The Bangko Sentral ng Pilipinas (BSP) is seeking tighter risk-based controls from its supervised institutions (BSIs) in a bid to strengthen the security and integrity of the national payment system.

Under a draft circular, the central bank has proposed amendments to the Manual of Regulations for Payment Systems (MORPS) that would require BSIs to establish mechanisms reinforcing controls over their payment activities. The move forms part of the BSP's broader supervision mandate over the national payment system, which the central bank has increasingly leaned on as digital payments and QR-based transactions expand across the country.

“BSP-Supervised Institutions, including Operators of Payment Systems (OPS), and Payment Service Providers (PSPs), and other relevant participants in the national payment system shall establish and maintain risk-based controls that provide sufficient, accurate, current, and timely visibility over the persons, merchants, intermediaries, accounts, payment channels, transactions, and settlement flows involved in payment activity, commensurate with their respective roles,” the central bank said.

Stricter due diligence and risk classification

The proposed rules would oblige BSIs to carry out strict due diligence, conduct risk assessments, and put in place reporting frameworks covering their payment activities, including merchant arrangements.

“In its risk assessment, an OPS-MAL (merchant acquisition license) or a BSFI (BSP-supervised financial institution) authorized to engage in merchant acquisition shall assign a risk classification that reflects the risks arising from the merchant and ultimate beneficiaries whose transactions are processed under the arrangement,” the BSP said.

“For instance, a merchant would not be considered low risk in a situation in which its ultimate beneficiary would be classified as high risk.”

The central bank bars BSIs from facilitating any payment arrangement that obscures identities, breaks accountability, prevents transaction reconstruction, or impairs the detection, investigation, or reporting of financial crimes.

Under direct merchant arrangements, BSIs would be prohibited from onboarding merchants linked to illegal activities. High-risk merchants could only be onboarded after enhanced due diligence, enhanced monitoring, and the imposition of transaction limits.

The draft circular identifies high-risk merchants or activities as those involving casinos and online gambling operators; gaming system administrators and platform operators; lawful adult-oriented content or goods providers; licensed virtual asset service providers; and money service providers.

A direct merchant arrangement, as defined in the draft circular, is a payment acceptance setup in which an authorized BSI maintains a direct relationship with the merchant, ensuring that no intermediary accepts, processes, collects, receives, allocates, or settles payments on their behalf.

For foreign merchants and intermediaries, BSIs would be required to verify legal existence, jurisdictional risks, website legitimacy, and sanctions exposure, and to ensure records can be retrieved without hindrance before onboarding.

New rules for layered merchant arrangements

The central bank is also introducing rules for layered merchant arrangements — setups that place one or more intermediaries between the acquiring BSI and the underlying merchant to support payment processing, routing, collection, or settlement.

BSIs may enter into such arrangements only if the participating intermediaries are duly authorized, roles across all parties are clearly allocated, and payment flows remain fully traceable from the originating account to the underlying merchant and the ultimate beneficiary.

These arrangements must also be backed by a robust governing agreement guaranteeing the acquiring institution timely access to comprehensive transaction data and enforceable rights to audit, monitor, and restrict activities, in order to prevent any impairment of visibility or accountability.

Once the transitory periods conclude, BSIs maintaining layered merchant arrangements would be required to submit their inventory, along with a list of restricted, suspended, or terminated underlying merchants and intermediaries, on a quarterly basis.

They would also need to file a notice of any material change in their arrangement at least 30 business days before its effective date, and to submit their annual review or independent assurance report annually within 120 days after the close of their calendar or fiscal year.

Centralized QR code merchant database

Separately, the BSP wants to establish a centralized national quick-response (QR) code merchant database to bolster the country's fraud prevention efforts and secure QR-based transactions. QR payments have become a common channel for scams in the Philippines, and the proposed database is intended to give payment providers a shared, authoritative record of legitimate merchants that can be checked in real time.

The database must be launched within 90 days and be fully operational no later than a year after the relevant MORPS amendments take effect.

For the database, payment service providers would have to submit and keep updated their core business profiles, including unique merchant and QR credentials, registered business and trade names, business classifications, licensing details, and physical or digital store addresses.

Merchants, for their part, must store in the database records of their associated PSPs; settlement accounts; the device, terminal, or channel used; beneficial ownership structures; and their onboarding date, real-time risk classification, and sanctions-screening status, among other information.

The BSP would further require all active merchant records to be completely migrated and validated in the database no later than 15 months from the rules' effectivity.

The database would inform all participating PSPs in real time of merchant status changes — such as suspensions or terminations due to fraud — with the BSP mandating affected parties to conduct immediate risk reviews.

Within six months, the payment system management body (PSMB) must submit to the BSP for approval the complete governance framework, data standards, application programming interface specifications, security requirements, and implementation plan for the database.

Upon the circular's effectivity, the BSP will also suspend the acceptance and processing of all new OPS registrations for one year while it conducts a comprehensive review of its licensing and taxonomy frameworks. — Katherine K. Chan