. It’s a good guide for them and most of them are already adhering based on our monitoring,” Plabasan said.

Plabasan said the guidelines are dynamic after undergoing several amendments to take into account the changes in the environment as well as evolving cyberthreats.