BSP’s cybersecurity push seeks to safeguard banking in AI era

Artificial intelligence is redefining the global financial landscape. It is making banking faster, smarter, and more accessible, enabling institutions to detect fraud in real time, automate routine processes, and deliver more responsive services. But AI is also reshaping the cyber threat environment, equipping malicious actors with increasingly sophisticated tools to exploit vulnerabilities at unprecedented speed and scale. This makes preparedness crucial and indispensable.

That is why the Bangko Sentral ng Pilipinas (BSP) deserves recognition for issuing Memorandum M-2026-034 through its Financial Supervision Sector, calling on BSP-supervised institutions (BSIs) to strengthen their cybersecurity and technology risk management frameworks against emerging AI-enabled threats. Rather than responding after a crisis unfolds, the BSP has chosen the more prudent course: encouraging financial institutions to anticipate risks before they escalate into systemic threats.

The BSP’s warning is grounded in a growing global concern. As the memorandum notes, frontier AI systems are becoming capable of identifying software vulnerabilities, generating exploit pathways, and executing multi-stage cyberattacks with minimal human intervention. Although access to these advanced systems remains limited today, the central bank rightly cautions that such capabilities may eventually be leveraged by malicious actors to target financial institutions, third-party service providers, and critical infrastructure. Similar concerns have also been raised by international cybersecurity authorities and technology experts, underscoring that this is neither a distant possibility nor a uniquely Philippine challenge.

The recommendations outlined by the BSP are comprehensive and practical. Maintaining accurate inventories of digital assets, strengthening credential management, adopting hardware-based multi-factor authentication, implementing zero-trust security principles, reducing unnecessary internet exposure, accelerating software patching, and leveraging AI to strengthen cyber defense all reflect internationally recognized cybersecurity practices. Equally important is the directive for institutions to revisit their business continuity plans to ensure resilience against increasingly sophisticated attacks.

Yet the memorandum should not be viewed as purely another compliance checklist. It is, above all, a call for vigilance. Banks and other supervised institutions must recognize that cybersecurity has become inseparable from corporate governance and public trust. Every investment in stronger cyber defenses protects not only institutional assets but also the savings, livelihoods, and confidence of millions of Filipinos who increasingly depend on digital financial services. Compliance with the BSP’s guidance should therefore be embraced not as a regulatory burden but as a strategic investment in long-term resilience.

The responsibility, however, does not rest solely with the banking industry. The private sector—including fintech companies, technology providers, cloud service operators, software developers, and cybersecurity firms—must continue strengthening collaboration through responsible innovation, timely information sharing, regular security assessments, and adherence to secure-by-design principles. The resilience of the financial system depends on the strength of the entire digital ecosystem that supports it.

Each Filipino, too, has an indispensable role. Cybersecurity begins with everyday habits. Using strong and unique passwords, enabling multi-factor authentication, keeping devices updated, exercising caution against phishing and social engineering attempts, and immediately reporting suspicious transactions all contribute to safeguarding the integrity of the country’s financial system. As AI makes scams more convincing, digital vigilance must become second nature.

Artificial intelligence is neither inherently good nor inherently dangerous. Its value depends on how responsibly society chooses to develop, regulate, and use it. The BSP’s latest memorandum reflects that balanced perspective. It neither resists innovation nor underestimates its risks. Instead, it reminds the financial sector that technological progress must always be matched by stronger safeguards.

As the Philippine banking industry continues its digital transformation, one principle should remain clear: trust is its most valuable asset. By urging institutions to stay ahead of AI-driven cyber threats today, the BSP is helping ensure that innovation strengthens—not compromises—the stability, security, and integrity of the nation’s financial system.