Lawyerly

[ REPUBLIC ACT NO. 12010, July 20, 2024 ]

AN ACT DEFINING AND PENALIZING FINANCIAL ACCOUNT SCAMMING AND OTHER OFFENSES, AND PROVIDING FOR THE ENFORCEMENT MECHANISMS THEREFOR

Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:

SECTION 1. Short Title. - This Act shall be known as the "Anti-Financial Account Scamming Act (AFASA)".

SEC. 2. Declaration of Policy. - The State recognize the vital role of banks, non-bank financial institutions, other payment service providers, and the general banking public in promoting and maintaining a stable and efficient financial system. The State also acknowledge that with the increased use of electronic and digital financial services, there is a need to promote awareness on the proper use of Financial Accounts and to protect the public from cybercriminals and criminal syndicates who target Financial Accounts or lure Account Owners into becoming accessories or perpetrators of fraudulent activities. The State shall undertake measures to protect all persons from cybercrime schemes by regulating the use of Financial Accounts and preventing their use in fraudulent activities.

SEC. 3. Definition of Terms. - As used in this Act:

(a) Account Owner refers to the person to whom a Financial Account belongs or under whose name the account was opened or registered;

(b) Electronic communications refers to phone calls, short message service (SMS), social media platform-enabled messages, electronic mail (email), technology-powered instant messaging, and other messages sent via electronic means;

(d) Financial Account refers to an account used to avail of products or services offered by Institutions such as:

(1) An interest or non-interest-bearing deposit, trust, investment, or credit card account;

(2) Other transaction account maintained with a bank, non-bank, or financial institution;

(3) E-wallet; and

(4) Any other account used to avail of financial products or services defined under Section 3(c) of Republic Act No. 11765, or the "Financial Products and Services Consumer Protection Act".

(e) Fraud Management Systems (FMS) refer to a comprehensive set of automated and real-time monitoring and detection systems to identify and block disputed, suspicious, or other online transactions;

(f) Institutions refers to banks, non-banks, other financial institutions, payments and financial services providers under the jurisdiction of the Bangko Sentral ng Pilipinas (BSP);

(g) Mass mailer refers to a services or software used to send electronic communications to an aggregate of fifty (50) or more recipients;

(h) Multi-Factor Authentication (MFA) refers to an authentication method that requires two (2) or more verification factors to gain access to a resource; and

(i) Sensitive identifying information refers to any information that can be used to access an individual's Financial Accounts such as usernames, passwords, bank account details, credit card, and e-wallet information among other electronic credentials, and other confidential and personal information.

SEC. 4. Prohibited Acts. - The following acts shall constitute Financial Account scamming under this Act:

(a) Money Muling Activities. - A person performing any of the followings acts for the purpose of obtaining, receiving, depositing, transferring, or withdrawing proceeds that are known to be derived from crimes, offenses, or social engineering schemes shall be considered as a money mule:

(1) Using, borrowing or allowing the use of a Financial Account;

(2) Opening a Financial Account under a fictitious name or using the identity or identification documents of another;

(3) Buying or renting a Financial Account;

(4) Selling or lending a Financial Account; or

(5) Recruiting, enlisting, contracting, hiring, utilizing, or inducing any person to perform the acts mentioned in items 1 to 4 of this subsection.

(b) Social Engineering Schemes. - A social engineering scheme is committed by a person who obtains sensitive identifying information of another person, through deception or fraud, resulting in unauthorized access and control over the person's Financial Account, by performing any of the following acts:

(1) Misrepresenting oneself as acting on behalf of an Institution, or making false representations to solicit another person's sensitive identifying information; or

(2) Using electronic communications to obtain another person's sensitive identifying information.

(c) Economic Sabotage. - The prohibited acts under Section 4(a) and (b) shall be considered as economic sabotage when committed under any of the following circumstances:

(1) By a group of three (3) or more persons conspiring or confederating with one another;

(2) Against three (3) or more persons individually or as a group;

(3) Using a mass mailer; or

(4) Through human trafficking.

SEC. 5. Other Offenses. - The following shall also constitute as offenses under this Act:

(a) Willfully aiding or abetting in the commission of any of the offenses enumerated under Section 4;

(b) Willfully attempting to commit any of the offenses enumerated under Section 4;

(d) Buying or selling a Financial Account.

SEC. 6. Responsibility to Protect Access to Client's Financial Account. - Institutions shall ensure that access to their clients' Financial Account is protected by adequate risk management systems and controls such as MFAs, FMS, and other Account Owner enrollment and verification processes: Provided, That such risk management systems and controls are proportionate and commensurate to the nature, size, and complexity of their operations.

Institutions that are determined by the BSP to be compliant with the requirements of adequate risk management systems and controls shall not be liable for any loss or damage arising from the offenses under Section 4 and 5 of this Act.

Without prejudice to other liabilities under existing laws and consistent with BSP rules and regulations, Institutions shall be liable for restitution of funds to the Account Owners for failure to employ adequate risk management systems and controls, or failure to exercise the highest degree of diligence in preventing loss or damage arising from the offenses under Section 4 and 5. Conviction shall not be a prerequisite to the restitution of funds.

SEC. 7. Temporary Holding of Funds Subject of a Disputed Transaction. - Institutions shall have the authority to temporarily hold the funds subject of a disputed transaction within the period prescribed by the BSP, which shall not exceed thirty (30) calendar days, unless otherwise extended by a court of competent jurisdiction: Provided, That Institutions shall promptly notify the BSP whenever it temporarily holds the funds subject of a disputed transaction.

A transaction shall be considered disputed if the Institution, based on information obtained from another Institution, a complaint, from an aggrieved party, or a finding under its own FMS, has reasonable ground to believe that such transaction appears to be:

(a) Unusual;

(b) Without clear economic purpose;

(c) From an unknown or illegal source, or unlawful activity; or

(d) Facilitated through social engineering schemes.

Where such belief arises from a finding under its won FMS, the Institution shall perform acts as may be legally warranted to preserve the integrity of the Financial Account.

No administrative, criminal, or civil liability shall be imposed, against an Institution or its directors, trustees, officers, and employees for holding funds subject of a disputed transaction when done in accordance with BSP rules and regulations.

The BSP shall issue rules and regulations on: the circumstances under which Institutions are required to exercise such authority to avoid probable fraud; the grounds for, procedure, and period of holding funds; the period wherein the Institutions should notify the BSP whenever it holds funds; the verification and validation process; the release of funds subject of a disputed transaction; and other actions that may be undertaken by the Institutions and Account Owners during the period of temporary holding of funds.

SEC. 8. Coordinated Verification of a Disputed Transaction. - Upon receipt of a complaint, an information from another Institution, or detection through FMS, the Institutions and Account Owners involved shall initiate a coordinated verification process to validate the disputed transaction, regardless of whether the funds remain in the banking system or not. The provisions of Republic Act No. 1405, as amended; Republic Act No. 6426, or the "Foreign Currency Deposit Act of the Philippines", as amended; Republic Act No. 8367, or the "Revised Non-Stock Savings and Loan Association Act of 1997"; and Republic Act No. 10173, or the "Data Privacy Act of 2012" shall not apply during the coordinated verification process of a disputed transaction.

SEC. 9. Liability for Failure to Temporarily Hold Funds. - An Institution that fails to temporarily hold funds subject of a disputed transaction, as required under this Act and relevant BSP rules and regulations, shall be liable for loss or damage arising from such failure, including the restitution of the disputed funds to the Account Owner.

SEC. 10. Liability for Improper Holding of Funds. - Without prejudice to liabilities under existing laws, an Institution that holds funds subject of a disputed transaction beyond the allowable period, or improperly holds funds, as provided in this Act and relevant BSP rules and regulations, shall be subjected to administrative action under Republic Act No. 7653, otherwise known as "The New Central Bank Act", as amended.

SEC. 11. Malicious Reporting. - Any person who, with malice or in bad faith, reports or files completely unwarranted or false information that results in the temporary holding of funds shall be punished under Section 16(e) of this Act.

SEC. 12. Investigation and Inquiry into Financial Accounts. - The BSP shall have the authority to investigate and inquire into Financial Accounts which may be involved in the commission of a prohibited act or offense under Sections 4 and 5 hereof. The provisions of Republic Act No. 1405, as amended; Republic Act No. 6426, as amended; Republic Act No. 8367; and Republic Act No. 10173 shall not apply to Financial Accounts subject of BSP's investigation.

Any of the information gathered from the investigation or inquiry of a Financial Account by the BSP pursuant to this section may be used for the enforcement of this Act and in the implementation of relevant provisions of Republic Act No. 11765.

The authority to investigate and inquire into Financial Accounts under this section shall be exercised by a duly authorized officer or body from the BSP.

No court below the Court of Appeals shall have jurisdiction to enjoin the BSP from exercising its authority to investigate and inquire into any Financial Account under this Act.

An Institution, or any of its directors, officers, or employees, shall be held free and harmless from any accountability or liability for any act done in compliance with an order from the BSP for an inquiry or investigation of a Financial Account.

SEC. 13. Cybercrime Warrants and Related Orders. - Without prejudice to the authority of the cybercrime units of the National Bureau of Investigation (NBI) and the Philippine National Police (PNP), the BSP or its duly authorized officer or body shall have the authority to apply for cybercrime warrants and to issue the orders provided in Chapter IV of Republic Act No. 10175, or the "Cybercrime Prevention Act of 2012", with respect to the electromagnetic communications used in any violation of this Act. The BSP may request the assistance of the NBI and the PNP in the investigation of cases and the enforcement and implementation of cybercrime warrants and related orders for violations of this Act.

SEC. 14. Sharing of Information of Financial Accounts. - The BSP shall have the authority to issue rules on information-sharing and disclosure with law enforcement and other competent authorities in connection with its inquiry and investigation of Financial Accounts under this Act: Provided, That any information on the Financial Account which may be shared by BSP shall be used solely to investigate and prosecute cases involving violations of Section 4 and 5 of this Act and to implement the relevant provisions of Republic Act No. 11765.

SEC. 15. Prohibition on the Disclosure of Information of a Financial Account. - Unless otherwise allowed under existing laws, directors, trustees, officers, or employees of an Institution, government officials or employees, or other persons who obtained information on the Financial Account subject of BSP's inquiry or investigation under this Act, shall be prohibited from disclosing such information on the Financial Account for purposes other than those mentioned in Section 12 and 14 hereof.

SEC. 16. Penalties. - (a) A person found guilty of the prohibited acts under Section 4(a) shall be penalized with imprisonment of not less than six (6) years but not more than eight (8) years, or a fine of at least One hundred thousand pesos (P100,000.00) but not exceeding Five hundred thousand pesos (P500,000.00), or both, at the discretion of the court. In addition, if the prohibited act falls under Section 4(a), items (1) to (4), the court shall also order the closure of the Financial Account involved in the transaction and forfeiture in accordance with Article 45 of the Revised Penal Code, without prejudice to Section 17 of this Act.

(b) A person found guilty of any of the prohibited acts enumerated under Section 4(b) shall be penalized with imprisonment of not less than ten (10) years but not more than twelve (12) years, or a fine of at least Five hundred thousand pesos (P500,000.00) but not exceeding One million pesos (P1,000,000.00), or both, at the discretion of the court: Provided, That the penalty of not less than twelve (12) years but not more than fourteen (14) years of imprisonment, or a fine of at least One million pesos (P1,000,000.00) but not more exceeding Two million pesos (P2,000,000.00), or both, at the discretion of the court, shall be imposed if the target or victim of the acts enumerated in Section 4(b) is a senior citizen at the time the offense was committed.

(c) A person found guilty of any of the prohibited acts involving economic sabotage enumerated under Section 4(c) shall be penalized with life imprisonment, or a fine of not less than One million pesos (P1,000,000.00) but not exceeding Five million pesos (P5,000,000.00), or both, at the discretion of the court.

(d) A person found guilty of other offenses enumerated in Section 5 shall be penalized with imprisonment of not less four (4) years but not more than six (6) years, or a fine of at least One hundred thousand pesos (P100,000.00) but not exceeding Two hundred thousand pesos (P200,000.00), or both, at the discretion of the court. In addition, if the prohibited act falls under Section 5(c) or (d), the court shall also order the closure of the Financial Account.

(e) A person found guilty of reporting or filing completely unwarranted or false information that resulted in the temporary holding of funds under Section 11 shall be penalized with imprisonment of not less than one (1) year but not more than five (5) years, or a fine of not less than Fifty thousand pesos (P50,000.00) but not exceeding Two hundred thousand pesos (P200,000.00), or both, at the discretion of the court.

(f) A person found guilty of knowingly or willfully obstructing, impending, frustrating, or delaying the inquiry and investigation of the BSP as provided under Section 12 shall be penalized with imprisonment of not less than one (1) year but not more than five (5) years, or a fine of not less than Fifty thousand pesos (P50,000.00) but not exceeding Two hundred thousand pesos (P200,000.00), or both, at the discretion of the court.

(g) An official, employee, or agent of an Institution, the govenrment, or any person who obtained information on the Financial Account subject of BSP's inquiry or investigation who shall commit the prohibited act under Section 15 shall be penalized with imprisonment of not less than one (1) year but not more than five (5) years, or a fine of not less than Fifty thousand pesos (P50,000.00) but not exceeding Two hundred thousand pesos (P200,000.00), or both, at the discretion of the court.

(h) When an offender is a juridical person, the fine to be imposed shall be double the amount of the corresponding penalty but shall not exceed Ten million pesos (P10,000,000.00). The liability imposed on the juridical person shall be without prejudice to the criminal liability of the responsible officer who committed the prohibited acts or other offenses under this Act.

(i) A government official or employee who shall be found guilty of the acts or offenses under Sections 4 and 5 shall, in addition to the penalties prescribed under this section, suffer perpetual absolute disqualification from holding any appointive or elective position in the government, or in any agency, entity, or instrumentality thereof.

SEC. 17. Civil Liability in Case of Conviction. - A conviction for violation of this Act shall carry with it civil liability, which may include restitution for the damage done in favor of the aggrieved party of any unwarranted benefit derived from such violation.

Independent of a criminal case, all properties, tools, instruments and/or any other non-liquid assets used for the commission of the acts prohibited in Sections 4 and 5 of this Act shall be subject to civil forfeiture, upon finding of probable cause, in accordance with rules of procedure to be formulated by the Supreme Court: Provided, That in cases of economic sabotage as defined in Section 4(c), the rules shall include a summary procedure for the release of a portion of such assets during the pendency of the proceedings, for operational support and victim protection, including victims of human trafficking involved in the commission of prohibited acts and other offenses in this Act.

SEC. 18. Administrative Sanctions. - Without prejudice to the criminal and civil liabilities prescribed under this Act, the administrative sanctions specified in Republic Act No. 7653, as amended, shall be imposed upon the Institution, its directors, officers, trustees, employees, or agents, for violation of this Act or any related rules, regulations, orders or instructions of the BSP.

SEC. 19. Criminal Liability Under Other Laws. - Prosecution under this Act shall be without prejudice to prosecution for any violation of the Revised Penal Code, as amended, or special laws such as Republic Act No. 8484, or the "Access Devices Regulation Act of 1998", as amended; Republic Act No. 9160, or the "Anti-Money Laundering Act of 2001", as amended; and Republic Act No. 10175.

SEC. 20. Immunity of Trafficked Persons from Criminal Liability. - Victims of trafficking in persons as defined under Republic Act No. 9208, or the "Anti-Trafficking in Persons Act of 2003", as amended, shall be free from criminal liability for acts committed as a direct result of being trafficked. Conviction under Republic Act No. 9208, as amended, shall not be a prerequisite to this defense, and it shall be sufficient to show clear and convincing evidence of circumstances under prevailing manuals, guidelines, and similar instruments on victim identification issued by the Inter-Agency Council Against Trafficking (IACAT).

SEC. 21. Jurisdiction. - The Regional Trial Court shall have jurisdiction over any violation of the province of this Act. Jurisdiction shall ie if any of the elements was committed within the Philippines or committed with the use of any device, tool, equipment, computer system or infrastructure, wholly or partly situated in the country, or when by such commission, damage is caused to a natural or juridical person who was in the Philippines at the time the offense was committed or whose Financial Account is maintained with an Institution operating in the Philippines.

SEC. 22. General Principles Relating to International Cooperation. - To the widest extent possible, all relevant instruments on international cooperation in criminal matters and arrangements agreed on the basis of reciprocal legislation and domestic laws, shall be given full force and effect for the purposes of investigations or proceedings concerning criminal offenses related to computer systems and data, or for the collection of evidence in the electronic form.

SEC. 23. Implementing Rules and Regulations. - Within one (1) year from the effectivity of this Act, the BSP, in coordination with the DOJ, the Department of Information and Communications Technology (DICT), the NBI, the PNP, the Cybercrime Investigation and Coordination Center (CICC), and the Anti-Money Laundering Council (AMLC), and upon consultation with relevant stakeholders, shall promulgate the rules and regulations to effectively implement the provisions of this Act.

A cooperative mechanism shall be established among the Institutions, the BSP, concerned government agencies and the private sector, to ensure the effective enforcement of the provisions and the prosecution of cases under this Act.

SEC. 24. Separability Clause. - If any provision of this Act is declared invalid or unconstitutional, the remainder thereof not otherwise affected shall remain in full force and effect.

SEC. 25. Repealing Clause. - All laws, presidential decrees, executive orders, letters of instructions, proclamations, or administrative regulations that are inconsistent with the provisions of this Act are hereby repealed, amended, or modified accordingly.

SEC. 26. Effectivity. - This Act shall take effect after fifteen (15) days following its publication in the Official Gazette or in a national newspaper of general circulation.

Approved,

(SGD.) FERDINAND MARTIN G. ROMUALDEZ	(SGD.) FRANCIS "CHIZ" G. ESCUDERO
Speaker of the House of Representatives	President of the Senate

This Act was passed by the Senate of the Philippines as Senate Bill No. 2560 on May 20, 2024 and adopted by the House of Representatives as an amendment to House Bill No. 7393 on May 22, 2024.

(SGD.) REGINALD S. VELASCO	(SGD.) RENATO N. BANTUG, JR.
Secretary General House of Representatives	Secretary of the Senate

Approved: JUL 20 2024

(SGD.) FERDINAND ROMUALDEZ MARCOS JR.

President of the Philippines