By Eileen Mencias
The Bangko Sentral ng Pilipinas (BSP) is requiring covered banks and other financial institutions to disclose unresolved cybersecurity vulnerabilities, security spending and cyber incidents as it steps up scrutiny of the financial sector’s defenses against digital threats.
Under Memorandum M-2026-047 signed on Oct. 1, institutions must submit a cybersecurity self-assessment supported by security testing reports, outstanding audit findings and timelines for addressing identified vulnerabilities.
The requirement covers BSP-supervised financial institutions with Moderate or Complex IT Profiles, as well as others designated by the central bank.
The 84-question assessment examines areas including board oversight, staffing, risk management, security controls, incident response, recovery arrangements and threat information sharing.
Institutions must report their IT and cybersecurity budgets and actual spending, unresolved vulnerabilities and challenges in retaining cybersecurity personnel.
They must also provide data on cyber incidents from the previous year, including their classification and severity, the number of incidents and the total amounts involved, where available.
The exercise forms part of the BSP’s Cybersecurity Maturity Framework, which is designed to assess and strengthen the financial sector’s resilience as banking and payment services become increasingly digital.
Customer-facing safeguards are also under scrutiny. Institutions will be asked whether they have protections such as biometric authentication, transaction alerts, money lock features, customizable transaction limits and facilities for stopping transactions.
The memorandum, however, does not require every institution to adopt all of the controls listed in the questionnaire.
“Further, the non-implementation of a specific control or the selection of a negative control statement in the CCSA does not automatically result in a lower maturity score, as controls will be assessed holistically,” the BSP said.
Institutions must submit their initial assessments through the BSP’s ASTERisC platform within 60 calendar days from the memorandum’s issuance. Subsequent submissions will be due annually by March 31 following the reference year.
The BSP will validate the submissions and provide the results to the respective institutions to help identify gaps and guide improvements in their cybersecurity defenses.
