By Luz Wendy T. Noble, Journalist
THE BANGKO SENTRAL ng Pilipinas (BSP) announced Thursday that it has approved sanctions against BDO Unibank, Inc. and UnionBank of the Philippines, Inc. following an online fraud incident involving customer accounts in December.
In a statement, the BSP said it had completed the investigation into the incident which “originated from a compromised web service” and involved unauthorized access to BDO accounts and fund transfers mainly to UnionBank accounts.
“Based on the results of the investigation, the Monetary Board has approved the imposition of sanctions on BDO and UnionBank to ensure that the two banks quickly resolve the issues,” he said.
The sanctions “underscore the importance of continuously improving risk management systems involving cybersecurity, anti-money laundering, and countering the financing of terrorism and proliferation,” the BSP said.
UnionBank President and CEO Edwin R. Bautista said the BSP did not impose monetary penalties.
“All BSP recommendations to avoid such incidents have been implemented. No monetary penalty. But we have been asked to increase our capital charge against operational risk,” he said in a text message.
He said UnionBank fully cooperated with BDO and the BSP, and froze a “significant amount and returned it to BDO.”
BDO President and CEO Nestor V. Tan said the bank will comply with BSP sanctions. “We will work with the BSP to ensure a more secure banking environment,” he said via Viber message.
In deciding on the sanctions, the BSP said it took into consideration the corrective measures implemented by the two banks related to the cyber incident, including BDO’s decision to refund funds from its affaffected customers.
“This incident reminds us that we must continue to strengthen our defenses against cyber threats in order to protect the integrity of the financial system and the interests of depositors,” BSP Governor Benjamin E. Diokno said in a statement.
In December, some BDO clients took to social media to complain about unauthorized funds transfers from their accounts to fictitious accounts at UnionBank.
In January, the National Bureau of Investigation arrested several people believed to be behind the hacking incident that affected more than 700 BDO clients.
The hackers stole about 1.2 million pesos but could have potentially embezzled more than 50 million pesos had the transactions not been immediately flagged as suspicious, the NBI said.