Law / Philippines

Manual of Regulations for Banks, Cyber Incident and Service Disruption Notification to the Bangko Sentral

Manual of Regulations for Banks, Section 148 (Information Technology Risk Management), reporting and notification standards

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived March 8, 2025. Publisher's page: https://morb.bsp.gov.ph/148-information-technology-risk-management/

In force.

A vulnerability and incident reporting rule binding private bodies.

Instrument type

a regulation made under an act

Obligation class

Reporting

As of 27 October 2026.

What it requires

• This binds a Bangko Sentral-supervised financial institution (BSFI), which the guidelines define to include banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision or regulation, and also a BSFI with offshore data processing as may be appropriate to its situation (reached by declaring that you provide financial services).
• Notify the appropriate supervising department of the Bangko Sentral, through your Compliance Officer or a designated officer, within two hours from discovery of a reportable major cyber-related incident or of a disruption of financial services and operations (Section 148, reporting and notification standards, item b(1)).
• Treat as a reportable major cyber-related incident any event that may seriously jeopardize the confidentiality, integrity or availability of critical information, data or systems of the institution, its customers and other stakeholders and that meets the criteria in item a(2)(a), such as unauthorized access into your internal network, a system-level compromise, significant data loss or a massive data breach, or an unavailability of critical systems.
• Treat as a reportable disruption any disruption of critical operations that lasts for more than two hours, whether it comes from internal or external threats and whether natural, man-made or technical in origin (item a(2)(b)).
• Disclose in the first notice at least the nature of the incident and the specific system or business function involved (item b(2)).
• Send a follow-up report by e-mail to the same department within twenty-four hours from the time of discovery, covering the nature of the incident, how and when you first detected it, its initial impact, your initial response, and whether the business continuity or crisis management plan was activated (item b(3)).
• Provide the additional information or updates the Bangko Sentral requests until the matter is satisfactorily resolved, and expect a special examination or inspection to verify the root cause (item c).

These lines are LexLint's reading of the law's text, as of 27 October 2026.

Who enforces it

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app