The Bangko Sentral ng Pilipinas has approved sanctions against BDO Unibank and UnionBank of the Philippines over the hacking incident that affected depositors in December last year.

In a statement released Thursday, the BSP said it has concluded its investigation into the unauthorized access of accounts with BDO and fund transfers mostly to accounts with Union Bank.

“Based on the results of the investigation, the Monetary Board (MB) approved the imposition of sanctions on BDO and UBP to ensure that both banks will swiftly address the issues,” the BSP said.

The central bank however did not specify what sanctions it was imposing against the 2 banks.

In December last year, many BDO customers complained over social media that funds were withdrawn from their accounts without their knowledge.

BDO said hackers used a “sophisticated fraud technique” last December 2021 to take advantage of a web service that was due to be phased out.

“This incident is a reminder that we should continue to enhance our defences against cyberthreat actors to protect the integrity of the financial system and the interests of depositors,” said BSP Governor Benjamin Diokno.

The BSP said its investigation recognized the corrective actions undertaken by both banks related to the cyber incident, including reimbursement by BDO of its affected clients.

“The sanctions imposed emphasize the importance of continuously enhancing risk management systems involving cybersecurity, anti-money laundering, and combating terrorism and proliferation financing,” the central bank said.

“The sanctions also reinforce the need for banks to take a proactive stance in ensuring that their depositors are adequately protected,” the BSP added.

UnionBank said it cooperated with BDO and the BSP over the investigation into the hacking incident.

“In fact, with swift action we were able to help BDO recover a sizeable amount so that it could return it to its customers,” UnionBank said in a statement.

The Aboitiz-led bank added that “there were no monetary penalties” and that all the recommendations of the BSP to avoid similar incidents had been implemented.