🛠 Lonetech Software & Development Services

Data access monitoring isn't a nice-to-have for Philippine banks — it's a regulatory requirement under BSP Circular 982. Yet most banks, especially rural and thrift banks, have significant gaps in their ability to track who accesses what data and when.

Here are five clear warning signs that your bank's data access monitoring needs an upgrade — before BSP finds the gaps for you.

1 You Can't Answer "Who Viewed This Account?"

A customer calls to complain they're receiving suspicious calls from someone who knows their account balance. Your compliance officer needs to know: which employees viewed this customer's record in the last 30 days?

If your answer involves checking with IT, reviewing server logs manually, or — worse — "we can't tell," you have a critical monitoring gap.

2 You Don't Know When Employees Access Data After Hours

Your core banking system is accessible 24/7 for operational flexibility. But is anyone checking whether employees are accessing customer records at 11 PM on a Sunday?

After-hours access is one of the most common indicators of insider data theft. Employees who are exfiltrating data often do it when no one is watching — evenings, weekends, and holidays.

• Normal: Teller accessing the system during assigned 8 AM – 5 PM shift
• Suspicious: Same teller accessing 200+ customer records at 10 PM from a home IP address
• Critical: No system or person noticed this happened

3 Bulk Data Access Goes Undetected

A teller views 5–10 customer records per hour during normal operations. But what happens when the same teller views 73 records in 29 minutes?

If your systems can't detect and alert on abnormal access volume, you're blind to the most common insider data theft pattern: bulk lookup and copy.

4 You Can't Track Copy, Print, or Screenshot Events

The three most common methods of data exfiltration in banking:

• Copy-paste: Employee copies account numbers, phone numbers, or balances from the banking system to a personal document or messaging app
• Print: Employee prints customer data and walks out with the paper
• Screenshot: Employee takes a screenshot with PrtScn, Snipping Tool, or — hardest to stop — a phone camera pointed at the screen

If your monitoring doesn't track these actions at the application level, you have no way to know when data leaves the system. The access log shows the employee viewed the record — but not that they copied it to their clipboard 14 times.

5 Your "Monitoring" Is a Manual Spreadsheet

Some banks technically have monitoring — a supervisor manually reviews access logs once a week, or IT generates a CSV report monthly. This approach has three fatal flaws:

• Delay: Weekly or monthly reviews mean anomalies go undetected for days or weeks. A motivated insider can exfiltrate thousands of records in one afternoon
• Volume: A 10-branch bank with 50 employees generates thousands of access events per day. No human can review them all manually
• Inconsistency: Manual reviews depend on who's doing them, when they do them, and what they decide to flag. There's no standardized threshold or automated alert

What Good Monitoring Looks Like

If your bank had proper data access monitoring, here's what would happen the moment something suspicious occurs:

The Bottom Line

If any of these five signs apply to your bank, you have a monitoring gap that represents both a security risk and a compliance risk. BSP Circular 982 requires data access monitoring and anomaly detection. RA 10173 requires reasonable security measures. "We didn't know" is not a defense.

The good news: the technology to solve this exists, and it doesn't require a ₱5 million enterprise deployment.