Philippines’ Anti-Financial Account Scamming Act (RA 12010)

1. Overview

Republic Act No. 12010, or the Anti-Financial Account Scamming Act, was approved on July 20, 2024. The AFASA law creates offenses addressing the misuse of financial accounts in cyber-enabled fraud. It applies to banks, non-bank financial institutions, and payment providers under the supervision of the Bangko Sentral ng Pilipinas (BSP).

2. Scope of the Law

The AFASA law in the Philippines applies to deposit, trust, investment, credit card, transaction, e-wallet, and other accounts used to access financial services. It covers money muling, social engineering, and unauthorized account access.

There is no clear definition of deepfakes in the Act. But impersonated speaking voices, faked videos, and fake identities could fall under its purview if they are intended to trick victims, acquire their identifying details, or trick them into giving up control of a financial account.

3. Key Provisions

• Money-Muling Activities

The Act bans the receipt, transfer, proceeds in, out of, or from financial accounts that have been used, lent, purchased, rented, or sold on the knowledge that the proceeds will result from a crime or social engineering scheme. It also includes fictitious accounts, identity documents being used for someone else’s account, and recruitment in money mule schemes.

• Social-Engineering Schemes

AFASA criminalizes deceptive conduct used to obtain another person’s sensitive AFASA outlaws “deceptive conduct” to obtain another person’s sensitive identifying information, which leads to the access to or control over a financial account without authorization. Covered conduct refers to impersonating a financial institution by using electronic communications to collect passwords, banking information, or e-wallet credentials.

Where the material is synthetic (audio, video, or biometric), it may be relevant where it is part of an impersonation scheme. To prove the liability, the involvement in deception and unauthorized access must be proven.

• BSFI Controls and KYC Requirements

The financial institution (BSFI) under the supervision of the Bangko Sentral must have risk-management systems commensurate with its operations. These include multi-factor authentication, fraud management systems, and account owner verification. BSP Circular 1213 bolsters transaction monitoring, device controls, and authentication requirements.

These are responsible for better KYC when handling onboarding, account recovery, and high-risk transactions in the Philippines. Institutions may be obligated to return the funds where there is a failure of control or a lack of diligence associated with the loss.

• AFASA Law Penalty and Enforcement

Money muling crimes are punishable by imprisonment of 6 to 8 years, a fine of PHP 100,000 to PHP 500,000, or both. Penalties for social-engineering offenses range from 10 to 12 years’ imprisonment and a fine of PHP 500,000 to PHP 1 million. Increased penalties if the victim senior citizen.

• AFASA Economic Sabotage

Conduct means AFASA economic sabotage and money muling, or social engineering means two or more conspirators and at least three persons as a target, mass mailer, or human trafficking. The AFASA law provides for a penalty of life imprisonment and a fine of PHP 1 million to PHP 5 million, or both, for economic sabotage.

• Important Cases or Legal Precedents

There is limited judicial interpretation of AFASA. The Supreme Court’s decision in EastWest Rural Bank referred to the law when considering financial-account disclosure and cybercrime investigation, and it is clear that the law has pertinence to inquiry and information-sharing powers.

• Comparison with Global Standards

In the case of AFASA, a supervised institution can be held liable for crime, as well as for having preventive obligations. Its framework links fraud controls, account investigation, disputed-fund preservation, and information sharing.

• Practical Implications

It is important that financial institutions improve identity verification across onboarding, logins, transactions, and account recovery.

• Future Outlook

BSP Circulars 1213, 1214, and 1215 shall serve as the implementing BSP regulations. These cover technology risk controls, financial account inquiries, information sharing, temporary holds on funds, and coordinated verification. A future enforcement will clarify AFASA’s application to deepfake-enabled and AI-assisted financial fraud.