The Bank of the Philippine Islands has become the first universal bank in the Philippines to secure certification under both ISO/IEC 27001 and ISO/IEC 27701, strengthening its information security and data privacy controls across critical banking operations.
BPI achieved ISO/IEC 27001:2022 certification for its Information Security Management System and ISO/IEC 27701:2019 certification for its Privacy Information Management System.
The certifications were awarded by The British Standards Institution Group Philippines Inc. and cover one of the broadest certification scopes in the local banking industry.
The covered operations include online and mobile banking platform management, inward and outward remittances, transaction banking-cash management services, and contact center operations.
“These certifications affirm that BPI has implemented internationally recognized frameworks for managing information security and data privacy across critical banking services. More importantly, these reflect our commitment to making security and privacy an integral part of how we operate and how we serve our customers,” said TG Limcaoco, BPI President and CEO.
“What is particularly meaningful about this achievement is that these standards are not confined to a single system, channel, or function. They are applied across critical parts of how we serve our customers – from digital banking and payments to transaction banking and our customer support operations. This breadth reflects the scale of our commitment: that wherever and however our customers interact with BPI, we are working to make their banking experience secure, resilient, and worthy of their trust,” he added.
Unlike a one-time compliance exercise, the ISO/IEC 27001:2022 and ISO/IEC 27701:2019 standards require organizations to maintain ongoing processes for managing information security and privacy risks.
These processes include regular risk assessments, internal controls, audits, monitoring and operational improvements designed to keep security and privacy practices evolving.
For BPI customers, the dual certification is intended to provide stronger protection for sensitive personal and financial information, more secure digital and cross-border transactions, and greater assurance that security and privacy controls are independently audited and continuously improved.
For corporate and institutional clients, the certifications demonstrate that BPI operates under a globally aligned framework for managing information security and privacy risks.
The achievement builds on more than two decades of work to strengthen BPI’s information security framework and governance practices.
Since the early 2000s, the bank has progressively enhanced its information security policies, controls and risk management capabilities to address evolving threats and support secure banking operations.
Those efforts later expanded to include a comprehensive data privacy program aimed at further protecting customer information while aligning BPI’s practices with global standards and regulatory requirements.
The bank said its broader information security and privacy strategy also supports compliance with the Data Privacy Act of 2012, the General Data Protection Regulation and relevant Bangko Sentral ng Pilipinas issuances, including Circulars 808 and 982.
BPI said the certifications reinforce that information security and data privacy are shared responsibilities across the organization and ongoing commitments to its clients.
Leave a Reply