Gaming Law & Compliance
Who Regulates Online Gaming in the Philippines? PAGCOR, AMLC, NPC and BSP
A PAGCOR license is only the start. Here is what the AMLC, NPC, BSP, SEC, BIR, CICC, NTC, LGUs and Congress can each demand from a licensed online gaming operator, and what changed in 2025–2026.
1One license, many regulators
Operators who obtain a PAGCOR electronic gaming license often assume that PAGCOR is the only agency they answer to. In practice, a licensed online gaming business in the Philippines sits inside a web of at least eight public authorities, each with its own legal basis, its own reporting calendar and its own power to stop the business if something goes wrong. PAGCOR licenses and audits the gaming activity. The Anti-Money Laundering Council (AMLC) treats the operator as a covered person. The National Privacy Commission (NPC) polices how player data is handled. The Bangko Sentral ng Pilipinas (BSP) regulates the banks and e-wallets that move the money. The Securities and Exchange Commission (SEC) and the Bureau of Internal Revenue (BIR) govern the corporate vehicle and its taxes. The Department of Information and Communications Technology (DICT), its Cybercrime Investigation and Coordinating Center (CICC) and the National Telecommunications Commission (NTC) deal with illegal sites and cyber offences. Local government units (LGUs) issue the permits for the physical office. And Congress, as of the research date, is debating bills that could redraw the map.
This article sets out what each body can demand from a licensed operator, which issuances create the obligation, and what has changed between 2025 and October 2026. It is written for operators, suppliers, investors and compliance officers who already understand the basics of a PAGCOR licensing roadmap and want a single reference for the surrounding regulators. It is not legal advice, and the status of pending bills and draft circulars should be confirmed before any decision relies on them.
- PAGCOR is the licensing and audit authority for domestic online gaming, but it does not handle AML supervision, data privacy, payments regulation or criminal prosecution.
- Internet-based casinos have been AMLA covered persons since Republic Act No. 10927 (14 July 2017); the casino covered-transaction threshold is a single cash transaction above PHP 5 million.
- Since August 2025 the BSP has required e-wallets and bank apps to remove in-app gambling links, and a broader BSP circular on gambling payments was still being finalised as of the research date.
- Site blocking runs through the NTC and CICC, not PAGCOR, under NTC Memorandum Order No. 001-2023 and the Cybercrime Prevention Act.
- Two structural changes are pending: the PAGCOR regulator/operator split under review by the GCG, and Senate Bill No. 57 (Online Gambling Regulatory Act).
2PAGCOR: licensing, fees and show-cause powers
PAGCOR's authority comes from Presidential Decree No. 1869 (the PAGCOR Charter, 1983) as amended by Republic Act No. 9487 (2007), which extended its franchise and confirmed its power to license and regulate games of chance, including those offered through electronic and online channels, outside the special economic zones that have their own charters. A licensed operator therefore deals with PAGCOR on four fronts: the grant and renewal of the license itself, the regulatory fee computed on gross gaming revenue (GGR), compliance audits and monitoring, and enforcement through show-cause orders, suspension or revocation.
Fees and the domestic pivot
PAGCOR has cut its e-games fee rates repeatedly. According to GMA News (21 January 2025), the standard e-games rate fell from 35% to 30% of GGR effective 1 January 2025, with integrated-resort operators charged 25%; before the cuts began in 2023, PAGCOR collected more than 50%. The fee is PAGCOR's main regulatory lever, and the agency has said openly that lower fees are meant to draw operators out of the grey market. The commercial logic and budgeting consequences are covered in our separate article on online casino licensing costs.
At the same time, the offshore segment has been closed. Executive Order No. 74 (series of 2024) banned Philippine Offshore Gaming Operators (POGOs) with effect from the end of 2024, and PAGCOR has since reoriented its licensing around Filipino players aged 21 and above. Trade reporting in May 2026 by Bright Side of News described roughly 45 domestic electronic gaming licenses in issue, a PHP 200 million minimum capitalisation, mandatory local offices, a performance bond, and quarterly compliance audits by PAGCOR's expanded regulatory division. Those figures come from an industry outlet rather than a PAGCOR issuance and should be checked against the current PAGCOR regulatory manual before being relied upon. The shift from offshore to domestic licensing is analysed in our separate article on internet gaming licenses versus POGOs.
The regulator/operator split
The most important pending change at PAGCOR is structural. PAGCOR both regulates gaming and runs its own casinos, a dual role that Chairman Alejandro Tengco has said should end. Asia Gaming Brief (20 July 2026) reported that the Governance Commission for GOCCs (GCG) was expected to send its recommendation to the Office of the President in August 2026, with Tengco targeting an Executive Order by the end of 2026 that would leave PAGCOR "as a pure regulator" and privatisation of its casinos before 2028. By 17 September 2026, Tengco was still describing the GCG review as nearing a decision and warned that the transition would have legal, financial and human-resource implications. As of 29 October 2026, no Executive Order implementing the split had been located in the public record; operators should expect their license conditions, reporting lines and fee schedules to be revisited once it issues.
3AMLC: the operator as a covered person
Online gaming operators are covered persons under the Anti-Money Laundering Act of 2001 (Republic Act No. 9160) because of Republic Act No. 10927, approved on 14 July 2017. The Act expressly includes "internet-based casinos," defined as casinos in which persons participate through remote communication facilities such as the internet, telephone, television or radio. Coverage is limited to casino cash transactions related to gaming operations, which is why the AMLC's interest centres on deposits, withdrawals and payouts rather than on the operator's payroll or supplier invoices.
Three features of the casino regime differ from the rules that apply to banks. First, the covered-transaction threshold is a single casino cash transaction exceeding PHP 5 million or its foreign-currency equivalent, rather than the general PHP 500,000 threshold. Second, the implementing rules were written jointly: the Casino Implementing Rules and Regulations were drafted by the AMLC with PAGCOR, the Cagayan Economic Zone Authority and the Aurora Pacific Economic Zone and Freeport Authority, published on 20 October 2017 and effective 4 November 2017, as Interaksyon reported at the time. Third, the rules expressly reach internet-based and ship-based casinos, so an online-only licensee cannot argue that the casino regime was written for gaming floors.
The practical demands are familiar to anyone who has implemented AML controls: register with the AMLC's electronic reporting portal, file covered transaction reports (CTRs) and suspicious transaction reports (STRs) within the prescribed working-day windows, keep customer and transaction records for at least five years, appoint a compliance officer, and conduct an institutional risk assessment. PAGCOR, as the supervising authority, examines the operator's AML programme during its own audits and can refer findings to the AMLC. The AMLC in turn can apply for freeze orders and bank inquiry orders before the Court of Appeals, and can impose administrative sanctions. For implementation detail, see our articles on AML duties for iGaming operators and drafting an AML risk assessment.
- 14 July 2017
RA 10927 approved, making casinos, including internet-based casinos, AMLA covered persons - PHP 5,000,000
Casino covered-transaction threshold per single cash transaction (vs. PHP 500,000 general threshold) - 4 November 2017
Casino Implementing Rules and Regulations took effect, issued jointly by AMLC, PAGCOR, CEZA and APECO - 5 years
Minimum retention period for customer identification and transaction records under the casino rules
4BSP, SEC and BIR: money, ownership and tax
BSP regulates your payment partners, not you
The BSP does not license gaming operators, but it supervises every bank, electronic money issuer and payment system operator an operator relies on, and it has used that leverage directly. On 14 August 2025, after a Senate committee hearing, the BSP directed e-wallets and bank payment apps to remove in-app features that redirect users to e-gambling sites within 48 hours, with the suspension to remain until the BSP finalised its policy on gambling payments, as the Philippine Daily Inquirer reported. GCash and Maya complied. Earlier BSP actions followed the same pattern: a 2021 directive barring supervised institutions from dealing with unlicensed gambling operators, and a 2022 order to remove e-sabong links after the national government suspended e-sabong.
The BSP has also said since July 2025 that it is finalising a circular, after public consultation, that would require supervised institutions to apply enhanced identity checks such as biometrics before funds are used for gambling, daily transaction limits, time-based restrictions and user-set spending caps or voluntary breaks, as the same Inquirer report noted. As of the research date we could not locate a published final circular with a number and effective date; operators should treat the in-app link suspension as the operative rule and monitor the BSP's issuances page. Because these rules bind the payment partner, they arrive in an operator's life as revised onboarding terms, new transaction-monitoring requests and sometimes abrupt off-boarding. Our separate article on payment processing and PSP onboarding covers how to structure those relationships.
SEC: the corporate vehicle and beneficial ownership
Every licensee is a Philippine corporation first. The SEC registers the entity, approves its articles and by-laws, and receives its General Information Sheet and audited financial statements each year. Since 2019 the SEC has required corporations to disclose their beneficial owners in the General Information Sheet, with later circulars tightening the definitions and penalties; this disclosure feeds directly into the AMLC's and PAGCOR's fit-and-proper reviews. Foreign-owned licensees also face foreign-ownership reporting, covered in our separate note on SEC foreign ownership reporting. Any change in shareholders after licensing triggers both SEC filings and PAGCOR notification, explained in our article on change-of-control notifications.
BIR: franchise tax, income tax and withholding
The BIR collects the taxes that sit alongside PAGCOR's regulatory fee. For PAGCOR licensees the tax treatment of gaming income has been shaped by the PAGCOR Charter's 5% franchise tax provision and by Supreme Court rulings on whether licensees share PAGCOR's exemptions, while non-gaming income is subject to regular corporate income tax, and the operator must withhold on salaries, rent and supplier payments like any other business. The details, including the separate regime that Republic Act No. 11590 (2021) created for offshore operators before the POGO ban, are set out in our separate article on how licensed online casinos are taxed.
5NPC: player data and breach notification
An online gaming operator processes identity documents, selfies, device data, transaction histories and behavioural signals for every player. That makes it a personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173) and brings it under the National Privacy Commission. The NPC's demands are procedural as much as substantive: appoint and register a Data Protection Officer, register data processing systems where the thresholds in the NPC's registration circular are met, maintain a privacy management programme and records of processing, conduct privacy impact assessments for high-risk processing such as biometric KYC, and notify the NPC and affected data subjects within 72 hours of knowledge of a breach that meets the notification criteria under the NPC's breach management rules. Cross-border transfers to offshore platform providers or KYC vendors need contractual safeguards and, where applicable, outsourcing agreements that the NPC can ask to see.
The NPC's attention to the sector became formal on 20 October 2025, when PAGCOR and the NPC signed a memorandum of understanding on data privacy in the gaming industry, announced the following day and reported by GMA News. The agreement commits the two agencies to joint awareness programmes, capacity building and policy development, and PAGCOR Chairman Tengco described it as aligning PAGCOR's processes with the privacy landscape for employees, licensees and patrons. The MOU itself does not create new obligations for operators, but it signals that privacy findings surfaced in a PAGCOR audit may now reach the NPC, and vice versa. A dedicated walkthrough is in our article on NPC registration and data privacy controls for licensed operators.
6DICT, CICC, NTC and the enforcement agencies
Licensed operators care about enforcement against illegal sites for two reasons: unlicensed competitors erode the market that justifies the license fee, and licensed brands are sometimes caught in blocking sweeps or impersonated by clone sites. The architecture is layered. PAGCOR identifies and reports unlicensed sites but, as practitioner Marie Antonette Quiogue noted in a Chambers and Partners article (27 October 2025), it has no power of its own to take a site down. The NTC directs internet service providers to block domains, relying on NTC Memorandum Order No. 001-2023, and can impose a 72-hour provisional block while PAGCOR verifies a site's status, with longer blocking following due process. The CICC, an attached agency of the DICT created under the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), provides technical intelligence, digital forensics and case build-up; the Philippine National Police Anti-Cybercrime Group and the National Bureau of Investigation make arrests; the Department of Justice prosecutes.
The scale is large and the results are partial. At a Senate hearing in February 2026 the CICC disclosed that it blocks an average of 50,000 illegal gambling sites, while acknowledging that 95 to 97 percent are hosted abroad and can only be made inaccessible locally before reappearing under new domains, according to The Manila Times (18 February 2026). In March 2026 the CICC formalised a partnership with the Presidential Anti-Organized Crime Commission under which the CICC prepares case files, conducts forensics and leads website and content blocking, and ran a one-month verification drive with the civil society group Digital Pinoys whose findings went to the PNP-ACG for prosecution under the Cybercrime Prevention Act and, potentially, syndicated estafa, as Asia Gaming Brief reported on 17 March 2026.
For a licensed operator, the practical demands from this cluster are: keep the PAGCOR-registered list of approved domains and apps current so that legitimate properties are not swept into a block; respond promptly when PAGCOR or the CICC asks to verify a domain; preserve logs that may be requested under a cybercrime warrant; and report impersonation and clone sites through PAGCOR rather than attempting self-help. Our separate guides on geo-blocking and on incident reporting for licensed iGaming cover the operator side.
7LGUs and Congress: local permits and pending bills
Local government units
A PAGCOR license does not replace local permits. The Local Government Code of 1991 (Republic Act No. 7160) gives cities and municipalities the power to issue mayor's and business permits, collect local business taxes and enforce zoning for the operator's offices, studios and any physical touchpoints. Because the domestic license regime requires a Philippine office with mostly Filipino staff, every licensee will have at least one LGU relationship, renewed annually in January; our separate article on Makati business permit renewal 2026 covers the mechanics in the city where many operators are based. LGUs have also used ordinances to restrict gambling advertising and physical betting shops, and several have historically passed resolutions objecting to gaming operations in their jurisdiction. Whether an LGU can veto a PAGCOR-licensed online operation has been litigated for land-based venues; for online operations with only an office locally, the practical exposure is permit delay rather than closure, but it should not be assumed away.
Congress
Two legislative tracks were live as of the research date, and they point in different directions. Senate Bill No. 57, the proposed Online Gambling Regulatory Act, was filed by Senator Sherwin Gatchalian on 2 July 2025 in the 20th Congress. It would bar players under 21, require an initial cash-in of at least PHP 10,000 and top-ups of at least PHP 5,000, route funding and withdrawals through AMLC-compliant channels such as over-the-counter and online banking while prohibiting e-wallets and non-bank e-money issuers, mandate third-party audit of GGR, and impose penalties of six to eight years' imprisonment and fines of at least PHP 10 million for facilitating unlicensed online gambling. On the House side, House Bill No. 1455, the Anti-Online Cockfighting and Gambling Act, takes the prohibition route, and Representative Rolando Valeriano has argued publicly for a total ban. In August 2026 reporting also referred to a bill by Senator Francis Escudero seeking a nationwide gambling advertising ban across all media; we could not verify its bill number or status by the research date.
PAGCOR has consistently supported regulation over prohibition. News reports reviewed up to 29 October 2026 gave no indication that either SB 57 or HB 1455 had passed its chamber, but committee action can move quickly and the status should be confirmed with the Senate and House legislative records before any planning decision. The minimum-deposit and e-wallet provisions in SB 57, if enacted, would change the economics of the domestic market more than any PAGCOR fee adjustment.
- RA 10927 approved. Casinos, including internet-based casinos, become AMLA covered persons.
- Casino Implementing Rules take effect. Joint AMLC, PAGCOR, CEZA and APECO rules on CTR/STR reporting and record-keeping.
- PAGCOR e-games fee cut to 30%. Integrated-resort operators charged 25% of GGR.
- Senate Bill No. 57 filed. Gatchalian's Online Gambling Regulatory Act proposes a 21+ age floor, PHP 10,000 minimum cash-in and an e-wallet prohibition.
- BSP orders e-wallets to remove gambling links. 48-hour deadline; suspension to last until a final BSP policy issues.
- PAGCOR and NPC sign data-privacy MOU. Joint awareness, capacity-building and policy work in the gaming sector.
- CICC and PAOCC formalise partnership. CICC to lead case build-up and blocking of illegal gambling sites and content.
- PAGCOR decoupling nears GCG decision. Tengco backs a regulator-only PAGCOR; Executive Order expected after presidential review.
8Who to notify when
The table below is a working summary of which authority a licensed operator typically notifies for common events. The exact deadlines sit in the operator's license conditions, the AMLA casino rules, the NPC's circulars and the SEC's reporting calendar, and several of them run concurrently. It is a starting point for a compliance calendar, not a substitute for the issuances themselves.
| Event | Primary authority | Also notify or file with | Typical timing |
|---|---|---|---|
| Single cash transaction above PHP 5 million | AMLC (covered transaction report) | Record in PAGCOR audit trail | Within the working-day window in the casino rules |
| Suspicious player activity or structuring | AMLC (suspicious transaction report) | PAGCOR if it affects license conditions | Promptly on determination of suspicion |
| Personal data breach meeting notification criteria | NPC | Affected players; PAGCOR under incident-reporting conditions | 72 hours from knowledge |
| Change in shareholders, directors or key persons | PAGCOR (prior approval or notification) | SEC (GIS amendment); AMLC where beneficial ownership changes | Before completion, as license conditions require |
| New brand, domain or mobile app | PAGCOR (approval) | Payment partners; app stores | Before launch |
| Payment partner off-boards or restricts gambling flows | No filing required; BSP rules bind the partner | PAGCOR if player withdrawals are affected | As soon as player impact is known |
| Clone or impersonation site detected | PAGCOR (referral to NTC and CICC) | PNP-ACG or NBI for criminal complaint | On detection |
| Annual corporate and tax filings | SEC (GIS, audited financial statements); BIR (returns) | LGU business permit renewal | SEC and BIR statutory dates; LGU renewal in January |
Working with the map
The regulators described here do not coordinate their calendars, and an operator that organises its compliance function around PAGCOR alone will discover the gaps at the worst moment: an AMLC inquiry during a license renewal, an NPC complaint during a payment partner review, or a blocked domain during a product launch. A better structure assigns an owner to each authority, maintains a single register of obligations with their legal source, and treats the pending changes, the PAGCOR split, the BSP circular and SB 57, as watch items with a named person responsible for tracking them. Our separate guide to a regulator-ready compliance manual shows one way to document this.
If you are applying for or operating under a PAGCOR license and need help mapping these obligations to your business, Abanto Law Firm's gaming license practice advises on PAGCOR, AMLC, NPC and payment-partner compliance from application through ongoing operations. You can contact the firm to discuss your situation.
9Frequently asked questions
Is PAGCOR the only regulator a licensed online gaming operator in the Philippines has to deal with?
No. PAGCOR issues and audits the license and collects the regulatory fee, but a licensed operator is also an AMLA covered person supervised for anti-money laundering purposes by the AMLC, a personal information controller answerable to the National Privacy Commission, a Philippine corporation reporting to the SEC and paying taxes to the BIR, and a business holding local permits from its LGU. Its payment partners are regulated by the BSP, and illegal-site enforcement runs through the NTC, the CICC under the DICT and the law-enforcement agencies. Each has a separate legal basis and separate powers.
What is the AMLC reporting threshold for online casinos?
Under Republic Act No. 10927 (approved 14 July 2017), a covered transaction for a casino, including an internet-based casino, is a single casino cash transaction exceeding PHP 5 million or its equivalent in another currency. This is higher than the general PHP 500,000 threshold that applies to banks and most other covered persons. Suspicious transactions must be reported regardless of amount. The Casino Implementing Rules and Regulations, effective 4 November 2017, set the filing windows and the five-year record-retention requirement.
Can the BSP stop players from funding gaming accounts through GCash or Maya?
The BSP regulates e-money issuers and banks rather than gaming operators, but it has used that authority directly. On 14 August 2025 it directed e-wallets and bank apps to remove in-app links to e-gambling sites within 48 hours, and that suspension was to remain in force until the BSP finalised its policy on gambling payments. The BSP has also said it is finalising a circular requiring enhanced identity checks, daily limits and time-based restrictions for gambling transactions. As of the research date we could not confirm that a final circular had been published, so operators should check the BSP's issuances directly.
Who actually blocks illegal gambling websites in the Philippines?
PAGCOR identifies and verifies unlicensed sites but has no power to take them down. The National Telecommunications Commission directs internet service providers to block domains under NTC Memorandum Order No. 001-2023, including a 72-hour provisional block while PAGCOR verifies a site. The CICC, an attached agency of the DICT, provides forensics and case build-up and in March 2026 formalised a partnership with the Presidential Anti-Organized Crime Commission to lead blocking of illegal gambling sites and content. Arrests and prosecution fall to the PNP Anti-Cybercrime Group, the NBI and the Department of Justice.
What happens to licensees if PAGCOR is split into a regulator and a separate casino operator?
As of 29 October 2026 the split had not been implemented. PAGCOR Chairman Alejandro Tengco has said the Governance Commission for GOCCs is reviewing the proposal and that an Executive Order would follow presidential approval, leaving PAGCOR as a pure regulator with its casinos privatised before 2028. For licensees, the likely consequences are revised license conditions, new reporting lines within a restructured regulatory division and a possible review of fee schedules. None of these have been published, and operators should confirm the status of the Executive Order before relying on any assumption about the new structure.
Does Senate Bill No. 57 change the rules for licensed operators today?
Not yet. Senate Bill No. 57, the Online Gambling Regulatory Act filed by Senator Sherwin Gatchalian on 2 July 2025, is a proposed bill, not law. If enacted in its filed form it would raise the minimum player age to 21, require an initial cash-in of at least PHP 10,000 and top-ups of at least PHP 5,000, prohibit e-wallets and non-bank e-money issuers as funding channels, mandate third-party GGR audits and create criminal penalties for facilitating unlicensed online gambling. Its status should be confirmed with the Senate legislative records before any planning decision is based on it.
Sources and references
- Republic Act No. 10927 — An Act Designating Casinos as Covered Persons under the AMLA — Senate of the Philippines, Legislative Digital Resource (2017-07-14)
- AMLC lays down rules to guard casinos vs dirty funds — Interaksyon / Philstar (2017-10-23)
- PAGCOR slashes e-games fee rates — GMA News Online (2025-01-21)
- Senate Bill No. 57 — Online Gambling Regulatory Act (filed text) — Office of Senator Sherwin Gatchalian (2025-07-02)
- BSP: E-wallets must 'unlink' from e-gambling sites — Philippine Daily Inquirer (2025-08-15)
- PAGCOR, NPC ink accord to bolster data privacy protection in gaming sector — GMA News Online (2025-10-21)
- Beyond the Blame Game: Why Illegal Online Gambling Needs Smarter Enforcement — Chambers and Partners (M. A. B. Quiogue) (2025-10-27)
- 50,000 illegal gambling sites blocked but problem persists — The Manila Times (via Newswav) (2026-02-18)
- Philippine agencies deepen coordination to tackle illegal online gambling networks — Asia Gaming Brief (2026-03-17)
- PAGCOR domestic gaming license overhaul reshapes Philippine market after POGO ban — Bright Side of News (2026-05-18)
- PAGCOR regulator-operator split may progress before year end — Asia Gaming Brief (2026-07-20)
- PAGCOR decoupling nears decision as Tengco backs regulator-only role — Context.ph (2026-09-17)
This article is for general informational purposes only and does not constitute legal advice. Laws, regulations, and regulatory requirements may change, and reading this article does not create an attorney-client relationship with Abanto Law Firm. Readers should consult qualified Philippine legal counsel regarding their specific circumstances.
