BSP tightens bank capital rules for operational risks

The Bangko Sentral ng Pilipinas has adopted the Basel III New Standardized Approach, or NSA, for calculating the capital banks must maintain against unexpected losses arising from operational failures.

The shift is intended to make capital requirements more responsive to each bank’s actual operational risk while bringing the Philippine regulatory framework closer to international banking standards.

For depositors, borrowers and the broader economy, stronger capital buffers can help banks absorb losses from cyberattacks, fraud, technology breakdowns and other disruptions without immediately threatening their financial stability.

Operational risk covers losses caused by inadequate or failed internal processes, employees, systems or external events, including cyberattacks, fraud, human error, technology failures and natural calamities.

Under BSP Circular No. 1241 issued Oct. 9, 2026, the NSA will replace the existing methods used to calculate operational risk capital requirements for universal, commercial and digital banks.

The rules also cover their subsidiary banks and quasi-banks, which the BSP collectively refers to as covered financial institutions.

The approaches being replaced are the Basic Indicator Approach, or BIA, and The Standardized Approach, or TSA.

Stand-alone thrift, rural and cooperative banks will continue using the modified BIA under the Basel 1.5 framework.

The BSP said the new approach is more risk-sensitive because it takes into account both a bank’s income and its historical operational loss experience when determining the amount of capital required.

The use of historical loss experience is subject to compliance with BSP criteria governing operational loss data, as provided under Annex J of the circular.

The framework is also intended to encourage banks to strengthen their operational risk management systems and develop more robust databases documenting previous operational losses.

Banks will undergo a monitoring period before the NSA becomes the mandatory basis for their operational risk capital requirements.

During this transition, covered institutions will submit capital adequacy ratio reports using both the NSA and the existing methodologies.

The existing methodologies will remain the official basis for determining compliance with minimum capital requirements during the monitoring period.

The BSP said the start of the monitoring period and procedures for parallel reporting will be set out in a separate issuance.

Full implementation of the NSA will begin with the end-December 2027 reporting period.

Covered financial institutions that can demonstrate adequate readiness may adopt the NSA earlier during the monitoring period, subject to BSP notification and post-verification requirements.

Capital adequacy ratio, or CAR, measures a bank’s eligible regulatory capital relative to its risk-weighted assets.

Assets are assigned different risk weights depending on their relative riskiness, which is why CAR is also referred to as the risk-based capital adequacy ratio.

Eligible regulatory capital includes Tier 1, or core capital, and Tier 2, or supplementary capital.

The new framework forms part of Basel III, a package of global banking reforms introduced by the Basel Committee on Banking Supervision in December 2010.

Those reforms strengthened the definition of regulatory capital and introduced capital buffers intended to help banks withstand economic and financial stress.

The Basel Committee on Banking Supervision was established in 1975 by the central bank governors of the Group of Ten countries.