Philippines AML Compliance After AFASA and the FATF Grey List Exit

The Philippines' exit from the FATF grey list in February 2025 closed one chapter of intensified international scrutiny — and opened another. At the same time, the Anti-Financial Account Scamming Act (AFASA) has introduced a new layer of anti-money laundering and anti-fraud obligations that go well beyond the country's existing Anti-Money Laundering Act (AMLA). For banks, e-wallets, fintechs, and money service businesses, the message is consistent: the supervisory bar keeps rising, even after the grey list designation is removed.

This guide breaks down what AFASA requires, what the FATF grey list exit does and does not change, and how to select AML software for Philippine financial institutions — including a comparison of leading vendors and a practical buyer's checklist.

Some links in this article are affiliate links. See our disclosure policy. This content is for informational purposes only and does not constitute legal advice.

What Is AFASA and Why It Matters for Philippines AML Compliance

AFASA — the Anti-Financial Account Scamming Act — is a Philippine law designed to strengthen the country's anti-money laundering and counter-fraud framework. Its central target is financial account scamming: money muling, social engineering schemes, and other fraud typologies that exploit bank accounts, e-wallets, and digital payment channels.

AFASA matters for Philippines AML compliance because it expands the perimeter of who must act and what they must do:

• Expanded covered institutions. AFASA extends obligations beyond traditional banks to include e-money issuers, e-wallets, and other financial service providers that hold or move customer funds.
• Fraud management systems. Financial institutions are expected to implement systems capable of detecting and disrupting account scamming — including real-time monitoring of account activity and transaction patterns.
• Enhanced due diligence. Customer onboarding and ongoing monitoring processes must be updated to account for scam-related risk typologies, not only classic money laundering predicates.
• Information sharing. AFASA grants authorities powers to investigate and prosecute offenders and mandates information sharing between banks and regulators to detect and disrupt scam networks.
• Reporting mechanisms. Suspicious activity and scam-related incidents must be escalated through formal reporting channels.

AFASA vs. AMLA: What Changed?

The Anti-Money Laundering Act (AMLA) remains the foundational statute for Philippines AML compliance. It establishes the Anti-Money Laundering Council (AMLC) as the country's financial intelligence unit, sets out customer due diligence and recordkeeping obligations, and requires covered institutions to file covered transaction reports (CTRs) and suspicious transaction reports (STRs).

AFASA does not replace AMLA — it strengthens and extends it. Where AMLA focuses on money laundering predicates and terrorist financing, AFASA adds a dedicated anti-scam layer. Practically, that means:

• Risk assessments must now explicitly cover account scamming and money muling typologies.
• Transaction monitoring rules need to detect scam-related patterns, not just traditional structuring or layering.
• Onboarding and KYC processes may require additional controls for high-risk account types and behaviors.
• Information-sharing frameworks between institutions and regulators become part of the operational compliance model.

One important guardrail: STRs and suspicious activity reports are confidential. Institutions must not disclose to a customer or any third party that a report has been filed — tipping-off prohibitions apply under Philippine AML rules. Compliance programs should include clear internal controls on who can access STR data and how it is handled.

FATF Grey List Philippines: What Changed After the February 2025 Exit

The Philippines exited the FATF grey list in February 2025. This is a significant milestone: it signals to the international community that the country has strengthened its AML/CFT regime and addressed the strategic deficiencies that led to the listing.

But the exit does not mean the pressure is off. In practice, it changes the nature of scrutiny rather than removing it.

What the Grey List Exit Does

• Improves country risk perception. International banks and correspondent partners reassess the Philippines' risk profile, which can ease some enhanced due diligence burdens.
• Supports correspondent banking relationships. De-risking — where global banks terminate or restrict relationships with institutions in higher-risk jurisdictions — becomes less likely when a country is off the grey list.
• Reduces reputational friction. Philippine financial institutions face fewer questions from foreign counterparties about the country's AML framework.

What the Grey List Exit Does Not Change

• Supervisory expectations remain stringent. The AMLC continues to enforce reporting obligations, and the Bangko Sentral ng Pilipinas (BSP) continues to supervise AML/CTF compliance under Part Nine of the Manual of Regulations for Banks (MORB).
• Correspondent banks still apply their own risk-based approach. Exit from the grey list does not guarantee that a foreign bank will lower its due diligence requirements. Many will continue to require robust AML programs, independent testing, and evidence of effective transaction monitoring.
• Reporting timelines remain tight. Recent AMLC guidance has compressed STR filing windows, increasing pressure for timely and accurate reporting. Institutions should verify current timelines directly with the AMLC, as supervisory expectations continue to evolve.

Why Correspondent Banking De-Risking Still Matters

For Philippine banks with cross-border relationships, the grey list exit is an opportunity — but not a guarantee. Correspondent banks assess not only country risk but also the quality of the institution's own AML program. A weak transaction monitoring system, poor STR quality, or gaps in beneficial ownership identification can still trigger de-risking decisions.

To maintain correspondent relationships, institutions should be prepared to demonstrate:

• A board-approved AML/CTF program with a clear risk-based approach.
• Automated transaction monitoring proportionate to the institution's size and risk profile.
• Effective customer due diligence and beneficial ownership identification.
• Timely, high-quality STR filing with a documented investigation process.
• Independent testing and audit trails that can be shared with counterparties under appropriate confidentiality arrangements.

Choosing AML Software Philippines Institutions Can Deploy

AFASA and the post-grey-list environment both point to the same conclusion: manual compliance processes are not enough. AML software for Philippine financial institutions must handle high transaction volumes, detect scam-related patterns in real time, and produce regulator-ready reports.

Essential Features

1. Transaction monitoring. Rule-based and behavioral monitoring that can detect structuring, rapid movement of funds, money muling patterns, and unusual account activity. Real-time or near-real-time monitoring is increasingly expected, especially for digital banks and e-wallets.
2. Customer risk scoring. Dynamic risk scoring that incorporates customer type, geography, product usage, and behavior — and that can be updated as AFASA typologies evolve.
3. Sanctions and PEP screening. Screening against international sanctions lists (OFAC, EU, UN) and politically exposed person databases, with ongoing rescreening as lists change.
4. Case management. A structured workflow for investigating alerts, documenting decisions, and escalating to STR filing — with audit trails that satisfy examiner review.
5. Regulatory reporting. The ability to generate CTRs and STRs aligned with AMLC requirements, not a foreign format. This is a critical localization point: Philippine STRs are filed with the AMLC, not with FinCEN or any other jurisdiction's financial intelligence unit.
6. Explainable AI and model transparency. Regulators expect institutions to understand and validate the models they use. Black-box systems create accountability problems.
7. Data Privacy Act compliance. The Data Privacy Act of 2012 requires lawful processing of personal data, proportionate security measures, and attention to data residency and hosting arrangements. These should be part of vendor discussions.

Vendor Comparison

The table below compares several vendors commonly considered for AML software in the Philippines. Pricing is often not publicly disclosed; where that is the case, the table notes it rather than estimating.

Vendor	Core Strengths	Local/Regional Support	Integration Notes	Pricing
ComplyAdvantage	Proprietary data pipeline, multilingual adverse media screening, transaction monitoring, agentic workflows to reduce false positives	Regional presence in Asia-Pacific; local support availability varies by plan	API-based integration with core banking and payment systems	Contact vendor for pricing
NICE Actimize	Enterprise-grade transaction monitoring, case management, sanctions screening, fraud and AML convergence	Established APAC operations; implementation typically requires partner support	Broad integration capabilities; often deployed alongside existing core banking systems	Contact sales
Unit21	No-code rule building, transaction monitoring, case management, fraud and AML use cases	Primarily US-centric; APAC support may be remote	API-first; suited to digital banks and fintechs	Contact vendor for pricing
RisksRadarAI	Cross-domain risk intelligence, transaction monitoring, automated STR generation aligned to AMLC reporting, audit-ready evidence briefs	Support model varies; verify regional coverage during evaluation	Integrates with core systems and risk data sources; on-premises reasoning option for data sovereignty	Contact vendor for pricing

Note: Feature and pricing details change frequently. Verify current capabilities and commercial terms directly with each vendor before making a decision.

Why RisksRadarAI Is Relevant for Philippine Institutions

For institutions that need to correlate AML signals with fraud and insider risk — a growing priority under AFASA — cross-domain risk platforms can be useful. RisksRadarAI combines transaction monitoring with behavioral and cross-domain signals, and supports automated STR generation aligned to AMLC reporting requirements, along with audit-ready evidence briefs for examiner review. Its on-premises reasoning option can also help address data residency considerations under the Data Privacy Act.

As with any vendor, institutions should validate performance claims through their own proof-of-concept and reference checks rather than relying on marketing metrics.

Buyer's Checklist for AML Software in the Philippines

• AMLC-aligned reporting. Can the system generate CTRs and STRs in the format and timeline the AMLC expects? Does it support confidential handling of STR data?
• BSP MORB Part Nine alignment. Does the vendor understand board-approved AML/CTF program requirements, risk-based approach, CDD, beneficial ownership, and sanctions screening expectations?
• Real-time monitoring capability. Can it detect scam-related patterns — money muling, rapid pass-through, mule account behavior — as they happen?
• Explainable AI. Can the institution explain and validate model outputs to regulators and auditors?
• Sanctions and PEP coverage. Are international lists updated in near-real-time, and is rescreening automated?
• Data Privacy Act compliance. Where is data hosted? What are the residency, security, and processing terms?
• Core banking integration. Does the vendor have experience integrating with the core systems used in the Philippines?
• Total cost of ownership. Include implementation, tuning, model validation, and ongoing support — not just license fees.
• Audit and examiner readiness. Can the system produce immutable audit logs and chain-of-thought reasoning for review?

Implementation Best Practices

1. Start with a risk assessment. Map AFASA and AMLA obligations to your specific products, customer base, and channels before selecting technology.
2. Define alert triage and STR workflows first. Technology should support a documented process, not replace it.
3. Run a proof-of-concept with real data. Test false positive rates, detection coverage, and reporting output against your actual transaction patterns.
4. Validate models before go-live. Document assumptions, thresholds, and tuning decisions for examiner review.
5. Train investigators, not just administrators. Case management and STR quality depend on people who understand the typologies.
6. Build in confidentiality controls. Restrict access to STR data and reinforce tipping-off prohibitions in policy and system permissions.
7. Plan for continuous tuning. Scam typologies evolve; monitoring rules must be reviewed regularly.

Key Takeaways

• AFASA adds a dedicated anti-scam layer to Philippines AML compliance, expanding covered institutions and requiring fraud management systems, real-time monitoring, and information sharing.
• The Philippines exited the FATF grey list in February 2025, improving country risk perception and reducing de-risking pressure — but supervisory expectations and correspondent bank due diligence remain stringent.
• STRs are filed with the AMLC, not with foreign financial intelligence units, and are confidential; tipping-off prohibitions apply.
• AML software for Philippine institutions must support AMLC-aligned reporting, BSP MORB Part Nine expectations, explainable AI, and Data Privacy Act compliance.
• Vendor selection should be based on proof-of-concept results and reference checks, not marketing claims.

Next Steps

If your institution is updating its AML program for AFASA and the post-grey-list environment, start by mapping your obligations, then evaluate technology against the checklist above. To see how real-time AML monitoring and AMLC-aligned STR filing automation can work in practice, request a demo of RisksRadarAI. And for a structured starting point, access AIGovHub's AML compliance toolkit, which includes readiness assessments and vendor due diligence templates.

This content is for informational purposes only and does not constitute legal advice. Regulatory timelines and requirements should be verified with the AMLC, BSP, and qualified counsel.