Supreme Court E-Library
Information At Your Fingertips

  View printer friendly version

The Monetary Board, in its Resolution No. 2130 dated December 8, 2000, approved the following new guidelines concerning electronic banking activities:

1.         Banks wishing to provide and/or enhance existing electronic banking services shall submit to the BSP an application describing the services to be offered/enhanced and how it fits the bank's overall strategy. This shall be accompanied by a certification signed by its President or any officer of equivalent rank and function to the effect that the bank has complied with the following minimum pre-conditions:

a       An adequate risk management process is in place to assess, control, monitor and respond to potential risks arising from the proposed electronic banking activities;

b.      A manual on corporate security policy and procedures exists that shall address all security issues affecting its electronic banking system, particularly the following:

i.          Authentication — establishes the identity of both the sender and the receiver; uses trusted third parties that verify identities in cyberspace;

ii.          Non-repudiation — ensures that transactions can not be repudiated or presents undeniable proof of participation by both the sender and the receiver in a transaction;

iii.         Authorization — establishes and enforces the access rights of entities (both persons and/or devices) to specified computing resources and application functions; also locks out unauthorized entities from physical and logical access to the secured systems;

iv.         Integrity — assures that the data has not been altered,

v.         Confidentiality — ensures that no one except the sender and the receiver of the data can actually understand the data.

c.       The system had been tested prior to its implementation and that the test results are satisfactory. As a minimum standard, appropriate systems testing and user acceptance testing should have been conducted, and

d.      A business continuity planning process and manual have been adopted which should include a section on electronic banking channels and systems.

2.         The BSP, thru the Technical Working Group on Electronic Banking, shall pre-screen the overall financial condition as well as the applicant-bank's compliance with the BSP rules and regulations based on the latest available Bank Performance Rating (BPR) and Report of Examination (ROE) including CAMELS.

The Working Group shall ensure that the applicant bank's overall financial condition can adequately support its electronic banking activities and that it shall have complied with certain comprehensive prudential requirements such as, but not limited to, the following:

a.    Minimum capital requirement and net worth to risk assets ratio;
b.    Satisfactory solvency, liquidity and profitability positions;
c.    CAMELS composite rating of at least 3 (this number, however can be flexible depending on other circumstances prevailing), and with at least a moderate risk assessment system (RAS) based on the latest regular examination;
d.    There are no uncorrected major findings/exceptions noted in the latest BSP examination.

3.         Based on the recommendation of the Technical Working Group on Electronic Banking, the Deputy Governor, SES, shall approve in principle the application so that banks may immediately launch and/or enhance their existing electronic banking services.

4.         Banks shall be informed of the conditional approval of the DG, SES and they shall in turn notify the BSP on the actual date of its launching/enhancement.

5.         Within thirty (30) calendar days from such launching/enhancement, banks shall submit to the BSP thru the Supervisory Reports and Studies Office (SRSO) for evaluation, the following documentary requirements:

a.      A discussion on the banking services to be offered/enhanced, the business objectives for such services and the corresponding procedures, both automated and manual, offered through the electronic banking channels;

b.      A description or diagram of the configuration of the bank's electronic banking system and its capabilities showing (i) how the electronic banking system is linked to other host systems or the network infrastructure in the bank; (ii) how transaction and data flow through the network; (iii) what types of telecommunications channels and remote access capabilities (e.g. direct modem dial-in, internet access, or both) exist, and (iv) what security controls/measures are installed;

c.       A list of software and hardware components indicating the purpose of the software and hardware in the electronic banking infrastructure;

d.      A description of the security policies and procedures manual containing (i) a description of the bank's security organization; (ii) definition of responsibilities for designing, implementing, and monitoring information security measures; and (iii) established procedures for evaluating policy compliance, enforcing disciplinary measures and reporting security violations;

e.      A brief description of the contingency and disaster recovery plans for electronic banking facilities and event scenario/problem management plan/program to resolve or address problems, such as complaints, errors and intrusions and the availability of back-up facilities;

f.        Copy of contract with the communications carrier; arrangements for any liability arising from breaches in the security of the system or from unauthorized/fraudulent transactions;

g.      Copy of the maintenance agreements with the software/hardware provider/s; and

h.       Latest report on the periodic review of the system, if applicable.

6.         If after the evaluation of the submitted documents, the Working Group has still some unresolved issues and grey areas, the bank may be required to make a presentation of its electronic banking transactions to BSP.

7.         Upon completion of evaluation, the appropriate recommendation shall be made to the Monetary Board. The following shall be the standard conditions for approval:

a.      Existence at all times of appropriate top-level risk management oversight;

b.      Operation of electronic banking system outsourced to a third party service provider taking into consideration the existence of adequate security controls and the observance of confidentiality [as required in Republic Act. No. 1405 (Bank Secrecy Law)] of customer information;

c.       Adoption of measures to properly educate customers on safeguarding of user ID, PIN and/or password, use of bank's products/services, actual fees/bank charges thereon and problem/error resolution procedures;

d.      Clear communication with its customers in connection with the terms and condition which would highlight how any losses from security breaches, systems failure or human error will be settled between the bank and its customers;

e.      Customer's acknowledgement in writing that they have understood the terms and conditions and the corresponding risks that entail in availing electronic banking services;

f.        The bank's oversight process shall ensure that business expansion shall not put undue strains on its systems and risk management capability;

g.      The establishment of procedures for the regular review of the bank's security arrangements to ensure that such arrangements remains appropriate having regard to the continuing developments in security technology;

h.       Strict adherence to Bangko Sentral regulations on fund transfers in cases where clients use the electronic banking services to transfer funds;

i.        The electronic banking service shall not be used for money laundering or other illegal activities that will undermine the confidence of the public; and

j.        The BSP shall be notified in writing thirty (30) days in advance of any enhancements that may be made to the online electronic banking service.

8.         The same procedure and requirements stated in the foregoing shall apply to all banks with pending applications with the BSP, except on the submission of the documents enumerated in item no. 5 i.e., banks which have already submitted all the required information/documents need not comply with this requirement.

9.         Banks with existing electronic banking services but do not qualify as a result of the pre-screening process mentioned in item 2 hereof, shall be given three (3) months within which to show proof of improved overall financial condition and/or substantial compliance with BSP's prudential requirements, otherwise, their electronic banking activities will be temporarily suspended until such time that the same have been complied with.

10.       Sanctions, in the form of monetary penalties and/or suspension of electronic banking activities or both, shall be imposed on erring banks and/or its officers for failure to: (a) seek BSP approval before launching/enhancing/implementing electronic banking services, and/or (b) submit within the prescribed deadline the required information/documents.

Monetary penalties proposed to be imposed, in accordance with Sections 36 and 37 of R.A. No. 7653 (The New Central Bank Act) are as follows:

a.         For the officer/s and/or director/s responsible for failure to seek prior BSP approval and/or for non-submission/delayed submission of required information/documents, a one time penalty of P200,000; and

b.         For the banking institution for failure to seek prior BSP approval and/or for non-submission/delayed submission of required information/documents, a penalty of P30,000 per day starting from the day the offense was committed up to the time the same was corrected.

This Circular supersedes the provisions of Circular No. 240 dated 5 May 2000 insofar as inconsistent herewith.

This Circular shall take effect immediately.

Adopted: 21 Dec. 2000

(SGD.) RAFAEL B. BUENAVENTURA
Governor