How Can BSP Investigate Scammed Bank Accounts?
Introduction
Bank deposits in the Philippines are generally confidential. However, the law now recognizes a specific exception for financial accounts suspected of involvement in digital scams, money muling, and related financial cybercrimes.
The Anti-Financial Account Scamming Act (AFASA) authorizes the Bangko Sentral ng Pilipinas (BSP) to investigate and inquire into financial accounts that may have been used in prohibited acts. This authority operates alongside existing rules on bank secrecy, anti-money laundering, cybercrime investigations, and data privacy.
What Is the General Rule on Bank Secrecy?
Section 2 of R.A. No. 1405, or the Bank Secrecy Law, declares bank deposits confidential. As a general rule, deposits may not be examined or disclosed without the depositor’s written permission or a legally recognized exception.
The traditional exceptions include cases involving impeachment, bribery or dereliction of duty by public officials upon court order, instances where the money deposited is the subject matter of litigation, and other exceptions created by later statutes.
The Supreme Court has repeatedly held that confidentiality remains the general rule and that exceptions must not be applied in a manner permitting unrestricted or arbitrary examination of bank accounts. This principle was reiterated in Republic of the Philippines v. Eugenio, Jr., et al., G.R. No. 174629, 2008, and Subido Pagente Certeza Mendoza and Binay Law Offices v. Court of Appeals, et al., G.R. No. 216914, 2016.
What Changed Under the Anti-Financial Account Scamming Act?
R.A. No. 12010, or the Anti-Financial Account Scamming Act, created a statutory exception directed specifically at financial account scamming.
Section 12 authorizes the BSP to investigate and inquire into financial accounts that may be involved in the commission of prohibited acts or offenses under the Act. For accounts covered by the BSP investigation, the following laws do not apply:
- R.A. No. 1405, as amended, or the Bank Secrecy Law;
- R.A. No. 6426, as amended, or the Foreign Currency Deposit Act;
- R.A. No. 8367, or the Revised Non-Stock Savings and Loan Association Act; and
- R.A. No. 10173, or the Data Privacy Act.
The information obtained may be used to enforce AFASA and implement relevant provisions of the Financial Products and Services Consumer Protection Act, R.A. No. 11765.
The authority must be exercised by a duly authorized BSP officer or body. In addition, no court below the Court of Appeals may enjoin the BSP from exercising its authority to investigate or inquire into a financial account under AFASA.
What Acts May Lead to a BSP Investigation?
AFASA addresses several forms of financial account abuse. One significant offense is a social engineering scheme, which generally involves obtaining sensitive identifying information through deception or fraud in order to gain unauthorized access to a financial account.
The law also criminalizes money muling and other schemes involving the use, transfer, or receipt of funds connected with fraudulent or unauthorized transactions. The precise offense and the circumstances of the account’s involvement must still be established under the applicable provisions of AFASA.
In Eastwest Rural Bank v. Philippine National Police Anti-Cybercrime Group, et al., G.R. No. 273720, 2025, the Supreme Court recognized AFASA as a law intended to combat financial cybercrimes, protect financial consumers, and preserve the integrity of the financial system.
How Does the BSP’s Authority Relate to Bank Secrecy?
The AFASA exception does not mean that all bank accounts may be examined freely. The account must be one that may be involved in the commission of a prohibited act or offense under AFASA, and the inquiry must be undertaken by a duly authorized BSP officer or body.
Thus, the statutory conditions remain material:
- There must be a possible connection between the financial account and an AFASA prohibited act or offense.
- The investigation must be conducted pursuant to the authority granted by AFASA.
- The BSP officer or body exercising the power must be duly authorized.
- The information obtained must be used for AFASA enforcement or the implementation of relevant financial consumer protection provisions.
The exception is therefore connected to the subject and purpose of the investigation. It is not a general repeal of bank secrecy for every regulatory inquiry.
What Rules Govern BSP Inquiries?
BSP Circular No. 1214 (2025) establishes the Rules of Procedure on the Conduct of Inquiry into Financial Accounts and Sharing of Financial Account Information by the BSP pursuant to AFASA.
The Circular confirms that the BSP may investigate and inquire into financial accounts that may be involved or used in the commission of a prohibited act. It likewise states that the Bank Secrecy Law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act, and the Data Privacy Act do not apply to financial accounts subject to the BSP’s investigation and inquiry.
The Circular also provides that doubts in interpreting the rules are to be construed in favor of the effective implementation of AFASA. The Rules of Court generally do not apply, except suppletorily or by analogy when the authorized BSP body determines that such application is appropriate.
Can the BSP Share Information With Law Enforcement Agencies?
Yes. AFASA permits the BSP to use information gathered from an investigation for enforcement of the Act and related financial consumer protection provisions. AFASA also authorizes the BSP or its authorized officers to apply for cybercrime warrants and issue related orders under the Cybercrime Prevention Act.
The BSP’s authority exists without prejudice to the existing investigative powers of the National Bureau of Investigation and the Philippine National Police. The BSP may seek assistance from those agencies in investigating violations and enforcing cybercrime warrants.
In Eastwest Rural Bank v. Philippine National Police Anti-Cybercrime Group, et al., the Supreme Court explained that current legislation, including the Cybercrime Prevention Act, the Data Privacy Act, and AFASA, permits the disclosure of information relating to bank deposits in appropriate cybercrime investigations, subject to the safeguards applicable to the particular legal process.
How Does This Differ From an AMLC Bank Inquiry?
An AMLC inquiry is governed principally by the Anti-Money Laundering Act, as amended. Under Section 11 of the AMLA, the Anti-Money Laundering Council may inquire into particular deposits or investments upon an order of a competent court when probable cause exists that the accounts are related to an unlawful activity or money laundering offense, subject to statutory exceptions.
In Republic of the Philippines v. Bolante, et al., G.R. No. 186717, 2017, the Supreme Court emphasized that the court must independently determine probable cause based on substantial evidence linking the accounts to unlawful activity. Unsupported allegations or uncorroborated reports are insufficient.
AFASA provides a distinct BSP-centered authority for financial accounts possibly involved in AFASA offenses. The applicability of a particular investigative procedure will depend on the nature of the suspected offense, the agency conducting the inquiry, and the legal order or warrant being sought.
What Is the Role of the Cybercrime Prevention Act?
The Cybercrime Prevention Act, or R.A. No. 10175, may authorize disclosure of subscriber or account-identifying information through a valid court-issued warrant to disclose computer data in a cybercrime investigation.
The Supreme Court in Eastwest Rural Bank v. Philippine National Police Anti-Cybercrime Group, et al. distinguished between basic identifying information and the confidential financial details of deposits. A valid warrant may permit disclosure of identifying information when statutory requirements are satisfied, while the disclosure of financial details must still be supported by the applicable legal authority.
Accordingly, banks and financial institutions should identify the precise information requested, the issuing authority, the statutory basis, and the scope and duration of the order before making disclosure.
Does the Data Privacy Act Prevent a BSP Inquiry?
Not when the financial account is subject to a valid BSP investigation under AFASA. Section 12 of AFASA expressly provides that the Data Privacy Act does not apply to financial accounts covered by the BSP’s investigation or inquiry.
This does not eliminate the need for responsible handling of information. Financial institutions and government agencies should still restrict access, preserve records securely, and disclose information only for the purposes authorized by the applicable law or order.
What Protection Does a Complying Financial Institution Receive?
Section 12 of AFASA provides that an institution, or its directors, officers, and employees, shall be held free and harmless from accountability or liability for an act done in compliance with a BSP order for an inquiry or investigation of a financial account.
This protection applies to acts performed in compliance with the BSP order. It does not authorize disclosures outside the order’s scope or protect conduct that is unrelated to, or inconsistent with, the lawful directive.
How Does This Authority Differ From Temporary Holding of Disputed Funds?
BSP Circular No. 1215 (2025) separately governs the temporary holding of funds involved in disputed electronic fund transfers and the coordinated verification process among financial institutions.
During the coordinated verification process, the laws on bank secrecy, foreign currency deposits, non-stock savings and loan associations, and data privacy do not apply to the extent provided by the Circular. Information must nevertheless be handled securely and disclosure must remain confined to the coordinated verification process.
The temporary holding mechanism is distinct from a formal BSP investigation under AFASA. It addresses disputed electronic fund transfers and provides a time-bound institutional process, while Section 12 of AFASA concerns the BSP’s investigative and inquiry authority over financial accounts possibly involved in prohibited acts or offenses.
What Happens to Disputed Funds After Verification?
Under BSP Circular No. 1215 (2025), disputed funds should generally be released when the applicable initial or extended holding period expires or when the legitimacy of the transaction is confirmed.
Release may not occur when a competent court extends the holding period, when the beneficiary account owner waives a claim over the funds, or when the information gathered reasonably indicates that the funds are connected with money muling, unlawful activities, illegal sources, transactions without an underlying economic purpose, or social engineering schemes.
What Should Banks and Account Holders Do?
Financial institutions receiving a BSP inquiry should verify the authenticity and scope of the order, identify the authorized issuing officer or body, preserve relevant records, and designate personnel responsible for controlled compliance.
Account holders whose accounts are investigated should preserve transaction records, communications, device information, identification documents, and evidence showing the legitimate source and purpose of funds. They should also determine whether the matter involves a BSP inquiry, an AMLC court application, a cybercrime warrant, or a temporary holding under BSP Circular No. 1215.
A financial institution should not assume that every request from a law enforcement agency overrides bank secrecy. The institution should require the legal authority applicable to the requested information and should disclose only what the law or order permits.
Examples of Possible Applications
Example 1: Account used as a money mule. If an account receives funds from multiple victims and rapidly transfers them to other accounts, the account may fall within an AFASA investigation if the facts indicate money muling or another prohibited act. The BSP may inquire into the account under Section 12 of AFASA, subject to the statutory conditions and authorized procedures.
Example 2: Victim’s account accessed through deception. If a victim was induced to reveal authentication information through a fake bank message, the resulting unauthorized transactions may involve a social engineering scheme. The BSP and appropriate cybercrime authorities may use the statutory mechanisms available for investigating the incident.
Example 3: Ordinary commercial dispute. A private disagreement over payment does not, by itself, establish an AFASA offense. The parties may need to pursue the appropriate civil, criminal, or regulatory remedy, and bank records remain protected unless a recognized exception applies.
Conclusion
The BSP may legally examine private financial accounts suspected of involvement in digital scamming when the requirements of AFASA are met. The authority is expressly recognized by R.A. No. 12010 and implemented through BSP Circular No. 1214 (2025), which removes the application of bank secrecy, foreign currency deposit confidentiality, non-stock savings and loan association secrecy, and data privacy restrictions to accounts subject to a qualifying BSP investigation.
The power is not unlimited. The account must be connected, at least potentially, to an AFASA prohibited act or offense; the investigation must be conducted by a duly authorized BSP officer or body; and information must be used within the purposes authorized by law.
Banks should carefully validate every request, document compliance, and limit disclosures to the order’s scope. Account holders should promptly preserve evidence and obtain advice on the specific investigative process involved, particularly where funds have been held, accounts have been restricted, or personal and financial information has been disclosed.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
