BSP Circular 1240: A ₱1-Billion Capital Floor Isn't a Credit Risk Control

Key takeaways: BSP Circular No. 1240 (issued September 21, 2026) requires thrift, rural and cooperative banks operating like digital banks to meet the same ₱1-billion minimum capital requirement as licensed digital banks, within six months of notice. The circular also directs the BSP to impose enhanced supervisory reporting and require "strengthened risk management and control systems" — a separate and harder condition than the capital number. Banks that treat this as a balance-sheet exercise will meet the letter of the circular and miss the point of it.

On September 21, 2026, the Bangko Sentral ng Pilipinas issued Circular No. 1240, directing thrift, rural and cooperative banks whose business model resembles a digital bank's to meet the same prudential standards digital banks already carry — starting with a ₱1-billion minimum capital requirement. Covered institutions have six months from the BSP's notice to comply.

The capital number is the part that will get quoted. It is also the easiest part of the circular to satisfy without changing anything about how a bank actually lends.

What the circular actually requires

Read past the capital floor and the circular asks for three things, not one:

1. A ₱1-billion minimum capital requirement, matched to what a licensed digital bank must hold. 2. Enhanced supervisory reporting — the BSP has signaled it can require more frequent or more granular disclosure from covered institutions than they currently provide. 3. Strengthened risk management and control systems — language the BSP has used before to mean the underwriting, monitoring and governance infrastructure behind the balance sheet, not the balance sheet itself.

A rural or cooperative bank that has grown quickly by lending through a digital-first channel can raise capital. Raising capital is a treasury problem — issue equity, retain earnings, bring in an investor. It does not, on its own, change whether that same institution is re-assessing its borrowers on a schedule that matches how fast its book is growing.

Why capital and underwriting capacity move at different speeds

This is not a new pattern. The Securities and Exchange Commission made the same distinction in 2026 when it lifted its moratorium on registering new online lending platforms under Memorandum Circular No. 20 — replacing a blanket freeze with higher capital thresholds for financing and lending companies operating digitally. Higher capital raised the bar for who could enter the market. It said nothing about how any given lender, once licensed, decides who to lend to or how often it re-checks a borrower once the loan is booked.

BSP Circular 1240 puts the same gap inside institutions that are already operating, not just at the door for new entrants. A thrift or rural bank moving to a digital-centric model is, by definition, originating faster than its legacy underwriting process was built to handle. That is usually the whole point of going digital — more borrowers, faster approvals, lower per-loan cost. The risk is that origination speed scales before assessment speed does.

Manual credit spreading — pulling a borrower's audited financial statements, ratio-analyzing them, and rating the result — takes hours per file when done by an analyst. It also produces a rating that reflects the analyst who did the work as much as the borrower being assessed: two files in similar condition can come back rated differently depending on who reviewed them and how recently. For an institution operating at digital-bank volume, full-portfolio manual spreading is not throughput-constrained by policy. It is throughput-constrained by arithmetic — there are only so many analyst-hours in a compliance period.

The six-month clock is a reporting deadline, not a risk-management deadline

BSP Circular 1213, issued in 2026, set a June 30 compliance deadline for a separate set of prudential obligations and was followed almost immediately by examination activity once the deadline passed — a pattern worth remembering here. A six-month compliance window measures whether an institution filed the right paperwork on time. It does not measure whether the institution's credit process improved in that window, and BSP examiners have historically treated the two as separable questions: did you comply, and separately, can you show your risk management actually works.

A covered bank that spends its six months solving for the capital number and treats "strengthened risk management and control systems" as a documentation exercise will pass the first test and fail the second the first time an examiner asks to see the underwriting behind a sample of recent approvals.

What a defensible answer looks like

The institutions best positioned for this circular are the ones that can show three things when asked, not just claim them:

• Standardized assessment. Every borrower rated against the same method, not whichever spreadsheet template the reviewing analyst prefers.
• Portfolio-wide coverage on a repeatable schedule. Not an annual review cycle that leaves nine months of the year unexamined, and not a sample-based check that only covers the largest exposures.
• A dated, reconstructable record. When a rating was produced, on what inputs, and whether it has been refreshed since — the exact record a BSP examiner or an internal auditor would ask to see to distinguish real risk management from a policy binder.

CreditBPO's CRDX platform exists to make that record possible at digital-bank speed: standardized borrower assessment produced in minutes rather than hours, applied consistently across a portfolio, on a cadence that does not wait for the next filing window. A mid-sized rural bank we work with moved its full SME book from an annual manual review cycle to continuous, standardized rating without adding headcount to its credit team — the kind of change that turns "strengthened risk management" from a phrase in a circular into something an examiner can actually verify.

The distinction that matters

BSP Circular 1240 is, on its face, a capital adequacy rule. Read against the pattern of BSP and SEC regulatory activity through 2026 — COCREE 2.0's move to borrower-level reporting, the SEC's capital-gated re-opening of online lending, the BSP's own streamlined disciplinary process for directors and officers — it is part of a broader shift toward institutions being able to demonstrate, on demand, that their credit process is current and standardized, not just that their books are solvent.

Capital tells a regulator an institution can absorb losses. It does not tell anyone how that institution decided who to lend to, or how it will know if that decision needs revisiting before the next scheduled review. For thrift, rural and cooperative banks now operating at digital-bank scale, closing that second gap — not just the capital gap — is the six-month clock that actually matters.

Sources: Bangko Sentral ng Pilipinas Circular No. 1240 (September 21, 2026); Bangko Sentral ng Pilipinas Circular No. 1213 (2026); Securities and Exchange Commission Memorandum Circular No. 20, Series of 2026.