As Asia-Pacific regulators impose stricter scam prevention and reimbursement rules, digital-first financial institutions must leverage technology to bridge resource gaps.

Financial regulators across the Asia-Pacific region are increasingly shifting scam liability and reimbursement obligations onto financial institutions. For digital-first entities such as digital banks, fintechs, and payments firms, these evolving frameworks present a unique challenge. These firms must generally meet the same stringent obligations as traditional banks, often without the same balance sheet depth or large compliance teams.

During a recent Regulation Asia webinar, industry experts discussed how leaner institutions can navigate these new shared responsibility frameworks. The consensus among panellists was that regulators are moving away from simply checking for the existence of policies, and are instead focusing heavily on outcomes and the speed of institutional responses.

Nauman Abuzar, Vice President of Risk & Compliance at SEON, which operates an AI-powered command centre and fraud prevention platform, noted that regulatory expectations now centre on whether a firm could have prevented a scam and what actions were taken upon detection.

He said digital-first institutions face a particular challenge because they are competing with much larger banks and often have limited resources to absorb fraud losses or investigate every alert. However, Abuzar noted that these firms are not burdened by legacy infrastructure, which provides some advantage.

"The real question is how to use that advantage," he said. "Ultimately, the institution that manages well will be the one that turn their existing data into faster and better decision making."

Shifting regulatory frameworks

In the Philippines, the regulatory approach has become significantly more proactive following the passage of the Anti-Financial Account Scamming Act (AFASA) in 2024. Ryan Bautista, Head of AML Compliance at UnionDigital Bank, explained that the central bank, Bangko Sentral ng Pilipinas (BSP), has since issued circulars to implement the law, focusing on strengthening technology and fraud risk controls, establishing procedures for information sharing, and creating a framework for the temporary holding of disputed funds.

Bautista noted that AFASA brings fraud, cybersecurity, and AML disciplines much closer together. "The framework therefore emphasises the prevention, the detection, and the delay, together with the ability to trace, temporary hold the funds, and verify the disputed funds," he said. For digital-first institutions, Bautista added, fraud prevention can no longer sit at the edge of compliance; it must be embedded directly into the customer journey and the transaction itself.

In Australia, the industry is preparing for the Scam Prevention Framework (SPF), which features principles-based legislation and potential fines of up to AUD 50 million. Toby Evans, Head of Economic Crime at AusPayNet, said the payments industry supports the SPF because it recognises that criminals do not identify and socially engineer their victims on payment platforms.

Currently, the SPF imposes mandatory obligations on banks, telecommunications companies, and social media platforms to prevent, detect, and disrupt scams. AusPayNet is advocating for the inclusion of dating platforms, online marketplaces, virtual asset service providers and the payments industry as a whole as designated sectors, Evans said.

"We don't want to see a displacement effect in the complex web of payments where there's undue frictions and controls for the rest of the payments industry," Evans said. He also highlighted that while the rollout of confirmation of payee services in Australia has built trust, it has not proven to be a silver bullet against payment misdirection and business email compromise scams, which rely heavily on social engineering.

Breaking down silos

To effectively combat the speed of modern scams, financial institutions are being urged to integrate their fraud and AML functions. However, the panellists cautioned that convergence does not necessarily mean merging the teams into a single unit.

Catherine Liu, Director, Regulatory Affairs & Compliance, Global Payments (formerly Worldpay) – which focuses on transactions for marketplaces, digital platforms, and payment facilitators – stressed that integration means connecting information, assessing it through different risk lenses, and coordinating a response.

Whether a fraud team is looking for illegitimate transactions, an AML team is tracing fund flows, or a scheme compliance team is monitoring chargeback rates, they should all rely on the same connected evidence, she said.

"It's actually about getting the right evidence to the right people so that they can make the right decisions at that time," Liu said. She emphasised that scam prevention must start before bad actors enter the payment system, making rigorous merchant onboarding critical. "The biggest risk isn't always the merchant we don't know, it's actually the merchant we think we know," she added.

Bautista echoed this sentiment, noting that technology should allow both fraud and AML teams to see the same customer risk picture to identify connections earlier, while governance determines who investigates and who reports. "Fraud sees the scam while AML sees where the money goes," Bautista said. "So, the opportunity is to connect those two views without blurring accountability."

Leveraging technology

With leaner teams, digital-first firms are increasingly turning to artificial intelligence (AI) and machine learning to manage high-volume detection and intervention. Liu said her firm utilises real-time fraud screening technology that analyses factors such as typing speed at checkout, alongside hundreds of thousands of behavioural rules, to spot suspicious patterns.

While AI offers significant operational efficiencies, Abuzar warned against removing human oversight. He suggested that AI should be used to summarise cases, identify connections, and provide contextual views for investigators, particularly when funds are on hold. "We should leverage AI to help bring efficiency in the process and in decisioning," Abuzar said. "But human in the loop is really important."

Ecosystem wide response

The panellists agreed that combating financial crime requires a coordinated network response, as no single institution can solve the scam problem alone. Bautista noted that scammers operate as networks, meaning defensive strategies must also operate as a network encompassing financial institutions, regulators, and law enforcement agencies.

Looking ahead, Evans raised concerns about the emerging risks associated with agentic commerce, where AI agents autonomously execute transactions. He warned that criminals will inevitably exploit these new systems, eroding trust in the digital economy if safeguards are not established early.

"We need to make sure that these systems are built with privacy, safety, and security by design," Evans said, noting that the industry must anticipate these vulnerabilities to avoid the delayed responses seen during the initial rollout of the digital economy.

Ultimately, because criminals do not view fraud and money laundering as separate disciplines, financial institutions cannot afford to either, Abuzar said. For firms with leaner teams, successfully navigating this shifting landscape will depend on breaking down internal silos and connecting risk data to outpace the networks they are fighting.

--

The webinar, available on-demand here, and this article were produced as a collaboration between SEON and Regulation Asia.