As a regtech player with a vision to enable sustainable compliance programs in financial institutions, Tookitaki organized a first-of-its-kind industry roundtable in Charlotte, NC, USA to discuss opportunities to innovate current AML programs and meet regulatory expectations. The roundtable was an open forum for various stakeholder groups to ideate on how to assimilate new-edge technologies like artificial intelligence (AI) and machine learning (ML) within their system of internal controls and across the industry to improve the detection and investigation of illicit financial flows.
{{ cta-first }}
It saw participation from global financial institutions, risk and compliance professionals, consulting firms and technology services firms. Long time AML industry veteran and associate director at Protiviti, George Harris, moderated the discussion topics. The roundtable addressed the following questions:
• How can we create a sustainable AML program design and address challenges associated with today’s compliance processes and systems?
• What role can modern technology play in bringing together banks’ money laundering wisdom?
• How can we deploy an AI model in production with scale and mitigate compliance risk?
Sustainability and modern tech
Our participants unanimously agreed that the general skepticism surrounding the adoption of AI and ML to address regulatory compliance issues has started fading away as such technologies meet applicable security guidelines, improves overall operational performance, and improves customer experience. However, the industry experts suggested specific key points, while adopting modern technologies to create sustainable compliance programs.
1. Behavior monitoring rather than transactional monitoring is the need of the hour.
As threshold setting may not be always effective to identify suspicious transactions, it’s imperative on today’s compliance programs to follow a behavior monitoring approach. They need to understand what normal behavior is to find out whether specific cases standout from that normal behavior. If we can identify the normal behavior, then we can weed out those non-productive cases much faster and in a sustainable way. To understand customers’ true banking behavior, we need to go beyond pre-defined banking segments and transactions and look at them from a holistic point of view. This approach would bring together all relevant customer information such as lifetime STRs/SARs, multiple accounts, demographics, and relationship with counterparties to create customer groups and identify normal and abnormal behavior.
2. Compliance programs are not sustainable unless they are explainable. Transparency has been an issue with AI/ML-powered solutions in any area. RegTech solutions are no exception. Results from a compliance solution should be explainable and auditable so that there is a complete audit trail to back up whatever decision a compliance professional is taking to handle all non-productive cases.
3. Data integrity is at the heart of machine learning.
To unlock the full potential of machine learning in compliance programs, the quality of input data must be verified. The first step in generating quality output from a machine learning model is to ensure that the right quality data is going into the model. If things are really bad, machine learning is nothing but garbage.
4. Less sophistication is better.
One of the problems with modern technologies such as Big Data and AI is that they require highly specialized, expensive people. While looking for AI-powered AML software, ensure it offers explanations for its output in business-friendly language, easy to implement with existing banking infrastructure and low in maintenance.
5. Secondary scoring is a nice way to transition to a new paradigm.
Though basic systems can get “incrementally matter, they can’t become materially better”. At some point in time, the industry is going to recognize, particularly regulators, that innovation is to come and take over. Machine learning is taking over our lives in multi-faceted ways. When we apply machine learning to financial crimes, the fundamental question is how we will move towards the new technology without disrupting the normal business flow and how we will do that in a low-risk way. Secondary scoring is a nice way to transition compliance to a new paradigm. If we layer in machine learning over whatever technologies currently in use, then over time, banks can shift towards machine learning models and phase out the older technology without disrupting business. Subsequently, you may put in an infrastructure of analytics that will serve the whole lifecycle of the behavioral process, onboarding with name matching, transaction monitoring, and investigations.
Collaboration and robust compliance programs
Banks are always looking to detect non-productive alerts in a better way so that they can prioritize alerts better. Currently, they are building rules or machine learning models on top of rules in silos to solve compliance issues. These rules and models are built based on information available to individual banks. However, if we have to move to the next generation of compliance systems, we need to go beyond these custom models that we are building. The fundamental challenge we have is building an ecosystem where each bank can share money laundering patterns to create a robust library of patterns that can help banks make their models more powerful in terms of detecting those scenarios beyond what they already have.
However, as banks cannot share their customer data, building a pattern sharing AML ecosystem is a real challenge. Tookitaki has brought in innovation to address the challenge and offer financial institutions an ability to share money laundering patterns, without data leakage. The approach helps banks enrich their detection rate for suspicious cases, especially complex structuring cases, with significantly low misclassification rates. There had been questions on the practicality of the novel concept. The most important ones and their responses are noted down below.
1. Is pattern sharing applicable across different types of financial institutions?
It’s up to the banks to decide whether they want a specific pattern or not. Also, the typologies work on each banks’ data. If the scenarios are not applicable to your data, then they will not be effective. As part of the regulatory approval, it has to be justified that the framework works or not. For that, it has to undergo rigorous testing, including under-the-line testing and over-the-line testing, and the results are to be validated at the segment level and the rules level.
2. Will the pattern-sharing framework replace existing solutions?
Most of Tookitaki’s regional and global deployments have been complementary solutions. We are looking at providing incremental results by adding new typologies without a ‘rip and replace’. Tookitaki solution can sit on top of existing solutions and drastically improve alerts prioritization with a 50% reduction in false positives. That level of efficiency can only happen when we can bring in industry knowledge rather than siloed knowledge.
3. Will it make sense if there is regulatory pressure to continuously update models?
By default, the concept follows a champion-challenger framework, where the challenger model needs to undergo various validation steps to become a champion model. While regulations for AI-powered model governance in the financial services industry are yet to mature, there are guidelines that banks can follow while taking up AI. Singapore’s FEAT framework (fairness, ethics, accountability, and transparency) and the US OCC guidance on model risk management can be used to promote the ethical and unbiased use of AI within financial institutions.
{{cta-guide}}
Pursuing the AI Journey for AML
Moving from innovation experimentation to day-to-day enterprise usage requires engineering excellence and a business case for change. It’s often more than ROI that banks consider while adopting a fresh approach to AML risk management.
1. It is important to get examiners to agree with you.
As standard setters in the industry, examiners play a crucial role in the adoption of AI in financial services. As one of the initial steps, it is recommended that business stakeholders talk to examiners, demo the solution and get their buy-in. Various examiners compete with each other, so if we can get one to adopt modern technology, the others will follow.
2. A proper balance between better risk management and monetary benefits is crucial.
While ROI is important for each and every bank, the benefits from the use of modern technology in regulatory compliance are primarily about augmented risk management and the ability to do compliance jobs better. These will obviously result in financial benefits in the long run in addition to the competitive edge over peers.
3. Have we reached a machine vs. human state? Not as of now.
As of now, we cannot take humans out of the compliance process and replace them with machine learning. Human intuition is something that cannot be replaced. Modern compliance technology looks to assist human beings with better analytics and intelligence so that they can do their work faster and better.
Conclusion
The roundtable concluded that the future of regulatory compliance will be powered by advanced technology. As criminals are using technology to outsmart legacy systems, financial institutions are lagging behind with process inefficiencies and heightened risk. The use of right technology can help them mitigate risk as well as reduce operational costs significantly. It is important to create awareness about novel technological approaches in the market to address AML compliance and ensure sustainability. In addition, collaboration among various industry stakeholders such as financial institutions, regulators and technology firms can surely alter the current AML compliance picture and make the world a better place to live.
Experience the most intelligent AML and fraud prevention platform
Experience the most intelligent AML and fraud prevention platform
Experience the most intelligent AML and fraud prevention platform
Top AML Scenarios in ASEAN

The Role of AML Software in Compliance

Talk to an Expert
Ready to Streamline Your Anti-Financial Crime Compliance?
Our Thought Leadership Guides
Beyond the Ratings: What FATF’s December 2025 Review Means for Malaysia’s AML Playbook
When the Financial Action Task Force publishes a Mutual Evaluation Report, it is not simply assessing the existence of laws and controls. It is examining whether those measures are producing real, demonstrable outcomes across the financial system.
The FATF Mutual Evaluation Report on Malaysia, published in December 2025, sends a clear signal in this regard. Beyond the headline ratings, the evaluation focuses on how effectively money laundering and terrorist financing risks are understood, prioritised, and mitigated in practice.
For banks, fintechs, and compliance teams operating in Malaysia, the real value of the report lies in these signals. They indicate where supervisory scrutiny is likely to intensify and where institutions are expected to demonstrate stronger alignment between risk understanding and operational controls.

What a FATF Mutual Evaluation Is Really Testing
A FATF Mutual Evaluation assesses two interconnected dimensions.
The first is technical compliance, which looks at whether the legal and institutional framework aligns with FATF Recommendations.
The second, and increasingly decisive, dimension is effectiveness. This examines whether authorities and reporting entities are achieving intended outcomes, including timely detection, meaningful disruption of illicit financial activity, and effective use of financial intelligence.
In recent evaluation cycles, FATF has made it clear that strong frameworks alone are insufficient. Supervisors are looking for evidence that risks are properly understood and that controls are proportionate, targeted, and working as intended. Malaysia’s December 2025 evaluation reflects this emphasis throughout.
Why Malaysia’s Evaluation Carries Regional Significance
Malaysia plays a central role in Southeast Asia’s financial system. It supports significant volumes of cross-border trade, remittance flows, and correspondent banking activity, alongside a rapidly growing digital payments and fintech ecosystem.
This positioning increases exposure to complex and evolving money laundering risks. FATF’s evaluation recognises Malaysia’s progress in strengthening its framework, while also highlighting the need for continued focus on risk-based implementation as financial crime becomes more cross-border, more technology-driven, and more fragmented.
For financial institutions, this reinforces the expectation that controls must evolve alongside the risk landscape, not lag behind it.
Key Signals Emerging from the December 2025 Evaluation
Effectiveness Takes Precedence Over Formal Compliance
One of the strongest signals from the evaluation is the emphasis on demonstrable effectiveness.
Institutions are expected to show that:
- Higher-risk activities are identified and prioritised
- Detection mechanisms are capable of identifying complex and layered activity
- Alerts, investigations, and reporting are aligned with real risk exposure
- Financial intelligence leads to meaningful outcomes
Controls that exist but do not clearly contribute to these outcomes are unlikely to meet supervisory expectations.
Risk Understanding Must Drive Control Design
The evaluation reinforces that a risk-based approach must extend beyond documentation and enterprise risk assessments.
Financial institutions are expected to:
- Clearly articulate their understanding of inherent and residual risks
- Translate that understanding into targeted monitoring scenarios
- Adjust controls as new products, delivery channels, and typologies emerge
Generic or static monitoring frameworks risk being viewed as insufficiently aligned with actual exposure.
Ongoing Focus on Cross-Border and Predicate Offence Risks
Consistent with Malaysia’s role as a regional financial hub, the evaluation places continued emphasis on cross-border risks.
These include exposure to:
- Trade-based money laundering
- Proceeds linked to organised crime and corruption
- Cross-border remittances and correspondent banking relationships
FATF’s focus here signals that institutions must demonstrate not just transaction monitoring coverage, but the ability to interpret cross-border activity in context and identify suspicious patterns that span multiple channels.
Expanding Attention on Non-Bank and Digital Channels
While banks remain central to Malaysia’s AML framework, the evaluation highlights increasing supervisory attention on:
- Payment institutions
- Digital platforms
- Designated non-financial businesses and professions
As risks shift across the financial ecosystem, regulators expect banks and fintechs to understand how their exposures interact with activity outside traditional banking channels.
Practical Implications for Malaysian Financial Institutions
For compliance teams, the December 2025 evaluation translates into several operational realities.
Supervisory Engagement Will Be More Outcome-Focused
Regulators are likely to probe:
- Whether monitoring scenarios reflect current risk assessments
- How detection logic has evolved over time
- What evidence demonstrates that controls are effective
Institutions that cannot clearly explain how their controls address specific risks may face increased scrutiny.
Alert Volumes Will Be Scrutinised for Quality
High alert volumes are no longer viewed as evidence of strong controls.
Supervisors are increasingly focused on:
- The relevance of alerts generated
- The quality of investigations
- The timeliness and usefulness of suspicious transaction reporting
This places pressure on institutions to improve signal quality while managing operational efficiency.
Static Monitoring Frameworks Will Be Challenged
The pace at which money laundering typologies evolve continues to accelerate.
Institutions that rely on:
- Infrequent scenario reviews
- Manual rule tuning
- Disconnected monitoring systems
may struggle to demonstrate timely adaptation to emerging risks highlighted through national risk assessments or supervisory feedback.

Common Execution Gaps Highlighted Through FATF Evaluations
Across jurisdictions, FATF evaluations frequently expose similar challenges.
Fragmented Monitoring Approaches
Siloed AML and fraud systems limit the ability to see end-to-end money flows and behavioural patterns.
Slow Adaptation to Emerging Typologies
Scenario libraries can lag behind real-world risk evolution, particularly without access to shared intelligence.
Operational Strain from False Positives
Excessive alert volumes reduce investigator effectiveness and dilute regulatory reporting quality.
Explainability and Governance Limitations
Institutions must be able to explain why controls behave as they do. Opaque or poorly governed models raise supervisory concerns.
What FATF Is Signalling About the Next Phase
While not always stated explicitly, the evaluation reflects expectations that institutions will continue to mature their AML capabilities.
Supervisors are looking for evidence of:
- Continuous improvement
- Learning over time
- Strong governance over model changes
- Clear auditability and explainability
This represents a shift from compliance as a static obligation to compliance as an evolving capability.
Translating Supervisory Expectations into Practice
To meet these expectations, many institutions are adopting modern AML approaches built around scenario-led detection, continuous refinement, and strong governance.
Such approaches enable compliance teams to:
- Respond more quickly to emerging risks
- Improve detection quality while managing noise
- Maintain transparency and regulatory confidence
Platforms that combine shared intelligence, explainable analytics, and unified monitoring across AML and fraud domains align closely with the direction signalled by recent FATF evaluations. Solutions such as Tookitaki’s FinCense illustrate how technology can support these outcomes while maintaining auditability and supervisory trust.
From Compliance to Confidence
The FATF Mutual Evaluation of Malaysia should be viewed as more than a formal assessment. It is a forward-looking signal.
Institutions that treat it purely as a compliance exercise may meet minimum standards. Those that use it as a reference point for strengthening risk understanding and control effectiveness are better positioned for sustained supervisory confidence.
Final Reflection
FATF evaluations increasingly focus on whether systems work in practice, not just whether they exist.
For Malaysian banks and fintechs, the December 2025 review reinforces a clear message. The institutions best prepared for the next supervisory cycle will be those that can demonstrate strong risk understanding, effective controls, and the ability to adapt as threats evolve.

RBNZ vs ASB: Why New Zealand’s AML Expectations Just Changed
In December 2025, the Reserve Bank of New Zealand sent one of its clearest signals yet to the financial sector. By filing civil proceedings against ASB Bank for breaches of the AML/CFT Act, the regulator made it clear that compliance in name alone is no longer sufficient. What matters now is whether anti-money laundering controls actually work in practice.
This was not a case about proven money laundering or terrorism financing. It was about operational effectiveness, timeliness, and accountability. For banks and financial institutions across New Zealand, that distinction is significant.
The action marks a turning point in how AML compliance will be assessed going forward. It reflects a shift from reviewing policies and frameworks to testing whether institutions can demonstrate real-world outcomes under scrutiny.

What Happened and Why It Matters
The Reserve Bank’s filing outlines multiple failures by ASB to meet core obligations under the AML/CFT Act. These included shortcomings in maintaining an effective AML programme, carrying out ongoing customer due diligence, applying enhanced due diligence when required, and reporting suspicious activity within mandated timeframes.
ASB admitted liability across all causes of action and cooperated with the regulator. The Reserve Bank also clarified that it was not alleging ASB knowingly facilitated money laundering or terrorism financing.
This clarification is important. The case is not about intent or criminal involvement. It is about whether an institution’s AML framework operated effectively and consistently over time.
For the wider market, this is a regulatory signal rather than an isolated enforcement action.
What the Reserve Bank Is Really Signalling
Read carefully, the Reserve Bank’s message goes beyond one bank. It reflects a broader recalibration of supervisory expectations.
First, AML effectiveness is now central. Regulators are no longer satisfied with documented programmes alone. Institutions must show that controls detect risk, escalate appropriately, and lead to timely action.
Second, speed matters. Delays in suspicious transaction reporting, extended remediation timelines, and slow responses to emerging risks are viewed as material failures, not operational inconveniences.
Third, governance and accountability are under the spotlight. AML effectiveness is not just a technology issue. It reflects resourcing decisions, prioritisation, escalation pathways, and senior oversight.
This mirrors developments in other comparable jurisdictions, including Australia, Singapore, and the United Kingdom, where regulators are increasingly outcome-focused.
Why This Is a Critical Moment for New Zealand’s Financial System
New Zealand’s AML regime has matured significantly over the past decade. Financial institutions have invested heavily in frameworks, teams, and tools. Yet the RBNZ action highlights a persistent gap between programme design and day-to-day execution.
This matters for several reasons.
Public confidence in the financial system depends not only on preventing crime, but on the belief that institutions can detect and respond to risk quickly and effectively.
From an international perspective, New Zealand’s reputation as a well-regulated financial centre supports correspondent banking relationships and cross-border trust. Supervisory actions like this are closely observed beyond domestic borders.
For compliance teams, the message is clear. Supervisory reviews will increasingly test how AML frameworks perform under real-world conditions, not how well they are documented.
Common AML Gaps Brought to Light
While the specifics of each institution differ, the issues raised by the Reserve Bank are widely recognised across the industry.
One common challenge is fragmented visibility. Customer risk data, transaction monitoring outputs, and historical alerts often sit in separate systems. This makes it difficult to build a unified view of risk or spot patterns over time.
Another challenge is static monitoring logic. Rule-based thresholds that are rarely reviewed struggle to keep pace with evolving typologies, particularly in an environment shaped by real-time payments and digital channels.
Ongoing customer due diligence also remains difficult to operationalise at scale. While onboarding checks are often robust, keeping customer risk profiles current requires continuous recalibration based on behaviour, exposure, and external intelligence.
Finally, reporting delays are frequently driven by workflow inefficiencies. Manual reviews, alert backlogs, and inconsistent escalation criteria can all slow the path from detection to reporting.
Individually, these issues may appear manageable. Together, they undermine AML effectiveness.
Why Traditional AML Models Are Under Strain
Many of these gaps stem from legacy AML operating models.
Traditional architectures rely heavily on static rules, manual investigations, and institution-specific intelligence. This approach struggles in an environment where financial crime is increasingly fast-moving, cross-border, and digitally enabled.
Compliance teams face persistent pressure. Alert volumes remain high, false positives consume investigator capacity, and regulatory expectations continue to rise. When resources are stretched, timeliness becomes harder to maintain.
Explainability is another challenge. Regulators expect institutions to articulate why decisions were made, not just that actions occurred. Systems that operate as black boxes make this difficult.
The result is a growing disconnect between regulatory expectations and operational reality.
The Shift Toward Effectiveness-Led AML
The RBNZ action reflects a broader move toward effectiveness-led AML supervision.
Under this approach, success is measured by outcomes rather than intent. Regulators are asking:
- Are risks identified early or only after escalation?
- Are enhanced due diligence triggers applied consistently?
- Are suspicious activities reported promptly and with sufficient context?
- Can institutions clearly explain and evidence their decisions?
Answering these questions requires more than incremental improvements. It requires a rethinking of how AML intelligence is sourced, applied, and validated.

Rethinking AML for the New Zealand Context
Modernising AML does not mean abandoning regulatory principles. It means strengthening how those principles are executed.
One important shift is toward scenario-driven detection. Instead of relying solely on generic thresholds, institutions increasingly use typologies grounded in real-world crime patterns. This aligns monitoring logic more closely with how financial crime actually occurs.
Another shift is toward continuous risk recalibration. Customer risk is not static. Systems that update risk profiles dynamically support more effective ongoing due diligence and reduce downstream escalation issues.
Collaboration also plays a growing role. Financial crime does not respect institutional boundaries. Access to shared intelligence helps institutions stay ahead of emerging threats rather than reacting in isolation.
Finally, transparency matters. Regulators expect clear, auditable logic that explains how risks are assessed and decisions are made.
Where Technology Can Support Better Outcomes
Technology alone does not solve AML challenges, but the right architecture can materially improve effectiveness.
Modern AML platforms increasingly support end-to-end workflows, covering onboarding, screening, transaction monitoring, risk scoring, investigation, and reporting within a connected environment.
Advanced analytics and machine learning can help reduce false positives while improving detection quality, when applied carefully and transparently.
Equally important is the ability to incorporate new intelligence quickly. Systems that can ingest updated typologies without lengthy redevelopment cycles are better suited to evolving risk landscapes.
How Tookitaki Supports This Evolution
Within this shifting environment, Tookitaki supports institutions as they move toward more effective AML outcomes.
FinCense, Tookitaki’s end-to-end compliance platform, is designed to support the full AML lifecycle, from real-time onboarding and screening to transaction monitoring, dynamic risk scoring, investigation, and reporting.
A distinguishing element is its connection to the AFC Ecosystem. This is a collaborative intelligence network where compliance professionals contribute, validate, and refine real-world scenarios based on emerging risks. These scenarios are continuously updated, allowing institutions to benefit from collective insights rather than relying solely on internal discovery.
For New Zealand institutions, this approach supports regulatory priorities around effectiveness, timeliness, and explainability. It strengthens detection quality while maintaining transparency and governance.
Importantly, technology is positioned as an enabler of better outcomes, not a substitute for oversight or accountability.
What Compliance Leaders in New Zealand Should Be Asking Now
In light of the RBNZ action, there are several questions worth asking internally.
- Can we evidence the effectiveness of our AML controls, not just their existence?
- How quickly do alerts move from detection to suspicious transaction reporting?
- Are enhanced due diligence triggers dynamic or static?
- Do we regularly test monitoring logic against emerging typologies?
- Could we confidently explain our AML decisions to the regulator tomorrow?
These questions are not about fault-finding. They are about readiness.
Looking Ahead
The Reserve Bank’s action against ASB marks a clear shift in New Zealand’s AML supervisory landscape. Effectiveness, timeliness, and accountability are now firmly in focus.
For financial institutions, this is both a challenge and an opportunity. Those that proactively strengthen their AML operating models will be better positioned to meet regulatory expectations and build long-term trust.
Ultimately, the lesson extends beyond one case. AML compliance in New Zealand is entering a new phase, one where outcomes matter as much as intent. Institutions that adapt early will define the next standard for financial crime prevention in the market.

AFASA Explained: What the Philippines’ New Anti-Scam Law Really Means for Banks, Fintechs, and Consumers
If there is one thing everyone in the financial industry felt in the last few years, it was the speed at which scams evolved. Fraudsters became smarter, attacks became faster, and stolen funds moved through dozens of accounts in seconds. Consumers were losing life savings. Banks and fintechs were overwhelmed. And regulators had to act.
This is the backdrop behind the Anti-Financial Account Scamming Act (AFASA), Republic Act No. 12010 — the Philippines’ most robust anti-scam law to date. AFASA reshapes how financial institutions detect fraud, protect accounts, coordinate with one another, and respond to disputes.
But while many have written about the law, most explanations feel overly legalistic or too high-level. What institutions really need is a practical, human-friendly breakdown of what AFASA truly means in day-to-day operations.
This blog does exactly that.

What Is AFASA? A Simple Explanation
AFASA exists for a clear purpose: to protect consumers from rapidly evolving digital fraud. The law recognises that as more Filipinos use e-wallets, online banking, and instant payments, scammers have gained more opportunities to exploit vulnerabilities.
Under AFASA, the term financial account is broad. It includes:
- Bank deposit accounts
- Credit card and investment accounts
- E-wallets
- Any account used to access financial products and services
The law focuses on three main categories of offences:
1. Money Muling
This covers the buying, selling, renting, lending, recruiting, or using of financial accounts to receive or move illicit funds. Many young people and jobseekers were unknowingly lured into mule networks — something AFASA squarely targets.
2. Social Engineering Schemes
From phishing to impersonation, scammers have mastered psychological manipulation. AFASA penalises the use of deception to obtain sensitive information or access accounts.
3. Digital Fraud and Account Tampering
This includes unauthorised transfers, synthetic identities, hacking incidents, and scams executed through electronic communication channels.
In short: AFASA criminalises both the scammer and the infrastructure used for the scam — the accounts, the networks, and the people recruited into them.
Why AFASA Became Necessary
Scams in the Philippines reached a point where traditional fraud rules, old operational processes, and siloed detection systems were not enough.
Scam Trend 1: Social engineering became hyper-personal
Fraudsters learned to sound like bank agents, government officers, delivery riders, HR recruiters — even loved ones. OTP harvesting and remote access scams became common.
Scam Trend 2: Real-time payments made fraud instant
InstaPay and other instant channels made moving money convenient — but also made stolen funds disappear before anyone could react.
Scam Trend 3: Mule networks became organised
Criminal groups built structured pipelines of mule accounts, often recruiting vulnerable populations such as students, OFWs, and low-income households.
Scam Trend 4: E-wallet adoption outpaced awareness
A fast-growing digital economy meant millions of first-time digital users were exposed to sophisticated scams they were not prepared for.
AFASA was designed to break this cycle and create a safer digital financial environment.
New Responsibilities for Banks and Fintechs Under AFASA
AFASA introduces significant changes to how institutions must protect accounts. It is not just a compliance exercise — it demands real operational transformation.
These responsibilities are further detailed in new BSP circulars that accompany the law.
1. Stronger IT Risk Controls
Financial institutions must now implement advanced fraud and cybersecurity controls such as:
- Device fingerprinting
- Geolocation monitoring
- Bot detection
- Blacklist screening for devices, merchants, and IPs
These measures allow institutions to understand who is accessing accounts, how, and from where — giving them the tools to detect anomalies before fraud occurs.
2. Mandatory Fraud Management Systems (FMS)
Both financial institutions and clearing switch operators (including InstaPay and PESONet) must operate real-time systems that:
- Flag suspicious activity
- Block disputed or high-risk transactions
- Detect behavioural anomalies
This ensures that fraud monitoring is consistent across the payment ecosystem — not just within individual institutions.
3. Prohibition on unsolicited clickable links
Institutions can no longer send clickable links or QR codes to customers unless explicitly initiated by the customer. This directly tackles phishing attacks that relied on spoofed messages.
4. Continuous customer awareness
Banks and fintechs must actively educate customers about:
- Cyber hygiene
- Secure account practices
- Fraud patterns and red flags
- How to report incidents quickly
Customer education is no longer optional — it is a formally recognised part of fraud prevention.
5. Shared accountability framework
AFASA moves away from the old “blame the victim” mentality. Fraud prevention is now a shared responsibility across:
- Financial institutions
- Account owners
- Third-party service providers
This model recognises that no single party can combat fraud alone.
The Heart of AFASA: Temporary Holding of Funds & Coordinated Verification
Among all the changes introduced by AFASA, this is the one that represents a true paradigm shift.
Previously, once stolen funds were transferred out, recovery was almost impossible. Banks had little authority to stop or hold the movement of funds.
AFASA changes that.
Temporary Holding of Funds
Financial institutions now have the authority — and obligation — to temporarily hold disputed funds for up to 30 days. This includes both the initial hold and any permitted extension. The purpose is simple:
freeze the money before it disappears.
Triggers for Temporary Holding
A hold can be initiated through:
- A victim’s complaint
- A suspicious transaction flagged by the institution’s FMS
- A request from another financial institution
This ensures that action can be taken proactively or reactively depending on the scenario.
Coordinated Verification Process
Once funds are held, institutions must immediately begin a coordinated process that involves:
- The originating institution
- Receiving institutions
- Clearing entities
- The account owners involved
This process validates whether the transaction was legitimate or fraudulent. It creates a formal, structured, and time-bound mechanism for investigation.
Detailed Transaction Logs Are Now Mandatory
Institutions must maintain comprehensive transaction logs — including device information, authentication events, IP addresses, timestamps, password changes, and more. Logs must be retained for at least five years.
This gives investigators the ability to reconstruct transactions and understand the full context of a disputed transfer.
An Industry-Wide Protocol Must Be Built
AFASA requires the entire industry to co-develop a unified protocol for handling disputed funds and verification. This ensures consistency, promotes collaboration, and reduces delays during investigations.
This is one of the most forward-thinking aspects of the law — and one that will significantly raise the standard of scam response in the country.
BSP’s Expanded Powers Through CAPO
AFASA also strengthens regulatory oversight.
BSP’s Consumer Account Protection Office (CAPO) now has the authority to:
- Conduct inquiries into financial accounts suspected of involvement in fraud
- Access financial account information required to investigate prohibited acts
- Coordinate with law enforcement agencies
Crucially, during these inquiries, bank secrecy laws and the Data Privacy Act do not apply.
This is a major shift that reflects the urgency of combating digital fraud.
Crucially, during these inquiries, bank secrecy laws and the Data Privacy Act do not apply.
This is a major shift that reflects the urgency of combating digital fraud.

Penalties Under AFASA
AFASA imposes serious penalties to deter both scammers and enablers:
1. Criminal penalties for money muling
Anyone who knowingly participates in using, recruiting, or providing accounts for illicit transfers is liable to face imprisonment and fines.
2. Liability for failing to protect funds
Institutions may be held accountable if they fail to properly execute a temporary hold when a dispute is raised.
3. Penalties for improper holding
Institutions that hold funds without valid reason may also face sanctions.
4. Penalties for malicious reporting
Consumers or individuals who intentionally file false reports may also be punished.
5. Administrative sanctions
Financial institutions that fail to comply with AFASA requirements may be penalised by BSP.
The penalties underscore the seriousness with which the government views scam prevention.
What AFASA Means for Banks and Fintechs: The Practical Reality
Here’s what changes on the ground:
1. Fraud detection becomes real-time — not after-the-fact
Institutions need modern systems that can flag abnormal behaviour within seconds.
2. Dispute response becomes faster
Timeframes are tight, and institutions need streamlined internal workflows.
3. Collaboration is no longer optional
Banks, e-wallets, payment operators, and regulators must work as one system.
4. Operational pressure increases
Fraud teams must handle verification, logging, documentation, and communication under strict timelines.
5. Liability is higher
Institutions may be held responsible for lapses in protection, detection, or response.
6. Technology uplift becomes non-negotiable
Legacy systems will struggle to meet AFASA’s requirements — particularly around logging, behavioural analytics, and real-time detection.
How Tookitaki Helps Institutions Align With AFASA
AFASA sets a higher bar for fraud prevention. Tookitaki’s role as the Trust Layer to Fight Financial Crime helps institutions strengthen their AFASA readiness with intelligent, real-time, and collaborative capabilities.
1. Early detection of money mule networks
Through the AFC Ecosystem’s collective intelligence, institutions can detect mule-like patterns sooner and prevent illicit transactions before they spread across the system.
2. Real-time monitoring aligned with AFASA needs
FinCense’s advanced transaction monitoring engine flags suspicious activity instantly — helping institutions support temporary holding procedures and respond within required timelines.
3. Deep behavioural intelligence and comprehensive logs
Tookitaki provides the contextual understanding needed to trace disputed transfers, reconstruct transaction paths, and support investigative workflows.
4. Agentic AI to accelerate investigations
FinMate, the AI investigation copilot, streamlines case analysis, surfaces insights quickly, and reduces investigation workload — especially crucial when time-sensitive AFASA processes are triggered.
5. Federated learning for privacy-preserving model improvement
Institutions can enhance detection models without sharing raw data, aligning with AFASA’s broader emphasis on secure and responsible handling of financial information.
Together, these capabilities enable banks and fintechs to strengthen fraud defences, modernise their operations, and protect financial accounts with confidence.
Looking Ahead: AFASA’s Long-Term Impact
AFASA is not a one-time regulatory update — it is a structural shift in how the Philippine financial ecosystem handles scams.
Expect to see:
- More real-time fraud rules and guidance
- Industry-wide technical standards for dispute management
- Higher expectations for digital onboarding and authentication
- Increased coordination between banks, fintechs, and regulators
- Greater focus on intelligence-sharing and network-level detection
Most importantly, AFASA lays the foundation for a safer, more trusted digital economy — one where consumers have confidence that institutions and regulators can protect them from fast-evolving threats.
Conclusion
AFASA represents a turning point in the Philippines’ fight against financial scams. It transforms how institutions detect fraud, protect accounts, collaborate with others, and support customers. For banks and fintechs, the message is clear: the era of passive fraud response is over.
The institutions that will thrive under AFASA are those that embrace real-time intelligence, strengthen operational resilience, and adopt technology that enables them to stay ahead of criminal innovation.
The Philippines has taken a bold step toward a safer financial system — and now, it’s time for the industry to match that ambition.

Beyond the Ratings: What FATF’s December 2025 Review Means for Malaysia’s AML Playbook
When the Financial Action Task Force publishes a Mutual Evaluation Report, it is not simply assessing the existence of laws and controls. It is examining whether those measures are producing real, demonstrable outcomes across the financial system.
The FATF Mutual Evaluation Report on Malaysia, published in December 2025, sends a clear signal in this regard. Beyond the headline ratings, the evaluation focuses on how effectively money laundering and terrorist financing risks are understood, prioritised, and mitigated in practice.
For banks, fintechs, and compliance teams operating in Malaysia, the real value of the report lies in these signals. They indicate where supervisory scrutiny is likely to intensify and where institutions are expected to demonstrate stronger alignment between risk understanding and operational controls.

What a FATF Mutual Evaluation Is Really Testing
A FATF Mutual Evaluation assesses two interconnected dimensions.
The first is technical compliance, which looks at whether the legal and institutional framework aligns with FATF Recommendations.
The second, and increasingly decisive, dimension is effectiveness. This examines whether authorities and reporting entities are achieving intended outcomes, including timely detection, meaningful disruption of illicit financial activity, and effective use of financial intelligence.
In recent evaluation cycles, FATF has made it clear that strong frameworks alone are insufficient. Supervisors are looking for evidence that risks are properly understood and that controls are proportionate, targeted, and working as intended. Malaysia’s December 2025 evaluation reflects this emphasis throughout.
Why Malaysia’s Evaluation Carries Regional Significance
Malaysia plays a central role in Southeast Asia’s financial system. It supports significant volumes of cross-border trade, remittance flows, and correspondent banking activity, alongside a rapidly growing digital payments and fintech ecosystem.
This positioning increases exposure to complex and evolving money laundering risks. FATF’s evaluation recognises Malaysia’s progress in strengthening its framework, while also highlighting the need for continued focus on risk-based implementation as financial crime becomes more cross-border, more technology-driven, and more fragmented.
For financial institutions, this reinforces the expectation that controls must evolve alongside the risk landscape, not lag behind it.
Key Signals Emerging from the December 2025 Evaluation
Effectiveness Takes Precedence Over Formal Compliance
One of the strongest signals from the evaluation is the emphasis on demonstrable effectiveness.
Institutions are expected to show that:
- Higher-risk activities are identified and prioritised
- Detection mechanisms are capable of identifying complex and layered activity
- Alerts, investigations, and reporting are aligned with real risk exposure
- Financial intelligence leads to meaningful outcomes
Controls that exist but do not clearly contribute to these outcomes are unlikely to meet supervisory expectations.
Risk Understanding Must Drive Control Design
The evaluation reinforces that a risk-based approach must extend beyond documentation and enterprise risk assessments.
Financial institutions are expected to:
- Clearly articulate their understanding of inherent and residual risks
- Translate that understanding into targeted monitoring scenarios
- Adjust controls as new products, delivery channels, and typologies emerge
Generic or static monitoring frameworks risk being viewed as insufficiently aligned with actual exposure.
Ongoing Focus on Cross-Border and Predicate Offence Risks
Consistent with Malaysia’s role as a regional financial hub, the evaluation places continued emphasis on cross-border risks.
These include exposure to:
- Trade-based money laundering
- Proceeds linked to organised crime and corruption
- Cross-border remittances and correspondent banking relationships
FATF’s focus here signals that institutions must demonstrate not just transaction monitoring coverage, but the ability to interpret cross-border activity in context and identify suspicious patterns that span multiple channels.
Expanding Attention on Non-Bank and Digital Channels
While banks remain central to Malaysia’s AML framework, the evaluation highlights increasing supervisory attention on:
- Payment institutions
- Digital platforms
- Designated non-financial businesses and professions
As risks shift across the financial ecosystem, regulators expect banks and fintechs to understand how their exposures interact with activity outside traditional banking channels.
Practical Implications for Malaysian Financial Institutions
For compliance teams, the December 2025 evaluation translates into several operational realities.
Supervisory Engagement Will Be More Outcome-Focused
Regulators are likely to probe:
- Whether monitoring scenarios reflect current risk assessments
- How detection logic has evolved over time
- What evidence demonstrates that controls are effective
Institutions that cannot clearly explain how their controls address specific risks may face increased scrutiny.
Alert Volumes Will Be Scrutinised for Quality
High alert volumes are no longer viewed as evidence of strong controls.
Supervisors are increasingly focused on:
- The relevance of alerts generated
- The quality of investigations
- The timeliness and usefulness of suspicious transaction reporting
This places pressure on institutions to improve signal quality while managing operational efficiency.
Static Monitoring Frameworks Will Be Challenged
The pace at which money laundering typologies evolve continues to accelerate.
Institutions that rely on:
- Infrequent scenario reviews
- Manual rule tuning
- Disconnected monitoring systems
may struggle to demonstrate timely adaptation to emerging risks highlighted through national risk assessments or supervisory feedback.

Common Execution Gaps Highlighted Through FATF Evaluations
Across jurisdictions, FATF evaluations frequently expose similar challenges.
Fragmented Monitoring Approaches
Siloed AML and fraud systems limit the ability to see end-to-end money flows and behavioural patterns.
Slow Adaptation to Emerging Typologies
Scenario libraries can lag behind real-world risk evolution, particularly without access to shared intelligence.
Operational Strain from False Positives
Excessive alert volumes reduce investigator effectiveness and dilute regulatory reporting quality.
Explainability and Governance Limitations
Institutions must be able to explain why controls behave as they do. Opaque or poorly governed models raise supervisory concerns.
What FATF Is Signalling About the Next Phase
While not always stated explicitly, the evaluation reflects expectations that institutions will continue to mature their AML capabilities.
Supervisors are looking for evidence of:
- Continuous improvement
- Learning over time
- Strong governance over model changes
- Clear auditability and explainability
This represents a shift from compliance as a static obligation to compliance as an evolving capability.
Translating Supervisory Expectations into Practice
To meet these expectations, many institutions are adopting modern AML approaches built around scenario-led detection, continuous refinement, and strong governance.
Such approaches enable compliance teams to:
- Respond more quickly to emerging risks
- Improve detection quality while managing noise
- Maintain transparency and regulatory confidence
Platforms that combine shared intelligence, explainable analytics, and unified monitoring across AML and fraud domains align closely with the direction signalled by recent FATF evaluations. Solutions such as Tookitaki’s FinCense illustrate how technology can support these outcomes while maintaining auditability and supervisory trust.
From Compliance to Confidence
The FATF Mutual Evaluation of Malaysia should be viewed as more than a formal assessment. It is a forward-looking signal.
Institutions that treat it purely as a compliance exercise may meet minimum standards. Those that use it as a reference point for strengthening risk understanding and control effectiveness are better positioned for sustained supervisory confidence.
Final Reflection
FATF evaluations increasingly focus on whether systems work in practice, not just whether they exist.
For Malaysian banks and fintechs, the December 2025 review reinforces a clear message. The institutions best prepared for the next supervisory cycle will be those that can demonstrate strong risk understanding, effective controls, and the ability to adapt as threats evolve.

RBNZ vs ASB: Why New Zealand’s AML Expectations Just Changed
In December 2025, the Reserve Bank of New Zealand sent one of its clearest signals yet to the financial sector. By filing civil proceedings against ASB Bank for breaches of the AML/CFT Act, the regulator made it clear that compliance in name alone is no longer sufficient. What matters now is whether anti-money laundering controls actually work in practice.
This was not a case about proven money laundering or terrorism financing. It was about operational effectiveness, timeliness, and accountability. For banks and financial institutions across New Zealand, that distinction is significant.
The action marks a turning point in how AML compliance will be assessed going forward. It reflects a shift from reviewing policies and frameworks to testing whether institutions can demonstrate real-world outcomes under scrutiny.

What Happened and Why It Matters
The Reserve Bank’s filing outlines multiple failures by ASB to meet core obligations under the AML/CFT Act. These included shortcomings in maintaining an effective AML programme, carrying out ongoing customer due diligence, applying enhanced due diligence when required, and reporting suspicious activity within mandated timeframes.
ASB admitted liability across all causes of action and cooperated with the regulator. The Reserve Bank also clarified that it was not alleging ASB knowingly facilitated money laundering or terrorism financing.
This clarification is important. The case is not about intent or criminal involvement. It is about whether an institution’s AML framework operated effectively and consistently over time.
For the wider market, this is a regulatory signal rather than an isolated enforcement action.
What the Reserve Bank Is Really Signalling
Read carefully, the Reserve Bank’s message goes beyond one bank. It reflects a broader recalibration of supervisory expectations.
First, AML effectiveness is now central. Regulators are no longer satisfied with documented programmes alone. Institutions must show that controls detect risk, escalate appropriately, and lead to timely action.
Second, speed matters. Delays in suspicious transaction reporting, extended remediation timelines, and slow responses to emerging risks are viewed as material failures, not operational inconveniences.
Third, governance and accountability are under the spotlight. AML effectiveness is not just a technology issue. It reflects resourcing decisions, prioritisation, escalation pathways, and senior oversight.
This mirrors developments in other comparable jurisdictions, including Australia, Singapore, and the United Kingdom, where regulators are increasingly outcome-focused.
Why This Is a Critical Moment for New Zealand’s Financial System
New Zealand’s AML regime has matured significantly over the past decade. Financial institutions have invested heavily in frameworks, teams, and tools. Yet the RBNZ action highlights a persistent gap between programme design and day-to-day execution.
This matters for several reasons.
Public confidence in the financial system depends not only on preventing crime, but on the belief that institutions can detect and respond to risk quickly and effectively.
From an international perspective, New Zealand’s reputation as a well-regulated financial centre supports correspondent banking relationships and cross-border trust. Supervisory actions like this are closely observed beyond domestic borders.
For compliance teams, the message is clear. Supervisory reviews will increasingly test how AML frameworks perform under real-world conditions, not how well they are documented.
Common AML Gaps Brought to Light
While the specifics of each institution differ, the issues raised by the Reserve Bank are widely recognised across the industry.
One common challenge is fragmented visibility. Customer risk data, transaction monitoring outputs, and historical alerts often sit in separate systems. This makes it difficult to build a unified view of risk or spot patterns over time.
Another challenge is static monitoring logic. Rule-based thresholds that are rarely reviewed struggle to keep pace with evolving typologies, particularly in an environment shaped by real-time payments and digital channels.
Ongoing customer due diligence also remains difficult to operationalise at scale. While onboarding checks are often robust, keeping customer risk profiles current requires continuous recalibration based on behaviour, exposure, and external intelligence.
Finally, reporting delays are frequently driven by workflow inefficiencies. Manual reviews, alert backlogs, and inconsistent escalation criteria can all slow the path from detection to reporting.
Individually, these issues may appear manageable. Together, they undermine AML effectiveness.
Why Traditional AML Models Are Under Strain
Many of these gaps stem from legacy AML operating models.
Traditional architectures rely heavily on static rules, manual investigations, and institution-specific intelligence. This approach struggles in an environment where financial crime is increasingly fast-moving, cross-border, and digitally enabled.
Compliance teams face persistent pressure. Alert volumes remain high, false positives consume investigator capacity, and regulatory expectations continue to rise. When resources are stretched, timeliness becomes harder to maintain.
Explainability is another challenge. Regulators expect institutions to articulate why decisions were made, not just that actions occurred. Systems that operate as black boxes make this difficult.
The result is a growing disconnect between regulatory expectations and operational reality.
The Shift Toward Effectiveness-Led AML
The RBNZ action reflects a broader move toward effectiveness-led AML supervision.
Under this approach, success is measured by outcomes rather than intent. Regulators are asking:
- Are risks identified early or only after escalation?
- Are enhanced due diligence triggers applied consistently?
- Are suspicious activities reported promptly and with sufficient context?
- Can institutions clearly explain and evidence their decisions?
Answering these questions requires more than incremental improvements. It requires a rethinking of how AML intelligence is sourced, applied, and validated.

Rethinking AML for the New Zealand Context
Modernising AML does not mean abandoning regulatory principles. It means strengthening how those principles are executed.
One important shift is toward scenario-driven detection. Instead of relying solely on generic thresholds, institutions increasingly use typologies grounded in real-world crime patterns. This aligns monitoring logic more closely with how financial crime actually occurs.
Another shift is toward continuous risk recalibration. Customer risk is not static. Systems that update risk profiles dynamically support more effective ongoing due diligence and reduce downstream escalation issues.
Collaboration also plays a growing role. Financial crime does not respect institutional boundaries. Access to shared intelligence helps institutions stay ahead of emerging threats rather than reacting in isolation.
Finally, transparency matters. Regulators expect clear, auditable logic that explains how risks are assessed and decisions are made.
Where Technology Can Support Better Outcomes
Technology alone does not solve AML challenges, but the right architecture can materially improve effectiveness.
Modern AML platforms increasingly support end-to-end workflows, covering onboarding, screening, transaction monitoring, risk scoring, investigation, and reporting within a connected environment.
Advanced analytics and machine learning can help reduce false positives while improving detection quality, when applied carefully and transparently.
Equally important is the ability to incorporate new intelligence quickly. Systems that can ingest updated typologies without lengthy redevelopment cycles are better suited to evolving risk landscapes.
How Tookitaki Supports This Evolution
Within this shifting environment, Tookitaki supports institutions as they move toward more effective AML outcomes.
FinCense, Tookitaki’s end-to-end compliance platform, is designed to support the full AML lifecycle, from real-time onboarding and screening to transaction monitoring, dynamic risk scoring, investigation, and reporting.
A distinguishing element is its connection to the AFC Ecosystem. This is a collaborative intelligence network where compliance professionals contribute, validate, and refine real-world scenarios based on emerging risks. These scenarios are continuously updated, allowing institutions to benefit from collective insights rather than relying solely on internal discovery.
For New Zealand institutions, this approach supports regulatory priorities around effectiveness, timeliness, and explainability. It strengthens detection quality while maintaining transparency and governance.
Importantly, technology is positioned as an enabler of better outcomes, not a substitute for oversight or accountability.
What Compliance Leaders in New Zealand Should Be Asking Now
In light of the RBNZ action, there are several questions worth asking internally.
- Can we evidence the effectiveness of our AML controls, not just their existence?
- How quickly do alerts move from detection to suspicious transaction reporting?
- Are enhanced due diligence triggers dynamic or static?
- Do we regularly test monitoring logic against emerging typologies?
- Could we confidently explain our AML decisions to the regulator tomorrow?
These questions are not about fault-finding. They are about readiness.
Looking Ahead
The Reserve Bank’s action against ASB marks a clear shift in New Zealand’s AML supervisory landscape. Effectiveness, timeliness, and accountability are now firmly in focus.
For financial institutions, this is both a challenge and an opportunity. Those that proactively strengthen their AML operating models will be better positioned to meet regulatory expectations and build long-term trust.
Ultimately, the lesson extends beyond one case. AML compliance in New Zealand is entering a new phase, one where outcomes matter as much as intent. Institutions that adapt early will define the next standard for financial crime prevention in the market.

AFASA Explained: What the Philippines’ New Anti-Scam Law Really Means for Banks, Fintechs, and Consumers
If there is one thing everyone in the financial industry felt in the last few years, it was the speed at which scams evolved. Fraudsters became smarter, attacks became faster, and stolen funds moved through dozens of accounts in seconds. Consumers were losing life savings. Banks and fintechs were overwhelmed. And regulators had to act.
This is the backdrop behind the Anti-Financial Account Scamming Act (AFASA), Republic Act No. 12010 — the Philippines’ most robust anti-scam law to date. AFASA reshapes how financial institutions detect fraud, protect accounts, coordinate with one another, and respond to disputes.
But while many have written about the law, most explanations feel overly legalistic or too high-level. What institutions really need is a practical, human-friendly breakdown of what AFASA truly means in day-to-day operations.
This blog does exactly that.

What Is AFASA? A Simple Explanation
AFASA exists for a clear purpose: to protect consumers from rapidly evolving digital fraud. The law recognises that as more Filipinos use e-wallets, online banking, and instant payments, scammers have gained more opportunities to exploit vulnerabilities.
Under AFASA, the term financial account is broad. It includes:
- Bank deposit accounts
- Credit card and investment accounts
- E-wallets
- Any account used to access financial products and services
The law focuses on three main categories of offences:
1. Money Muling
This covers the buying, selling, renting, lending, recruiting, or using of financial accounts to receive or move illicit funds. Many young people and jobseekers were unknowingly lured into mule networks — something AFASA squarely targets.
2. Social Engineering Schemes
From phishing to impersonation, scammers have mastered psychological manipulation. AFASA penalises the use of deception to obtain sensitive information or access accounts.
3. Digital Fraud and Account Tampering
This includes unauthorised transfers, synthetic identities, hacking incidents, and scams executed through electronic communication channels.
In short: AFASA criminalises both the scammer and the infrastructure used for the scam — the accounts, the networks, and the people recruited into them.
Why AFASA Became Necessary
Scams in the Philippines reached a point where traditional fraud rules, old operational processes, and siloed detection systems were not enough.
Scam Trend 1: Social engineering became hyper-personal
Fraudsters learned to sound like bank agents, government officers, delivery riders, HR recruiters — even loved ones. OTP harvesting and remote access scams became common.
Scam Trend 2: Real-time payments made fraud instant
InstaPay and other instant channels made moving money convenient — but also made stolen funds disappear before anyone could react.
Scam Trend 3: Mule networks became organised
Criminal groups built structured pipelines of mule accounts, often recruiting vulnerable populations such as students, OFWs, and low-income households.
Scam Trend 4: E-wallet adoption outpaced awareness
A fast-growing digital economy meant millions of first-time digital users were exposed to sophisticated scams they were not prepared for.
AFASA was designed to break this cycle and create a safer digital financial environment.
New Responsibilities for Banks and Fintechs Under AFASA
AFASA introduces significant changes to how institutions must protect accounts. It is not just a compliance exercise — it demands real operational transformation.
These responsibilities are further detailed in new BSP circulars that accompany the law.
1. Stronger IT Risk Controls
Financial institutions must now implement advanced fraud and cybersecurity controls such as:
- Device fingerprinting
- Geolocation monitoring
- Bot detection
- Blacklist screening for devices, merchants, and IPs
These measures allow institutions to understand who is accessing accounts, how, and from where — giving them the tools to detect anomalies before fraud occurs.
2. Mandatory Fraud Management Systems (FMS)
Both financial institutions and clearing switch operators (including InstaPay and PESONet) must operate real-time systems that:
- Flag suspicious activity
- Block disputed or high-risk transactions
- Detect behavioural anomalies
This ensures that fraud monitoring is consistent across the payment ecosystem — not just within individual institutions.
3. Prohibition on unsolicited clickable links
Institutions can no longer send clickable links or QR codes to customers unless explicitly initiated by the customer. This directly tackles phishing attacks that relied on spoofed messages.
4. Continuous customer awareness
Banks and fintechs must actively educate customers about:
- Cyber hygiene
- Secure account practices
- Fraud patterns and red flags
- How to report incidents quickly
Customer education is no longer optional — it is a formally recognised part of fraud prevention.
5. Shared accountability framework
AFASA moves away from the old “blame the victim” mentality. Fraud prevention is now a shared responsibility across:
- Financial institutions
- Account owners
- Third-party service providers
This model recognises that no single party can combat fraud alone.
The Heart of AFASA: Temporary Holding of Funds & Coordinated Verification
Among all the changes introduced by AFASA, this is the one that represents a true paradigm shift.
Previously, once stolen funds were transferred out, recovery was almost impossible. Banks had little authority to stop or hold the movement of funds.
AFASA changes that.
Temporary Holding of Funds
Financial institutions now have the authority — and obligation — to temporarily hold disputed funds for up to 30 days. This includes both the initial hold and any permitted extension. The purpose is simple:
freeze the money before it disappears.
Triggers for Temporary Holding
A hold can be initiated through:
- A victim’s complaint
- A suspicious transaction flagged by the institution’s FMS
- A request from another financial institution
This ensures that action can be taken proactively or reactively depending on the scenario.
Coordinated Verification Process
Once funds are held, institutions must immediately begin a coordinated process that involves:
- The originating institution
- Receiving institutions
- Clearing entities
- The account owners involved
This process validates whether the transaction was legitimate or fraudulent. It creates a formal, structured, and time-bound mechanism for investigation.
Detailed Transaction Logs Are Now Mandatory
Institutions must maintain comprehensive transaction logs — including device information, authentication events, IP addresses, timestamps, password changes, and more. Logs must be retained for at least five years.
This gives investigators the ability to reconstruct transactions and understand the full context of a disputed transfer.
An Industry-Wide Protocol Must Be Built
AFASA requires the entire industry to co-develop a unified protocol for handling disputed funds and verification. This ensures consistency, promotes collaboration, and reduces delays during investigations.
This is one of the most forward-thinking aspects of the law — and one that will significantly raise the standard of scam response in the country.
BSP’s Expanded Powers Through CAPO
AFASA also strengthens regulatory oversight.
BSP’s Consumer Account Protection Office (CAPO) now has the authority to:
- Conduct inquiries into financial accounts suspected of involvement in fraud
- Access financial account information required to investigate prohibited acts
- Coordinate with law enforcement agencies
Crucially, during these inquiries, bank secrecy laws and the Data Privacy Act do not apply.
This is a major shift that reflects the urgency of combating digital fraud.
Crucially, during these inquiries, bank secrecy laws and the Data Privacy Act do not apply.
This is a major shift that reflects the urgency of combating digital fraud.

Penalties Under AFASA
AFASA imposes serious penalties to deter both scammers and enablers:
1. Criminal penalties for money muling
Anyone who knowingly participates in using, recruiting, or providing accounts for illicit transfers is liable to face imprisonment and fines.
2. Liability for failing to protect funds
Institutions may be held accountable if they fail to properly execute a temporary hold when a dispute is raised.
3. Penalties for improper holding
Institutions that hold funds without valid reason may also face sanctions.
4. Penalties for malicious reporting
Consumers or individuals who intentionally file false reports may also be punished.
5. Administrative sanctions
Financial institutions that fail to comply with AFASA requirements may be penalised by BSP.
The penalties underscore the seriousness with which the government views scam prevention.
What AFASA Means for Banks and Fintechs: The Practical Reality
Here’s what changes on the ground:
1. Fraud detection becomes real-time — not after-the-fact
Institutions need modern systems that can flag abnormal behaviour within seconds.
2. Dispute response becomes faster
Timeframes are tight, and institutions need streamlined internal workflows.
3. Collaboration is no longer optional
Banks, e-wallets, payment operators, and regulators must work as one system.
4. Operational pressure increases
Fraud teams must handle verification, logging, documentation, and communication under strict timelines.
5. Liability is higher
Institutions may be held responsible for lapses in protection, detection, or response.
6. Technology uplift becomes non-negotiable
Legacy systems will struggle to meet AFASA’s requirements — particularly around logging, behavioural analytics, and real-time detection.
How Tookitaki Helps Institutions Align With AFASA
AFASA sets a higher bar for fraud prevention. Tookitaki’s role as the Trust Layer to Fight Financial Crime helps institutions strengthen their AFASA readiness with intelligent, real-time, and collaborative capabilities.
1. Early detection of money mule networks
Through the AFC Ecosystem’s collective intelligence, institutions can detect mule-like patterns sooner and prevent illicit transactions before they spread across the system.
2. Real-time monitoring aligned with AFASA needs
FinCense’s advanced transaction monitoring engine flags suspicious activity instantly — helping institutions support temporary holding procedures and respond within required timelines.
3. Deep behavioural intelligence and comprehensive logs
Tookitaki provides the contextual understanding needed to trace disputed transfers, reconstruct transaction paths, and support investigative workflows.
4. Agentic AI to accelerate investigations
FinMate, the AI investigation copilot, streamlines case analysis, surfaces insights quickly, and reduces investigation workload — especially crucial when time-sensitive AFASA processes are triggered.
5. Federated learning for privacy-preserving model improvement
Institutions can enhance detection models without sharing raw data, aligning with AFASA’s broader emphasis on secure and responsible handling of financial information.
Together, these capabilities enable banks and fintechs to strengthen fraud defences, modernise their operations, and protect financial accounts with confidence.
Looking Ahead: AFASA’s Long-Term Impact
AFASA is not a one-time regulatory update — it is a structural shift in how the Philippine financial ecosystem handles scams.
Expect to see:
- More real-time fraud rules and guidance
- Industry-wide technical standards for dispute management
- Higher expectations for digital onboarding and authentication
- Increased coordination between banks, fintechs, and regulators
- Greater focus on intelligence-sharing and network-level detection
Most importantly, AFASA lays the foundation for a safer, more trusted digital economy — one where consumers have confidence that institutions and regulators can protect them from fast-evolving threats.
Conclusion
AFASA represents a turning point in the Philippines’ fight against financial scams. It transforms how institutions detect fraud, protect accounts, collaborate with others, and support customers. For banks and fintechs, the message is clear: the era of passive fraud response is over.
The institutions that will thrive under AFASA are those that embrace real-time intelligence, strengthen operational resilience, and adopt technology that enables them to stay ahead of criminal innovation.
The Philippines has taken a bold step toward a safer financial system — and now, it’s time for the industry to match that ambition.


