BSP to Enhance Oversight of Financial Institutions

The Bangko Sentral ng Pilipinas (BSP) is preparing to roll out a new risk-based supervisory model that will tighten oversight of banks and non-bank electronic money issuers based on their potential to harm consumers and their ability to address financial consumer protection risks. In a draft memorandum to all BSP-supervised institutions, the central bank said the Financial Consumer Protection Risk-and-Impact Supervisory Model (FCPRISM) would guide all financial consumer protection supervisory assessments starting Jan. 1, 2027. The proposed framework is being issued under Republic Act 11765 or the Financial Products and Services Consumer Protection Act, which gives financial regulators stronger authority to protect consumers of financial products and services. Under the draft, the model will link a BSP-supervised institution’s potential consumer impact and financial consumer protection risk profile to the level of supervisory engagement it will receive. This means institutions with a larger consumer reach, more complex retail activities or weaker consumer protection systems may face closer monitoring, more frequent engagement with regulators or on-site reviews. The BSP said the model is designed to ensure that “supervisory attention remains proportionately focused on institutions with greater potential to cause consumer harm” while allowing “prompt and calibrated supervisory actions” to reinforce compliance with consumer protection standards. While the principles of FCPRISM will eventually apply to all BSP-supervised institutions regardless of size and risk profile, the BSP said the framework would initially cover banks and non-bank electronic money issuers. The framework has three major components: consumer impact, consumer protection risk profile and level of supervisory engagement. For consumer impact, the BSP will assess an institution’s potential to cause harm to consumers, affect public confidence or disrupt the functioning of financial services in case of misconduct, operational failures or weak controls. The rating will be classified as low, moderate, above average or high. The BSP defines consumer harm broadly to include financial loss, unfair or discriminatory treatment, unjustifiable exclusion, poor value for money, hidden or unexpected costs, misuse or loss of consumer data or assets and delayed access to support or redress. The second component — the consumer protection risk profile — will measure whether institutions can uphold consumer rights and sustain fair outcomes over time. This will cover retail consumer activities, including the design, pricing, offering, distribution, servicing and support of financial products across physical and digital channels, as well as third-party arrangements. The quality of consumer protection risk management will be rated as strong, acceptable, inadequate or weak. The BSP will then combine the net consumer protection risk profile with an assessment of institutional governance, compliance and internal audit arrangements to determine an institution’s overall consumer protection stance. The overall stance will fall under four categories: consumer-centric, consumer-attentive, consumer-risk exposed or consumer-harm evident. A consumer-centric institution has well-established consumer protection arrangements, with consumer considerations embedded in business practices and complaints generally limited in severity and recurrence. A consumer-harm evident institution, on the other hand, has deficient arrangements, severe supervisory concerns and complaints that show harm is already occurring or likely to persist. The final component will determine the level of BSP engagement. Depending on an institution’s rating, the central bank may require additional reports, data extracts, survey responses and supporting materials. It may also conduct meetings with the board, senior management, compliance officers, internal audit teams or home regulators of foreign bank branches. The BSP may also conduct regular examinations, thematic reviews, special examinations, periodic risk assessments and complaints-based surveillance.