Bangko Sentral ng Pilipinas (BSP)

The BSP’s updated framework, as detailed in Appendix 79/Q-66, outlines specific guidance on the adoption of multi-factor authentication (MFA) across digital financial services. Institutions offering complex digital products or processing high volumes of online transactions are now expected to implement robust authentication protocols to maintain the integrity of customer-initiated activities.

• Biometric authentication, which enhances both convenience and security by using unique, hard-to-replicate physical traits such as fingerprints, facial recognition, or voice patterns.
• Behavioral biometrics, which monitor unique user behaviors like typing rhythm, screen interaction, and device usage patterns to detect anomalies. This approach supports continuous authentication and integrates well with fraud detection systems.
• Passwordless authentication, which removes the reliance on traditional passwords by using secure alternatives such as biometric identifiers, physical tokens, or cryptographic credentials. One widely accepted
  standard is FIDO (Fast Identity Online), which enables login through passkeys, secure hardware keys or biometric input.
• Adaptive authentication, which dynamically evaluates contextual factors such as user location, device characteristics, and usage behavior. Based on perceived risk, it can escalate verification requirements or trigger preemptive security measures.

These mechanisms reflect the BSP’s risk-based approach to digital security, prioritizing solutions that are both user-centric and resilient against fraud. Institutions adopting such technologies will not only enhance customer protection but also future proof their digital platforms in compliance with the latest regulatory standards.

The 1Kosmos platform is well-positioned to address the BSP’s guidelines on alternative authentication mechanisms for digital payment transactions. Below is a detailed summary.

The 1Kosmos platform exhibits flexibility which allows service providers and their users to choose the authentication method that best suits their needs, thereby increasing the adoption of digital payments while maintaining high security standards with minimal friction to the user experience.

The platform is attested for Authentication Assurance Level 1, 2, and 3 as per NIST 800-63 standards. This allows 1Kosmos to enforce multiple factors of authentication via various authentication methods in a single platform.

It also leverages adaptive authentication to adjust the required factors based on risk signals, ensures secure transmission and storage of authentication data, and provides convenient user management and recovery options. This approach helps to protect against unauthorized access while maintaining a user-friendly experience.

1Kosmos customers are able to leverage this in multiple ways, for example, by a global banking customer.

Risk-Based Authentication Privacy

The BSP circular recommends a risk-based approach to determine the appropriate AFA for a transaction. The 1Kosmos platform continuously assesses risk levels associated with each transaction or login attempt based on several factors such as user behavior, device, location, and time.

This dynamic assessment allows the system to adjust authentication requirements in real-time. The system collects and analyzes risk signals, which might include unusual login locations, changes in user behavior, high-value transactions, or access attempts from unfamiliar devices.

Based on the risk assessment, 1Kosmos adapts the authentication process. For elevated risk/ high value activities, it might require additional verification steps, such as biometric authentication, multifactor authentication (MFA), or additional
identity proofs. For low-risk activities, it may streamline the process with fewer steps.

As an example, a 1Kosmos banking customer leverages Facial Liveness authentication to authenticate digital payments, proving they are a real person.

Customer Consent and Deregistration

The BSP circular requires explicit customer consent before implementing any new authentication method and provides the option for customers to deregister from any method.

The 1Kosmos platform ensures compliance with this requirement by:

• Ensuring that users provide explicit consent before any > identity-related data is collected or used. This is typically > managed through user interfaces where consent is obtained through > affirmative actions, such as checking a box or clicking a consent > button.
• Giving users control over the specific information they are sharing > and with whom. The system allows for detailed permission settings, > giving users the ability to grant or revoke access to their > personal data as needed.
• One of the most unique differentiators that 1Kosmos offers to its > customer is its privacy-by-design architecture. Utilizing a > private, permissioned ledger (AKA private blockchain) to create > immutable audit trails of all consent actions. This means that > once consent is given or revoked, the record of this action is > permanently stored and cannot be altered, providing a clear and > verifiable history of user permissions.

Real-Time Transaction Alerts

The BSP guidelines mandates near real-time alerts for all eligible digital payment transactions. The 1Kosmos platform supports this requirement by:

• Providing real-time notifications for all transactions, ensuring > that customers are immediately aware of any activity on their > accounts.
• Offering customizable alert settings, allowing users to choose how > they receive notifications (e.g., SMS, email, push notifications).

Additionally, 1Kosmos platform architecture has privacy-by-design built in which emphasizes the protection of personal data, ensuring data privacy, security, and minimizing data breaches. The 1Kosmos solution can significantly aid in compliance
with this act by offering more secure and user-friendly ways to verify identity without traditional passwords, which are a common point of vulnerability. Specifically, the following benefits accrue on its implementation:

Enhanced Security: Passwords are susceptible to breaches, phishing, and other attacks. The diverse and flexible methods (e.g., biometrics, device-based authentication, and one-time codes) offered by 1Kosmos reduce the risk of unauthorized access, aligning with local privacy requirements for strong data protection.

Data Minimization: The Data Privacy Act of 2012 encourages minimizing data collected, used, and retained. Passwordless systems often reduce or eliminate the need to store password data, which reduces the volume of sensitive information the organization must protect.

Compliance: Adhering to industry standards and certifications such as the NIST 800-63-3 identity proofing and access management, FIDO2 for passwordless authentication and iBeta for biometric authentication.

Privacy by Design: The state-of-the-art approach of 1Kosmos solution aligns with the compliance requirement for ‘’privacy by design.’’ This approach inherently reduces the data footprint and enhances user security, which is built into the authentication mechanism from the start.

Improved User Control and Transparency: The reliable mechanisms, particularly those that use biometrics or device-based factors, help comply with the Data Privacy Act of 2012 emphasis on user rights by giving individuals more control over their data (e.g., biometric data stored locally on their device rather than a central server).

Reduced Risk of Data Breaches: With fewer stored passwords, the organization’s risk of exposure from data breaches decreases, which helps in meeting the Data Privacy Act of 2012 requirements for data security and breach reporting standards.

The 1Kosmos platform is well-equipped to address the BSP’s guidelines on alternative authentication mechanisms for digital payment transactions. By offering robust, dynamic, and diverse authentication methods, 1Kosmos enhances security while maintaining user convenience. The platform’s risk-based approach, customer consent mechanisms, and real-time transaction alerts further align with the BSP’s requirements. Additionally, 1Kosmos’ commitment to compliance and standardization ensures that its solutions are secure, interoperable, and reliable, making it an ideal choice for issuers looking to meet the BSP’s guidelines.