BPI first Philippine universal bank to earn dual ISO certification
Bank secures international standards for information security, privacy management
Text size
Bank secures international standards for information security, privacy management
The Bank of the Philippine Islands (BPI) has become the first universal bank in the Philippines to secure certifications for both information security and privacy management, strengthening its safeguards for customer data and digital banking services.
BPI received ISO/IEC 27001:2022 certification for its Information Security Management System (ISMS) and ISO/IEC 27701:2019 certification for its Privacy Information Management System (PIMS).
The certifications were awarded by British Standards Institution (BSI) Group Philippines Inc. and cover online and mobile banking platform management, inward and outward remittances, transaction banking and cash management services, and contact center operations.
The two standards require organizations to maintain continuing approaches to information security and privacy management through regular risk assessments, internal controls, audits, monitoring and operational improvements, rather than relying on a one-time audit.
“These certifications affirm that BPI has implemented internationally recognized frameworks for managing information security and data privacy across critical banking services. More importantly, these reflect our commitment to making security and privacy an integral part of how we operate and how we serve our customers,” said TG Limcaoco, BPI president and CEO.
Limcaoco said the standards apply across critical customer-facing operations, including digital banking, payments, transaction banking and customer support.
“What is particularly meaningful about this achievement is that these standards are not confined to a single system, channel, or function. They are applied across critical parts of how we serve our customers – from digital banking and payments to transaction banking and our customer support operations. This breadth reflects the scale of our commitment: that wherever and however our customers interact with BPI, we are working to make their banking experience secure, resilient, and worthy of their trust,” he said.
BPI said the certifications provide customers with stronger protection of sensitive personal and financial information, more secure digital and cross-border transactions, and assurance that its security and privacy controls are independently audited and continuously improved.
For corporate and institutional clients, the certifications demonstrate that the bank operates under a globally aligned framework for managing information security and privacy risks.
BPI's certification journey builds on more than two decades of efforts to strengthen its information security framework and governance practices. Since the early 2000s, the bank has enhanced its security policies, controls and risk-management capabilities, later expanding these efforts to include a comprehensive data privacy program.
The bank said its broader information security and privacy strategy also supports compliance with the Data Privacy Act of 2012, the General Data Protection Regulation and relevant Bangko Sentral ng Pilipinas issuances, including Circulars 808 and 982.
BPI said the dual certification reinforces information security and data privacy as shared and continuing responsibilities across the organization.
