BSP circulars compliance for Philippine financial institutions, with controls you can show the Bangko Sentral.

What it is

What are the BSP circulars on IT risk, security, continuity and outsourcing?

The Bangko Sentral ng Pilipinas regulates banks and other supervised financial institutions through circulars, which it consolidates into its Manual of Regulations for Banks. Several of those rules deal with the technology and operations behind financial services: how an institution governs IT, protects information, keeps services available through disruption and oversees the third parties it depends on.

This page covers four connected areas. Section 148 of the Manual sets the expectations for information technology risk management, supported by an appendix of IT risk management standards and guidelines. Section 149 covers business continuity management, introduced by Circular No. 951 dated 20 March 2017. Section 112 governs management contracts and outsourcing, with 2022 amendments to the regulations on outsourcing and IT risk under Circular No. 1137. Circular No. 1203, Guidelines on Operational Resilience, followed in 2024.

Together they ask one practical question: if a system fails, a supplier stops or an attacker gets in, can the institution show it saw the risk, controlled it and recovered? A programme built for the examiner alone rarely answers that well.

Current framework. The Bangko Sentral amends these rules through new circulars, and the online Manual of Regulations for Banks carries the consolidated text. We work from the Manual and the latest issuances in force when your programme starts, and check any recent circular with you and your compliance office before it shapes the plan.

Who it is for

Who needs BSP circulars compliance?

The IT risk and business continuity sections apply to BSP-supervised financial institutions: banks, non-banks with quasi-banking functions, non-bank electronic money issuers and other non-bank institutions under Bangko Sentral supervision. Organisations come to Sterling from four starting points:

• A supervisory finding or a new circular needs a response. An examination has raised gaps, or a recent issuance changes what your IT, continuity or outsourcing programme must show.
• You are a service provider to a Philippine bank. Your client's outsourcing due diligence asks for security, continuity and audit evidence before it will sign or renew, and you need to answer it properly.
• You are launching digital services or changing core systems. New channels, cloud platforms and major IT projects bring the project, change and electronic services expectations into play, and may move your IT profile classification.
• You belong to a regional group. Group standards such as ISO/IEC 27001 or ISO 22301 exist, and the Philippine entity needs them mapped to what the Bangko Sentral expects locally.

The intended benefit is control you can demonstrate. Results depend on how well the programme is implemented and owned, not on any document alone.

Requirements

What are the main BSP IT risk, continuity and outsourcing requirements?

The list below maps the headings of the Manual of Regulations for Banks in plain language. Expectations scale with your IT profile, which the Manual classifies as complex, moderate or simple according to factors such as infrastructure, digital services, IT projects, outsourcing, systemic importance and threat exposure. Your programme is checked against the full current text, heading by heading, with your compliance office and legal advisers.

• IT governance (Sec. 148): oversight of technology risk by the board and senior management.
• Risk identification and assessment (Sec. 148): know your technology risks and rate them consistently.
• IT controls implementation (Sec. 148): information security; project management, development, acquisition and change management; IT operations; IT outsourcing and vendor management; electronic products and services.
• Risk measurement and monitoring (Sec. 148): track indicators, test controls and report results to those accountable.
• IT risk management standards and guidelines (appendix to Sec. 148): information security governance, security programme management, and cyber threat intelligence and collaboration.
• Business continuity management (Sec. 149): business impact analysis and risk assessment, strategy formulation, plan development, plan testing, and personnel training and plan maintenance.
• Outsourcing (Sec. 112): no outsourcing of inherent banking functions, authority to outsource, governance of outsourcing risks, documentation, intra-group and offshore arrangements.
• Operational resilience (Circular No. 1203): guidelines on continuing to deliver critical operations through disruption.

Compliance process

How do you achieve BSP circulars compliance?

No certificate exists for these rules. You demonstrate compliance to your board and to the Bangko Sentral through supervision, so the route is built to produce evidence that holds up to internal audit and examination.

1. 01
   Confirm the applicable rules and your IT profile.Identify which sections and circulars apply to your licence, the likely IT profile classification, and the critical systems, operations and service providers in scope.
2. 02
   Gap analysis: compare current practice with each heading.We review governance, risk assessment, security controls, change, operations, continuity, outsourcing files and audit coverage, then agree actions, owners and dates.
3. 03
   Build the programme and close the gaps.Policies, risk registers, security controls, recovery strategies and plans, and a vendor management process your teams operate day to day.
4. 04
   Test, train and audit.Exercise continuity and recovery plans, train the people who run them, and have internal audit review design and operation before results go to the board.
5. 05
   Operate, report and keep pace with new circulars.Keep reviews and tests on schedule, report to the board, and update the programme as the Bangko Sentral issues amendments.

Check the route before you sign. Only the Bangko Sentral supervises compliance with its circulars; no consultant, certification body or software vendor can declare an institution compliant. Ask what evidence the work will produce and how it maps to each heading. If you also pursue ISO/IEC 27001 or ISO 22301 certification, confirm the certification body's accreditation directly. The certification buyer's checklist

Cost

How much does BSP circulars compliance cost?

With no certification fee, the budget sits in the programme work, any remediation and your own people's time. A simple-profile institution with mature controls needs a very different scope from a complex one rebuilding its outsourcing oversight.

Timeline

How long does BSP circulars compliance take?

Continuity testing and service provider files usually set the pace: plans need a real exercise, and due diligence needs each provider's cooperation. As an estimate, most programmes reach a defensible position in four to nine months; a response to a specific finding can be faster.

Your engagement

What your BSP circulars compliance engagement includes

Sterling OS™ runs every engagement, with each phase adapted to a regulatory obligation rather than a certificate. Sterling does not certify, attest or declare compliance: the Bangko Sentral supervises, and your board remains accountable. We work alongside your compliance office and legal advisers; nothing we deliver is legal advice.

• Design™: guided support

  Your team builds the programme; a Sterling consultant sets the method, reviews each policy, register and plan, and coaches the owners.

• Drive™: managed support

  The alternative to Design™ when capacity is short: Sterling drafts the framework, registers, plans and provider assessments with your owners and takes the programme to board approval.

• Sustain™: after the programme is in place

  Annual continuity tests, provider reviews, updates for new circulars and readiness for internal audit and examination.

• Automate™: Effivity

  Your IT risk, continuity and vendor programme runs in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Compliance decisions and any supervisory action remain with the Bangko Sentral ng Pilipinas.

Often combined with

Standards organisations pair with BSP circulars (Philippines)

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.