How Does AFASA Protect Defrauded Businesses?
Introduction
Businesses that fall victim to fraudulent electronic transfers often face an immediate risk: by the time the fraud is reported, the money may already have moved through several bank accounts or financial institutions. The Anti-Financial Account Scamming Act, or AFASA, addresses this problem by allowing financial institutions to temporarily hold disputed funds while the transaction is investigated.
The mechanism is not technically a permanent freeze. It is a temporary holding of funds that may initially last for up to five calendar days and may be extended for up to twenty-five additional calendar days, subject to the conditions prescribed by law and Bangko Sentral ng Pilipinas regulations.
What Law Governs the Temporary Holding of Disputed Funds?
The principal statute is Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA). Section 7 authorizes financial institutions to temporarily hold funds subject of a disputed transaction for a period prescribed by the BSP, not exceeding thirty calendar days, unless a court of competent jurisdiction grants an extension.
Section 8 of AFASA requires the financial institutions and account owners involved to undertake a coordinated verification process. During that process, the statutory restrictions under the Bank Secrecy Law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act, and the Data Privacy Act do not apply to the extent provided by the law.
The BSP implemented these provisions through BSP Circular No. 1215, entitled “Regulations on the Temporary Holding of Funds Subject of Disputed Transactions and Coordinated Verification Process.”
When Is a Transaction Considered Disputed?
Under AFASA, a transaction may be treated as disputed when a financial institution has reasonable grounds to believe that it appears to be:
- unusual;
- without a clear economic purpose;
- from an unknown or illegal source, or connected with unlawful activity; or
- facilitated through a social engineering scheme.
The financial institution may obtain this basis from another institution, a complaint filed by an aggrieved party, or a finding generated by its own Fraud Management System. A fraud complaint is therefore an important source of information, but the institution must still assess whether reasonable grounds exist under AFASA and the applicable BSP rules.
How Does the Temporary Holding Process Work?
Initial holding period
Under BSP Circular No. 1215, an Originating Financial Institution may request an initial hold on disputed funds for a period of not more than five calendar days. The originating institution is the institution holding the source account from which the disputed transfer was made.
The Receiving Financial Institution holds the beneficiary account into which the funds were transferred. Other institutions that later receive the funds may be treated as subsequent receiving financial institutions and may also participate in the verification process.
Extension of the holding period
The initial five-day holding may be extended for not more than twenty-five calendar days, resulting in a maximum ordinary holding period of thirty calendar days.
The extension is not automatic. It may be made when the nature of the transaction, together with readily available information about the account owners—such as customer profiles, risk profiles, and behavioral patterns—provides reasonable grounds to believe that the funds are likely disputed funds and additional time is needed to complete the coordinated verification process.
AFASA separately provides that the holding period may exceed thirty calendar days if extended by a court of competent jurisdiction.
What Must a Business Do After Discovering Fraud?
A defrauded business should act immediately because the temporary holding mechanism is intended to preserve funds that remain within the financial system. The business should:
- Report the unauthorized or fraudulent transaction promptly to its bank, electronic-money issuer, payment service provider, or other relevant financial institution.
- Request that the complaint be recorded as a disputed transaction under AFASA and BSP Circular No. 1215.
- Provide transaction references, account details, dates, amounts, screenshots, invoices, communications, and other records showing the fraud.
- Identify whether the incident involved stolen credentials, impersonation, deceptive messages, unauthorized access, or another social engineering method.
- Ask for confirmation of whether the funds were successfully held and whether the coordinated verification process has begun.
- Consider reporting the matter to appropriate law-enforcement authorities and preserving all electronic evidence for possible criminal, civil, or regulatory proceedings.
The business should not assume that filing a complaint automatically guarantees recovery. The financial institution must determine whether the statutory grounds for holding the funds exist, whether the funds remain identifiable, and whether the verification process supports continued retention or restitution.
What Notice Must Be Given to the Account Owner?
BSP Circular No. 1215 requires the originating financial institution to promptly update the source account owner regarding the complaint. The notice should state whether the disputed funds were successfully held for not more than five calendar days and explain the next steps concerning any extension and possible recovery.
The institution should also inform the source account owner about available legal remedies, including the filing of a complaint with authorized law-enforcement agencies. The notice must further state that a person who maliciously or in bad faith submits completely unwarranted or false information resulting in the temporary holding of funds may incur criminal liability for malicious reporting under AFASA.
Does the Process Require a Court Order?
No, not for the initial temporary holding authorized by AFASA. A financial institution may temporarily hold disputed funds under the statutory and regulatory conditions without first obtaining a court order.
This administrative and banking mechanism differs from an AMLA freeze order. Under the Anti-Money Laundering Act, as amended, a freeze order is a distinct legal remedy subject to the requirements applicable to money laundering investigations and judicial or statutory authority. In Castañeda Limlingan et al. v. Republic of the Philippines, et al., General Register No. 222312 (2025), the Supreme Court recognized that an AMLA freeze order may cover related accounts when probable cause establishes a material connection to unlawful activity, subject to statutory limits.
The AFASA temporary holding process should therefore not be confused with a permanent asset freeze, civil forfeiture, or an AMLA freeze order. Each remedy has a different legal basis, purpose, duration, and procedure.
How Does Coordinated Verification Work?
Upon receiving a complaint, information from another institution, or a detection through its Fraud Management System, the financial institutions and account owners involved must initiate a coordinated verification process.
The process may involve coordination among the originating financial institution, receiving financial institution, subsequent receiving institutions, clearing switch operators, and relevant account owners. Its purpose is to validate the disputed transaction and determine whether the funds are connected with fraud, money muling, social engineering, unlawful activity, or another ground recognized by AFASA and the BSP rules.
Information shared during the process must still be handled securely. Although the specified bank-secrecy and data-privacy restrictions do not apply during the coordinated verification process, the information must be protected with appropriate safeguards and confined to the scope of the investigation.
When Must the Funds Be Released?
Under BSP Circular No. 1215, the appropriate financial institutions must lift the temporary holding and release the funds to the beneficiary account owner immediately upon the lapse of the initial or extended holding period, or upon confirmation that the transaction was legitimate.
Release is not required when any of the following circumstances exists:
- a court of competent jurisdiction extends the holding period;
- the beneficiary account owner executes a written waiver of any claim over the disputed funds; or
- the totality of the information obtained during verification reasonably shows that the funds are derived from or related to money muling, unlawful activities, illegal sources, transactions without an underlying economic purpose, or social engineering schemes.
These exceptions are important. The expiration of the ordinary thirty-day period does not necessarily require release if a court has lawfully extended the period or if the verification results establish a statutory basis for further legal action.
What Happens If a Financial Institution Fails to Hold the Funds?
Section 9 of AFASA provides that an institution that fails to temporarily hold disputed funds when required by AFASA and applicable BSP rules may be liable for loss or damage arising from the failure, including restitution of the disputed funds to the account owner.
Liability is not automatic in every fraud complaint. The business must still establish the relevant facts, including the existence of a disputed transaction, the institution’s legal duty to act, the institution’s failure to comply, and the resulting loss or damage.
Can the Bank Be Sued for Holding the Funds?
AFASA protects an institution and its directors, trustees, officers, and employees from administrative, criminal, or civil liability for holding disputed funds when the act is performed in accordance with BSP rules and regulations.
This protection applies to a lawful and good-faith holding under the statutory process. It does not authorize arbitrary action, bad-faith conduct, discrimination, concealment, or a holding that falls outside AFASA and the applicable BSP regulations.
How Does AFASA Interact With Bank Secrecy and Data Privacy Rules?
Section 8 of AFASA expressly provides that the Bank Secrecy Law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act, and the Data Privacy Act do not apply during the coordinated verification process of a disputed transaction.
The Supreme Court also discussed AFASA in Eastwest Rural Bank v. Philippine National Police Anti-Cybercrime Group, et al., General Register No. 273720 (2025). The Court recognized that existing law permits the disclosure of relevant financial-account information in properly authorized cybercrime investigations, including circumstances involving AFASA and valid cybercrime warrants.
This does not mean that all bank information may be freely disclosed. Disclosure must remain connected to the authorized investigation and must comply with the safeguards and limits imposed by AFASA, the Cybercrime Prevention Act, applicable BSP rules, and any court-issued warrant or order.
Illustrative Example
Suppose a company receives a message appearing to come from its supplier. The message instructs the company to transfer payment to a new bank account. After the transfer, the company learns that the supplier’s email account had been compromised.
The company promptly reports the transaction to its bank and provides the payment instruction, email headers, transaction confirmation, supplier communications, and proof that the supplier did not authorize the change in account details. If the bank finds reasonable grounds to treat the transaction as unusual or facilitated through social engineering, it may request or implement an initial hold of the disputed funds for up to five calendar days.
If further verification is required and the conditions for extension are met, the hold may continue for up to twenty-five additional calendar days. The funds may later be released, returned, or subjected to further legal process depending on the verification results and any court action.
Important Limits of the AFASA Remedy
The temporary holding mechanism protects the possibility of recovery; it does not guarantee that the money will be recovered. The funds may have been withdrawn, converted, transferred outside the banking system, or mixed with other assets before the complaint was received.
AFASA also does not replace the need for a criminal complaint, civil action, AMLA proceedings, or applications for cybercrime warrants when those remedies are appropriate. The proper legal response depends on the evidence, the identity of the recipient, the location of the funds, and the nature of the fraud.
Final Recommendations for Defrauded Businesses
Businesses should maintain written fraud-response procedures requiring immediate internal escalation, preservation of electronic evidence, and prompt communication with the relevant financial institution. Payment controls should also require independent verification of changed account details through a trusted communication channel.
When fraud occurs, the business should report without delay, request an AFASA temporary hold, provide complete supporting records, monitor the five-day initial period and any twenty-five-day extension, and obtain written updates from the financial institution.
Where the amount is substantial or the funds have moved through several accounts, the business should consider coordinated assistance from counsel, law enforcement, the BSP, and other competent authorities. The temporary holding process is most effective when activated quickly and supported by clear evidence showing why the transaction is unauthorized or fraudulent.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
