The Anti-Financial Account Scamming Act’s implementing rules took effect on 25 June 2025, and BSP Circular 1213’s June 2026 deadline has passed. Two dated rules are mapped here, each with its status and public source, to the controls they call for and the DeepID modules that support them. DeepID supports compliance and never guarantees it.
Named for orientation. Which routes are live with which operator is confirmed with you before a pilot.
Phone numbers, payees and amounts are the illustrative values this site uses for the Philippines.
Each rule with its date, its status, what it asks of a bank and the controls it calls for. A proposal is listed for what it would touch, and never marks the map.
Money muling and social engineering are offences. Financial institutions can temporarily hold disputed funds while a claim is verified, and the implementing rules have applied since 25 June 2025.
Calls for: Mule detection, Cool-off and holds.
Source: Malaya Business Insight (Anti-financial scam law’s IRR to take effect June 25: BSP, opens in a new tab), 2025, press report
BSP Circular 1213 requires authentication that cannot be shared or intercepted for high-risk transactions, such as biometric, behavioural or passwordless methods, with a deadline in June 2026 that has passed.
Calls for: Beyond SMS OTP.
Source: GMA News (No more SMS, email OTPs for high-risk financial transactions, opens in a new tab), 2025, press report
Each control the rule map tracks, whether a rule in the Philippines calls for it, and the DeepID modules that support it.
| Control | In the Philippines | DeepID modules and how they support it |
|---|---|---|
| Bind the customer to the phone | Not mapped yet | SIM and device binding, Device intelligenceSIM and device binding at onboarding and re-binding on change, with the number confirmed by the network and device integrity read every session. |
| Move beyond SMS OTP | Rule mapped | Silent network verification, Liveness and face matchOne-tap login that tries the network check and the SIM check before any one-time code, and face checks with injection defence where identity is in doubt. |
| Check risk at every key event | Not mapped yet | Device intelligence, Behavioural biometrics, Scam signals, Payee and mule graph, One decision, with reasonsDevice, behaviour, scam and payee signals read at login, new payee and payment, returned as one decision with its reasons. |
| Cool off and hold | Rule mapped | SIM and device binding, One decision, with reasonsCool-off and hold decisions after a new device, SIM or payee, or when a payment looks coerced, set per market and journey. |
| Find and stop mule accounts | Rule mapped | Payee and mule graphA payee and mule graph across accounts and devices, with recipient risk scored before the payment is sent. |
| The bank pays when controls fail | Not mapped yet | One decision, with reasonsDecision logs with their reasons and the message shown to the customer, and versioned policies, as evidence of what the bank did. |
Not mapped yet means no rule is mapped to that control here, not that no rule exists. DeepID supports compliance and never guarantees it, and it claims no regulator approval.
AFASA lets financial institutions hold disputed funds, but by now the money has moved on. BSP has said financial institutions that missed the June 2026 upgrade may have to reimburse their customers’ losses.
Malaya Business Insight (Anti-financial scam law’s IRR to take effect June 25: BSP, opens in a new tab), 2025, press report; Manila Bulletin (Banks now forced to reimburse victims of online account fraud, opens in a new tab), Jul 2026, press report
The attacks whose pages name a rule or advisory in the Philippines, each told step by step.
By industry: Banks, Digital banks, Lenders, Payments, Insurance, Capital markets.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.