AFASA Enforcement in 2026: Account Holds, Money Mules and Bank Duties

1What happened: AFASA moves from rulebook to routine enforcement

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), was approved on 20 July 2024. In 2026 its enforcement reached a new stage. The main developments, each from a dated report, are:

• June 2026: The deadline passed for banks and other BSP-supervised institutions (BSIs) to upgrade their fraud management systems and cut back interceptable authentication such as SMS and email one-time passwords. GMA News reported on 26 January 2026 that the BSP had refused to move the deadline. Deputy Governor Elmore Capule was quoted as saying, “As of now we are not extending it.”
• 23 July 2026: BSP General Counsel Roberto Figueroa said the Philippine National Police had filed more than 500 cases under AFASA. He also said that, with the deadline past, banks that fall short of the anti-fraud requirements may be ordered to reimburse customers in full (GMA News, 23 July 2026).
• 15 September 2026: The first monthly report on temporarily held funds (THF) was due through the BSP’s ASTERisC* supervisory platform, covering August 2026. The requirement comes from BSP Memorandum No. M-2026-029, dated 24 June 2026.
• Late October to early November 2026: The DICT reported on 28 October 2026 that its 1326 complaint hotline logged 18,553 complaints, up from 6,800 before the hotline. On 4–5 November, e-wallet operator Maya said it had joined a Department of Justice–convened Technical Working Group on Financial Cybercrime Concerns. The group includes the BSP, DTI, NTC, telcos and financial institutions, and it focuses on tracing and freezing illicit funds.

This article covers what those developments mean in practice: how temporary holds work, how money-mule prosecutions are framed, what banks, e-wallets, merchants and fintechs must do, and what an account holder can do when a legitimate account is frozen. For the wider payments picture, including licensing and the 2026 rule changes for EMIs and payment operators, see our earlier pieces on what changed in fintech and online payments for 2026 and the Philippine regulatory map for mobile payment apps. This article does not repeat them.

2The legal toolkit: holds, verification, investigation and restitution

AFASA gives institutions and the BSP four main tools. Each has its own source of authority, so they should be kept apart.

The temporary hold is the tool consumers notice most. Fintech News Philippines’ summary of Circular No. 1215 reports that a hold may be lifted before 30 days if the transaction turns out to be legitimate. It also reports that institutions acting in good faith are not liable for the hold itself, and that institutions must log when each complaint or fraud alert was received. The hold is not a court freeze order. A freeze sought by the Anti-Money Laundering Council (AMLC) from the Court of Appeals is a separate remedy under the anti-money laundering law with its own procedure. In September 2025 the BSP invoked AFASA for the first time in the flood-control corruption inquiry, while the AMLC separately sought freeze orders from the appellate court (InsiderPH, 17 September 2025).

The BSP’s power to examine accounts matters for businesses. InsiderPH reported that bank secrecy and data-privacy restrictions do not stand in the way when the BSP examines accounts under investigation for AFASA offences. Companies whose accounts receive funds from flagged sources should expect questions and should keep their transaction records ready to produce.

3June 2026 deadline: bank and e-wallet liability has changed

Section 6 of RA 12010 requires institutions to adopt controls such as multi-factor authentication and fraud management systems that are “proportionate and commensurate” to their operations. An institution the BSP finds compliant is not liable for losses from AFASA offences. One that is not compliant may have to make restitution.

According to GMA News, the BSP’s standard is risk-based. Institutions offering complex electronic products, or averaging at least ₱75 million in monthly network value over six months, need fraud management systems that can:

• detect unusual user behaviour;
• screen against watchlists;
• monitor location; and
• track changes to devices and account information.

Institutions are also expected to reduce reliance on SMS and email OTPs in favour of biometrics and behavioural signals. Capule summed up the regulator’s position on losses after the deadline: “The presumption is that you are negligent.” That is a regulator’s statement of policy, not wording from the statute. Whether a particular institution is liable will still depend on the BSP’s compliance findings and, in contested cases, on the courts.

“The bank can no longer claim that that’s the fault of the client.”

— Roberto Figueroa, BSP General Counsel, as reported by GMA News, 23 July 2026

Two points cut down the scope of that quote. First, it describes institutions that have not met the requirements. Section 6 still protects institutions the BSP finds compliant. Second, Section 6 states that restitution does not depend on a conviction, but it is not automatic either. A victim still needs to report quickly and document the loss. GMA also reported that the BSP’s Financial Supervision Sector will consider what non-compliance means for a non-compliant bank’s licence.

4Money mules: prosecutions, penalties and the scale of the problem

Enforcement against mule accounts is visible in police operations. On 21 January 2026, the PNP Anti-Cybercrime Group ran three simultaneous entrapment operations in Quezon City, Davao Oriental and Manila and arrested eight people for allegedly selling e-wallet accounts, charging them under Section 5(d) of RA 12010 (Newsbytes.PH, 26 January 2026). The acting director of the group was quoted as saying, “Electronic wallet accounts must remain personal.” These are allegations. The persons arrested are presumed innocent until proven guilty, and the reports did not include their side.

AFASA’s penalties, set out in Section 16, are substantial:

• 6–8 years
  Money muling (Sec. 4(a)): imprisonment, a fine of ₱100,000–₱500,000, or both, with closure and forfeiture of the account for most modes
• 10–12 years
  Social engineering (Sec. 4(b)): ₱500,000–₱1 million fine; heavier if the victim is a senior citizen
• Life imprisonment
  Economic sabotage (Sec. 4(c)): for example, three or more conspirators, three or more victims, or mass mailers
• 4–6 years
  Other offences (Sec. 5), including buying or selling an account; fines double for juridical persons, capped at ₱10 million

Reported estimates of the problem’s size vary and should be used with care. A 26 September 2026 InsiderPH report cited an estimate that mule-enabled fraud could cost the economy about ₱603 billion a year. It also reported that verified bank and e-wallet accounts sell for ₱500 to ₱5,000, and that an estimated 60–70% of mule accounts involve voluntary participation. The report did not name the study behind the ₱603-billion figure, so treat it as an industry estimate, not an official statistic. The CICC reported on 22 January 2026 that its complaint center logged 18,633 complaints in 2025. Consumer fraud led at 6,453 complaints, and reported losses across fraud, hacking and phishing categories reached ₱418.187 million.

For individuals, the practical lesson is simple: “renting out” an account, a SIM-linked e-wallet or a verified profile is not a harmless side income. Someone who lends an account and later says they did not know where the money came from will still have to explain that claim to investigators. Prosecutors will look at the circumstances, including payment received for the account and repeated transfers. Our guide to online scam and investment fraud charges explains how estafa and cybercrime charges are typically combined in scam cases.

5Reporting, supervision and the SIM registration link

The BSP is now collecting structured data on holds. Under Memorandum No. M-2026-029, institutions enrolled in ASTERisC*, including banks, EMIs and virtual asset service providers, must file a THF report by the 15th of each month for the previous month. They are not required to file for a month with no holds. Any institution that initiated holds during the year must also submit an annual notarized certification to the BSP’s Consumer Account Protection Office within 30 calendar days after year-end, confirming that adequate risk controls were in place when the holds were made. The first certification under this framework therefore falls due in January 2027. As of 6 November 2026, we found no published BSP statistics on the number or value of funds held since reporting began.

Telecommunications are the other half of the chain. Many social engineering attacks start with a text or call, and many mule e-wallets are opened with SIMs registered in another person’s name. The SIM Registration Act (RA 11934) remains in force. In March 2025 the NTC said it was considering requiring registrants to appear in person and was preparing proposed amendments. Telco counsel raised concerns about access for rural users. As of the research date, we could not confirm that any amendment to RA 11934 has been enacted, so businesses should treat it as a proposal only. The presence of the NTC and telcos in the DOJ working group suggests closer coordination between telcos and financial institutions, but the group is not a regulator and has not, to our knowledge, issued binding rules. Readers interested in how losses are divided when a SIM is hijacked can see our explainer on SIM swap fraud liability of banks and telcos.

6What banks, e-wallets, merchants and fintechs should do now

Banks, EMIs and other BSIs

• Document how your fraud management system meets the BSP’s risk-based expectations. If you cannot show the BSP your controls are adequate, you may be liable to make restitution.
• Keep a timestamped record of every complaint and fraud alert, every hold placed and released, and the reason for each decision.
• Set up monthly THF reporting through ASTERisC* (or the existing channel if you are not enrolled) and prepare for the annual notarized certification.
• Write hold-release scripts and evidence checklists so that legitimate customers are cleared quickly. Holds that are slow or never explained create complaint and litigation risk.

Merchants, marketplaces and platform businesses

• Expect incoming payments to be held occasionally when a payer disputes a transfer. Keep invoices, delivery proof and chat logs that tie each payment to a real sale.
• Never accept settlement into employees’ or agents’ personal e-wallets. A borrowed account can look exactly like a mule account.
• Review refund and chargeback terms so they are consistent with a 30-day hold.

Fintechs and payment partners

• Map which party in each payment flow is the “institution” responsible for holds and verification, and put response times into partner contracts.
• Check that onboarding controls detect account resale signals, such as repeated device changes and identity mismatches, without unlawfully excluding legitimate users.

7Remedies if your account is wrongly frozen or you are scammed

If your account is wrongly held. Start with the institution’s dispute channel and ask which transaction was flagged. Then submit evidence that it was legitimate, such as contracts, receipts and identity documents. Reports on Circular No. 1215 indicate that a hold must be lifted early once the transaction is shown to be clean, and the statute caps a hold at 30 calendar days unless a court extends it. If the institution does not answer, you may escalate the complaint to the BSP’s consumer assistance channels. A hold that continues past the statutory period without a court order, or an institution that acted in bad faith, may support a civil claim for release and damages. A lawyer should assess those options on the facts. Be aware that a hold may be followed by a separate AMLC freeze or a criminal investigation, and each has a different procedure and venue.

If you are a scam victim. Report to your bank or e-wallet immediately so it can trigger a hold before the money moves on. Also report to the CICC hotline (1326) or the PNP Anti-Cybercrime Group, and keep screenshots, reference numbers and the times of each report. If the institution did not have adequate controls, Section 6 allows restitution without waiting for a conviction.

If you are accused of being a mule. Do not move or withdraw any remaining funds, and get legal advice before giving a statement. Whether you knew the funds were criminal proceeds is often the central issue under Section 4(a).

• AFASA holds are made by the institution, last up to 30 calendar days, and can be extended only by a court.
• Since June 2026, institutions without adequate fraud controls may be ordered to reimburse scam losses.
• More than 500 AFASA cases had been filed by July 2026, according to the BSP.
• Monthly reporting of held funds to the BSP began in September 2026.
• Merchants should be able to document every incoming payment and must never route sales through personal accounts.

Abanto Law Firm assists individuals and businesses with AFASA disputes, wrongful account holds, scam-related complaints and money-muling allegations, as well as compliance reviews for payment businesses. To discuss a specific matter, see our cybercrime practice or contact our Makati office.

8Frequently asked questions