How Gaming Companies Handle Payments in the Philippines: Top-Ups, Payouts and Compliance (2026)
Game studios and publishers entering the Philippines usually arrive with a payment stack built for card markets, and it breaks within the first month. Players here top up through e-wallets and convenience stores far more than through cards, app store billing takes a large cut and does not cover web shops, and the money also has to flow back out to streamers, tournament winners and affiliates who want to be paid into GCash or a local bank. This guide explains how gaming companies actually run payments in the Philippines: which channels players use, how payouts work, where the regulatory lines are, how to architect collection and disbursement, and what to ask a provider before signing.
Why Gaming Payments in the Philippines Are a Two-Way Problem
Most merchants only collect. Gaming companies collect and disburse, often on the same day. Top-ups arrive in small, frequent amounts from a mobile-first audience; payouts go to a smaller set of recipients in larger, less regular amounts. The two flows have different fraud profiles, different compliance questions and different technical rails, and the companies that struggle are the ones that try to run both through a single account and a single integration. The rest of this article treats them as two systems that share one ledger.
A second structural point: a meaningful share of Filipino players do not hold a card at all. If your checkout only offers Visa and Mastercard, you are not offering a checkout to those players. Wallets, QR Ph and over-the-counter cash are not "alternative" methods here; they are the primary ones.
Where the Money Comes In: Wallets, QR Ph, OTC and Cards
The collection side has four practical channels, and most publishers end up offering at least three of them:
- E-wallet direct payment (GCash, Maya): the player is redirected or deep-linked into the wallet app, confirms with a PIN or biometrics, and returns to your shop. This is the default top-up path for mobile games and the one with the best conversion for small amounts. A native integration, where the wallet is invoked directly rather than through a hosted page, matters for in-app purchases because every extra redirect loses players.
- QR Ph: the national QR standard operated under the central bank's framework. One dynamic QR code can be paid from any participating wallet or bank app. It is the natural choice for web shops opened on a desktop, for internet cafés and for live events, because the player scans with whatever app they already have.
- Over-the-counter cash: the player generates a reference number and pays at a convenience store or payment center, and your system is notified when the cash is posted. Conversion is slower, but it reaches players with no wallet balance. How these channels work is covered in OTC Payment Channels in the Philippines.
- Cards: still relevant for higher-value bundles and for players paying with a family member's card. Cards bring chargebacks, so they need a different risk posture, which we come back to below.
The practical takeaway is to route by amount and context: wallets and QR Ph for everyday top-ups, OTC as a fallback for the unbanked, cards for larger bundles with step-up authentication. A gateway that lets you reorder and hide methods per segment without a release is worth more than one with a marginally lower fee.
Where the Money Goes Out: Creators, Prizes and Affiliates
Payouts are where gaming companies most often get stuck, because the recipients are individuals rather than businesses. Typical payout flows are streamer and creator revenue shares, tournament prize money, affiliate and referral commissions, and refunds that cannot be returned to the original method. Recipients want the money in a GCash or Maya wallet or a local bank account, and they want it without being asked for a foreign bank form.
Technically, payouts ride the interbank rails: InstaPay for real-time transfers up to its per-transaction ceiling, and PESONet for larger or batched transfers that settle in clearing windows. A payment partner wraps both behind a single disbursement API and a batch file format. What you must own is the recipient data: a verified name that matches the receiving account, a stable recipient identifier, and a record of why each payout was made. The operational details of large batches are in Batch Payout in the Philippines, and the end-to-end API path for a foreign company is described in GCash Collection and Payout API for Foreign Merchants.
The Compliance Line: Video Games vs Regulated Gambling
This is the section to read twice. In the Philippines, publishing and monetizing video games is ordinary commerce. Operating games of chance for money is gambling, licensed and supervised by PAGCOR, and it sits on a completely separate regulatory and payments track with its own licensing, reporting and enhanced due diligence. Payment providers will ask which side of the line you are on, and they will check. The table below summarizes what a licensed payment partner will typically want to see for each business type.
| Business type | Primary regulator for the activity | What a payment partner will ask for | Typical payment setup |
|---|---|---|---|
| Mobile or PC game publisher selling virtual goods | General business registration; consumer and data privacy rules | Company documents, game listings, terms of service, refund policy | Wallet and QR Ph collection, card acceptance, payouts to creators |
| Esports organizer or tournament platform | General business registration; event permits where applicable | Prize rules, recipient verification process, source of prize funds | Entry fee collection, batch prize payouts |
| Game distribution or top-up reseller | General business registration; supplier agreements | Reseller authorizations, inventory and settlement records | High-frequency small collections, supplier disbursements |
| Real-money games of chance, betting, casino-style apps | PAGCOR licensing; AML reporting obligations | Gaming licence, AML program, responsible gaming controls | Separate regulated track; many providers decline or require specific approval |
Two further points apply to everyone. The Anti-Money Laundering Act obliges regulated payment institutions to know their merchants and to report suspicious activity, so expect questions about unusual payout patterns even for a pure video game business. And the Data Privacy Act governs how you store player identity data collected for payouts; keep it minimal and keep it separate from gameplay data.
Architecture: Keep Collection and Disbursement on Separate Rails
The architecture that holds up in production separates the two money flows end to end: separate API credentials, separate webhook endpoints, separate ledgers, and a daily reconciliation that joins them. Collection credits an in-game wallet; disbursement debits a payout balance that finance tops up deliberately. Never let a payout be funded automatically from the day's collections without a human-approved transfer between the two, because that is the pattern both your auditors and your payment partner will flag first.
On the collection side, the key design decisions are an idempotent order creation keyed by your own order ID, a webhook handler that acknowledges first and verifies by querying the gateway afterwards, and a sweeper job that re-queries any order still pending after its expiry. The reasoning behind idempotency keys is laid out in Idempotency Keys: Preventing Duplicate Payments. On the disbursement side, every payout request carries a unique reference, status is polled until terminal, and failed payouts return to a review queue rather than being retried blindly. Settlement timing for collections, including same-day options, is explained in D0 Same-Day Settlement in the Philippines.
Integration Walkthrough: A Top-Up Order and Its Webhook
The collection flow in code is short. First, create an order with your own idempotency key, the player's identifier and the item being purchased. The example uses a generic gateway shape; field names vary by provider but the structure does not.
curl -X POST https://api.gateway.example/v1/collections \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-H "Idempotency-Key: topup-7f3a9c-000812" \
-d '{
"merchantOrderId": "topup-7f3a9c-000812",
"amount": { "value": "150.00", "currency": "PHP" },
"method": "gcash",
"customer": { "playerId": "7f3a9c", "country": "PH" },
"description": "600 gems",
"metadata": { "sku": "gems-600", "gems": 600 },
"returnUrl": "https://play.example.com/wallet/return",
"notifyUrl": "https://api.example.com/webhooks/payments"
}'Second, handle the webhook. The handler below acknowledges immediately, de-duplicates by event ID, re-queries the gateway for the authoritative status, and credits the player inside a database transaction guarded by a conditional update so that a replayed event can never credit twice.
app.post('/webhooks/payments', express.raw({ type: 'application/json' }), async (req, res) => {
if (!verifySignature(req.headers['x-signature'], req.body)) return res.status(401).end();
res.status(200).end(); // acknowledge first, work afterwards
const evt = JSON.parse(req.body);
const fresh = await redis.set(`evt:${evt.id}`, 1, 'NX', 'EX', 86400);
if (!fresh) return; // duplicate delivery, ignore
const order = await gateway.getCollection(evt.merchantOrderId); // trust the query, not the push
if (order.status !== 'PAID') return;
await db.transaction(async (tx) => {
const updated = await tx.orders.markPaid(order.merchantOrderId, order.gatewayRef); // UPDATE ... WHERE status = 'PENDING'
if (updated === 0) return; // already credited by an earlier event
await tx.wallets.credit(order.customer.playerId, order.metadata.gems);
await tx.ledger.insert({ type: 'topup', ref: order.gatewayRef, amount: order.amount });
});
});The same pattern, with the direction reversed, applies to payout status webhooks: acknowledge, de-duplicate, re-query, then move the payout record to its terminal state.
Fraud, Refunds and Velocity Controls for Games
Gaming has a fraud profile of its own. Stolen cards are used to buy virtual currency that is then traded or sold; compromised player accounts are drained of balance; promotional credits are farmed with bulk account creation; and on the payout side, fake creator accounts are used to extract commissions. The controls that work are mostly velocity and linkage rules rather than blanket limits: cap top-ups per account and per device over a rolling window, hold first-time card purchases from a new account for review, and refuse payouts to a receiving account that is linked to more than one creator identity. A practical rule framework is in Fraud Detection Rules for Philippines Payment Processing.
Refund policy needs to be written before launch, not after the first dispute. Virtual goods that have been consumed are generally not refundable, and your terms should say so, but a clear and fast refund path for duplicate charges and failed deliveries will prevent most chargebacks on card top-ups. The mechanics of issuing refunds through local channels are covered in Refunds in the Philippines: Process and Technical Implementation. Wallet and QR Ph payments do not carry card-style chargebacks, which is one more reason to steer everyday top-ups toward them.
Choosing a Provider: Direct Contracts, Aggregator or Licensed Gateway
Three routes exist. You can contract directly with each wallet, which gives maximum control and maximum overhead. You can use an aggregator that resells access, which is fast but means your funds and your compliance standing depend on an intermediary whose own status you must verify. Or you can integrate with a gateway that is itself licensed by the central bank, which combines a single API with a regulated custodian of funds.
| Route | Integration effort | Payouts included | Who holds the funds | Best for |
|---|---|---|---|---|
| Direct wallet contracts | One integration per wallet, each with its own onboarding | Usually a separate product and contract | Each wallet settles to your local bank account | Large publishers with a local entity and a payments team |
| Unlicensed aggregator or reseller | Single API | Sometimes | Often unclear; depends on the aggregator's upstream arrangement | Short-term tests; not recommended for recurring volume |
| BSP-licensed gateway | Single API covering wallets, QR Ph, cards and payouts | Yes, on the same credentials and ledger | A regulated institution under central bank supervision | Publishers and platforms that need both directions and audit-ready records |
SMARTPAY holds Operator of Payment System (OPS) and Electronic Money Issuer (EMI) licences from the Bangko Sentral ng Pilipinas (BSP). Game publishers integrate once for GCash, Maya, QR Ph and card collection, and use the same credentials for creator, prize and affiliate payouts to wallets and bank accounts, with funds held and settled by a licensed institution. Whatever provider you choose, confirm its licence status on the BSP's published lists before you sign.
What each licence type means in practice is explained in What Is a BSP NOPS License?, and the broader question of entity, onboarding and settlement for a foreign company is covered in Philippines Payment Gateway Integration for Global Merchants. If you later add more rails, failover between them is discussed in Smart Payment Routing and Cascading.
Frequently Asked Questions
Do we need a Philippine company to accept top-ups and pay creators?
It depends on the route. Direct wallet contracts generally require a locally registered entity and bank account. A licensed gateway can onboard a foreign entity under its own merchant due diligence for collection, and payouts to local recipients can be funded from the collection balance through a documented internal transfer. Ask the provider to walk you through its specific onboarding path for non-resident companies.
Can we run payouts from the same account that receives top-ups?
Use the same provider, but keep separate balances and separate credentials. Funding payouts from collections should be an explicit, logged transfer approved by finance, not an automatic sweep.
How do we handle a player who paid at a convenience store but the credit did not arrive?
OTC postings can lag the cash handover. Your sweeper job should re-query pending references, and support should be able to look up a reference number and trigger a manual re-check. Never credit based on a photo of a receipt alone.
Are wallet top-ups subject to chargebacks?
Wallet and QR Ph payments are push payments authorized by the player in their own app and do not carry the card-network chargeback process. Disputes are handled through the wallet's complaint channels and your own refund policy. Card top-ups do carry chargebacks and should be risk-scored accordingly.
What records should we keep for payouts to individuals?
The recipient's verified name and account identifier, the business reason for the payout, the approving user, the gateway reference and the terminal status. Keep these for the period required by your tax and AML obligations and store identity data separately from gameplay data.
Is a game with loot boxes treated as gambling?
This is a legal question for counsel, not a payments question. From a payments perspective, publishers of games with randomized virtual items are onboarded as game merchants, while real-money games of chance are not. Be transparent with your provider about your monetization design so the classification is made correctly up front.
How quickly can a new publisher go live?
The integration itself is days of work using the patterns above. The schedule is driven by merchant onboarding and document review, so start the compliance conversation with the provider before the engineering sprint, not after it.
Final Thoughts
Gaming payments in the Philippines reward companies that respect two facts: players pay with wallets and cash more than with cards, and money has to flow out as reliably as it flows in. Build collection and disbursement as two systems on one ledger, put the compliance classification in writing early, and choose a partner whose licence you can verify. If you are planning a launch or re-platforming an existing title, reach out on Telegram at @LouisSMARTPAY or by email at [email protected].