Amendments to Regulations on Information Technology Risk Management

BANGKO SENTRAL NG PILIPINAS

OFFICE OF THE GOVERNOR

CIRCULAR NO.1140 Series of 2022

Subject: Amendments to Regulations on Information Technology Risk Management

Institutions(MORNBFI). Appendix Q-66 of the Manual of Regulations for Non-Bank Financial cybersecurity posture and minimize losses arising from fraud and approved the amendments incorporating requirements on the adoption of robust fraud management systems and reinforced consumer education and awareness programs to Section 148 and Appendix 79 of the Manual of Regulations for Banks (MORB) and Sections 147-Q/l45-s/142-P/l26-N and cybercriminal activities. The Monetary Board, in its Resolution No. 375 dated 17 March 2022, These amendments aim to strengthen

N of the MORNBFI (IT Risk Management System) on IT controls implementation for electronic products and services shall be amended, as follows: Section1. Section 148 of the MORB and Sections 147-Q/145-S/142-P/126

148/147-Q/145-S/142-P/126-N.INFORMATIONTECHNOLOGY MANAGEMENT RISK

XX

5. Electronic products and services. xxx

electronically. Otherwise, consumer confidence on the use of BsFls should adopt aggressive security posture such as the following: electronic channels as safe and reliable method of making transactions will be eroded. To mitigate the impact of cyber fraud, BsFIs should protect customers from fraudulent schemes done

(c) xxx; and (a) xxx; (b)xxx;

to showits plan.of actions with specific-timelines, as well as the status of initjatives being undertaken to fully Xxx BsFis shall-comply with the foregoing standards until 31 December.2022. In this regardBSFisshould be able comply with the provisions of this Circular,upon-request of the Bangko Senfral starting1.September 2022

be able to process surges in transactions, collectively analyze customer FMS and AML systems should be linked or integrated to have a cohesive and comprehensive financial crime prevention system in accordance with Section 803/801-Q/501-S/401-P/502-N transactions. The expected sophistication and capabilities of BsFls' fraud monitoring systems (FMs) should be commensurate to the risks associated with their digital financial and payment platforms. As fraud and cyber threats evolve, the FMs should be constantly calibrated to profiles/behavior, and detect new fraud patterns. To ensure robustness and effectiveness in early detection and prevention of fraudulent and suspicious activities, it is optimal that the FMs is able to collect, monitor, and analyze transactions from all channels. Moreover, the detection systems to identify and block suspicious or fraudulent online (d) Implement automated and real-time fraud monitoring and

XXX

on consumer awareness shall be amended, as follows: Section 2.Appendix 79 of the MORB and Appendix Q-66 of the MORNBFI

XXX

4.3.3 Consumer Awareness. Customer education is a key defense against that their clients have undertaken a pre-requisite consumer education fraud, identity theft and security breach. Therefore, BsFls should pay advice to its customers on security precautions for e-services. As an integral part of their customer onboarding process, BsFis shall ensure special attention to the provision of easy to understand and prominent

capture the customer's atten financial services (EPFs), including the associated risks. To effectively course/program on the safe and secure use of electronic payment and interest and reinforce their awareness and understanding OfPisKs ,BsFis should explore the use of interactive platforms/materials 3 but not limited to video clips. online quizzes, infographics, etc aimed at promoting continuing awarer its clients on the safe and secure use of EPFs, including the associated BsFls shall likewise adopt a program and constantly reminding

risks.

BsFls should maintain and continuously evaluate its consumer awareness program. Methods to evaluate a program's effectiveness include tracking the number of customers who report fraudulent attempts to obtain their authentication credentials, the number of clicks on information security links on websites, the number of inquiries,

that the BsFI should convey to its customers. etc.Annex"C"provides for the minimum Consumer Awareness Program

Page 2 of 3

XXX

as needed. As part of its enforcement actions, the BsP may impose business activity that has adverse effects on the safety or soundness of the BsFI, among others. Sanctions may likewise be imposed against a of the MORNBFI, the Bangko Sentral may deploy enforcement actions to promote adherence to the requirements set forth in this Circular and ensure timely implementation of preventive and/or corrective measures corrective actions and/or sanctions to improve the BsFI's risk management systems and processes or limit the level of or suspend any Section 002 of the MORB and Sections 002-Q, 002-S, 002-P and O02-N BsFI and/or its directors, officers and/or employees. Section 3. Supervisory Enforcement Actions. Consistent with

as footnote to Section 148/147-Q/145-s/142-P/126-N as follows: Section 4. The following transitory provision shall be incorporated

fully comply with the provisions of this Circular, upon request of the 2022. In this regard, BSFIs should be able to show its plan of actions with Bangko Sentral starting 1 September 2022 specific timelines, as well as the status of initiatives being undertaken to BsFIs shall comply with the foregoing standards until 31 December

(15)calendar days following its publication either in the Official Gazette Section 5. Effectivity Clause. This Circular shall take effect fifteen

or any newspaper of general circulation.

FOR THE MONETARY BOARD

C cS BENJAMIN E.DIOKNO Governor

24 March 2022

Page 3 of 3