BSP to banks: Reinforce cybersecurity with ‘zero trust’ systems

MANILA, Philippines – The country’s banking regulator has ordered financial institutions to reinforce their information technology systems to better protect their institutions and clients from cyberattacks, which is growing alongside the increase in digital transactions during the ongoing pandemic.

In a press briefing, Bangko Sentral ng Pilipinas Governor Benjamin Diokno said banks should reexamine their cybersecurity strategies and assess the feasibility of shifting to a “zero trust” operational model.

Under this scheme model, access to banks’ resources will be continuously verified and authorized by implementing security protocols to include multifactor authentication or biometric technologies.

“As [financial institutions] adopt technology that is practically borderless, protecting data becomes even more crucial,” he said, adding that supervised entities “should evaluate whether implementing zero trust identity can address cyber risks in the post COVID-19 setup.”

The urgency of the regulator’s marching orders to the banking industry came after suspected Nigerian hackers were able to make off with P167 million from the United Coconut Planters Bank last June by exploiting computer vulnerabilities that allowed the perpetrators to make large automated teller machine withdrawals and online transfers over a three-day holiday.

Diokno said strengthening data protection is in line with the BSP’s efforts to boost the regulated institutions’ cyber resilience by establishing an environment conducive to digital innovation and employing robust cybersecurity measures and consumer protection mechanisms.

These were pursued side by side with policy issuances urging banks to augment their existing capabilities and implementing appropriate strategies to address the increasing demand for digital financial services.

In this regard, the BSP granted regulatory reliefs to include relaxed know-your-customer requirements to pave the way for more convenient digital onboarding of clients. The BSP took a step further by waiving applicable license fees for financial institutions that wished to offer electronic payment and financial services.

To manage cyberthreats, the BSP reinforced collaboration and active engagement with key stakeholders, including law government agencies.

While cyber surveillance intensified, policy issuances put stronger emphasis on vigorous and multilayered cybersecurity controls to ward off evolving threats.

The BSP also embarked on focused cybersecurity awareness campaigns to alert and warn financial consumers on emerging cyberthreats and scams.

In addition, the BSP directed financial institutions to ramp up their customer service and redress mechanisms to protect consumers and minimize fraud losses.

At the height of the lockdown earlier this year, regulators noted an exponential increase in the adoption of digital or electronic payments in recent years, with the number of transactions made over the Instapay platform from March until April rising to 15.6 million, which was 3.9 million or 34.5-percent higher compared to figures during pre-ECQ January to February of 11.6 million.

Meanwhile, the value of Instapay transactions in March and April reached P96.4 billion, higher by 27.4 percent or P20.8 billion versus the first two months of this year. On the other hand, PESONet transaction value during the same period was higher by P57.4 billion or 21.5 percent compared to the combined figures from January and February. [ac]