Fintech and Online Payments in the Philippines: What Changed for 2026

1Why 2026 is a turning point for Philippine fintech regulation

For most of the past decade, Philippine fintech regulation grew in layers: the National Retail Payment System framework in 2015, the Payment System Act in 2018, e-money and virtual asset rules, and then a wave of digital bank licences in 2021. The period from January 2025 to October 2026 is different. Instead of adding new categories, the Bangko Sentral ng Pilipinas (BSP) and the Securities and Exchange Commission (SEC) have been tightening and completing the system: reopening and then re-closing the digital bank licensing window, implementing the Anti-Financial Account Scamming Act (AFASA), rewriting the pricing rules for InstaPay and PESONet, launching new payment rails, finalising crypto-asset rules, and moving open finance from a sandbox into live use.

This article maps those developments as of 29 October 2026, distinguishes enacted law from regulator circulars and from projects that are still being built, and sets out what each one means in practice for payment startups, e-commerce merchants, lenders and crypto businesses operating in or selling into the Philippines. It is a regulatory overview, not legal advice, and several items are still moving; the legal considerations panels flag where confirmation is needed before you rely on a point.

• The BSP lifted its digital bank moratorium in January 2025, stopped accepting applications after 30 November 2025, and in 2026 approved MariBank as the seventh digital bank, leaving up to three slots under the cap of ten.
• AFASA (Republic Act No. 12010) is in force and its BSP implementing rules took effect on 25 June 2025, with a one-year compliance deadline for stronger fraud management and authentication that lapsed on 25 June 2026.
• BSP Circular No. 1238 (signed 17 June 2026) replaced the fee moratorium on InstaPay and PESONet with cost-based pricing rules and eased onboarding of low-risk micro-merchants.
• Crypto is now regulated on two tracks: the BSP for payment-type virtual assets and VASPs (new licences remain under moratorium), and the SEC for crypto-asset service providers under Memorandum Circulars 4 and 5, Series of 2025.
• Open finance moved from pilot to live use with the PERA pilot in July 2025, while cross-border instant payments through Project Nexus are targeted for onboarding in mid-2027.

2Digital bank licensing: the window that opened and closed

The BSP imposed a moratorium on new digital bank licences in 2021 after approving six: Overseas Filipino Bank, Tonik Digital Bank, UNOBank, UnionDigital Bank, GoTyme Bank and Maya Bank. In August 2024 it announced that the cap would rise from six to ten, and the moratorium was lifted in January 2025. The reopened window was short. On 18 September 2025 the Monetary Board approved a fresh moratorium, and the BSP stopped accepting new applications after 30 November 2025. According to BusinessWorld's reporting of BSP statements, three complete applications were received within that deadline and were assessed in parallel under BSP Memorandum No. M-2025-032 dated 25 September 2025; the BSP did not name the applicants.

The first result came through a different route. SeaBank Philippines, a Singapore-owned thrift bank, applied to upgrade its existing licence. The Monetary Board approved the upgrade on 19 February 2026, the SEC approved the amended articles of incorporation on 16 June 2026, the BSP issued its certificate of authority on 8 July 2026, and the bank began operating as MariBank, the seventh licensed digital bank, on 18 July 2026, as reported by The Philippine Star. That leaves up to three slots under the cap of ten. As of the research date the BSP had not announced decisions on the remaining applications. It has said that applicants undergo a rigorous assessment of their business models, value propositions and resources, including the fitness and propriety of owners, directors and officers, and that an available slot does not guarantee approval.

What the licensing criteria tell applicants

The BSP's public statements in 2025 and 2026 consistently list three tests: sound governance, a robust risk management framework, and a "compelling value proposition" that serves Filipinos, with a stated preference for models aligned with financial inclusion. The MariBank sequence also shows that BSP approval is only one of several gates. Corporate documents still have to clear the SEC, and a certificate of authority is issued only after post-approval conditions are met, which in this case took roughly five months after the Monetary Board decision.

3Retail payments: fee reform and new rails on InstaPay and PESONet

InstaPay and PESONet are the two automated clearing houses under the National Retail Payment System. Their growth has been steep: BSP Deputy Governor Mamerto Tangonan said in March 2026 that combined InstaPay and PESONet transactions reached PHP 24.74 trillion in 2025, up 42 percent from PHP 17.42 trillion in 2024, and that digital payments made up 57.4 percent of retail transaction volume in 2024, according to the Manila Bulletin. The government's Philippine Development Plan target is 60 to 70 percent by 2028.

Circular No. 1238: from fee freeze to cost-based pricing

For several years the BSP maintained a moratorium on increases to InstaPay and PESONet fees. On 17 June 2026 Governor Eli Remolona Jr. signed BSP Circular No. 1238, which amends the NRPS framework and the merchant payment acceptance rules; the BSP lifted the fee moratorium at the same time, after what Deputy Governor Tangonan described as two conditions being met: waiver of fees on small-value merchant payments and issuance of a pricing mechanism, as reported by The Philippine Star. The circular's main rules, as reported, are:

• BSP-supervised institutions must adopt a written policy on electronic payment fees, with the basis and quantitative support for each charge.
• Person-to-person transfer fees must follow a "reasonable and fair market-based pricing mechanism" supported by analysis of the actual cost of delivering the service.
• Fees for "off-us" transfers (between different institutions) should not materially exceed "on-us" fees except for switch costs directly attributable to off-us processing, and one customer group should not unreasonably subsidise another.
• Recipients of person-to-person transfers must receive the full amount, with no deductions.
• Electronic payment fees must remain lower than the equivalent manual or over-the-counter charge.
• Fee changes require ample prior notice to customers.

The circular took effect fifteen days after publication, and the BSP later clarified that it does not mandate zero fees; it requires institutions to justify their fee structures. The market response was a round of fee cuts rather than increases, and industry reporting in August 2026 attributed a near 45 percent rise in InstaPay and PESONet transactions in the first seven months of 2026 partly to those cuts.

Three new payment services launched in July 2026

On 29 July 2026 the BSP and the Philippine Payments Management Inc. (PPMI) launched three services, as reported by BitPinas: Direct Debit PH, a standardised account-to-account pull payment that lets customers authorise billers to collect recurring amounts on due dates; InstaPay Cash-In, a request-for-funds flow between individuals; and InstaPay for Business, which raised the per-transaction limit for registered businesses from PHP 50,000 to PHP 500,000. The BSP also restated the 2024 distinction between QR Ph for person-to-merchant payments, where the merchant bears the fee, and InstaPay QR for person-to-person transfers.

• PHP 24.74 trillion
  InstaPay and PESONet value in 2025, up 42% year on year (BSP, March 2026)
• 57.4%
  Share of retail payments made digitally in 2024, against a 2028 target of 60–70%
• PHP 500,000
  New InstaPay for Business per-transaction ceiling from 29 July 2026, up from PHP 50,000
• 17 June 2026
  BSP Circular No. 1238 signed; InstaPay/PESONet fee moratorium lifted

4Merchant acceptance, aggregators and marketplaces

Three 2026 issuances matter for anyone who accepts or facilitates online payments. First, Circular No. 1238 itself. Beyond consumer fees, it requires operators of payment systems holding merchant acquisition licences to adopt merchant fees that are "reasonable, transparent, market-based and proportionate" to the cost of the service, backed by documented cost analysis. It also eases onboarding of low-risk merchants, including micro-merchants and informal sellers, who may be enrolled with only a national ID or other valid ID, with the exact requirement depending on the acquirer's risk profile. For a small online seller, this means QR Ph acceptance should become easier to obtain and cheaper to maintain, but the acquirer, not the merchant, decides the tier.

Second, BSP Memorandum No. M-2026-017 of 8 May 2026, as summarised in industry compliance briefings, tightens anti-money laundering expectations in merchant acquiring: payment aggregators carry independent AML and counter-terrorist financing duties; banks and e-money issuers must keep transaction-level data and risk profiles for sub-merchants, with triggers to restrict or terminate high-risk ones; and providers must separate merchant accounts from personal accounts and control commercial use of personal wallets. The stated targets are "mule merchants" and misuse of QR codes. Third, BSP Circular No. 1237 of 16 June 2026 regulates digital financial marketplaces run by banks and e-money issuers, requiring BSP approval, an advanced electronic payments and financial services licence, at least PHP 1 billion in net worth, and at least three unaffiliated product providers; it bars such marketplaces from presenting online gambling products.

A payment aggregator or marketplace that serves regulated sectors should read these alongside sector-specific rules; our guide on payment aggregator compliance for iGaming explains how PSP due diligence works where the merchant itself is licensed.

5AFASA in force: fraud systems, account inquiry and the 30-day hold

Republic Act No. 12010, the Anti-Financial Account Scamming Act, was approved on 20 July 2024. The text of the law creates three principal offences: money muling (using, lending, buying, renting or selling a financial account, or recruiting others to do so, to move proceeds of crime), punishable by six to eight years' imprisonment and a fine of PHP 100,000 to PHP 500,000; social engineering schemes (obtaining sensitive identifying information by deception, for example by posing as a bank), punishable by ten to twelve years and PHP 500,000 to PHP 1 million, with higher ranges where the victim is a senior citizen; and economic sabotage, where these acts are committed by three or more conspirators, against three or more victims, through mass mailers or through trafficking, punishable by life imprisonment and a fine of PHP 1 million to PHP 5 million. Fines on juridical persons are doubled, up to PHP 10 million.

The provisions that reshape compliance are the institutional ones. Section 6 obliges financial institutions to protect account access with risk controls proportionate to their operations, including multi-factor authentication and fraud management systems. Institutions that the BSP finds compliant are shielded from liability for scam losses; those that fail to employ adequate controls or the highest degree of diligence must restore the funds, and "conviction shall not be a prerequisite to the restitution of funds." Section 7 lets institutions temporarily hold funds in a disputed transaction for a period the BSP prescribes, not exceeding 30 calendar days unless a court extends it, and Section 8 requires the institutions involved to run a coordinated verification process. Sections 12 to 15 give the BSP authority to inquire into accounts it has well-founded reason to believe are involved in these offences, notwithstanding bank secrecy and data privacy laws, and to share the results with law enforcement; no court below the Court of Appeals may enjoin that authority.

The implementing rules and the June 2026 deadline

The BSP issued the implementing rules on 10 and 11 June 2025, effective 25 June 2025, as a set of three issuances covering IT risk management, financial account inquiry and information sharing, and the temporary holding of disputed funds. The IT risk component is BSP Circular No. 1213, signed 30 May 2025. As reported by GMA News, it requires institutions with complex electronic products, or with an average monthly network transaction value of at least PHP 75 million over six months, to run fraud management systems that are real-time, able to detect and block transactions, and continuously calibrated, addressing behavioural anomalies, blacklist screening, geolocation and changes to device or account information. It also directs institutions to limit authentication methods that third parties can intercept, meaning SMS and e-mail one-time passwords, for high-risk transactions and critical account changes, in favour of biometrics, passwordless methods such as FIDO, and adaptive authentication. The BSP gave a one-year transition, so that deadline passed on 25 June 2026. Reporting in 2026 indicates the BSP followed up with Circular No. 1232 (27 April 2026) on cybersecurity maturity and a July 2026 memorandum discontinuing password and SMS-based authentication for privileged administrative access; the texts of those issuances should be confirmed directly with the BSP.

6Crypto on two tracks: BSP virtual asset rules and SEC CASP rules

Crypto regulation in the Philippines is now split by function. Where a crypto-asset is used for payment or remittance, the provider is a virtual asset service provider (VASP) under BSP Circular No. 1108 of 2021. Where the asset is offered, traded or intermediated as a security or investment, the provider is a crypto-asset service provider (CASP) under SEC rules. Many businesses fall under both.

BSP: moratorium extended, token listing standards imposed

The BSP stopped accepting new VASP applications in 2022. On 20 August 2025 it issued a memorandum extending that moratorium from 1 September 2025 "until further notice," citing consumer protection, financial integrity and cybercrime risks, with an exception for banks and institutions rated "stable" under the BSP's Supervisory Assessment Framework, as reported by CoinGeek. On 5 June 2026 the Monetary Board approved Memorandum No. M-2026-023, which, according to the Philippine Daily Inquirer, requires the eleven registered VASPs to run a due diligence and accreditation process before listing any token, covering the issuer's identity and beneficial owners, market capitalisation and 30-day trading volume, use case, security and audit status, liquidity and reserves, and legal compliance. VASPs must set deviation thresholds that trigger review or delisting, must suspend or delist tokens on insolvency of the issuer, loss of liquidity support, involvement in a scam or a regulator flag, and are barred from listing anonymity-enhancing "privacy" coins.

SEC: Memorandum Circulars 4 and 5, Series of 2025

On 30 May 2025 the SEC issued MC No. 4 (the CASP Rules) and MC No. 5 (the CASP Operational Guidelines), effective 5 July 2025. As summarised by Fintech News Philippines, a CASP must register with the SEC before issuing, selling, trading or promoting crypto-assets; maintain a physical office in the Philippines and a local data centre; hold minimum paid-up capital of PHP 100 million, excluding any crypto holdings; publish an offering disclosure document at least 30 days before marketing a crypto-asset; segregate customer assets from its own; and file monthly, quarterly and annual reports including wallet addresses, related-party transactions and audited financial statements. CASPs are "covered persons" under the Anti-Money Laundering Act, and outsourcing must be documented with the CASP remaining fully liable. The marketing rules are broad: third-party promoters, including online influencers, are covered unless their content is purely educational and in good faith. Administrative fines range from PHP 50,000 to PHP 10 million per instance, with PHP 10,000 per day for continuing violations, and wilful violations carry one to five years' imprisonment.

The practical consequence is that a token exchange serving Philippine users may need a BSP VASP registration (currently unavailable to new entrants except through the stable-bank exception), an SEC CASP registration, and Anti-Money Laundering Council registration, all at once. Our guide on securing a cryptocurrency business licence in the Philippines walks through the application sequence.

7Open finance, cross-border payments and the sandbox

The BSP's Open Finance Framework was issued as Circular No. 1122 in 2021. It defines open finance as "leveraging on and sharing of customer-permissioned data" among banks, other financial institutions and third-party providers, and it was deliberately industry-led: an Open Finance Oversight Committee Transition Group was recognised in November 2021, a Standards Consultation Working Group was formed in March 2023, and a voluntary pilot supported by the International Finance Corporation ran from June 2023, according to the BSP's open finance page. The framework is tiered, starting with product and account information and extending later to transaction data, payment initiation, lending and insurance, always on the basis of customer consent.

The first live, public-facing use came on 29 July 2025 with the Open Finance for PERA pilot, which lets individuals open Personal Equity and Retirement Accounts through banking apps and e-wallets by consenting to the reuse of their existing know-your-customer data, with Land Bank, Maya, Metrobank, PNB, RCBC, UnionBank and GCash as account providers and ATRAM Trust, BDO Unibank and BPI Wealth as PERA administrators, as reported by the Daily Guardian. Governor Remolona said the BSP would monitor results before extending open finance to credit, insurance and investments. As of the research date we could not locate a BSP issuance making any open finance tier mandatory for all supervised institutions in 2026; the regime remains consent-based and participation-driven, and fintechs seeking data access should expect to join through accredited third-party-provider arrangements rather than a statutory right of access.

Project Nexus and cross-border payments

Project Nexus, a Bank for International Settlements Innovation Hub initiative, will connect InstaPay to the instant payment systems of Malaysia, Thailand, Singapore, India and, since early 2026, Indonesia, through a single multilateral platform instead of bilateral links. Deputy Governor Tangonan said on 2 March 2026 that an operating company had been set up in Singapore, executives hired and a technology operator selected, with 2026 devoted to building and testing and onboarding scheduled for mid-2027. Remittance firms and e-wallets planning cross-border products should treat 2027 as the earliest realistic date for live Nexus corridors and plan around existing bilateral and correspondent arrangements until then.

1. 2021-06-17
   Circular No. 1122 establishes the Open Finance Framework (date per BSP records; confirm against the circular text).
2. 2024-07-20
   RA 12010 (AFASA) approved.
3. 2025-01-01
   Digital bank moratorium lifted; cap raised to ten licences.
4. 2025-05-30
   SEC MC 4 and 5 on crypto-asset service providers issued (effective 5 July 2025); BSP Circular No. 1213 signed.
5. 2025-06-25
   AFASA implementing rules take effect; one-year fraud-management transition begins.
6. 2025-07-29
   Open Finance for PERA pilot launched.
7. 2025-09-01
   VASP licensing moratorium extended until further notice.
8. 2025-11-30
   Digital bank application window closes; three complete applications received.
9. 2026-02-19
   Monetary Board approves MariBank licence upgrade; operations begin 18 July 2026.
10. 2026-06-17
    Circular No. 1238 signed; InstaPay/PESONet fee moratorium lifted.
11. 2026-06-25
    Circular No. 1213 compliance deadline for fraud management systems and authentication.
12. 2026-07-29
    Direct Debit PH, InstaPay Cash-In and InstaPay for Business launched.

The regulatory sandbox

The BSP operates a regulatory sandbox framework for emerging technologies, allowing a limited "test and learn" deployment under supervision before full licensing. Open finance pilots have run under this framework. As of the research date we have not verified any 2026 amendment to the sandbox rules, and prospective participants should obtain the current framework and application form directly from the BSP's Technology Risk and Innovation Supervision Department.

8Compliance implications for startups and merchants

Taken together, the 2025 and 2026 developments point in one direction: the BSP and SEC are extending bank-grade expectations on fraud control, pricing transparency and customer due diligence down to the smallest participants in the payment chain, while keeping the most sensitive licences (digital banks, VASPs) closed or tightly rationed. For a startup or merchant, the practical consequences break down by role.

• Online merchants and marketplaces: review acquirer agreements for new sub-merchant monitoring, termination triggers and the separation of personal from merchant wallets; expect simpler onboarding for low-risk micro-merchants but tighter action on misuse of QR codes; build the possibility of a 30-day AFASA hold on disputed receipts into cash-flow and refund policies.
• Payment aggregators and gateways: confirm whether you hold or need an Operator of Payment System registration and merchant acquisition licence; document cost-based fee policies under Circular No. 1238; adopt independent AML programmes rather than relying on the sponsoring bank.
• Lending, wallet and account-based apps: map every authentication step against the Circular No. 1213 expectations, retire SMS and e-mail OTPs for high-risk actions, and keep evidence of fraud management system calibration, since compliance is the gateway to the AFASA safe harbour.
• Crypto businesses: determine whether each product falls under BSP VASP rules, SEC CASP rules or both; plan for PHP 100 million paid-up capital, a local office and data centre, and the 30-day pre-marketing disclosure; audit influencer and affiliate arrangements against the SEC marketing restrictions.
• Data-driven fintechs: treat open finance access as consent-based and partnership-driven for now, and align data-sharing agreements with the Data Privacy Act; see our Data Privacy Act breach notification checklist.
• Prospective bank or EMI applicants: with the digital bank window shut, evaluate acquisition of an existing licence and budget for SEC corporate approvals and post-approval conditions, which added roughly five months in the MariBank case.

Abanto Law Firm advises payment companies, platforms and merchants on BSP and SEC licensing, AFASA compliance, contract structuring with acquirers and aggregators, and crypto-asset registration. If your business is affected by any of the developments above, you can contact the firm or read more about our corporate and regulatory practice.

9Frequently asked questions