New Philippine Laws Affecting Technology and Digital Businesses, 2024–2026

1Why the 2024–2026 legislative cycle matters for technology businesses

Between late 2024 and the first half of 2026, the Philippines enacted or operationalised a cluster of laws that change how technology companies build networks, sell digital services, pay tax, handle customer money and deal with government. None of them is a single "tech law". Together, however, they rewrite the compliance baseline for internet service providers, software-as-a-service vendors, e-commerce platforms, fintech firms, business process outsourcing (BPO) operators and foreign digital platforms selling into the Philippine market.

This article summarises the measures that are actually in force as of the research date (29 October 2026): the Konektadong Pinoy Act (Republic Act No. 12234), the E-Governance Act (RA 12254), the VAT on Digital Services Act (RA 12023), CREATE MORE (RA 12066), the Anti-Financial Account Scamming Act (RA 12010) and the implementing rules of the Internet Transactions Act (RA 11967). It then separates these from the digital bills that remain pending on the Legislative-Executive Development Advisory Council (LEDAC) priority list, so that readers do not mistake a priority bill for an enacted obligation.

• The Konektadong Pinoy Act removed the legislative franchise requirement for data transmission; registration with the NTC and a cybersecurity certification within two years of registration replace it.
• Non-resident digital service providers have been subject to 12% VAT on services consumed in the Philippines since 2 June 2025, with registration through the BIR.
• Banks, e-wallets and other BSP-supervised institutions operate under AFASA rules effective since June 2025, including a 30-day hold on disputed funds.
• Online merchants and platforms have been fully subject to the Internet Transactions Act since the transition period ended on 20 June 2025; the Philippine E-Commerce Trustmark stays voluntary until 31 December 2026.
• The Cybersecurity Act, Digital Payments Act and an anti-disinformation bill were LEDAC priorities in 2025–2026 but, as far as could be verified, had not been enacted by the research date.

2Konektadong Pinoy Act (RA 12234): open access in data transmission

The Konektadong Pinoy Act, formally the Open Access in Data Transmission Act, is the most structural change to Philippine connectivity law in a generation. The measure passed the House in December 2022 and the Senate on 5 February 2025, and both chambers adopted the bicameral report on 9 June 2025. President Marcos neither signed nor vetoed it. The Palace announced on 24 August 2025 that the bill had lapsed into law. The law was published in the Official Gazette on 29 August 2025 and took effect in mid-September 2025.

What it changes

Before RA 12234, anyone wishing to build or operate data transmission infrastructure generally needed a congressional franchise and a certificate of public convenience and necessity from the National Telecommunications Commission (NTC). The Act replaces both with an administrative registration regime for "data transmission industry participants" (DTIPs). According to a summary of the implementing rules by Conventus Law, the IRR classifies participants into international gateway facilities, core or backbone networks, middle-mile and last-mile segments, with registration certificates valid for up to five, ten or fifteen years depending on the segment. Franchises remain necessary only for basic telephone services such as landline and mobile voice.

The Act also imposes open-access duties. Operators of passive infrastructure must offer co-location and co-use on open, fair, reasonable and non-discriminatory terms and publish a reference access offer. Registered participants may deploy satellite capacity without leasing it from an incumbent telecommunications entity. Spectrum use still requires NTC authorisation, and the DICT, NTC and Philippine Competition Commission are tasked to issue a spectrum management policy framework within one year of the IRR taking effect.

Cybersecurity and change-of-control conditions

The telecommunications incumbents, through the Philippine Chamber of Telecommunications Operators, argued during the bill's final stages that new entrants might use shared infrastructure without first clearing cybersecurity requirements; one large operator publicly hinted at a court challenge. The IRR answers that concern in part: participants must obtain third-party cybersecurity certification within two years of registration, based on ISO standards or DICT-prescribed minimums, and are subject to audit by the DICT Cybersecurity Bureau. The rules also require NTC approval for transfers of 20% or more of voting equity within a twelve-month period, for transactions that hand a new party control of the board or management, and for transfers of a material portion of network assets.

Implementation timeline

The DICT signed the IRR on 5 November 2025, together with representatives of the economic planning, public works, interior, transportation, competition and telecommunications agencies. The rules were published in the Official Gazette on 1 December 2025 and became effective fifteen days later. The DICT and NTC were given three months from effectivity to establish the DTIP registry, which means registration mechanics were being rolled out in the first quarter of 2026. Companies that have been operating under a franchise, or that wish to enter as a middle-mile or last-mile provider, should confirm the current NTC registration forms and fees directly with the Commission, because eligibility criteria for each segment are set by NTC issuance rather than by the Act itself.

3E-Governance Act (RA 12254): digital government as a counterparty

The E-Governance Act was signed on 5 September 2025. It is primarily a law about how the government organises itself: the DICT is made the lead agency for an Electronic Government Master Plan, every agency must designate a chief information officer and digitise its frontline services, and local government units must either build their own portals or adopt the DICT's eLGU system. The statute also makes the ICT Academy a permanent training institution and sets up an interoperability fund for agencies and LGUs with limited budgets.

For the private sector the consequences are indirect but real. First, the law institutionalises an Integrated Government Network, a government public key infrastructure, government digital payment systems and a single online public service portal. Vendors of cloud, identity, payments and cybersecurity services will find that agency procurement increasingly references these shared standards. Second, systems that process personal data must undergo a privacy impact assessment, which aligns public-sector projects with the Data Privacy Act obligations already familiar to private companies; see our guide to Data Privacy Act breach notification duties. Third, companies that transact with government, from permit applicants to taxpayers, should expect electronic filing and electronic payment to become the default channel rather than an alternative.

The implementing rules were signed on 24 March 2026 at a ceremony at the Asian Development Bank headquarters, together with the approval of the E-Government Master Plan. The IRR direct agencies to adopt common standards, prioritise cybersecurity and re-engineer processes around the citizen. A Joint Congressional Oversight Committee on E-Governance monitors implementation. Because the rules are recent, specific agency-level migration deadlines should be confirmed against DICT circulars issued after April 2026.

4VAT on Digital Services Act (RA 12023)

RA 12023 was signed on 2 October 2024. It amends the National Internal Revenue Code to make clear that digital services consumed in the Philippines are subject to 12% VAT whether the supplier is resident or non-resident. Covered services include online search engines, online marketplaces, cloud services, online media and advertising, digital content such as music, video games and video-on-demand, and software and application licensing. The Department of Finance estimated at signing that the measure would raise roughly PHP 105 billion over five years, and 5% of collections is earmarked for the creative industry. Educational digital services, including online courses offered by accredited institutions, are excluded.

The Bureau of Internal Revenue issued Revenue Regulations No. 3-2025 on 16 January 2025 to implement the law. After registration deadlines were extended twice, VAT on digital services became collectible from 2 June 2025, and the registration window for non-resident digital service providers (NRDSPs) was extended to 1 July 2025. Later circulars (RMC Nos. 47-2025, 52-2025 and 58-2025) clarified registration through the BIR's online registration system pending the launch of a dedicated VAT on Digital Services portal, invoicing contents, and how a provider may verify whether a Philippine buyer is VAT-registered.

Who does what

• Non-resident providers selling to consumers (B2C) must register, charge, file and remit 12% VAT themselves, or through a resident third-party service provider.
• Non-resident providers selling to VAT-registered Philippine businesses (B2B) do not remit; the Philippine buyer withholds and remits the VAT under a reverse-charge mechanism, and the invoice must say so.
• Online marketplaces are treated as the digital service provider for non-resident sellers whose transactions they control (setting terms, ordering or delivery), and must account for VAT on those sales as well as on their own platform fees.
• Resident Philippine digital businesses were already VAT-liable; the practical change is a more level price comparison against foreign competitors.

Non-compliance carries more than monetary penalties. RR 3-2025 authorises the Commissioner to issue closure or take-down orders, including blocking of the digital service in the Philippines, against providers that fail to register, in addition to assessments and possible criminal prosecution under the BIR's Run After Tax Evaders programme. Foreign platforms that dispute an assessment follow the ordinary protest and appeal route described in our article on BIR tax assessment disputes.

5CREATE MORE (RA 12066): incentives for digital and BPO investors

The CREATE MORE Act was signed on 11 November 2024 and, according to the interim implementing rules jointly issued by the Department of Finance and Department of Trade and Industry on 17 December 2024, took effect on 28 November 2024. It amends the 2021 CREATE Act, and several of its provisions were written with technology and outsourcing investors in mind.

• Telecommuting allowed: registered business enterprises (RBEs) in economic zones and freeports may run a work-from-home programme covering up to 50% of the total workforce without forfeiting incentives, subject to investment promotion agency rules. This resolved a long-running dispute between IT-BPM firms and the Fiscal Incentives Review Board.
• Lower rate under the Enhanced Deduction Regime (EDR): the corporate income tax rate for RBEs electing EDR is reduced from 25% to 20%, and power expenses become 100% deductible, up from 50%.
• Immediate election: RBEs may elect the 5% special corporate income tax or EDR from the start of commercial operations; the election is irrevocable.
• RBE local tax: local governments may impose a tax of up to 2% of gross income in lieu of all local taxes, fees and charges during the income tax holiday or EDR period, giving multi-site data centre and BPO operators a simpler local tax footprint.
• VAT clarity: VAT zero-rating on local purchases and VAT exemption on importation for registered export enterprises expressly cover goods and services directly attributable to the registered activity, including security, consultancy, HR and accounting services; pre-CREATE enterprises keep comparable treatment until 31 December 2034.

For a software house, cloud provider or shared-services centre deciding where to locate in Southeast Asia, these provisions interact with the ownership questions discussed in our note on foreign investor entry rules and with the registration category chosen with the relevant investment promotion agency.

6Anti-Financial Account Scamming Act (RA 12010) and the BSP rules

AFASA was signed in July 2024 and created new offences for social engineering schemes, money muling and the misuse of financial accounts, filling gaps that the Cybercrime Prevention Act had left for scams that do not involve unauthorised system access. It also gave the Bangko Sentral ng Pilipinas (BSP) a limited power to inquire into financial accounts where it has a well-founded belief that an AFASA offence has been committed, notwithstanding bank secrecy, and to share that information with law enforcement under formal arrangements.

The law became fully operational when the BSP issued three implementing circulars in June 2025: revised information technology risk management regulations, rules on financial account inquiry and information sharing, and regulations on the temporary holding of disputed funds and coordinated verification. The rules took effect on 25 June 2025. For fintech companies, e-money issuers, digital banks and payment operators, the operative obligations are:

1. Build, within one year of effectivity, a real-time or near-real-time system to track disputed transactions, including at clearing switch operators.
2. Upgrade fraud management systems within the same period, including authentication methods beyond one-time passwords, such as biometrics.
3. Hold disputed funds for up to 30 days (previously five) while the sending and receiving institutions verify the transaction, and return funds to the defrauded customer where warranted.
4. Accept that failure to comply can expose the institution to civil liability for the resulting customer losses.

The one-year implementation deadlines therefore fell in June 2026, and BSP-supervised institutions should by now be able to evidence compliance in examinations. Technology vendors that supply core banking, wallet or fraud-screening systems to these institutions are affected contractually, since their customers will pass down the requirements. The allocation of loss between banks, telcos and customers in account-takeover cases is examined in our article on SIM swap fraud liability.

7Internet Transactions Act (RA 11967): full enforcement and the Trustmark

The Internet Transactions Act was signed in December 2023 and its implementing rules were issued in 2024, but the law only became fully enforceable after an eighteen-month transition. According to the DTI, the transition ended on 20 June 2025. From that date the E-Commerce Bureau may issue subpoenas, order the take-down of listings for illegal goods and services, and hold digital platforms solidarily liable with their sellers where the platform fails to act on violations. Joint Administrative Order No. 24-03, released on 24 May 2025 with several agencies, supplies the operating rules on platform liability.

The baseline duties for e-marketplaces, e-retailers and online merchants are disclosure-based: price, product condition, brand, a full description and the seller's contact details must be shown; payment systems must be secure; a consumer redress mechanism must exist; and data privacy standards must be met. These duties apply to foreign platforms that target Philippine consumers as much as to local sellers.

The Philippine E-Commerce Trustmark, a digital badge for compliant merchants, has had a more erratic history. The DTI announced it as voluntary in mid-2025, moved to make registration mandatory with a 30 September 2025 deadline, extended that to 31 December 2025, and then announced on 22 December 2025 that registration would stay voluntary until 31 December 2026. Registration costs at most PHP 1,130, and PHP 130 for micro-enterprises with assets below PHP 3 million. Online sellers should treat 1 January 2027 as a plausible, but not yet confirmed, start of mandatory registration and watch for a DTI department administrative order fixing the date.

8Still pending: the LEDAC digital agenda

It is easy to conflate what Congress has prioritised with what it has passed. When LEDAC adopted a 44-measure common legislative agenda for the 20th Congress on 30 September 2025, the technology-related items were a Cybersecurity Act, a Digital Payments Act, a law on online gambling, amendments to the Anti-Money Laundering Act and the bank deposits secrecy law, and a measure on the fair use of social media, artificial intelligence and internet technology in elections. At its 10 February 2026 meeting, LEDAC added an Anti-Fake News and Digital Disinformation Act and amendments extending the child-protection laws to new technologies. By March 2026 the House reported that it had approved the Digital Payments Act and the bank secrecy amendments at its end, but neither had been enacted at that point.

As of 29 October 2026 this article could not verify that any of these bills had become law. Readers should check the Official Gazette and the Senate legislative information system before treating any of them as binding. Where a bill has moved to bicameral conference or enrolment, the realistic preparation window before implementing rules take effect is usually six to twelve months.

9A compliance sequence for technology companies

The six measures above do not arrive with a single regulator or a single deadline, so the useful exercise is to map them against business functions rather than read them law by law.

1. Classify the business. Does the company transmit data for third parties (RA 12234), sell digital services into the Philippines from abroad (RA 12023), hold or move customer funds (RA 12010), sell goods or services online to Philippine consumers (RA 11967), or hold investment incentives (RA 12066)? Most technology groups fall under two or three of these at once.
2. Identify the registration or certification trigger. NTC DTIP registration and the two-year cybersecurity certification; BIR registration as an NRDSP; BSP licensing and the June 2026 systems deadlines; DTI Trustmark readiness ahead of a mandatory date; IPA registration for CREATE MORE.
3. Fix the contracts. Platform terms must now carry the disclosure items the Internet Transactions Act requires; B2B invoices to Philippine customers must address reverse-charge VAT; vendor agreements with BSP-supervised institutions should allocate responsibility for AFASA-driven controls; and infrastructure-sharing agreements should reflect the reference access offer regime.
4. Monitor the pending list. Assign someone to track the Cybersecurity Act, Digital Payments Act and disinformation bill through the Senate, because each would add obligations that interact with those already in force.

Abanto Law Firm advises technology companies, platforms and investors on registration, licensing, tax and contractual compliance under these measures through its corporate law practice. If your business needs a structured assessment of how the 2024–2026 laws apply to its operations, or is considering entry into the Philippine market, you may contact the firm to arrange a consultation.

10Frequently asked questions