The Bangko Sentral ng Pilipinas (BSP) has rolled out new regulations requiring eligible financial institutions to phase out one-time passcodes (OTPs) delivered via SMS and email for high-risk financial transactions by June 25, 2026, and replace them with phish-resistant enhanced identity verification methods. The move is designed to curb online financial fraud and strengthen digital banking security protections.
This requirement is set out in Circular No. 1213, which implements relevant provisions of the "Anti-Financial Account Scamming Act". It applies to regulated financial institutions with average monthly online transaction volumes exceeding 75 million pesos, covering the vast majority of commercial banks, all digital banks, and some rural and cooperative banks. Low-risk transactions may still use SMS OTP verification.
Alternative verification methods permitted under the new rules include biometrics, behavioral characteristic verification, adaptive security mechanisms, passwordless authentication and other technologies. Biometrics cover fingerprint, facial and voiceprint recognition; behavioral authentication collects data on users' typing habits and device operation trajectories; adaptive authentication dynamically adjusts verification intensity based on login location, device, and users' historical behavior, and also supports passwordless solutions such as in-app push notifications and security keys.
In addition to replacing verification methods, financial institutions must also upgrade their anti-fraud systems to identify suspicious activities such as abnormal fund transfers, logins from unfamiliar devices, and new payee additions, and promptly block unauthorized transactions. The BSP stated that the policy balances financial innovation and consumer fund security, and many institutions have already completed system upgrades ahead of schedule.
