Unlicensed Gaming Apps: Liability for Developers, Hosts and PSPs

1Why technology vendors are now inside the enforcement perimeter

For most of the past decade, a game studio, a cloud host or a payment gateway that supplied an online gambling app in the Philippines could treat licensing as the operator's problem. That assumption no longer holds. Between mid-2025 and the research date of 29 October 2026, three things changed at once: the Philippine Amusement and Gaming Corporation (PAGCOR) moved every business-to-business supplier of licensed e-gaming into a formal accreditation regime; the Bangko Sentral ng Pilipinas (BSP) ordered e-wallets to cut their direct links to gambling platforms; and the Cybercrime Investigation and Coordinating Center (CICC), the Philippine National Police and PAGCOR formalised joint operations against unlicensed sites. The CICC reported 1,891 illegal online gambling reports in the first three months of 2026 alone.

A vendor whose code, servers or rails sit behind an app that takes wagers from Philippine residents without a PAGCOR licence now faces four distinct exposures: the criminal gambling statutes, the Cybercrime Prevention Act, anti-money laundering rules, and PAGCOR's administrative reach over accredited suppliers. This article maps each layer, then sets out how studios, aggregators, hosting providers and payment service providers (PSPs) can allocate the risk in their contracts and screen their clients. It does not describe how to avoid licensing, geo-blocking or AML controls; where a client wants that, the correct answer is to decline the engagement.

• PD 1602 reaches anyone who "directly or indirectly" takes part in unauthorised gambling, and RA 9287 punishes the financier, maintainer and premises-owner tiers of illegal numbers games with long prison terms.
• RA 10175 adds liability for wilfully aiding or abetting an offence committed through ICT and raises the penalty for predicate crimes by one degree.
• PAGCOR's B2B accreditation framework (memo of 30 April 2025; Revision 1 effective 2 October 2025; decommissioning of non-compliant systems from 1 August 2026) means supplying licensed operators is itself a regulated activity.
• Contract language cannot make an illegal engagement legal, but licensing warranties, suspension rights, audit access and indemnities materially change who bears the loss when a client turns out to be unlicensed.
• Client due diligence should be documented before onboarding and repeated on triggers, not treated as a one-time sales formality.

2The criminal baseline: PD 1602 and RA 9287

Philippine gambling offences rest on two main instruments. Presidential Decree No. 1602 (11 June 1978) prescribes stiffer penalties for illegal gambling and remains the general charging statute. Its Section 1(a) punishes "any person other than those referred to in the succeeding subsections who in any manner, shall directly or indirectly take part in" an enumerated illegal game, and the enumeration closes with "any other game scheme, whether upon chance or skill, wherein wagers consisting of money" are made. Section 1(b) covers the "maintainer or conductor" of such a game, and Section 1(a)(2) separately punishes any person who "knowingly permits any form of gambling" in a place, building, vessel or vehicle "owned or controlled by him." The base penalty for a participant is prision correccional in its medium period (two years, four months and one day to four years and two months) with a fine, and the fine figures still carry 1978 values, which is why prosecutors usually pair the decree with other statutes.

Republic Act No. 9287 (approved 2 April 2004) replaced the PD 1602 penalties for one category, illegal numbers games such as jueteng, masiao and last two, with a graduated ladder of imprisonment by role. The bettor faces 30 to 90 days; personnel or staff six years and one day to eight years; the collector or agent eight years and one day to ten; the coordinator or supervisor ten years and one day to twelve; the maintainer, manager or operator up to fourteen years; the financier or capitalist fourteen years and one day to sixteen; and the protector or coddler sixteen years and one day to twenty. Section 3(b) extends the personnel penalty to "any person who allows his vehicle, house, building or land to be used in the operation." Section 9 forfeits paraphernalia and property used in the operation, and presumes that assets disproportionate to lawful income are proceeds of the offence.

Three points matter for technology vendors. First, RA 9287 is confined to numbers games; a slot-style or card-game app is charged under PD 1602 (and the Revised Penal Code articles it amended), so the heavier RA 9287 ladder is not automatically in play. Second, the "directly or indirectly take part" language in PD 1602 and the "financier or capitalist" and premises tiers in RA 9287 are the hooks a prosecutor would use to argue that a vendor's conduct went beyond neutral supply; no published Supreme Court decision located during research has applied them to a software developer or cloud host as such. Third, the Chambers Gaming Law 2025 Philippines chapter notes that Executive Order No. 13 (2017) expanded "illegal gambling" to include direct or indirect unauthorised participation, which reinforces the reading that supply-side involvement is within scope.

3RA 10175: aiding, abetting and the one-degree uplift

The Cybercrime Prevention Act of 2012 (RA 10175), approved 12 September 2012, is the statute that converts a gambling case into a technology-provider case. Section 6 provides that all crimes under the Revised Penal Code and special laws, "if committed by, through and with the use of information and communications technologies," fall within the Act and that "the penalty to be imposed shall be one (1) degree higher." That is why charge sheets for online sabong and app-based betting now routinely read "PD 1602 in relation to RA 10175," as the CIDG did after its March 2026 raid on an online sabong hub in Tondo, Manila, where 174 people were arrested, including IT personnel and tellers.

Section 5(a) then adds a distinct offence: "Any person who willfully abets or aids in the commission of any of the offenses enumerated in this Act shall be held liable." Under Section 8 the penalty for a Section 5 offence is imprisonment one degree lower than the principal offence, or a fine of PHP 100,000 to PHP 500,000, or both. The operative word is willfully. A host that learns its client is an unlicensed gambling operator and keeps the servers running, or a studio that ships a Tagalog-localised casino build after being told the client has no PAGCOR licence, is far closer to that threshold than a vendor that was deceived and acted promptly once it knew. Section 9 adds corporate liability: where an offence is knowingly committed for the benefit of a juridical person by someone in a leading position, the company itself faces a fine of up to PHP 10 million, and up to PHP 5 million where the offence was made possible by a lack of supervision or control. A compliance programme that is written but not operated is precisely the "lack of supervision" the provision describes.

Two cautions. The Supreme Court in Disini v. Secretary of Justice (2014) upheld Section 5 generally but limited its application to certain content offences, and no reported decision applies Section 5 to a gambling predicate against a developer or host; the exposure is live but untested. Second, RA 10175 contains no intermediary safe harbour that the firm could identify, so vendors cannot assume "mere conduit" status protects them once knowledge is established.

4Anti-money laundering exposure and the payments squeeze

Republic Act No. 10927 (approved 14 July 2017) made "casinos, including internet and ship-based casinos" covered persons under the Anti-Money Laundering Act (RA 9160, as amended). A "casino" is defined as a business "authorized by the appropriate government agency to engage in gaming operations," and an internet-based casino is one "in which persons participate by the use of remote communication facilities." A single casino cash transaction above PHP 5 million is a covered transaction. Because the definition is tied to authorisation, an unlicensed app is not a "covered person" that files reports; it is instead a potential source of unlawful proceeds. Gambling offences under PD 1602 and RA 9287 are among the unlawful activities listed in the AMLA, so money flowing from an unlicensed app to a PSP, a hosting invoice or a developer's revenue-share can be characterised as proceeds, and a party that handles those funds knowing their source risks a laundering charge in addition to the gambling and cybercrime counts. The Chambers chapter also records that a 2025 statute banning offshore gaming made that activity a predicate offence under the AMLA; the exact Republic Act number should be confirmed by counsel.

Payment providers have the most concrete recent history. On 14 August 2025, following a Senate hearing, the BSP ordered e-wallets and other supervised institutions to remove direct links to online gambling platforms; GCash and Maya complied within days, and PAGCOR told a House committee on 22 October 2025 that its monthly income had fallen from PHP 5.7 billion in May to PHP 2.9 billion in September as a result. On 10 December 2025 PAGCOR announced that credit cards and cryptocurrencies could no longer be used for gambling payments with its licensees, citing over-borrowing and impulsive behaviour, and it required licensees to add self-exclusion and betting-limit tools. On 21 May 2026 the PAGCOR board approved amendments, effective 4 June 2026, under which BSP-supervised financial institutions accredited as support service providers must follow applicable Anti-Money Laundering Council rules, and BSP will report their non-compliance to PAGCOR's Anti-Money Laundering Supervision and Enforcement Department. A PSP that processes for an unlicensed app therefore stands outside every one of these frameworks while remaining fully inside the AMLA's predicate-offence provisions.

• 14 Aug 2025
  BSP orders e-wallets to unlink from online gambling platforms
• PHP 5.7bn to 2.9bn
  PAGCOR monthly income, May to September 2025, as reported to the House on 22 Oct 2025
• 10 Dec 2025
  PAGCOR bars credit cards and cryptocurrency for gambling payments with licensees
• 4 Jun 2026
  Amended e-gaming rules for payment providers, affiliates and support service providers take effect

5PAGCOR's reach over suppliers: the B2B accreditation framework

PAGCOR cannot prosecute anyone. Its leverage over suppliers comes from two sources: the conditions it attaches to its licensees, and, since 2025, a direct accreditation requirement for the suppliers themselves. In a memorandum dated 30 April 2025, PAGCOR's Electronic Gaming Licensing Department announced a Regulatory Framework for the Accreditation of Gaming Affiliates and Support Service Providers, bringing payment processors, game content suppliers, KYC vendors and customer-support outsourcers under direct PAGCOR accreditation for the first time and re-labelling gaming system service providers as Gaming System Administrators (GSAs). According to the Chambers chapter, Revision No. 1 of the framework took effect on 2 October 2025 with a transition period to 31 March 2026, foreign providers must establish a local presence with SEC registration and BIR compliance, and accredited entities face fines of up to PHP 300,000 per offence, suspension or revocation, blacklisting, and forfeiture of a PHP 1 million performance cash deposit per entity or game offering.

Enforcement followed. A memorandum signed on 21 May 2026 and published on 26 May 2026 set 31 May 2026 as the application deadline for contracted B2B providers, 31 July 2026 as the date to complete all requirements (non-refundable fee, probity check report, on-site inspection, actual testing of the electronic gaming system and online gaming platform, and posting of the deposit), and warned that non-compliant providers would have their systems decommissioned from 1 August 2026. Providers that missed the May deadline were barred from serving any GSA, with technical evaluation requests returned without action.

Two consequences flow for vendors around an unlicensed app. First, accreditation is permission to serve PAGCOR licensees; it is not a licence to supply anyone else, and an accredited studio or PSP found to be supplying an unlicensed Philippine-facing operator puts its own accreditation, deposit and probity standing at risk. Second, the framework allocates responsibility inside the licensed ecosystem in ways that matter for drafting: the Chambers chapter records that white-label arrangements "do not transfer or dilute regulatory responsibility," that obligations of a non-accredited foreign aggregator fall on the accredited distributor, and that operators and accredited marketing providers are "jointly liable" for advertising breaches. The firm's earlier article on when B2B suppliers need their own licence or accreditation covers the application mechanics; this article is concerned with what happens when the operator at the end of the chain has none.

1. 2025-04-30
   PAGCOR EGLD memo announces direct accreditation of gaming affiliates and support service providers; GSA category created.
2. 2025-07-11
   Government ultimatum to influencers and promoters of illegal gambling, as reported by the CICC.
3. 2025-08-14
   BSP directive requires e-wallets to sever direct links to online gambling platforms.
4. 2025-10-02
   Revision No. 1 of the B2B accreditation framework takes effect; transition to 31 March 2026.
5. 2025-12-10
   PAGCOR payment restrictions on credit cards and cryptocurrency announced.
6. 2026-03-16
   CICC formalises joint operations with PNP-ACG and PAGCOR; 1,891 reports logged in Q1 2026.
7. 2026-05-31
   Application deadline for contracted B2B providers; completion by 31 July; decommissioning from 1 August 2026.
8. 2026-06-04
   Amended e-gaming rules for payment providers, affiliates and support service providers take effect.

6Risk by provider type

Exposure scales with how much a vendor knows, how specific its contribution is to wagering, and how much it earns from the wagering itself. A revenue-share tied to gross gaming revenue is harder to characterise as neutral supply than a flat hosting fee, and a vendor that keeps serving a client after a PAGCOR advisory names it is in a different position from one that never knew.

The CICC's own figures illustrate the last row: in September 2025 it identified 1,007 sites operating without PAGCOR authority and documented 119 influencers promoting gambling platforms, and its acting executive director said demand letters for possible criminal charges would follow. Marketing vendors that cannot show a licence check for every promoted brand are the easiest category to pursue.

7Allocating the risk in the contract

No contract term can make it lawful to supply an unlicensed gambling operation, and an indemnity from a client that is later raided is often worth little. What contract drafting can do is three things: force the licensing question to be answered in writing before work starts, give the vendor the right to stop immediately when the answer changes, and shift the financial loss onto the party that controls the licence. The firm's companion piece on game provider contracts from the operator's side approaches the same relationship from the other direction.

Representations and warranties

The client should warrant, as of signing and continuously, that it holds every licence, accreditation and permit required to offer the product in each market where the vendor's deliverable will be used; that it will not make the deliverable available to persons in the Philippines unless a PAGCOR authority covering that product is in force; and that it will notify the vendor within a fixed short period of any show-cause order, suspension, regulatory inquiry or change of control. Attach the licence as a schedule and define "Licensed Markets" as a closed list.

Covenants on use and controls

Require the client to maintain geo-restriction, age and identity verification and responsible-gaming tools that meet the applicable regulator's standards; prohibit sub-licensing or white-labelling to third parties without consent and evidence of their own authority; and reserve the right to require, at the vendor's option, that content be served only through an accredited GSA or platform. For PSPs, require accurate merchant category coding and prohibit routing gambling volume through non-gambling merchant accounts.

Suspension, termination and step-in

The vendor needs an immediate, no-fault suspension right triggered by any credible indication that the client is unlicensed in a market it serves, including a regulator advisory, a CICC or NTC blocking notice, a payment-partner termination or an unexplained change of corporate control. Termination for cause should follow if the client cannot produce a valid licence within a short cure period. The clause should also address what happens to player data, content and funds in flight so that stopping does not itself breach the Data Privacy Act or trust obligations.

Indemnity, insurance and audit

Indemnity should cover fines, forfeited deposits, defence costs and losses from blacklisting or loss of the vendor's own accreditation, and should sit outside the general liability cap. Require the client to maintain insurance where available, and secure audit rights over licence status, KYC and AML files, and advertising. For aggregators and white-label platforms, mirror the PAGCOR position that regulatory responsibility stays with the operator, and refuse clauses that purport to shift it to the vendor. Governing law and dispute clauses should not be allowed to make a Philippine criminal exposure harder to defend; an offshore arbitration seat does nothing for a director facing a PNP-ACG complaint in Manila.

8Know your client: a due-diligence checklist for suppliers

Most vendor onboarding checks creditworthiness and sanctions but not gaming authority. The following items should be evidenced in a file that would withstand a regulator's or prosecutor's question "what did you know, and when?" The firm's articles on PSP onboarding controls and AML duties for iGaming operators give the operator-side detail that a vendor's questionnaire should test.

• Identify the operating entity, its beneficial owners and key persons; reconcile against SEC and BIR registration and against PAGCOR's published list of licensees and accredited entities.
• Obtain the licence or accreditation certificate and confirm its scope covers the product (e-games, e-bingo, sports betting, live dealer) and the channel (web, app) the deliverable will serve.
• Confirm the markets to be served, how players outside licensed markets are blocked, and who operates that control.
• Check how the client is paid by players and pays you; be alert to cash, cryptocurrency or third-party settlement that bypasses BSP-supervised channels.
• Review the client's responsible-gaming, KYC and AML policies and ask who its compliance officer and data protection officer are.
• Search enforcement sources: PAGCOR advisories, CICC and PNP-ACG announcements, court dockets and payment-network terminations.
• Set monitoring triggers (licence expiry, regulator advisory, change of control, abnormal volume) and a named owner who can invoke suspension.
• Keep the file: questionnaires, certificates, screenshots with dates, correspondence and the decision record for each onboarding and each review.

9Where this leaves suppliers in late 2026

Bills to ban or sharply restrict licensed domestic online gambling have been pending in Congress since July 2025; as of the research date their status should be confirmed with the Senate and House legislative information systems before being relied upon. PAGCOR's accreditation regime is in enforcement mode, the BSP has drafted further limits on betting and top-ups, and the CICC has the mandate and partners to block and refer. For a vendor the message is the same across all of it: the legal character of your client's operation determines the legal character of your revenue.

Studios, aggregators, hosts and PSPs that want to serve the Philippine market lawfully should treat accreditation, licence verification and contract controls as one programme. Abanto Law Firm advises technology providers and operators on gaming licensing and accreditation in the Philippines, on supplier and platform agreements, and on responding to regulatory and criminal inquiries. To discuss a specific engagement or review an existing client portfolio, contact the firm.

10Frequently asked questions