AFASA: What Philippine compliance teams need to change

A recap of our Philippines session, hosted by Iain Armstrong, Executive Director of Financial Crime Compliance (FCC) Strategy at ComplyAdvantage, with Edison Guevarra, anti-money laundering (AML) Operations Manager at East West Banking Corporation.

The Philippines officially exited the Financial Action Task Force grey list in February 2025 – a milestone that typically offers financial institutions some breathing room. However, the local regulatory landscape has only grown tighter over the last 18 months. Between the Bangko Sentral ng Pilipinas (BSP) introducing strict new anti-scam guidelines, the creation of a beneficial ownership registry, an outright ban on offshore gaming, and a new consumer-protection framework, compliance teams face a wave of incoming requirements ahead of the next FATF evaluation in 2027.

At the core of this shift is the Anti-Financial Account Scamming Act (AFASA), which fundamentally changes the rules of engagement. Instead of just reporting suspicious transactions after the fact, firms must now act to prevent them in real time. Rather than easing, regulatory expectations for Philippine institutions are rapidly climbing. This session explores how compliance functions can navigate this transition and build the capabilities needed to stay compliant.

What examiners will test, and what to fix first

The BSP has canceled nine money service business registrations since 2024, and more than 70% of payments are expected to go digital by 2028. Moving forward, examiners will focus closely on four core capabilities:

• Real-time fraud blocking.
• Instant payment screening.
• Sanctions lists that update automatically.
• Electronic know your customer (eKYC) checks.

According to Edison, firms should focus their immediate efforts on fraud prevention. Examiners are looking beyond static policy documents to see if a firm can detect suspicious behavior early, apply step-up verification when risk is detected, and intervene before funds are gone for good. To succeed, institutions should start their fraud prevention efforts by addressing the critical challenge of digital identity.

“Every other financial crime control depends on knowing who your customer is. If identity assurance is weak, then sanctions screening, watchlist screening, transaction monitoring, and even fraud detection all become less effective. Institutions often want to jump directly into advanced analytics or AI. In my honest view, identity is the foundation.”
– Edison Guevarra, AML Operations Manager, East West Banking Corporation

It is easy to conflate advanced technology with robust compliance. But jumping straight into sophisticated detection tools while foundational customer data remains weak is a common trap – and a costly one.

Evidence has replaced assurance

Supervisors have stopped accepting documentation alone as proof of compliance. Edison noted that the central question has shifted from whether a monitoring program exists to whether a firm can demonstrate that it works.

In practice, this means demonstrating performance through concrete metrics: alert volumes, case aging reports, suspicious transaction report (STR) filings, and rigorous control reviews. Firms must also show that their systems are continuously tuned and calibrated. Recalibration is no longer optional. Today, success is not just about reducing false positives – it is about ensuring you are not missing real threats.

AFASA is the driving force behind this shift. Historically, compliance programs prioritized minimizing the cost of investigations. However, with new restitution obligations and potential criminal liability for money muling, the financial and regulatory exposure of missing a scam has grown significantly higher.

“The question isn’t how much an alert costs anymore. It is how much it costs when the institution misses something.”
– Edison Guevarra, AML Operations Manager, East West Banking Corporation

Visibility before automation

When manual compliance processes fail to keep pace, it is rarely due to a lack of effort.

“However good your human operations team might be, they can’t feasibly operate at sub-second timescales.”
– Iain Armstrong, Executive Director of FCC Strategy at ComplyAdvantage

For compliance teams still relying heavily on manual monitoring, Edison shared some highly practical advice on sequencing: focus first on visibility, then standardization, then automation, and finally, advanced analytics. Too often, organizations rush to implement AI before they have full confidence in their underlying customer data, investigation processes, or case management workflows. 

Automating a flawed or poorly documented process only accelerates and amplifies errors. Instead of attempting a complete overnight overhaul, firms should target high-risk areas first, demonstrate success, and scale from there.

Precision, not friction

These regulatory shifts impact onboarding just as much as transaction monitoring. According to BSP Deputy Governor Lyn Javier, social engineering, account takeover and identity theft together account for 76% of all financial fraud losses. Furthermore, TransUnion reported that the suspected digital fraud rate in the Philippines reached 4.1% in 2025 – exceeding the global average for the sixth year in a row – with 72% of Filipinos reporting they were targeted by scammers late last year.

Under AFASA, the core challenge is ensuring that the identity verified during onboarding remains valid when that user eventually transacts. Edison advocates for a continuous identity framework: starting with liveness checks, ID verification, and watchlist screening at signup, followed by dynamic, risk-based authentication as customers move money. The goal is not to introduce friction across the board, but to apply targeted verification where and when it is needed. When controls are designed this way, compliance and customer experience are no longer at odds.

This balances a classic trade-off that compliance and product teams debate daily.

“The key is precision rather than more friction. Good controls don’t create friction for everyone. They only create friction where risk exists. The best controls are often the ones legitimate customers barely notice.”
– Edison Guevarra, AML Operations Manager, East West Banking Corporation

As Iain noted, some friction can build trust rather than deter users – after all, most passengers would feel uneasy boarding a plane without going through security. He emphasized the importance of monitoring both sides of this equation:

“Somebody in your organization should be tracking abandonment rates and dropout rates during the onboarding stage, alongside how much fraud or attempted fraud you are catching. If one of those numbers is too high and one is too low, that’s usually a signal that you should be reviewing the way that you’re doing these things.”
– Iain Armstrong, Executive Director of FCC Strategy at ComplyAdvantage

The next 90 days

With digital transactions settling in seconds, relying on controls that run hours or days later introduces significant liability and risk.

Over the next quarter, compliance leaders should conduct an honest self-assessment to identify which critical controls still rely on manual or delayed interventions. From there, teams can build a clear roadmap to shift high-risk decisioning closer to real time.

Watch the full session on demand, and catch up on Iain’s three-part series analyzing the Philippine compliance landscape:

• Read Part 1: Why the Philippines is one of Asia’s most exciting financial markets, and why fraudsters have taken note
• Read Part 2: The Philippines’ experience with the FATF greylist: A tax on migrant workers? Looking ahead to 2027’s evaluation
• Read Part 3: Strategic name screening in the Philippines: What financial institutions need to know