BSP adopts new bank capital rules for fraud and cyber risks

The Bangko Sentral ng Pilipinas (BSP) has approved changes to how banks calculate the capital needed to cover operational risks, including fraud, cyberattacks and system failures. Circular 1241 introduces the Basel III New Standardized Approach (NSA), with full implementation beginning in the end-December 2027 reporting period.

Universal, commercial and digital banks fall within the framework, alongside their bank and quasi-bank subsidiaries. It replaces both the Basic Indicator Approach and the existing Standardized Approach. The BSP aims to improve banks’ capacity to withstand unexpected losses and bring Philippine rules into line with international standards.

Capital charges will draw on a business indicator calculated from financial statements, including interest earnings and expenses, service income and financial transactions. The calculation generally uses three consecutive years of data. An internal loss multiplier then adjusts the amount based on operational losses recorded over the preceding 10 years.

A heavier loss history may mean higher capital requirements, while smaller losses may lower them. Banks need accurate, comprehensive loss records to qualify for an adjustment. Those falling short of BSP data standards will receive a neutral multiplier of one; significant weaknesses in internal controls may result in higher requirements.

Covered institutions must have systems to identify, record and verify losses. During a monitoring period, they must report capital adequacy ratios under both approaches, although existing methods will still determine compliance. Banks that demonstrate readiness may switch early after notifying the BSP and undergoing its verification.

The BSP will separately specify when parallel reporting starts. Stand-alone thrift, rural and cooperative banks will retain the modified Basic Indicator Approach within the Basel 1.5 framework.