BSP outsourcing rules: how banks in the Philippines stay in control of their technology

The BSP allows outsourcing, cloud and offshore arrangements. In return it expects your bank to stay accountable for each one and to prove it, which comes down to three things your technology has to give you: visibility of your data, reporting you can stand behind and audit trails you can open on request. 

This article covers what the BSP’s rules say, six questions your leadership team should be able to answer and how a modern core keeps those answers easy. 

Only got five minutes? Here are the key takeaways of this article: 

• The BSP allows outsourcing, cloud and offshore outsourcing while your bank keeps ultimate responsibility for every outsourced activity. 

• Offshore arrangements add work: monitoring conditions where your provider is based and keeping contingency and exit strategies ready. 

• The BSP must be able to get information about outsourced operations and, when off-site checks are not enough, access to the service provider itself. 

• Reporting and audit trails are technology requirements in the BSP’s Manual of Regulations for Banks, including access to audit trails your providers hold. 

• Book a call with vanda.jirasek@oradian.com to test your bank against the six questions in this article. 

Want to find out more first? Read the rest of this. 

BSP rules are keeping pace with banking technology 

As Philippine banks modernise, more of their technology runs with cloud providers, group services, partners and offshore arrangements. The BSP’s rules have grown more detailed alongside that shift. 

Circular No. 1137, issued in 2022, brought materiality assessments into the BSP’s outsourcing rules, along with an outsourcing register “covering all outsourcing arrangements” that banks must make available when the BSP asks. In September 2026 the BSP issued Circular No. 1240, which applies the PHP 1 billion minimum capital and the prudential standards of digital banks to thrift, rural and cooperative banks moving to technology-driven models. 

Every one of these rules leaves room to modernise, as long as your bank can show it is still in control. 

Outsourcing moves the work and keeps the responsibility with your bank 

Under Section 148 of the BSP’s Manual of Regulations for Banks (MORB), banks “retain ultimate responsibility for the outsourced activity” and are expected to run an effective outsourcing oversight programme. Circular No. 1137 says the same of the people at the top: your board and senior management “shall remain responsible for ensuring that outsourced activities are conducted in a safe and sound manner”. 

Your provider can run the work while your bank stays the one that understands it, watches it and controls it. That leaves one question for every critical system that runs outside your walls: can your bank still see, understand and control what is happening inside it? 

Offshore outsourcing is allowed, with conditions 

Circular No. 1137 sets out how banks can outsource offshore. Where your service provider is based in another country, the BSP expects your bank to “closely monitor, on continuing basis, government policies” and other conditions there. The bank is also expected to “develop appropriate contingency and exit strategies”. 

Location matters for data too. The circular expects banks to be able to identify where their data is processed and stored. The BSP’s cloud guidance in Appendix 78 of the MORB calls data location one of the most common challenges in cloud computing. 

Where something runs becomes part of your technology risk. What the BSP asks is that your bank can oversee it, keep it running and move it if it has to. 

The BSP’s access has to survive the contract 

Supervision follows the service to the provider. Under Circular No. 1137, your bank has “the primary responsibility to ascertain the adequacy of design and effectiveness” of a provider’s security controls, through third-party auditors or your own internal audit. If those results fall short, the BSP will obtain the information it needs from your bank. And “if reasonable means to conduct offsite procedures have been exhausted, the Bangko Sentral shall be given access to the service provider”. 

Appendix 78 builds the same access into the contract. Your agreement should let the BSP and your auditors review the provider’s operations and controls. For cloud services, you and your provider should agree in advance that your bank can audit and verify. 

The question to ask of any provider is whether your bank and the BSP can still see inside the operation when they need to. 

Reporting and audit trails are technology requirements 

The MORB ties reporting and audit trails directly to the technology your bank runs on. 

• Reporting: Section 171 asks the board and senior management to “implement an effective reporting system to generate complete, accurate, consistent, reliable and timely reports”. It expects banks to use available information technology to do it. The framework calls for a management information system and technology infrastructure capable of meeting your reporting requirements, validation before reports are submitted, written policies and procedures, regular independent review and a process for fixing weaknesses. 

• Records: Section 162 says records should be “kept up-to-date and contain sufficient detail to establish an audit trail”, with independent balancing and reconciliation “to ensure the integrity of the reported data and balances”. 

• Audit trails held by providers: for electronic services, Appendix 79 expects comprehensive logs of all critical transactions. Where a provider holds them, “the BSFI should ensure that it has access to relevant audit trails maintained by the service provider”. 

Visibility, reporting and auditability all depend on your technology, wherever it runs. 

Cloud works when control comes with it 

The BSP recognises cloud computing in its rules. Appendix 78 says that using outsourced cloud services “does not diminish the responsibility” of your board and management. It names the risks to manage, including data integrity, sovereignty, recoverability and confidentiality, along with regulatory compliance, auditing and data offshoring. 

The same guidance sets out how to manage them: 

• Due diligence: choosing a cloud provider is “of paramount importance”. 

• Audit: your bank and the provider agree in advance that your bank can audit and verify. 

• Reporting: your bank decides the level of detail and the schedule of the reports it receives. 

• Monitoring: a vendor management process that watches the provider’s performance on an ongoing basis. 

• Business continuity: plans that are well documented and tested. 

• Transparency: a service level agreement that gives you enough insight into how the provider operates. 

What matters to the BSP is whether your operating model keeps your bank in control. A cloud-native platform designed for transparency, data access, auditability and resilience fits those expectations well. 

Six questions your leadership team should be able to answer 

Let’s say the BSP asked tomorrow. Could your leadership team answer these with confidence? 

1. Can we access our own operational and transactional data whenever we need it? 

2. Can we produce accurate regulatory reports on time? 

3. Can we trace every transaction and every change through a clear audit trail? 

4. Can we show the BSP how we oversee each outsourced technology service? 

5. Can the BSP get the information it needs to supervise us, including from our providers? 

6. Do we know what happens if a service provider becomes unavailable or needs to be replaced? 

Oradian: the core that keeps your bank in control as it modernises 

Oradian is the AI-native banking platform for banks and lenders in emerging markets. It runs in the cloud and is built so your bank can see, check and explain what its technology is doing. 

Your data within reach 

Database Access gives your bank a governed, read-only copy of its production database, continuously synced and held on infrastructure you control, so finance, risk and compliance teams can query complete, current data without touching the live system. 

Reports you can trace 

your teams use that copy for reconciliation and reporting, so the figures come from the same records your bank runs on. 

Logic you can show the regulator 

Every Custom Code extension is versioned, auditable and permission-scoped, so the BSP can be shown exactly what logic runs, who changed it and when. 

Open integrations 

Stable, versioned APIs and real-time events through Kafka and HTTP webhooks connect your channels, partners and internal systems.

Resilience 

Oradian runs at 99.98% uptime. 

On-the-ground team  

Oradian’s own team in Manila implements the platform and works directly with yours. 

Oradian has worked through these questions with BSP-regulated banks since 2017. Cantilan Bank, a community bank in Surigao del Sur, was the first bank in the Philippines to get the BSP’s approval to use cloud-based core banking technology. It chose Oradian as its strategic technology partner. The BSP backed its 2017 pilot with Oradian and the Asian Development Bank, when the then BSP Governor, Nestor Espenilla Jr., called the introduction of cloud banking “a key moment in solving the challenges of financial inclusion”. 

More recently, Esquire Financing took Oradian’s core banking platform live in three months, with the implementation run by Oradian’s Manila team. 

Modernise and keep the BSP’s questions easy to answer 

The BSP gives Philippine banks room to use cloud, outside providers and offshore arrangements as long as each bank stays in control of every one. Your core should make that part simple, with your data, reports and audit trails always within reach. 

Want to see how your bank measures up against the six questions? Book a call by emailing vanda.jirasek@oradian.comand talk it through with our Manila team before the end of the year.