Money
The BSP tightens rules on banks, e-wallets, and payment aggregators to ensure every peso is traceable. Read about the new BSP payment rules for merchants.
September 6, 2026 2:52 PM
By Eileen Mencias
The Bangko Sentral ng Pilipinas is proposing tighter rules for banks and payment firms that would hold them responsible for identifying merchants and beneficiaries using their networks, even when transactions pass through third-party aggregators.
Under a draft circular, BSP-supervised institutions would have to identify the actual merchant and ultimate beneficiary of each transaction, regardless of whether screening or monitoring is handled by an intermediary.
The proposal could require banks, e-wallet operators and merchant acquirers to restructure partnerships with payment aggregators and online platforms that rely on multiple layers of intermediaries.
Merchant acquisition would generally have to be conducted directly. Layered arrangements would be allowed only if the acquiring institution can identify all parties involved, trace the full flow of funds and promptly retrieve transaction-level data.
Payments must be rejected or suspended when the actual merchant cannot be identified or matched with the transaction.
Shared QR codes, pooled settlement accounts and bulk transaction records would remain allowed as long as each payment can be traced to a specific underlying merchant.
The BSP would also prohibit intermediaries from outsourcing merchant acquisition or adding another tier, restricting so-called “aggregator of aggregators” arrangements.
Casinos, gaming platforms handling wagers or player funds, lawful adult-oriented businesses, virtual asset service providers and money service businesses could only be accepted through direct arrangements.
High-risk layered arrangements would require board approval, enhanced monitoring, quarterly compliance reviews and annual independent assurance. Other layered arrangements would also be subject to annual independent review or audit.
Sanctions screening would cover intermediaries, underlying merchants, ultimate beneficiaries, beneficial owners, controlling persons, aliases and settlement-account holders.
Each institution would remain responsible for assessing suspicious activity and filing any required report. Coordination with other participants in the payment chain could not delay or replace that obligation.
Material fraud, scams, sanctions breaches, cyber incidents, unlicensed operations and illegal merchant activity would have to be reported to the BSP within 24 hours of detection, followed by a complete report within five business days.
The central bank is also proposing a National QR Code Merchant Database containing merchant identities, beneficial owners, registration details, websites, settlement accounts, QR credentials and risk classifications.
Payment providers would be required to keep the information current and reconcile discrepancies with their own records.
Institutions would have six months to review existing merchant relationships and another six months to address deficiencies. Those that remain noncompliant after the 12-month transition period could face enforcement action.
Separately, the BSP is proposing a 12-month moratorium on new applications to register as operators of payment systems while it reviews its licensing framework.
Pending applications could continue to be evaluated, but no final decisions would be issued until the moratorium ends.
The proposed rules would increase the responsibility of banks and payment firms for merchants operating through their networks and could require changes to business models that rely on pooled accounts, shared QR codes and multiple layers of intermediaries.