Digital bank AML is the set of controls that identify customers, screen them and monitor their activity when the whole relationship runs through an app, with no branch. Onboarding becomes the main control point and monitoring starts on day one, so the two must work as one system.
Circular 1105 lists AML/CFT among the BSP rules that digital banks must follow, but the sources reviewed describe no AML rule written only for digital banks. This guide applies the existing rules to a remote-first model, and the e-KYC requirements are described from press reports because the BSP text could not be retrieved.
This guide is the practical side of what is often searched as neobank compliance or neobank regulatory requirements. It is written for CCOs and heads of AML at digital banks and at banks building a digital channel.
What makes AML different at a digital bank?
A digital bank has no face-to-face moment, so identity, the first transaction and early monitoring all depend on digital signals.
BSP's guidelines on the establishment of digital banks, Circular 1105, describe a digital bank as one whose products are processed end to end through a digital platform, without a branch-type unit. The same summary notes that digital banks must follow BSP rules on governance and risk management, including information technology and cyber security, outsourcing, and AML/CFT.
The segment is no longer small. BSP announced in August 2024 that it would lift its moratorium on new digital bank licences from 1 January 2025, allowing up to four more. By July 2026, GMA reported seven BSP-licensed digital banks. More remote-first customers means more accounts that have never met a bank officer, and a larger share of the monitoring workload sits in the first weeks of an account's life.
What do the rules say about remote onboarding?
BSP allows e-KYC using digital identity, and expects it to be risk-based and built on reliable technology.
In April 2023 BSP approved amendments to its due diligence rules on e-KYC. As reported at the time, the rules call for e-KYC anchored on robust ICT architecture, with tiered or risk-based policies and authentication assurance levels matched to each tier. They treat PhilSys-enabled e-KYC as acceptable, subject to the Philippine Statistics Authority's guidelines. Institutions with existing e-KYC systems were given one year to comply. A 2021 draft of the rules proposed that remote identification and verification meet the same standards as face-to-face onboarding, so check the final circular for the current wording.
FATF's guidance on digital identity of March 2020 gives a method for judging a digital identity system. First, understand the assurance levels of its technology, architecture and governance. Then decide whether it is appropriately reliable and independent in light of the risks. Our piece on why identity verification is not KYC explains why a passed identity check settles only part of the due diligence question. Our guide to deepfakes and synthetic identities covers the threat that targets it.
How should onboarding and monitoring connect?
The onboarding result should set the customer's risk rating, and the rating should set how closely the account is monitored.
In a branch bank, a relationship manager supplies context that never reaches the system. A digital bank has only the data it captured. That makes the handover between onboarding and monitoring the weak point, so decide which onboarding signals travel into monitoring. Useful candidates are the verification outcome, the channel and device used, declared purpose and expected activity, and the initial risk rating. A rating that never changes after onboarding is not risk-based, a point we make in our guide to customer risk rating reviews.
Treat the first weeks as a distinct phase. Accounts that pass funds straight through soon after opening are a classic mule pattern. A rule that compares early activity with the declared profile catches them sooner than a rule tuned for mature accounts.
Which monitoring scenarios matter most for a remote-first bank?
Six scenarios cover the behaviours most associated with mule and scam proceeds at accounts opened remotely.
- 01New account with immediate pass-through. Funds arrive and leave with little or no balance retained.
- 02Fan-in, then fast fan-out. Many unrelated senders pay one account and the value leaves quickly.
- 03Dormant account that wakes up. Little activity, then sudden volume.
- 04Shared identifiers. Different customers share a device, phone number or address.
- 05Small test transfers followed by a large one. A probe before the main movement.
- 06Contact with flagged accounts. Receipts from, or payments to, accounts already reported.
Republic Act 12010, the Anti-Financial Account Scamming Act, defines a money mule in Section 4(a) to include a person who opens an account under a false identity or uses, lends, buys, rents or sells an account. We cover the scam context in our post on scam compounds and money mules. Each scenario needs thresholds taken from your own data and tested above and below the line, as described in our guide to threshold tuning.
How can a lean team keep up as volume grows?
Aggregate by customer, segment the rules, and let one case hold everything that relates to one customer.
Remote growth tends to add accounts faster than analysts. Three habits keep the workload manageable. First, aggregate behaviour over windows instead of judging single transactions, which is the core idea in our transaction monitoring guide. Second, set thresholds by customer segment so students, merchants and salaried users are not compared with each other. Third, open one case per customer and link every alert to it, so a mule account that trips three rules is investigated once.
Review each rule against closed-case outcomes every quarter, and retire or retune those that only produce false positives. For banks making the move from branches, our piece on the digital decision facing rural banks covers the resourcing side.
What evidence should a digital bank be ready to show?
It should be able to show how it verified identity, how it rated risk, how its rules were tested and how its cases were decided.
Rule 15 of the 2018 implementing rules requires covered persons to identify, assess and understand their ML/TF risks. It also requires an institutional risk assessment at least every two years, and a remote-first channel mix belongs in that assessment. BSP's Memorandum M-2023-013, the guidance paper on an effective AML/CTPF transaction monitoring system, covers system design and pre-implementation testing, alert and case management, and independent testing. A sensible evidence set contains the following.
- The e-KYC design, including the assurance level and the basis for relying on it.
- The channel and product risk assessment.
- Rule inventories, calibration records and change approvals.
- Closed cases with the reasoning, the approver and the determination date.
- Independent test results and the status of findings.
How does Fyscal ARCX support a remote-first bank?
In Fyscal ARCX Transaction Monitoring, compliance teams define their own variables, such as the sum, count or average of an attribute over a chosen window. They use them in rules without an engineering ticket. Rules can be tested against historical data in a dry run before activation, and a suppression window prevents repeat alerts on a customer already under investigation. Real-time screening and case management sit in the same platform, related alerts consolidate into one case per customer, and connectors bring in data from internal and third-party systems, including onboarding outputs.
If you want to see how an early-life mule scenario runs from alert to case, book a walkthrough of Fyscal ARCX and bring a scenario you want to test.