Retrieval index, loaded through Mesh API

Regulatory library

12 rules and frameworks, 38 passages, indexed for retrieval so no bank builds a knowledge base from scratch. Answers cite a passage like any piece of evidence, and each passage links to the controls it drives.

Ask the library

BSP · issued Apr 27, 2026

Circular 1232 · Supervisory Assessment and Cybersecurity Maturity Frameworks

Open the source

1It replaces the IT Rating System with the Supervisory Assessment Framework (SAFr).
2It adds a Cybersecurity Maturity Framework with four tiers: Foundational, Established, Managed and Optimized.
3Target tiers follow the IT profile: simple institutions aim for Foundational to Established, moderate for Established to Managed, complex for Managed to Optimized.
4Moderate and complex institutions file a Cybersecurity Control Self-Assessment (CCSA) through ASTERisC by March 31 each year.
5The first CCSA is due 60 days after BSP releases its reporting guidelines, which are still to come.

BSP · issued Nov 2, 2017

Circular 982 · Enhanced Guidelines on Information Security Management

Open the source

Drives 13 controlsGV-01 ID-01 ID-03 ID-04 ID-05 PR-04 PR-06 PR-07BSP+5

1Each institution is classified by IT profile as complex, moderate or simple.
2The Board approves the information security strategic plan and program and reviews them at least once a year.
3A CISO is appointed, independent of IT, with a reporting line to the Board.
4Institutions offering digital or electronic financial services run an external vulnerability assessment and penetration test at least once a year.
5Complex institutions keep a 24x7 security operations centre.
6Institutions take part in threat intelligence and information sharing.

BSP · issued Oct 18, 2018

Circular 1019 · Technology and Cyber-Risk Reporting and Notification

Open the source

Drives 1 controlsRS-01

1A major cyber incident, or a disruption of critical operations lasting more than 2 hours, is notified to BSP within 2 hours of discovery.
2A follow-up within 24 hours covers the nature, detection, impact and response, and whether the continuity plan was activated.
3BSP may run a special examination to verify the root cause.

BSP · issued May 30, 2025

Circular 1213 · AFASA implementing rules

Open the source

Drives 2 controlsPR-03 DE-05

1The rules took effect on Jun 25, 2025, with a one-year window that closed on Jun 25, 2026.
2Institutions with complex e-products, or at least ₱75 million in average monthly online transactions, need a robust fraud management system.
3Required fraud rules cover velocity, device and account changes, geolocation, blacklists and behavioural anomalies.
4SMS and email one-time PINs are limited in favour of biometric, passwordless (FIDO) or adaptive authentication.
5Key account changes trigger a 24-hour hold, customers get a kill switch and money lock, and messages carry no clickable links.
6Transaction logs capture 11 minimum fields, are protected against tampering and are kept at least 5 years.

BSP · issued Mar 17, 2022

Circular 1140 · Fraud management and consumer awareness

Open the source

Drives 2 controlsPR-10 DE-05

1Institutions run a fraud management system that monitors in real time, covers all channels and links to AML systems.
2Institutions run consumer awareness programs on fraud and scams.

BSP · issued Jun 24, 2026

Memorandum M-2026-031 · AI governance principles

Open the source

Drives 2 controlsGV-02 PR-09

1Five STARS principles: sustainability, transparency, accountability, responsibility and security.
2The principles are voluntary but framed as BSP's minimum supervisory expectations.
3BSP expects a central AI inventory, auditability, human accountability, and defences against adversarial attacks and data poisoning.
4Vendors are in scope under a shared-responsibility model.

BSP · issued Jul 6, 2026

Memorandum M-2026-034 · Cyber risk from frontier AI systems

Open the source

Drives 4 controlsID-02 PR-01 PR-02 DE-03

1BSP recommends hardware-based MFA such as FIDO2 or smart cards for admin and privileged access, ending passwords, SMS and push approval there.
2It recommends attack-surface inventories, micro-segmentation, zero trust and faster patching.
3It recommends AI-enabled defences for patching, threat hunting, exposure management and security orchestration.

BSP · issued Feb 10, 2022

Circular 1137 · Outsourcing and cloud arrangements

Open the source

Drives 1 controlsGV-03

1Institutions classify each outsourcing arrangement as material or non-material.
2Offshore arrangements must address the risk of access to data.

PCI Security Standards Council · issued Jun 2024

PCI DSS v4.0.1

Open the source

Drives 18 controlsGV-01 GV-03 ID-01 ID-02 ID-03 ID-05 PR-01 PR-02PCI DSS+10

1v4.0.1 is the only active version of the standard.
2Its 51 future-dated requirements became mandatory on March 31, 2025.

NIST · issued Feb 26, 2024

NIST Cybersecurity Framework 2.0

Open the source

Drives 27 controlsGV-01 GV-02 GV-03 ID-01 ID-02 ID-04 ID-05 PR-01NIST CSF+19

1Outcomes sit under six functions: Govern, Identify, Protect, Detect, Respond and Recover.
2The framework is voluntary, with no attestation, and NIST publishes free mappings to ISO 27001, PCI DSS and CIS Controls.

ISO/IEC · issued Oct 25, 2022

ISO/IEC 27001:2022

Open the source

Drives 26 controlsGV-01 GV-02 GV-03 ID-01 ID-02 ID-03 ID-04 PR-01ISO 27001+18

1The transition from the 2013 edition ended on October 31, 2025, and 2013 certificates are no longer valid.

SWIFT · issued Jul 2025

SWIFT Customer Security Controls Framework v2026

Open the source

Drives 7 controlsID-02 PR-01 PR-02 PR-06 PR-11 DE-01 RS-01

1The framework has 32 controls: 26 mandatory and 6 advisory, and control 2.4A on back-office data flow is now mandatory.
2Attestation runs from July 1 to December 31, 2026, with an independent assessment of all mandatory controls.

Regulatory library

Search

Regulatory library