BSP shifts to Basel III operational risk standards

The Bangko Sentral ng Pilipinas (BSP) is tightening its risk-based capital framework for banks, adopting a new Basel III standard that will require lenders to better account for potential losses from operational failures, including cyberattacks, fraud and technology disruptions.

Under BSP Circular No. 1241 dated 9 October 2026, the New Standardized Approach (NSA) will replace existing methods of calculating operational risk capital requirements for universal, commercial and digital banks, as well as their subsidiary banks and quasi-banks.

The new framework aims to strengthen banks’ ability to absorb unexpected losses by making capital requirements more reflective of their operational risk profiles, including their income and historical losses.

“The NSA is more risk-sensitive because it allows capital requirements to better reflect a bank’s operational risk profile by considering its income and historical operational loss experience,” the BSP said.

Basel III is an international regulatory framework developed by the Basel Committee on Banking Supervision in response to the global financial crisis of 2007–2009. Its primary goal is to strengthen bank capital requirements, improve risk management, and prevent bank failures by ensuring financial institutions hold enough high-quality assets to absorb economic shocks.

Operational risk refers to potential losses arising from inadequate or failed internal processes, personnel and systems, as well as external events such as natural calamities. The BSP said the new approach would also encourage banks to strengthen their operational risk management systems and maintain comprehensive historical loss databases.

Full implementation is scheduled to begin with the end-December 2027 reporting period. During the transition, banks must submit capital adequacy ratio reports under both the NSA and existing methodologies, with the latter remaining the basis for determining compliance with minimum capital requirements.

Banks that demonstrate sufficient readiness may adopt the new approach earlier, subject to notification to the BSP and post-verification requirements.

The latest change comes as the central bank continues to recalibrate capital rules to address risks arising from banks’ evolving business models and volatile financial markets.

In September, the BSP required existing thrift, rural and cooperative banks operating under business models similar to those of digital banks to meet the same P1-billion minimum capital requirement imposed on digital banks.

Under Circular No. 1240 dated 21 September, affected lenders were given six months from receipt of the BSP’s notice to comply. The rules cover banks whose business models, risk management systems or capital levels are no longer commensurate with their operations, as well as lenders delivering services digitally while recording significant growth in loans or deposits.

The central bank said the requirements were intended to ensure banks could manage risks arising from the “nature, scale, complexity, and risk profile” of their operations.

In June, meanwhile, the BSP granted temporary capital relief to banks and quasi-banks amid financial market volatility linked to the conflict in the Middle East.

Under Memorandum No. 2026-027, lenders were allowed to exclude certain unrealized losses on peso-denominated government securities from regulatory capital calculations from 1 April to 31 December 2026.