Philippines central bank proposes one-year freeze on new payment system operator registrations
Key Takeaways
- •The BSP's draft circular would suspend acceptance and processing of new payment system operator applications for 12 months, while applications already under review would continue to be assessed.
- •Licensed virtual asset service providers are classified as high-risk merchants, and banks would be required to onboard regulated VASPs through direct merchant relationships without intermediary layers.
- •A National QR Code Merchant Database would record every merchant accepting payments via the standardized QR scheme, with a temporary registry operational within 90 days and all active merchants validated within 15 months.
- •Institutions would have to report material fraud, sanctions breaches, cyber or data incidents, and unlicensed merchant activity to the BSP within 24 hours of discovery.
- •If finalized, the circular takes effect 15 days after publication, and the BSP is collecting feedback during the comment period.

The Bangko Sentral ng Pilipinas (BSP) has circulated a draft rule that would suspend the acceptance of applications from new payment system operators for a full year. According to the regulator, the pause is intended to give it time to overhaul how it licenses and supervises the firms that move money through the country's QR and mobile payment systems. The move lands in one of Southeast Asia's fastest-growing digital payments markets, where the BSP's standardized QR Ph scheme and peer-to-peer transfer rails, built out under the National Retail Payment System initiative launched in 2015, have driven rapid adoption of cashless payments in recent years.
Why did Bangko Sentral ng pause its operations?
The BSP has written the full-year freeze into a proposed circular titled "Regulations to Strengthen Integrity Controls in Payment Transactions," which amends the Manual of Regulations for Payment Systems (draft circular).
According to a Philstar report, there has been growing concern inside the BSP that mobile and QR payments have expanded faster than banks and regulators can follow the money. Investigators also say that layered arrangements between intermediaries make it hard to name the actual seller behind a payment or to freeze a suspicious flow while it is happening.
If approved, the BSP would neither accept nor process new applications to run a payment system for 12 months. Firms already waiting in line will have their files remain under review during the freeze. Companies would also be blocked from launching activities that require operator registration unless the central bank signs off separately.
Licensed virtual asset service providers (VASPs) are singled out in the draft as high-risk merchants, alongside casinos, gambling and gaming operators that hold player funds, adult-oriented businesses, and money service outfits such as remittance and currency-exchange firms. The Philippines has licensed VASPs under a BSP framework in place since 2021, which requires virtual asset businesses to register with the central bank and comply with anti-money-laundering controls.
The rule would push banks and other supervised institutions to onboard regulated VASPs only through direct merchant arrangements, with no intermediary layer in between. Regulators have complained that complex chains of intermediaries hide the true recipient of payments. These direct relationships would carry stricter monitoring and limits on transaction size and payout schedules set against each merchant's risk profile.
Will merchants in the Philippines be on a registry?
The draft also proposes creating a National QR Code Merchant Database. This database would hold a record for every business that accepts payment through the country's standardized QR scheme, and would mark whether a merchant is active, restricted, suspended, or terminated.
When one provider changes a merchant's status, other providers working with that same business would be alerted automatically and prompted to run their own checks.
The BSP is planning for a temporary secure registry to be operational within 90 days of the rule taking effect. A full database is expected to be running after 12 months, and every active merchant is expected to be recorded and validated within 15 months.
The draft also states that institutions would have to flag material fraud, sanctions breaches, cyber or data incidents, and unlicensed merchant activity within 24 hours of discovering them, and provide a fuller report afterwards.
The proposal comes after the Philippine SEC warned 10 exchanges in August 2025, including OKX, Bybit, KuCoin, and Kraken, for serving Filipino users without local authorization, and said it would coordinate with Google, Apple, and Meta to block their marketing and apps. It also fits a broader regional pattern, with regulators across Southeast Asia tightening oversight of digital payment and crypto channels as scam and fraud activity increasingly moves through mobile rails.
Cryptopolitan previously reported that the government launched Integrity Chain in September 2025, a blockchain records system for public-works contracts, after mass protests over flood-control corruption.
If finalized, the circular will take effect 15 days after publication, during which time the BSP will be collecting feedback. Watch for the composition of the eventual merchant database rules and how banks restructure existing intermediary arrangements with VASPs during the comment period.