AFASA Compliance Checklist for Banks and E-Wallets
AFASA, short for Anti-Financial Account Scamming Act, is Republic Act 12010. It requires Philippine banks, e-wallets, and other BSP-supervised institutions to protect accounts from scams, money muling, and social engineering. In practice, compliance means verifying customers strongly at onboarding, running real-time fraud monitoring that can block suspicious transfers, limiting weak authentication, and handling disputed funds within the rules. So institutions that fall short can lose the law’s protection and may have to compensate victims.
What AFASA (RA 12010) Requires of Institutions
AFASA was signed on 20 July 2024. In effect, it changed fraud from a customer problem into a shared duty. Before the law, after all, scam victims often had little recourse. Now, institutions must show that they took adequate steps to protect accounts.
For compliance teams, then, the law does three things that matter most.
- It defines new offenses. First, money muling, social engineering schemes, and economic sabotage involving financial accounts are now crimes. Economic sabotage, for instance when three or more people act together or the scheme targets three or more victims, carries life imprisonment, a fine of P1 million to P5 million, or both.
- It gives institutions new powers. Specifically, they may temporarily hold funds subject to a dispute while they verify, for a maximum of 30 days, longer only with a court order.
- It ties liability to controls. Finally, institutions that comply with the required safeguards are protected. Otherwise, they may have to restore losses to affected customers.
BSP has issued implementing rules. In particular, Circular 1213 (2025) amended IT risk management rules to cover fraud management systems and account protection, while Circular 1215 (2025) set guidelines on holding disputed funds and coordinated verification. Since secondary summaries differ on details, compliance teams should work from the BSP’s official texts.
The AFASA Compliance Checklist
Use this checklist to gap-check your current controls. Note that each line reflects a duty under AFASA or BSP’s implementing rules, as commonly described in legal and industry summaries.
| Area | Control | Evidence to keep |
|---|---|---|
| Onboarding | Verify identity against official records and a live selfie | Verification results per account, with timestamps |
| Onboarding | Detect duplicate faces and devices across accounts | Duplicate search logs and decisions |
| Fraud monitoring | Real-time monitoring that can flag and block suspicious transfers | Rules, alerts, and actions taken |
| Fraud monitoring | Watch for device, phone number, and account detail changes | Change logs and step-up results |
| Authentication | Limit methods that third parties can share or intercept | Authentication policy and rollout plan |
| Authentication | Step-up checks, such as a selfie, for high-risk actions | Step-up triggers and outcomes |
| Disputes | Procedure to temporarily hold disputed funds within the legal limit | Hold records, verification steps, release decisions |
| Coordination | Process to share information with other institutions and authorities | Requests sent and received |
| Customer education | Regular scam awareness messages | Campaign records |
| Governance | Board-approved fraud management policy and periodic review | Policy, minutes, test results |
Larger institutions face extra expectations. For example, industry summaries of Circular 1213 describe added fraud system features for institutions with complex electronic payment services, such as velocity checks, geolocation monitoring, blacklist screening, and detection of unusual behavior.
Stopping Money Mule Accounts at Onboarding
Every scam, of course, needs a place to send the money. So mule accounts are the plumbing of financial fraud, and AFASA now treats running them as a crime. Yet the cheapest point to stop a mule is before the account exists.
| Mule pattern | Onboarding control |
|---|---|
| Accounts opened with stolen or bought IDs | Record lookup plus face comparison with the ID portrait |
| Recruited mules opening many accounts | 1:N face search across existing customers |
| Photos or deepfakes used at sign-up | Liveness detection with injection attack checks |
| Account farms on emulators | Device risk signals and device reuse checks |
| Sold or rented accounts after opening | Selfie step-up on new devices and large outflows |
Verihubs ID Verification checks applicant data with four government sources (PhilSys, LTO, SSS, NBI), so a bought ID with mismatched details fails early. Meanwhile, Verihubs face recognition and liveness confirms a live owner and can search for faces already linked to other accounts. For the typologies behind these controls, also read our guide to money mule schemes.
Fraud Management Systems and Transaction Holds
Onboarding controls reduce mule supply. Still, some fraud gets through, so the second line is monitoring. Specifically, under BSP’s implementing rules, as summarized by industry sources, institutions need automated, real-time systems that can identify and block disputed, suspicious, or fraudulent online transactions. Our guide to choosing fraud detection software compares those tools.
- Velocity rules. First, flag many transfers in a short time, especially to new recipients.
- Behavior change. Next, watch for a dormant account that suddenly receives and forwards funds.
- Device and location shifts. For example, a login from a new phone in another region minutes before a large transfer.
- Network signals. Finally, look for several accounts sending money to the same mule cluster.
When a transfer is disputed, AFASA lets institutions hold the funds temporarily while they verify. That power has limits, though. Holds cannot exceed 30 calendar days without a court order, the institution must promptly notify the BSP of each hold, and Circular 1215 sets out the coordination process. Therefore, document each hold, the reason for it, and the verification steps, because the record is your defense if a customer challenges it. BSP has also added a reporting duty: under Memorandum M-2026-029 (June 2026), institutions file periodic reports on temporarily held funds through the BSP reporting platform and submit an annual notarized certification of compliance. For rule design in more depth, see our article on transaction monitoring.
Customer Authentication and Social Engineering Controls
Most account takeovers in the Philippines start with a conversation, not a hack. Typically, a scammer poses as bank staff, a courier, or a government office and persuades the customer to share a code or approve a login. So authentication must hold up even when the customer is being manipulated.
- Reduce shareable factors. For one, BSP’s rules, as reported, require institutions to limit methods that can be shared with or intercepted by third parties.
- Bind accounts to devices. Then registering a new phone becomes a high-risk event that needs extra proof.
- Use a face check for step-up. Unlike a code, the customer’s own live face cannot be read out to a caller pretending to be the bank.
- Add cooling-off periods. For instance, delay large transfers to new recipients right after a device change.
- Warn in context. Also show scam warnings at the moment a customer adds a new payee or raises a limit.
Face-based step-up matters most here, because it shifts proof from “something you know” to “someone you are.” Our explainer on account takeover shows how these attacks unfold.
Where to Start: A 90-Day Plan
Few institutions can fix every gap at once. So order the work by how much fraud each control stops and how hard it is to prove.
- Weeks 1 to 4: map and measure. First, compare current controls with the checklist and pull fraud data by channel, so the biggest gaps are visible.
- Weeks 5 to 8: close onboarding gaps. Then add record validation, liveness, and duplicate face search for new accounts, since mule supply starts there.
- Weeks 9 to 12: tighten step-up and holds. Next, add face-based step-up for device changes and large transfers, and test the disputed-funds procedure end to end.
After the first quarter, review the results with the board and set the next round. Meanwhile, keep every policy, test, and decision in one evidence folder, because examiners will ask for it.
Penalties and Liability
AFASA’s criminal penalties fall mainly on the people who commit the offenses: mules, recruiters, and scammers. Of these, the heaviest, for economic sabotage, reach life imprisonment, a fine of P1 million to P5 million, or both.
For institutions, however, the bigger exposure is liability. If an institution cannot show it met the required safeguards, it may have to restore what customers lost. On top of that, BSP can impose administrative sanctions for weak controls under its supervisory powers. So the practical question is not only “are we compliant?” but “can we prove it, transaction by transaction?”
Frequently Asked Questions
What is AFASA in the Philippines?
AFASA refers to Republic Act No. 12010, the scam-focused law signed in July 2024. Among other things, it criminalizes money muling and social engineering schemes and sets duties for financial institutions to protect accounts.
Who must comply with AFASA?
The law covers banks, e-money issuers, and other institutions supervised by the BSP, among others. Still, each institution should confirm its coverage with the law and BSP’s implementing circulars.
How long can a bank hold disputed funds under AFASA?
Institutions may temporarily hold disputed funds for up to 30 days while they verify the transaction, unless a court extends the hold.
Is running a mule account a crime under AFASA?
Yes. Money muling, including opening or lending accounts to receive scam proceeds, is an offense under AFASA. When a syndicate commits it, or it hits many victims, it can count as economic sabotage.
How does eKYC help with AFASA compliance?
Strong onboarding checks, including record validation, liveness, face comparison, and duplicate face search, stop many mule accounts before they open. They also give institutions evidence that they applied adequate safeguards.
Prove Protection, Account by Account
In short, AFASA rewards institutions that can show their work. So check every new customer against agency records and a live selfie, monitor transfers in real time, replace shareable authentication with face-based step-up, and keep a clean record of every hold and decision. Those controls stop mules and scams, and they are also the evidence that keeps liability with the fraudsters rather than the institution.
Running an AFASA gap review this quarter? Map your onboarding controls with Verihubs and close the identity gaps first.
