BSP Licensing Requirements for Payment Service Providers in the Philippines (2026)

2026-10-14 15:20:00

I lead market entry for a payments company headquartered outside the Philippines, and the first question our board asked about Manila was the one every foreign payment business asks: what licence do we need? It took me longer than I expected to give a clean answer, because the Philippines does not have a single "payment service provider licence". The Bangko Sentral ng Pilipinas (BSP) regulates by activity. What you need depends on whether you operate a payment system, hold customer funds, move remittances, acquire merchants, or touch virtual assets, and a single product can trigger more than one of those. This article is the map I wish I had at the start: the main BSP authorizations, what each one is triggered by, what the regulator expects from applicants in broad terms, the non-BSP registrations that sit alongside, and the practical alternative of working through an entity that is already authorized. It is written from an operator's perspective and is not legal advice; BSP circulars change, so confirm every point against current text and local counsel.

Start With Activities, Not Licence Names

The most common mistake I see from foreign teams is to pick a licence name they recognise from another jurisdiction and look for its Philippine twin. The BSP framework works the other way around. You describe what your business actually does with money and payment instructions, and the description determines the authorization. Four questions sort most business models:

Do you operate or maintain a payment system? That includes providing clearing or settlement services, or running the platform through which payment instructions between payers and payees are processed.
Do you issue stored value? If customers hold a balance with you that they can spend or transfer, you are issuing electronic money.
Do you move money for people across or within borders? Remittance and money transfer are regulated as a separate activity.
Do you contract merchants and settle card or wallet payments to them? Merchant acquisition has its own layer of rules.

A gateway that only routes instructions and never holds funds answers yes to the first question. A wallet answers yes to the first and second. A cross-border payout business may answer yes to the first and third. Knowing which combination applies to you is most of the work.

The Main BSP Authorizations at a Glance

The table below summarises the authorizations a payment business most often encounters. It is deliberately high level. Each row has detailed conditions in its governing circular, and some categories have been subject to moratoriums on new applications at various times.

Authorization	Triggered by	Typical holder	Holds customer funds?
Operator of a Payment System (OPS) registration	Operating a payment system, or providing clearing, settlement or payment processing services to others	Gateways, aggregators, processors, clearing switch operators	Depends on the model; many do not
Electronic Money Issuer (EMI) licence	Issuing stored value redeemable at face value	Wallets, prepaid programmes, banks and non-bank issuers	Yes, backed by liquid assets
Remittance and transfer company registration	Remitting or transferring funds for customers, including inbound cross-border remittance	Remittance operators, payout networks, money changers under related categories	In transit
Merchant acquirer licence	Contracting merchants and settling accepted payments to them	Acquirers and some payment facilitators	Settlement funds in transit
Virtual asset service provider licence	Exchanging, transferring or safekeeping virtual assets	Crypto exchanges and custodians	Yes, in virtual assets
Bank or digital bank licence	Taking deposits and lending	Banks	Yes, as deposits

For a deeper treatment of the two authorizations that matter most to gateways and wallets, see What Is a BSP NOPS License? and BSP EMI License Explained.

OPS Registration: The Baseline for Payment Processing

The National Payment Systems Act gives the BSP oversight of payment systems and requires operators to register before they do business. In practice this is the baseline authorization for any company that processes payment instructions for others. The regulator's interest is that the people and systems standing between payers and payees are identifiable, governed, and resilient. In broad terms an applicant should expect to show:

A Philippine-registered corporate entity with a primary purpose that covers the payment activity.
A clear description of the business model and fund flows: who holds money at each step, in whose account, and for how long.
Fit and proper directors and officers, with a governance structure that separates oversight from operations.
Risk management, information security and business continuity arrangements proportionate to the system.
Agreements with the banks, wallets and clearing participants the system connects to.

Registration is not a one-off event. Registered operators carry continuing obligations: reporting, notifying the BSP of material changes in ownership, management or business model, and meeting governance standards issued for operators. The BSP has also consulted on pausing new operator registrations for a period, which is a signal that existing registrations are becoming scarcer and more valuable. If your plan depends on obtaining a new registration on a fixed timetable, test that assumption early.

EMI Licensing: When You Hold Stored Value

The moment your product lets a customer keep a balance, you are in e-money territory, and the requirements step up because customer funds are at stake. The EMI framework distinguishes between bank and non-bank issuers and between categories of issuer by scale. Across categories, the themes are consistent:

Capital: a minimum capital level set by category, which the issuer must maintain on an ongoing basis.
Safeguarding: liquid assets held against outstanding e-money balances, segregated from the issuer's own funds.
Account limits and customer due diligence: wallet limits tied to the level of identity verification, with full anti-money-laundering obligations as a covered person.
Consumer protection: disclosure, complaint handling and redress mechanisms.
Technology risk: security controls, fraud management and outsourcing oversight.

E-money is not a deposit and is not covered by deposit insurance, which is why the safeguarding rules carry so much weight. New non-bank EMI licences have at times been closed to applicants and later reopened, so the availability of this route is itself something to verify before building a business plan around it.

Other Authorizations That Catch Foreign Businesses

Three further categories regularly surprise international teams.

Remittance and transfer. If you deliver funds to Philippine beneficiaries on behalf of overseas senders, or transfer money domestically for customers, you are likely within the remittance and transfer company rules, which carry their own registration, capital, network accreditation and reporting requirements. A payout product marketed as "disbursement" can fall here depending on who the customer is and whose money is moving.

Merchant acquisition. The BSP has issued rules specifically on merchant payment acceptance, adding a licensing layer for entities that contract merchants and settle to them, with expectations on merchant due diligence, settlement timeliness and monitoring. If your model is a payment facilitator with sub-merchants, read these rules closely. Our piece on what a payment aggregator is explains where aggregation sits in the chain.

Virtual assets. Converting between fiat and virtual assets, or transferring and safekeeping them, requires a virtual asset service provider licence. New licences in this category have been under a moratorium, so most new entrants cannot rely on obtaining one.

Clearing access is a separate matter again. Direct participation in InstaPay, PESONet and QR Ph is through BSP-supervised institutions that are members of the industry's payment system management body and connected to the relevant clearing switch. A foreign company does not join these rails directly; it reaches them through a participant. The mechanics are covered in QRPH Interoperability Explained.

Registrations Outside the BSP

BSP authorization sits on top of ordinary corporate compliance, and applications generally presuppose that these are in place:

Corporate registration with the Securities and Exchange Commission, with attention to foreign ownership rules and minimum capital rules that apply to foreign-owned domestic enterprises.
Tax registration with the Bureau of Internal Revenue and a local business permit from the city where you operate.
Anti-money-laundering registration with the Anti-Money Laundering Council for covered persons.
Data protection compliance under the Data Privacy Act, including registration with the National Privacy Commission where thresholds are met.
Card scheme and security standards where cards are involved; see PCI DSS Compliance for Philippines Payment Businesses.

We keep our own internal mapping of activities to authorizations in a small machine-readable file so that product, legal and engineering are reading the same thing. A simplified version looks like this:

{
  "jurisdiction": "PH",
  "regulator": "BSP",
  "activities": [
    {
      "activity": "route_payment_instructions",
      "holds_customer_funds": false,
      "authorization": ["OPS_REGISTRATION"]
    },
    {
      "activity": "issue_wallet_balance",
      "holds_customer_funds": true,
      "authorization": ["OPS_REGISTRATION", "EMI_LICENSE"],
      "extra": ["AMLC_REGISTRATION", "SAFEGUARDING_ACCOUNT"]
    },
    {
      "activity": "inbound_remittance_payout",
      "holds_customer_funds": "in_transit",
      "authorization": ["REMITTANCE_TRANSFER_REGISTRATION"]
    },
    {
      "activity": "contract_and_settle_merchants",
      "holds_customer_funds": "in_transit",
      "authorization": ["OPS_REGISTRATION", "MERCHANT_ACQUIRER_LICENSE"]
    }
  ],
  "review": { "owner": "compliance", "recheck_on": ["new_product", "fund_flow_change", "new_circular"] }
}

Build, Partner, or Integrate: Three Routes to Market

Once you know which authorizations your model triggers, the strategic question is whether to hold them yourself. There are three realistic routes, and most foreign companies end up on the second or third.

Route	What you do	Who holds the authorization	Best suited to	Main trade-off
Apply for your own authorization	Incorporate locally, build compliance functions, apply to the BSP	You	Companies whose core business is payments in the Philippines for the long term	Longest path, highest fixed cost, exposed to moratoriums
Partner with an authorized institution	Offer your product under a commercial arrangement in which the partner performs the regulated activity	The partner	Platforms that need wallets or payouts as a feature	Dependence on the partner; your role must stay outside regulated activity
Integrate as a merchant of a licensed gateway	Connect by API to collect and pay out; the gateway processes and settles	The gateway	Merchants, marketplaces, gaming, e-commerce and SaaS companies that simply need to get paid	Less control over the rails; due diligence on the gateway is essential

The distinction between the second and third routes matters. If you are a merchant selling your own goods or services, you are not a payment service provider at all, and you need a provider rather than a licence. If you are handling other people's money, you are in regulated territory and the partner structure has to be designed so that the authorized entity genuinely performs and controls the regulated function.

For a merchant integration, the technical surface is small. A typical collection request to a gateway looks like the following, with the gateway's authorized entity appearing as the processor on the customer's side:

curl -X POST https://api.example-gateway.com/v1/collections \
  -H "Content-Type: application/json" \
  -H "X-Merchant-Id: M_XXXXX" \
  -d '{
    "merchant_ref": "INV-20261014-0001",
    "channel": "QRPH",
    "amount": "<ORDER_AMOUNT>",
    "currency": "PHP",
    "notify_url": "https://merchant.example.com/webhooks/payments",
    "nonce": "8c1f2a",
    "sign": "..."
  }'

The full integration sequence for overseas companies, from entity questions to settlement, is in Philippines Payment Gateway Integration for Global Merchants.

If you take the partner or merchant route, the authorization you rely on belongs to someone else, so verifying it becomes your most important piece of diligence. Check that the exact legal entity in your contract appears on the BSP's published lists, and that settlement accounts are in that entity's name. SMARTPAY provides its collection and payout services through an entity holding BSP OPS registration and an EMI licence, and we encourage every prospective merchant to check the lists independently before signing.

How to Verify a Provider's Authorization

Verification is simple and too often skipped. The steps I follow for every prospective provider:

Ask for the full registered corporate name and the authorization it claims, in writing.
Look the name up on the BSP's published lists of registered operators and licensed e-money issuers. Trade names and brand names are not enough; the legal entity must match.
Confirm that the contracting party in the agreement is that same entity, not an affiliate or an offshore company.
Confirm that settlement and collection accounts are held in the entity's name with a Philippine bank.
Ask how customer funds are safeguarded and who the settlement bank is.
Repeat the list check periodically; authorizations can be restricted or revoked.

Providers that are properly authorized answer these questions quickly. Evasion at step one or step three is the clearest warning sign there is. The operational consequences of working with a provider that gets into trouble are described in Payment Risk Control: How Philippines Merchants Get Flagged.

Frequently Asked Questions

Is there a single payment service provider licence in the Philippines?

No. The BSP authorizes by activity. A payment business may need operator registration, an e-money licence, a remittance registration, a merchant acquirer licence, or a combination, depending on what it does with funds and payment instructions.

Can a foreign company apply to the BSP directly without a local entity?

BSP authorizations are granted to entities established in the Philippines. A foreign group would normally incorporate a local subsidiary, subject to foreign ownership and capital rules, and apply through it. Offshore companies that only need to collect or pay out typically integrate with a licensed local provider instead.

Do I need a licence to accept GCash, Maya or QRPH payments for my own sales?

No. A merchant accepting payment for its own goods or services is a customer of the payment system, not an operator of one. You need a contract with an authorized acquirer or gateway. Licensing questions arise when you start handling payments for third parties.

We are a marketplace that collects from buyers and pays sellers. Are we a payment service provider?

Possibly. If buyer funds pass through accounts you control before reaching sellers, regulators may view that as a regulated activity. The usual solution is to have a licensed provider hold and split the funds so that you never take possession. Structure this with counsel before launch.

How long does BSP authorization take?

There is no reliable standard timeline. It depends on the authorization type, the completeness of the application, the regulator's queue, and whether the category is open to new applicants at all. Plan on the basis that it is long and uncertain, and avoid commitments that assume a date.

What is the difference between OPS registration and an EMI licence?

Operator registration covers running or processing for a payment system. An e-money licence covers issuing stored value and holding the funds behind it. A gateway that never holds balances needs the first; a wallet needs both.

Are moratoriums on new licences common?

The BSP has used moratoriums in several categories, including virtual assets, digital banks and non-bank e-money, and has consulted on one for operator registrations. Some have later been lifted. Always check the current position rather than relying on older articles, including this one.

Where to Go From Here

Map your activities before you look at licence names. Decide honestly whether payments are your product or simply how you get paid. If they are your product, budget for a local entity, a compliance function and an uncertain timeline, and check whether the category is open. If they are how you get paid, your task is to choose an authorized provider and verify it properly. If you would like to compare your model against the map above, or see the entity details behind SMARTPAY's services, reach me on Telegram at @LouisSMARTPAY or by email at [email protected].