The Bangko Sentral ng Pilipinas, the country's central bank, has set June 30, 2026, as the deadline for financial institutions to stop using SMS OTPs for high-risk banking transactions. Deputy Governor Elmore Capule has confirmed the central bank is holding the date firm: "As of now we are not extending it, so they have to catch up."
Under the Anti-Financial Account Scamming Act (AFASA), banks that fail to put adequate authentication controls in place are required to reimburse customers for funds lost to scams. Banks that comply get liability protection.
Why the BSP is moving away from SMS OTPs
SMS OTPs travel over the telecom network, which the bank has no control over. SIM swap fraud lets attackers receive OTP messages intended for the account holder. Phishing pages harvest codes in real time. Smishing tricks users into reading the code aloud over the phone. Each of these attacks works because the authentication factor has to leave the bank's systems and pass through a channel anyone can potentially intercept.
BSP Circular 1213 requires institutions to "transition away from interceptable authentication mechanisms" for financial transactions and high-risk activities. The coverage extends beyond login. Adding a new payee, updating registered contact details, initiating large transfers - any high-risk transaction or critical account change falls under the mandate.
What the BSP is actually requiring
The regulation goes beyond a mandate to adopt biometrics. The BSP has published specific guidelines on server-side biometric authentication, which it recognises as an acceptable control for covered transactions.
The difference between server-side and device-side biometrics matters here. Device-side biometrics, the fingerprint or face scan that unlocks a banking app, rely on whatever is happening on the user's phone. If the device is compromised, that check can be bypassed. Server-side biometrics validate the user's identity against templates stored in the bank's own backend, so the check happens independently of the device's state.
The guidelines also acknowledge the security tradeoff that comes with centralising biometric data. A database of biometric templates is a high-value target for attackers. Banks are required to store templates as encrypted mathematical representations rather than raw images, and to encrypt data both at rest and in transit. Liveness and deepfake detection are mandatory. Biometrics also has to be layered with other controls rather than used alone, and banks are required to monitor false acceptance rates, false rejection rates, and algorithmic bias across different user groups.
The BSP also requires banks to think about users who may struggle with biometric authentication: elderly customers with worn fingerprints, people with certain disabilities, users on lower-end devices. Solutions have to work for these cases while maintaining the security standard.
The liability provision
Before AFASA(Anti-financial account scamming act), liability for digital banking fraud was often contested. The law changes that. Banks with adequate risk management systems and strong authentication are protected from liability when scams occur despite those controls. Banks without adequate controls are required to reimburse customers directly.
The BSP also clarified that OTPs retain one permitted use: confirming the existence or ownership of a registered mobile number. OTPs remain in the toolkit, just not as a way to authorise transactions.
What compliance actually involves
Circular 1213 sets the fraud management baseline. Institutions handling complex electronic services, or with average monthly transaction volumes above PHP 75 million, are required to have real-time fraud detection covering behavioral anomalies, geolocation, blacklist screening, and device change events. This infrastructure has to be in place alongside the authentication changes, and the authentication side requires phishing-resistant mechanisms for anything classified as high-risk. Methods that can be socially engineered out of a user, including SMS codes, fall outside that definition.Biometrics alone does not satisfy the requirement either. The BSP is explicit that authentication has to be layered: biometrics combined with device binding, behavioral signals, and transaction risk scoring. Banks using third-party biometrics vendors also carry obligations under the circular. The circular requires due diligence on the vendor's security architecture, explicit data protection clauses in contracts, and independent audits on an ongoing basis.
Where Authsignal fits
Authsignal's platform handles adaptive, risk-based authentication. Financial institutions can configure authentication to scale with transaction risk, so a balance check and a large transfer to a new payee go through different flows. The platform supports passkeys, biometric-backed authenticators, in-app push confirmations, and a no-code rules engine that can be tuned to each institution's risk profile. Given that the BSP mandate is risk-tiered by design, that configurability is where the compliance work actually happens.
Get in touch with if you're figuring out what the transition looks like for your stack, we've helped banks across the region move off SMS OTPs without rebuilding their identity layer.
.svg)
