The Market Monitor Minding the Nation's Business
The Bank of the Philippine Islands (BPI) has become the first universal bank in the Philippines to secure both international certifications for information security and privacy management.
BPI said it obtained ISO/IEC 27001:2022 certification for its Information Security Management System and ISO/IEC 27701:2019 certification for its Privacy Information Management System.
The certifications were awarded by The British Standards Institution (BSI) Group Philippines Inc. and cover a broad range of BPI operations, including online and mobile banking, inward and outward remittances, transaction banking and cash management services, and contact center operations.
The two standards require organizations to maintain continuously evolving systems for managing information security and privacy through regular risk assessments, internal controls, audits, monitoring and operational improvements.
“These certifications affirm that BPI has implemented internationally recognized frameworks for managing information security and data privacy across critical banking services. More importantly, these reflect our commitment to making security and privacy an integral part of how we operate and how we serve our customers,” BPI President and CEO TG Limcaoco said.
He said the certifications cover critical customer touchpoints rather than being limited to a single system or banking channel.
“This breadth reflects the scale of our commitment: that wherever and however our customers interact with BPI, we are working to make their banking experience secure, resilient, and worthy of their trust,” Limcaoco said.
BPI said the dual certification provides customers with stronger safeguards for sensitive personal and financial information, more secure digital and cross-border transactions, and independently audited security and privacy controls.
For corporate and institutional clients, the certifications demonstrate that BPI follows a globally aligned framework for managing information security and privacy risks.
The bank’s certification journey builds on more than two decades of efforts to strengthen information security policies, controls and risk management. Its program later expanded to include a comprehensive data privacy framework.
BPI said it continues to align its information security and privacy practices with the Data Privacy Act of 2012, the General Data Protection Regulation, and relevant Bangko Sentral ng Pilipinas regulations.
The bank added that information security and data privacy remain shared responsibilities across the organization and continuing commitments to its customers.