Philippines Fintech Regulatory Landscape for Foreign Businesses: Who Regulates What (2026)
I run compliance and payments for a software company headquartered outside the Philippines. We sell subscriptions and a small marketplace of add-ons to Filipino customers, we pay a network of local creators, and none of our staff sit in Manila. When we decided to take the market seriously, I asked three advisers the same question, "what licence do we need," and got three incompatible answers. One said we needed a licence from the central bank. One said we needed nothing beyond a corporate registration. One said we needed nothing at all as long as we used a local payment gateway. All three were partly right, and the reason they disagreed is that I had asked the wrong question. The Philippine fintech landscape is not one regulator with one licence. It is a set of agencies, each with its own statute, and each attaches to a specific activity rather than to an industry label. The right question is which activities we perform, and which agency attaches to each of them. This article is the map I wish someone had handed me on day one. It deliberately does not re-explain the individual central bank authorizations, which are covered activity by activity in our guide to BSP licensing requirements for payment service providers, with deeper explainers on the e-money issuer licence and the operator of payment systems category. It explains who regulates what, where the layers overlap, and how to read your own business model against them.
Why the Landscape Confuses Foreign Teams
Four things make the Philippines harder to read than it needs to be, and none of them is the quality of the regulators.
"Fintech" is not a legal category. No Philippine statute regulates fintech. Statutes regulate payment systems, electronic money, banking, lending, securities, insurance, gambling, personal data, consumer transactions and tax. A product your investors call fintech will be sliced by the law into three or four of those activities, and each slice has a different home.
Licence, registration and plain compliance are three different things. A licence means you may not perform the activity without prior approval. A registration means you may perform it but must be on a register and report. A compliance obligation means no permit exists at all, but rules apply to you the moment you do the thing. Foreign teams tend to collapse all three into "we need a licence," which produces either paralysis or a false sense that a corporate registration has settled everything.
Some laws reach you with no local presence; others only attach when you set up locally. The Data Privacy Act, the Internet Transactions Act and the value-added tax rules for digital services supplied from abroad all reach a foreign business that has no Philippine entity. Corporate registration, local tax registration and most secondary licences only become relevant once you incorporate or open a branch. If you do not separate the two groups, you will either over-build a local structure you do not need or assume you are invisible when you are not.
A single transaction touches several agencies at once. Take one subscription payment from a Filipino customer through a wallet to a foreign software company. The central bank regulates the wallet and the rail. The anti-money-laundering authority receives the wallet's reporting. The privacy regulator cares about the customer data you collected at checkout. The tax authority cares whether value-added tax was accounted for on a digital service. The trade department cares whether your terms, price and refund policy were disclosed the way the e-commerce law requires. Nobody at any of those agencies thinks of the transaction as "fintech." They each see their slice.
Once I accepted that the map had to be drawn agency by agency and activity by activity, the three contradictory answers resolved themselves. The adviser who said "central bank licence" was thinking of us operating our own rail. The adviser who said "corporate registration" was thinking of the local entity we were considering. The adviser who said "use a gateway" was describing the route we eventually took for the payments layer, which satisfies the central bank's requirements through a supervised partner but does nothing about privacy, tax or consumer law.
The Regulator Map: Who Regulates What
The table below is the version of the map we keep in our compliance wiki. The "when a foreign business meets it" column is the one that matters most for planning. The "typical touchpoint" column is where the obligation actually shows up in your operations, which is often inside a contract with a licensed partner rather than in a filing you make yourself. Republic Act numbers are given so you can find the primary text; implementing rules and agency circulars change more often than the statutes and should always be checked against the current issuance.
| Agency | What it regulates | Main laws | When a foreign business meets it | Typical touchpoint |
|---|---|---|---|---|
| Bangko Sentral ng Pilipinas (BSP) | Payment systems and their operators, electronic money issuers, banks and digital banks, remittance and transfer companies, foreign exchange dealers, virtual asset service providers, the national retail payment rails (InstaPay, PESONet, QR Ph), financial consumer protection for the entities it supervises | RA 7653 as amended by RA 11211 (New Central Bank Act), RA 11127 (National Payment Systems Act), RA 11765 (Financial Products and Services Consumer Protection Act), RA 12010 (Anti-Financial Account Scamming Act), BSP circulars | Whenever you move, hold or process Philippine money, and whenever you want a wallet or QR Ph on your checkout | Your licensed gateway or e-money partner's onboarding and contract; your own registration or licence only if you build the rail yourself |
| Securities and Exchange Commission (SEC) | Corporate registration and foreign ownership, lending and financing companies and their online platforms, securities and investment contracts, crowdfunding, corporate reporting | RA 11232 (Revised Corporation Code), RA 7042 as amended (Foreign Investments Act), RA 9474 (Lending Company Regulation Act), RA 8556 (Financing Company Act), RA 8799 (Securities Regulation Code) | When you set up a local entity or branch; when you lend or offer instalments on your own balance sheet; when you raise money from the public | Entity registration; secondary licence for lending or financing; memorandum circular compliance |
| Anti-Money Laundering Council (AMLC) | Know-your-customer, record keeping, covered and suspicious transaction reporting, freeze orders and sanctions screening by covered persons | RA 9160 (Anti-Money Laundering Act) as amended by RA 9194, RA 10365, RA 10927 and RA 11521 | Indirectly through every licensed financial partner; directly only if you become a covered person (e-money issuer, remittance company, virtual asset provider, lending company) | Merchant due diligence by your partner, payer verification tiers, data retention, transaction reports filed by the partner |
| National Privacy Commission (NPC) | Collection and processing of personal data, cross-border transfer, breach notification, data protection officer appointment, registration of data processing systems | RA 10173 (Data Privacy Act) and its implementing rules, NPC circulars and advisories | As soon as you process the personal data of Philippine residents, with or without a local entity | Privacy notice, consent and lawful-basis records, data protection officer, breach playbook, processor agreements with your gateway |
| Bureau of Internal Revenue (BIR) | Tax registration, value-added tax including on digital services supplied by nonresidents, withholding on platform sellers, invoicing and electronic invoicing | National Internal Revenue Code as amended, RA 12023 (VAT on Digital Services), RA 11976 (Ease of Paying Taxes Act), revenue regulations and memorandum circulars | When you sell digital services to Philippine consumers from abroad; when you run a marketplace; when you have a local entity | Nonresident digital service provider registration, invoice and receipt rules, withholding certificates, records that reconcile to gateway settlement reports |
| Department of Trade and Industry (DTI) | Business name registration for sole proprietors, consumer protection, conduct of online merchants and platforms, product standards | RA 7394 (Consumer Act), RA 8792 (Electronic Commerce Act), RA 11967 (Internet Transactions Act) | When you sell goods or services online to Philippine consumers, including from abroad where you have sufficient Philippine contacts | Identity and terms disclosure, returns and dispute handling, platform duties and record keeping under the Internet Transactions Act |
| Philippine Amusement and Gaming Corporation (PAGCOR) | Gambling and electronic games with real-money wagering, licensing of operators and their service providers | PD 1869 as amended by RA 9487, PAGCOR regulations | Only if your product involves wagering; non-wagering video games sit outside | Licence or accreditation, which any payment partner will ask to see before onboarding |
| Insurance Commission (IC) | Insurance, pre-need plans, health maintenance organizations, insurtech distribution | RA 10607 (amended Insurance Code), IC circulars | When you embed insurance, extended warranties sold as insurance, or protection products in checkout | Partnership with a licensed insurer; agency and distribution rules |
| DICT, Cybercrime Investigation and Coordinating Center, National Telecommunications Commission | Cybercrime, cybersecurity incident response, SIM registration, the national identification system used for electronic verification | RA 10175 (Cybercrime Prevention Act), RA 11934 (SIM Registration Act), RA 11055 (Philippine Identification System Act) | When fraud and account takeover hit your Philippine traffic; when you rely on mobile numbers or the national ID for verification | Incident reporting and cooperation with investigations; the data sources your verification vendor is allowed to query |
Two observations fall out of the table. First, only two rows contain anything a foreign business must obtain before acting: the central bank row if you operate a rail or hold stored value, and the SEC row if you lend or incorporate. Everything else is registration or plain compliance. Second, the touchpoint column is dominated by "your partner." Most of the central bank and anti-money-laundering layer reaches a foreign merchant through the onboarding process and contract of a supervised provider, which is why choosing that provider is the single most consequential compliance decision you make.
The BSP Layer: Payments, E-Money and the Rails
The Bangko Sentral ng Pilipinas is the regulator foreigners have heard of, and it is the one whose authorizations are most often misdescribed. The structure is simpler than the vocabulary suggests.
The National Payment Systems Act of 2018 gave the central bank oversight of all payment systems in the country and created the category of operator of payment systems. Anyone who operates a system through which payments flow for other people must register. Registration is mandatory, but it is a registration with supervisory conditions attached, not a discretionary licence in the banking sense. Separately, the e-money framework governs anyone who issues stored value and holds customer funds against it, and that is a licence in the full sense. Many providers hold both, because a gateway that also offers wallets or holds merchant balances needs both. The distinction, and the other authorizations that catch foreign businesses such as remittance and foreign exchange, is laid out in the licensing requirements guide linked at the top of this article, so I will not repeat it.
Three other pieces of the central bank layer deserve a mention because they affect foreign businesses indirectly. The digital bank framework introduced in 2020 created a separate licence category; the central bank has kept the number of such licences small and has periodically opened and closed the window for new applicants, so anyone whose plan depends on becoming or partnering with a digital bank should check the current status of that window. The virtual asset service provider rules introduced in 2021 bring crypto exchange, custody and transfer activity under central bank supervision, and the window for new applicants has likewise been opened and closed over time. And the National Retail Payment System framework is what stands behind InstaPay, PESONet and the QR Ph national QR standard; a merchant never registers for QR Ph directly but obtains it through a participating acquirer, which is why "can we get QR Ph" is really "which licensed acquirer or gateway will onboard us."
Two newer statutes change how disputes and fraud flow. The Financial Products and Services Consumer Protection Act of 2022 gave the central bank, the SEC, the Insurance Commission and the Cooperative Development Authority explicit consumer protection powers over the entities each supervises, including complaint handling standards and the authority to order restitution. That cascades to merchants through gateway contracts: your provider's complaint procedure is now a regulatory requirement, and it will expect you to respond to escalations inside its timelines. The Anti-Financial Account Scamming Act of 2024 criminalised money-mule accounts and gave the central bank investigative authority over financial accounts, which in practice means accounts and transactions connected to suspected scams can be frozen faster, and a merchant whose customers are victims will see more holds and more information requests.
One item is still moving as I write. In 2026 the central bank circulated for comment a draft that would pause the acceptance of new operator of payment systems registrations for a period. We reported on it when it appeared, and you should check whether it has been adopted and in what final form. If it is adopted, the practical effect for a foreign business that had planned to register itself is a longer and less predictable road, which pushes the partner route further ahead in any comparison.
SMARTPAY operates as a payment gateway in the Philippines under Bangko Sentral ng Pilipinas supervision, holding BSP OPS/EMI authorizations. For a foreign merchant that does not hold customer funds and does not operate its own rail, integrating through a supervised provider of this kind is what satisfies the central bank and anti-money-laundering layers of the map; the privacy, tax and consumer layers remain the merchant's own.
The Layers Outside the BSP That Bite Foreign Businesses
In my experience the central bank layer is the one foreign teams worry about most and get caught by least, because a competent gateway handles it. The layers that actually generate findings, penalties and awkward conversations with the board are the ones below.
The SEC and the shape of your local presence. If you decide to incorporate, the SEC is where it happens, and the Foreign Investments Act together with the Foreign Investment Negative List determines how much of the entity foreigners may own in a given activity. Ceilings apply in some sectors and not in others; retail trade has its own statute with its own conditions; the list is revised periodically. Do not assume the answer for software is the answer for a marketplace or a lending product. The SEC also issues the secondary licences for lending and financing companies and requires online lending platforms to be registered. If you offer instalments or buy-now-pay-later on your own balance sheet rather than through a licensed lender, you are lending, and the SEC has been active against unregistered lending apps. Holding an SEC registration as a corporation does not make you a regulated financial entity; that confusion is common enough that we wrote about it separately.
The AMLC and covered-person status. The Anti-Money Laundering Act lists the covered persons who must verify customers, keep records and file reports: banks, e-money issuers, remittance and transfer companies, virtual asset service providers, lending and financing companies, securities dealers and several others. A foreign merchant that merely accepts payments is not a covered person. Its obligations arrive indirectly: the gateway must perform due diligence on the merchant, must know the payer to the tier the wallet rules require, must retain records for a multi-year period and must report covered and suspicious transactions. Expect the provider to ask for beneficial ownership, licences, website and product evidence, and to ask again when any of them change. Reporting thresholds exist and are revised, so never hard-code them in your own monitoring.
The NPC and the Data Privacy Act. This is the law most likely to apply to you on day one with no local entity, because it reaches any entity that processes the personal data of Philippine residents and has links to the country, which a checkout page aimed at Filipinos plainly has. The practical obligations are a privacy notice and a lawful basis for each processing purpose, a designated data protection officer, registration of data processing systems where the commission's criteria apply, a breach notification process that runs to both the commission and the affected individuals within the short window the commission prescribes, and processor agreements with every vendor that touches the data, including your gateway. Cross-border transfer is permitted, but you remain accountable for what the recipient does. Keep the consent reference and the privacy notice version alongside each transaction; it is the cheapest evidence trail you will ever build.
The BIR and the three taxes that reach foreigners. The value-added tax on digital services law enacted in 2024 requires nonresident digital service providers that sell to Philippine consumers to register and account for the tax, with a simplified registration route and different mechanics for business customers. The withholding rules for online platforms make a marketplace a withholding agent for its sellers above a threshold that the bureau sets and revises. And the electronic invoicing and receipting programme, together with the Ease of Paying Taxes Act, changes what a valid invoice looks like and who must issue one electronically. If you have a local entity, all of this plus ordinary registration applies. The record-keeping side, and how to reconcile payment records to what the bureau expects, is covered in payment records and tax reporting for Philippine e-commerce merchants.
The DTI and the Internet Transactions Act. The 2023 e-commerce law created an E-Commerce Bureau and imposed duties on online merchants, e-marketplaces and digital platforms that transact with Philippine consumers, including foreign ones with sufficient contacts with the country. Merchants must disclose who they are, their terms, prices and return policies; platforms must keep records of their sellers, act on complaints and takedown requests and maintain an online business database entry. The Consumer Act sits underneath and governs warranties, refunds and misleading claims. None of this requires a permit, which is exactly why foreign teams miss it until a complaint arrives.
Mapping Your Business Model to the Agencies
The map becomes useful when you lay your own business model across it. The decisive question is in the third column: what you must hold or do yourself, as distinct from what a licensed provider satisfies on your behalf. The fork that matters most is whether you ever hold other people's money. If you do, you are in e-money or escrow territory and need either your own licence or a structure in which a licensed partner holds the funds. If you do not, the central bank layer is almost entirely a matter of choosing and contracting with the right provider.
| Business model | Agencies that touch you | What you must hold or do yourself | What a licensed provider can satisfy for you |
|---|---|---|---|
| Foreign e-commerce seller with no local entity | BIR (digital services VAT if the goods are digital; customs on physical imports), DTI under the Internet Transactions Act, NPC; BSP only through the partner | Nonresident tax registration where the digital services rules apply; privacy programme; identity and terms disclosure | Collection through local wallets and QR Ph, payer verification, anti-money-laundering reporting, settlement of proceeds to your home account |
| SaaS subscription business | BIR (digital services VAT), NPC, DTI; BSP through the partner for recurring debits | Nonresident tax registration if caught; consent records for stored payment credentials; privacy programme | Recurring payment methods, mandate and token storage, failed-payment handling, settlement |
| Online game publisher (no wagering) | DTI, NPC, BIR; BSP through the partner; PAGCOR only if real-money wagering appears in the product | Consumer and content rules, age gating, tax on digital goods | Top-ups through wallets, payouts to creators, fraud controls on the collection side |
| Marketplace with seller payouts | BSP (holding and moving money for others), AMLC, BIR (withholding on sellers), DTI (platform duties), NPC | Decide whether you hold funds; platform registration and record keeping under the e-commerce law; withholding on sellers | Collection, split and payout through a supervised gateway so that you never hold customer money yourself |
| Lending or buy-now-pay-later on your own book | SEC (lending or financing licence and online platform registration), AMLC, NPC, BIR; BSP if a bank or e-money partner funds or collects | Your own SEC secondary licence and platform registration; disclosure and collection-conduct rules | Disbursement rails and repayment collection, not the lending authorization itself |
| Crypto or stablecoin services | BSP (virtual asset service provider rules), AMLC, SEC if the tokens are securities, NPC, BIR | Your own virtual asset authorization or a partnership with a licensed provider; travel-rule compliance | Fiat on-ramps and off-ramps through a licensed e-money issuer |
| Remittance into or out of the Philippines | BSP (remittance and transfer company rules, e-money, foreign exchange regulations), AMLC, NPC | Your own registration as a remittance company, or a partnership in which the licensed party faces the regulator | Payouts to wallets and bank accounts, currency conversion, reporting |
Two of these rows deserve a warning. The marketplace row is where foreign businesses most often drift into regulated territory without noticing: collecting from buyers and paying sellers later, from a pooled balance you control, is holding other people's money. The clean structure is one where the supervised gateway collects, splits and pays out and your platform never holds the funds. The lending row is where foreign businesses most often assume a payments partner has solved a problem it cannot solve; no gateway can lend you its SEC licence. For the entity, settlement and repatriation side of these models, read payment gateway integration for global merchants, and for the direction-of-funds rules that apply when proceeds leave the country, read cross-border payment compliance for exporters.
How the Layers Show Up Inside an Integration
Regulatory layers are abstract until you see where they land in a request. In our integration, four groups of fields carry the obligations. The payer verification tier is the wallet's statement of how well the payer is known, which the central bank and anti-money-laundering rules define and which determines what a payer may do; we read it and never try to infer it. The merchant category and product descriptor is what the provider uses for onboarding, monitoring and rail eligibility; it must match what we told the provider at onboarding, and a drift between the two is the fastest way to get a merchant account reviewed. The consent reference and privacy notice version are our evidence under the Data Privacy Act. The invoice reference and tax treatment flag are what let finance reconcile gateway settlement to the tax position. Where card payments are involved, the card-data obligations are a separate layer again, covered in PCI DSS compliance for Philippine payment businesses.
Before any of that, we keep an obligation register that is generated rather than remembered. It is a planning aid, not legal advice, and every line in it points to an issuance that someone re-reads each quarter. The version below is simplified but structurally identical to ours.
// obligations.js — illustrative obligation register for a foreign business selling into the Philippines.
// A planning aid only: confirm every line against the current issuance of the agency named.
const REGISTER = [
{ agency: 'BSP', obligation: 'Integrate through an OPS-registered or EMI-licensed provider for collection and payout',
when: (p) => p.activities.includes('collect') || p.activities.includes('payout') },
{ agency: 'BSP', obligation: 'Own operator registration or e-money licence (you run the rail or hold stored value)',
when: (p) => p.holdsCustomerFunds || p.activities.includes('operate_rail') },
{ agency: 'BSP', obligation: 'Virtual asset service provider authorization, or a licensed VASP partner',
when: (p) => p.activities.includes('crypto') },
{ agency: 'SEC', obligation: 'Corporate registration and foreign ownership check against the negative list',
when: (p) => p.localEntity },
{ agency: 'SEC', obligation: 'Lending or financing company licence and online lending platform registration',
when: (p) => p.activities.includes('lend') },
{ agency: 'AMLC', obligation: 'KYC, record keeping and transaction reporting as a covered person',
when: (p) => p.holdsCustomerFunds || ['lend', 'crypto', 'remit'].some((a) => p.activities.includes(a)) },
{ agency: 'NPC', obligation: 'Privacy notice, lawful basis, data protection officer, breach playbook, processor agreements',
when: (p) => p.dataCategories.length > 0 },
{ agency: 'NPC', obligation: 'Registration of data processing systems where the commission criteria apply',
when: (p) => p.dataCategories.includes('sensitive') || p.localEntity },
{ agency: 'BIR', obligation: 'Nonresident digital service provider VAT registration and remittance',
when: (p) => !p.localEntity && p.activities.includes('digital_services') },
{ agency: 'BIR', obligation: 'Local tax registration, invoicing and electronic invoicing readiness',
when: (p) => p.localEntity },
{ agency: 'BIR', obligation: 'Withholding on platform sellers',
when: (p) => p.activities.includes('marketplace') },
{ agency: 'DTI', obligation: 'Internet Transactions Act duties for online merchants and platforms',
when: (p) => p.activities.includes('sell_online') || p.activities.includes('marketplace') },
{ agency: 'PAGCOR', obligation: 'Gaming licence or accreditation before any payment partner will onboard you',
when: (p) => p.activities.includes('wagering') }
];
function applicable(profile) {
return REGISTER
.filter((rule) => rule.when(profile))
.map((rule) => rule.agency + ': ' + rule.obligation);
}
// Example: a foreign SaaS company with no local entity that collects through a licensed gateway.
const profile = {
localEntity: false,
holdsCustomerFunds: false,
activities: ['sell_online', 'digital_services', 'collect'],
dataCategories: ['contact', 'transaction']
};
console.log(applicable(profile).join('\n'));
// Expected output: one BSP line (partner route), two NPC lines, one BIR line, one DTI line.
// Flip holdsCustomerFunds to true and the register immediately adds an own-licence line and AMLC obligations.The register has a second use: it tells engineering which fields the integration must carry. Each obligation that applies maps to a field in the collection request, and the request becomes the place where the evidence trail is written. This is what a collection order looks like against a supervised gateway when the compliance metadata travels with it. Keys and amounts are placeholders.
curl -X POST https://apix.example.com/api/v1/collections \
-H "Content-Type: application/json" \
-H "X-Merchant-Id: YOUR_MERCHANT_ID" \
-H "X-Signature: HMAC_SHA256_OF_REQUEST_BODY" \
-d '{
"merchant_reference": "INV-2026-000123",
"amount": "100.00",
"currency": "PHP",
"channel": "qrph",
"description": "Team plan, monthly subscription",
"merchant_category": "digital_subscription",
"payer": {
"minimum_kyc_tier": "verified",
"country_of_residence": "PH"
},
"compliance": {
"consent_reference": "consent_7f3a9c",
"privacy_notice_version": "2026-03",
"invoice_reference": "EIS-INV-000123",
"tax_treatment": "nonresident_digital_service",
"data_residency": "transfer_with_accountability"
},
"callback_url": "https://merchant.example.com/webhooks/payments"
}'
# The gateway echoes the payer tier actually observed in the webhook; store it, never infer it.
# If merchant_category drifts from what the provider onboarded, expect the order to be held for review.None of those compliance fields change how the money moves. They change what you can prove afterwards: that the payer was verified to the tier the rules required, that consent existed at the moment of collection under a specific notice version, that the invoice the tax authority will look for is tied to the settlement line, and that the category the provider monitors against is the category you are actually selling in. Fraud and dispute handling sit on top of this trail; our fraud detection rules framework assumes it exists.
Keeping Up With Change Without a Manila Law Firm on Retainer
The statutes in the map change slowly. The issuances beneath them do not. The central bank publishes circulars and memoranda to its supervised institutions; the SEC publishes memorandum circulars; the National Privacy Commission publishes circulars and advisories; the Bureau of Internal Revenue publishes revenue regulations and revenue memorandum circulars; the trade department publishes administrative orders under the e-commerce law. Each has a public page, and each page is worth a bookmark.
We run a quarterly routine that takes one afternoon. Someone re-reads the obligation register against each agency's recent issuances and notes anything that changes a line. We ask our gateway for its own change log: new verification tiers, new fields it requires, changes to the QR Ph specification, changes to its complaint procedure under the consumer protection law, and the status of its own registrations and licences. We check the current state of any window that was open or closed last quarter, which in 2026 means the draft on operator registrations, the digital bank window and the virtual asset window. We re-run the obligation script with any changes to our own profile, because launching a new product line is the most common way a business quietly crosses into a new row of the model table. And we verify, not just ask, that the provider's authorizations are still current; the method for doing that against the central bank's own lists is set out in the licensing guide linked earlier.
A provider holding BSP OPS/EMI authorizations is itself subject to examination, reporting and consumer protection obligations, which is why the practical test of a good partner is not the logo on its website but whether it will put in writing which layers of the map it satisfies for you, which it does not, and how it will notify you when the rules beneath either change.
Frequently Asked Questions
Do I need a central bank licence to accept GCash, Maya or QR Ph payments from abroad?
Not if you only accept payments and never hold customer funds or operate a rail. You integrate through a provider that is registered as an operator of payment systems or licensed as an e-money issuer, and that provider faces the central bank and the anti-money-laundering authority. You still owe the privacy, tax and consumer obligations yourself. If you hold funds for others, or if you build the switching or processing layer yourself, your own registration or licence becomes necessary.
Does the Data Privacy Act apply to us if we have no office in the Philippines?
Almost certainly yes. The law reaches entities with links to the Philippines that process the personal data of its residents, and a checkout aimed at Filipino customers is such a link. Appoint a data protection officer, publish a privacy notice, keep consent evidence, build a breach process and sign processor terms with every vendor including your gateway. Treat registration of your data processing systems as a question to check against the commission's current criteria rather than as something to assume away.
We sell software subscriptions from abroad. Do we owe Philippine value-added tax?
The digital services law enacted in 2024 brings nonresident providers of digital services to Philippine consumers into the value-added tax net, with a registration route designed for foreigners and different mechanics where the customer is a registered business. Whether and how it applies depends on what you sell and to whom; check the bureau's current regulations and, if in doubt, register. The gateway's settlement report is the record you will reconcile against, so make sure your invoice reference travels with each order.
Our marketplace pays Filipino sellers. Does that make us a payment system operator or an e-money issuer?
It depends on whether the money passes through a balance you control. If buyers pay you and you pay sellers later from a pooled account, you are holding other people's money and have walked into regulated territory. If a supervised gateway collects, splits and pays out and your platform never holds the funds, the central bank layer is satisfied by the partner. The trade department's platform duties and the tax withholding rules for platform sellers apply either way.
Is SEC registration the same as being regulated as a fintech?
No. SEC registration as a corporation makes you a legal person; it says nothing about your authority to handle payments, hold money or lend. Those come from the central bank or from an SEC secondary licence respectively. A provider that cites only its corporate registration as evidence of being "regulated" is telling you it holds no financial authorization at all.
Can a foreign company own a Philippine fintech outright?
Sometimes. The Foreign Investments Act and the Foreign Investment Negative List set ceilings for certain activities and leave others open, retail trade has its own conditions, and the list is revised. The answer for a software business can differ from the answer for a marketplace, a lender or a remittance company. Get the activity classification right before you choose a corporate structure, because changing it afterwards is expensive.
How do I verify that a provider really holds the authorizations it claims?
Check the central bank's published lists of registered operators of payment systems and licensed e-money issuers, match the exact legal entity name on the list to the entity on your contract, and ask the provider to confirm in writing which layers of the map its authorizations cover. A marketing name that does not match a listed entity, or a reluctance to name the licensed entity, is the clearest warning sign there is.
What has changed recently that a foreign business is most likely to miss?
Four things. The value-added tax on digital services now reaches nonresident sellers. The Internet Transactions Act imposes conduct and record duties on online merchants and platforms with Philippine consumers. The Anti-Financial Account Scamming Act has made freezes and information requests faster and more frequent. And the central bank's 2026 draft on pausing new operator registrations, if adopted, lengthens the road for anyone planning to register themselves. All four reward the same habit: re-read the register every quarter.
Where to Go From Here
Draw your own version of the second table before you talk to anyone. List the activities you actually perform, answer honestly whether you ever hold other people's money, and mark for each agency whether you need a licence, a registration or simply compliance. Then separate what you must do yourself from what a supervised provider can satisfy, and have that provider confirm its side in writing. Most foreign businesses discover that the central bank layer is the easiest to close and the privacy, tax and consumer layers are the ones that need an owner inside the company. If you are integrating Philippine payments from abroad and want to walk through which rows of the map your model falls into, reach out on Telegram at @LouisSMARTPAY or by email at [email protected].