Mobile Payment Apps: The Philippine Fintech Regulatory Map for 2026

1Why the 2026 map looks different from 2023

Three years ago a Philippine payment or merchant app could plan around a short list: register with the Bangko Sentral ng Pilipinas (BSP) if it moved money and with the National Privacy Commission (NPC) if it processed personal data. By the research date of 29 October 2026, several agencies each police a different layer of the same transaction. The BSP still licenses the money-movement layer, but now also enforces the Anti-Financial Account Scamming Act (Republic Act No. 12010, signed 20 July 2024) through 2025 circulars. The Department of Trade and Industry (DTI) polices the commerce layer under the Internet Transactions Act. The Securities and Exchange Commission (SEC) has taken jurisdiction over crypto-assets that are not primarily payment instruments. The NPC remains the privacy regulator for all of them. This article maps which rule applies to which business model and what changed in 2025 and 2026; it is an overview of enacted law and regulator issuances, not a licensing opinion on a specific product.

• The BSP pathway turns on what you do with the money: issue e-money (EMI), operate a payment system (OPS registration) or exchange virtual assets (VASP).
• AFASA (RA 12010) and BSP Circulars 1213, 1214 and 1215 of 2025 shifted the fraud burden onto institutions: stronger authentication, 30-day holds on disputed funds, civil liability for weak controls.
• Merchants and platforms outside BSP supervision answer to DTI's E-Commerce Bureau under RA 11967, in full effect since 20 June 2025.
• Crypto is split between the BSP's VASP regime and the SEC's Memorandum Circulars 4 and 5 of 2025.
• Consumer protection, QR Ph and Open Finance obligations attach the moment you become a BSP-supervised institution.

2The BSP layer: EMI, OPS and VASP

The BSP regulates three overlapping activities that payment apps perform. Which one your product triggers is the most important design decision, because each carries a different capital, governance and reporting burden.

Electronic money issuers

An app that stores customer value in a wallet and lets the customer spend or transfer it is issuing electronic money. The framework is BSP Circular No. 1166, issued 7 February 2023 and effective 2 March 2023, which replaced Circular 649 of 2009, reduced the categories to EMI-Banks and EMI-Non-Bank Financial Institutions (EMI-NBFIs), raised capital and liquidity requirements on a tiered basis and gave existing issuers one year to comply. The precise capital figures depend on the issuer's tier and should be read from the circular itself.

The BSP had imposed a moratorium on new EMI-NBFI licences in November 2021, extended it to 15 December 2024, and then lifted it effective 16 December 2024. The lifting is not an open door: the BSP said it would process only applications backed by an evidence-based market study, transparent ownership, fit-and-proper shareholders and management and adequate capital, and would prioritise new business models, unserved markets or emerging technologies. As of September 2024 it had licensed 42 EMI-NBFIs and 27 EMI-Banks, so a new applicant must show what it adds.

Operators of payment systems

The National Payment Systems Act (RA 11127, signed 30 October 2018) made the BSP overseer of all payment systems and required operators of payment systems (OPS) to register. BSP Circular No. 1049, Series of 2019 created a simplified, self-assessment registration and seeded the Manual of Regulations for Payment Systems. Two features matter. First, OPS is a registration, not a licence: the BSP uses it to build an inventory before deciding which systems to "designate" for closer oversight. Second, entities already licensed by the BSP only file a notification, while previously unregulated companies, including gateways, aggregators, acquirers and marketplaces that hold or route funds, must complete the full registration.

Virtual asset service providers

If the app lets users buy, sell, exchange or transfer crypto-assets used as a means of payment, the BSP's VASP rules, dating from Circular 1108 of January 2021, apply. They now sit alongside the SEC's crypto-asset service provider rules; the dividing line is discussed in section 6.

3AFASA and the BSP's 2025 implementing circulars

RA 12010 criminalises money muling, social engineering schemes and economic sabotage through financial account scamming, and gave the BSP three tools: inquiry into suspect financial accounts without a court order, temporary holding of disputed funds, and a mandate to strengthen institutions' IT and fraud controls. The statute took effect on 13 August 2024, but the operative detail arrived with the implementing rules. The BSP released them in June 2025, and the rules took effect on 25 June 2025, about two months ahead of the deadline Congress had set.

The IRR is a set of three circulars signed by Governor Eli Remolona Jr. on 30 May 2025, as described in the Baker McKenzie Philippines cyber-law summary and in contemporaneous reporting:

• Circular No. 1213 (2025) amends the BSP's IT risk management regulations to implement Section 6 of AFASA. Covered institutions must build enhanced fraud management systems and move high-risk transactions beyond SMS and email one-time passwords towards biometrics or device-bound authentication. Reporting indicates a one-year window, placing the main compliance date around 25 June 2026; the thresholds that determine which institutions must retire OTPs should be confirmed against the circular text.
• Circular No. 1214 (2025) sets the rules of procedure for the BSP's inquiry into financial accounts and for sharing account information with law enforcement and other competent authorities under formal agreements. An inquiry requires a well-founded belief that AFASA has been violated, and the IRR states that deposit secrecy and data privacy laws do not bar the BSP's inquiry into accounts under investigation.
• Circular No. 1215 (2025) governs the temporary holding of disputed funds and the coordinated verification process. According to Inquirer reporting on the circular, an institution may hold funds for not more than 30 calendar days unless a court extends the hold, the recipient's account is credited but the amount cannot be withdrawn, and the recipient may challenge the hold at any time by showing the transaction's legitimacy. Grounds include transactions that are unusual or lack a clear economic purpose, funds from unknown or unlawful sources, and funds linked to unauthorised access to account information; erroneous transfers and card transactions are generally excluded. Institutions must log the time a complaint or alert is received and report monthly on held funds.

The follow-through continued into 2026. BSP Memorandum No. M-2026-029, dated 24 June 2026, moved the monthly report on temporarily held funds onto the BSP's ASTERisC* platform for enrolled institutions, with the first report due on 15 September 2026 covering August 2026, and required an annual notarised certification, due within 30 calendar days after year-end, that the institution had adequate risk management systems when it initiated holds in the preceding year. The memorandum expressly covers banks, EMIs and VASPs: a wallet app that issues e-money is squarely within AFASA's operational regime.

1. 2024-07-20
   RA 12010 (AFASA) signed. Took effect 13 August 2024.
2. 2025-05-30
   BSP Circulars 1213, 1214 and 1215 signed. Published in June 2025.
3. 2025-06-25
   AFASA IRR takes effect. One-year compliance windows for fraud systems and disputed-transaction tracking begin.
4. 2026-06-24
   Memorandum M-2026-029. Temporarily held funds reporting via ASTERisC*; annual notarised certification.
5. 2026-09-15
   First ASTERisC* report on temporarily held funds falls due for enrolled institutions.

4Consumer protection and pricing: RA 11765 and Circular 1160

The Financial Products and Services Consumer Protection Act (RA 11765, signed 6 May 2022) gave the BSP, SEC, Insurance Commission and Cooperative Development Authority express power to adjudicate consumer complaints and require fair treatment, disclosure and redress. The BSP implemented it for supervised institutions through Circular No. 1160, Series of 2022. In Memorandum No. M-2024-030 of September 2024, the BSP reminded institutions what the fraud and misuse provisions of Circular 1160 require: a free complaints channel open 24 hours a day with immediate written acknowledgement, priority handling of fraud complaints, immediate notice to the receiving institution in interbank disputes, suspension of interest and fees and a provisional hold or credit while the investigation runs, notice of the result within three banking days of concluding the investigation, and reversal of confirmed unauthorised transactions. Liability may take into account the account holder's conduct, but also the institution's and its service providers' non-compliance.

For an app, these are product requirements: the dispute flow, service-level timers and customer communications must map to Circular 1160 and, since 2025, to Circular 1215's hold mechanics. Where a wallet is used by victims of SIM-swap fraud, the allocation of loss between wallet provider, bank and telco is contested; our article on how banks and telcos share liability for SIM-swap fraud explains the competing theories.

Pricing is also under scrutiny. According to a compilation of 2026 BSP issuances published by a licensed payment provider, BSP Circular No. 1238, signed 17 June 2026 and effective 4 July 2026, amended the National Retail Payment System framework and the merchant payment acceptance rules to require cost-based, transparent pricing for fund transfers and merchant fees, with recipients receiving the full transferred amount and digital fees expected to be lower than over-the-counter fees. The same compilation reports that Memorandum M-2026-025 lifted the InstaPay and PESONet fee moratorium subject to those rules, and that Circular No. 1237 of June 2026 created a framework for digital financial marketplaces requiring, among other things, OPS registration. These 2026 items were verified only through secondary reporting as of the research date and should be confirmed against the BSP's published circulars.

5The commerce layer: RA 11967 and DTI's E-Commerce Bureau

Not every app that takes payment is a financial institution. A delivery platform or online store that hands the payment step to a licensed gateway is, for the BSP, a merchant. For the DTI it is an online merchant, e-retailer, e-marketplace or digital platform under the Internet Transactions Act of 2023 (RA 11967, signed December 2023). The Act had an 18-month transitory period, and it took full effect when that period ended on 20 June 2025.

The Act created the E-Commerce Bureau within the DTI. The Bureau can issue subpoenas for documents, order takedowns of listings for illicit goods or services, impose administrative fines reported to range from PHP 5,000 to PHP 1 million depending on the violation and the value involved, and, under Section 16, blacklist platforms that ignore compliance or takedown orders. Platforms that fail to act on illegal activity by their sellers can be held solidarily liable with those sellers. DTI stated at the time that its authority is secondary to other regulators' primary jurisdiction over specific goods and services, the clause that keeps the DTI from second-guessing the BSP on payments. The Bureau has also signalled an online business registry and a Philippine E-Commerce Trustmark, both in development as of mid-2025.

The substantive duties fall into three groups: disclosure of price, brand, description, condition and seller contact details; accessible consumer redress systems; and secure payment methods with adequate data protection. The payment-security duty is where the ITA and BSP regimes meet. A platform that integrates a BSP-registered gateway inherits that gateway's compliance, but remains responsible for how checkout is presented, what it stores and whether it has started holding funds in a way that tips it into OPS territory. For platforms considering regulated verticals, our analysis of payment aggregator compliance in the iGaming sector illustrates how quickly a merchant model can acquire financial-regulatory duties.

6Crypto-assets: the BSP and SEC split

On 30 May 2025 the SEC issued Memorandum Circular No. 4 (Rules on Crypto-Asset Service Providers) and Memorandum Circular No. 5 (Guidelines on the Operations of CASPs), both Series of 2025. The rules took effect on 5 July 2025. They reach entities that, as a business, offer crypto-assets to the public, operate trading platforms or otherwise intermediate crypto-assets, and third parties that market them, including influencers whose content is not purely educational.

The headline requirements, as reported: registration before issuing, selling or promoting crypto-assets; minimum paid-up capital of PHP 100 million excluding crypto holdings; a physical Philippine office; segregation of customer assets; a local data centre; prior authorisation of public offerings; and a disclosure document published at least 30 days before marketing. CASPs are covered persons under the Anti-Money Laundering Act. Violations carry fines of up to PHP 10 million, imprisonment of up to five years, or both.

The jurisdictional rule is functional. Crypto-assets used primarily for payment fall to the BSP as a VASP matter; crypto-assets that are securities or other financial products fall to the SEC as a CASP matter. A token wallet that also lists yield products or tokenised securities may therefore need both a BSP VASP licence and SEC CASP registration. Readers evaluating a crypto product can start with our guide on how to secure a cryptocurrency business licence in the Philippines.

7The obligations that attach to everyone: privacy, QR Ph, Open Finance, merchant AML

Data privacy. The Data Privacy Act (RA 10173) applies whichever financial regulator you answer to. Payment apps must generally register their processing systems with the NPC, appoint a data protection officer and notify qualifying breaches within 72 hours. Because AFASA authorises BSP inquiries notwithstanding privacy law, apps need a documented process for responding while protecting unrelated data. Our checklist on Data Privacy Act breach notification covers the NPC side.

QR Ph. The national QR code standard was adopted under BSP Circular No. 1055 of October 2019, and the BSP required payment service providers to use and display QR Ph on internet and mobile channels from 1 July 2023, with non-QR Ph codes disabled after that date. Proprietary QR codes are therefore not an option for person-to-person or person-to-merchant payments in the Philippine market.

Open Finance. BSP Circular No. 1122 of 2021 established the Open Finance Framework, an industry-led, BSP-supervised model in which account holders consent to share data and, in later tiers, initiate payments through standardised APIs, phased from product information through account data to transaction initiation. A fintech that consumes bank data must participate and meet its security and consent standards. The BSP's timetable for the later tiers should be checked directly, as public sources describe it only in general terms.

Merchant acquiring and AML. Reporting on 2026 issuances describes BSP Memorandum M-2026-017 as tightening AML requirements for merchant acquiring, requiring separation of merchant from personal accounts and treating aggregators as bearing their own AML duties. An app that onboards merchants must therefore run merchant due diligence, not just customer KYC.

• Map every fund flow, identify where value is held, routed or exchanged, and decide the BSP pathway (EMI, OPS, VASP or none) before building the ledger.
• Build Circular 1160 and Circular 1215 dispute handling into the app: 24/7 channel, acknowledgement, time-stamped logs, hold and release mechanics.
• Plan authentication around Circular 1213: biometric or device-bound factors for high-risk transactions, with OTP reserved for lower-risk flows.
• If a merchant or platform, align disclosures, redress and payment security with RA 11967.
• If crypto is in scope, classify each asset as payment-type or securities-type and determine whether BSP, SEC or both apply.

8Sequencing compliance in 2026 and what to watch

Sequencing matters. BSP licensing is the slowest and most structural: it dictates corporate form, capital, ownership disclosure and fit-and-proper vetting of directors and officers, so it should be settled first and the corporate vehicle built to fit it, a corporate law exercise as much as a regulatory one. NPC registration and DTI compliance can run in parallel once data and commerce flows are fixed. SEC CASP registration, where needed, has its own capital floor and physical-presence requirement that may dictate whether a crypto feature sits in the same entity or a separate one.

Open items as of 29 October 2026 include the April 2026 amendment to Circular 1213 reported as Circular 1232, the text of Circulars 1237 and 1238, DTI's registry and trustmark rules, and the Open Finance tier timetable. Finally, the BSP's Circular No. 1240 of 21 September 2026, which imposes the PHP 1 billion digital-bank capital floor on thrift, rural and cooperative banks that operate like digital banks, is a reminder that the BSP will re-classify a business by its substance, not its label. The same instinct applies to apps that call themselves platforms while behaving like payment institutions.

Abanto Law Firm advises fintech, payments and digital commerce businesses on Philippine licensing and regulatory compliance, including BSP, SEC, DTI and NPC matters. If you are structuring a payment, wallet, marketplace or crypto product for the Philippine market, you can contact the firm to discuss which pathway fits your model, or read more about our corporate and regulatory practice.

9Frequently asked questions