The Bangko Sentral ng Pilipinas (BSP) has amended its Manual of Regulation for Banks to require lenders to disclose their operational risk-weighted assets, operational loss events and excluded divested activities in their annual reports. Under the Basel III New Standardized Approach (NSA), universal, commercial and digital banks, and their subsidiary banks or quasi-banks, must combine their historical operational loss experience with their financial size to compute operational risk capital.
What counts as operational risk
The BSP defines operational risks as potential losses from inadequate or failed internal processes, people, systems or external events. The risks covered include cyberattacks, fraud, human error, technology failures and natural disasters.
The BSP said exclusions must be rare, strongly justified and evaluated on whether the cause of the loss event could occur in other areas of the financial institution's operations.
Once the circular takes effect, covered banks will enter a monitoring period in which they must submit parallel capital adequacy ratio reports under both the old Basic Indicator Approach or Standardized Approach and the new NSA. The BSP said the start date and reporting details will be announced in a separate issuance. Banks may apply for early adoption during the monitoring period, subject to prior notification to the BSP and supervisory post-verification.
Basel reforms and the fraud backdrop
The NSA is part of the Basel III reforms, which the Basel Committee on Banking Supervision introduced in December 2010 and finalised in December 2017. The Philippines currently has seven licensed digital banks, which fall within the banks covered by the NSA rules.
A BSP official, Ms. Javier, earlier said social engineering schemes, including phishing scams, account takeover and identity theft, were the top cyberthreat to the country's digital payments system. These schemes accounted for 76% of the total amount lost to financial fraud in the first half of 2025.
Among the measures the BSP has recommended are better visibility of banks' attack surfaces and the integration of AI-enabled defensive tools for real-time threat detection and automated patching. Separately, Circular No. 1240, dated 21 September 2026, requires existing thrift, rural and cooperative banks that the BSP determines operate a business model similar to a digital bank to meet the ₱1.0-billion minimum capital requirement for digital banks.