Where a Philippine bank's technology meets its customers' worst moments

Instant transfers and QR payments have changed the shape of demand on a Philippine bank's systems. Most private employers pay on the fifteenth and the last day of the month, and December adds thirteenth-month pay and holiday shopping. On those days our instant and QR volumes run at two and a half to three times the daily average, packed into a few afternoon hours. I plan capacity, testing and change around that calendar. We size the payment channels for three and a half times average load and test them each month against a synthetic payday. I also look after the merchant side. Since 2021 our QR acceptance has grown from a few thousand merchants to about 210,000, many of them market stalls and sari-sari stores whose takings now arrive as credits rather than cash. For them a failed QR payment is a lost sale, so merchant success rates sit beside customer ones in every report I send to the board.

A digital account-opening flow verifies identity well and intent poorly. Most mule accounts we find were opened by real people with genuine identity documents who had been recruited to rent them out. I therefore treat mule prevention as a property of the onboarding product and of the first weeks of an account's life, not only as a task for fraud operations. At Talampas that has meant device binding, temporary limits on what a new account can send, scoring of every inbound credit within seconds, and a quick route for genuine customers to lift those limits through a short video call. With our head of fraud operations I own the measures the board sees: confirmed mule accounts per thousand openings, the share of flagged funds frozen before they leave and how long mule accounts had existed before they were used. The 2024 anti-scam law gave banks a clearer basis to hold suspicious funds temporarily while they verify; our systems decide whether we can use it in time.

I measure availability by what customers could and could not do, not by whether servers were running. We track nine journeys, among them paying by QR code, sending and receiving an instant transfer, card authorisation, cash withdrawal, app login and payroll credit. Each has a success rate, a completion time and an impact tolerance approved by the board risk oversight committee, and the tolerances are tighter on paydays. Our change calendar protects the two business days either side of the fifteenth and of month-end, and a customer-facing status page goes live within fifteen minutes of a confirmed disruption. When an incident is significant, we notify the Bangko Sentral ng Pilipinas promptly and follow with a written account. I review those accounts before they leave the bank and insist that each begins with the customer impact. I would rather the supervisor and the board hear about a bad afternoon from us, with numbers, than from complaint volumes.

Our deposit and loan ledgers have run on a mainframe since 1997. I am leading the move to a new core one product family at a time: time deposits in 2024, savings in 2025, current and payroll accounts planned for February 2027, and loans across 2027 and 2028. Phasing costs more than a single cut-over, about ₱1.3 billion more on our estimates, because two cores run side by side and every customer holding products on both needs consistent statements, limits and fraud views. In exchange, each migration is small enough to rehearse in full and to reverse. The parts I watch most closely are the reconciliation between the two ledgers, the customers whose products straddle both and the shrinking group of engineers who understand the old deposit modules. A phased exit also improves our commercial position. The mainframe renewal due in March 2027 is now being negotiated for a footprint 41% smaller.

I look for concentration where a bank could not replace a supplier's knowledge, not only where it spends the most. In 2021 one integrator held 64% of our change spend and the only working knowledge of the layer connecting our channels to the core. We split that contract into three lots and built our own design authority. I apply the same test to cloud services. The central bank's technology-risk and outsourcing expectations leave accountability with a bank's board and senior management, call for proper due diligence, and expect a bank to plan how it would exit a service and to give examiners access to it. We have moved our mobile channel, fraud analytics and developer tooling to cloud services, while the deposit ledger remains in our own data centres. For each cloud service the board sees a one-page record: what runs there, what data is held outside the country, how we would leave and who inside the bank could lead that exit.