BSP plans pause on new payment system operators

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) wants to suspend for a year the registration of new payment system operators as part of tighter safeguards to make merchant payments traceable and curb fraud and illicit transactions.

Under a draft circular, the central bank will suspend the acceptance and processing of applications for operators of payment systems. OPS are entities that operate arrangements enabling payments and fund transfers.

“The suspension is being imposed to facilitate the BSP’s holistic review of the OPS taxonomy and licensing framework, including the attendant risk management and regulatory considerations,” the BSP said.

Applications received before the suspension will continue to be evaluated, but none can be approved or denied until the suspension is lifted. The proposed pause will run for 12 months from the circular’s effectivity.

During that period, entities cannot begin activities that require registration unless otherwise authorized by the BSP under existing regulations.

The draft also proposes a centralized database of merchants accepting quick response (QR) code payments and stricter controls over payment arrangements involving intermediaries between financial institutions and sellers.

A central requirement would be for BSP-supervised institutions (BSIs) to identify the actual merchant behind a payment and the person or entity ultimately entitled to receive its proceeds.

“A BSI authorized to engage in merchant acquisition shall not process or continue to process a transaction, where the merchant cannot be identified or where the transaction cannot be attributed and reconciled to the same merchant,” the BSP said.

Merchant acquisition refers to accepting and processing payments on behalf of sellers and transferring the proceeds to them. The proposal would generally require this service to be conducted through a direct relationship between the authorized institution and the merchant.

Certain businesses could be accepted only through direct arrangements and would face more extensive background checks, closer monitoring and transaction and settlement limits proportional to their risks. Settlement refers to the transfer of payment proceeds to the merchant.

These businesses include casinos and other gambling operators, gaming-related providers directly handling player funds or gaming proceeds, lawful adult-oriented businesses, regulated virtual asset service providers and money service businesses such as remittance companies and money changers.

Institutions would be prohibited from maintaining merchant relationships involving illegal activities or regulated businesses operating without the required authorization.

For other merchants, arrangements involving intermediaries would remain possible if institutions could identify the parties involved, trace funds and exercise effective oversight.

Under the proposal, payments for multiple merchants could pass through a shared account, platform or QR-enabled channel only if each transaction could be linked to a unique merchant identifier and separately monitored, investigated and reconciled.

Missing, inaccurate or inaccessible merchant information would require institutions to reject or suspend the affected transaction or merchant, except for temporary technical problems covered by documented safeguards approved under their incident management framework.

Intermediaries would also be barred from delegating or subcontracting merchant acquisition to another party, including by adding another intermediary tier. Ancillary support services could still be outsourced under applicable BSP rules.

High-risk layered arrangements would require approval by the institution’s board or equivalent body, management or compliance reviews at least quarterly and independent assurance at least annually.

National QR Code Merchant Database

Separately, the proposed National QR Code Merchant Database would consolidate information on businesses accepting payments through the national QR code standard.

Its records would include merchant identities, business registration and licensing details, payment providers, settlement accounts, owners and risk classifications. It would also indicate whether a merchant is active, restricted, suspended or terminated.

Changes in a merchant’s status would be communicated to other payment service providers maintaining relationships with the same business, prompting their own reviews and appropriate safeguards.

An interim secure merchant information repository would have to be established within 90 calendar days of effectivity. The full database would need to be operational within 12 months, with all active merchant records migrated and validated within 15 months.

The draft would also require material fraud or scam incidents, sanctions breaches, cybersecurity or data access breaches, unlicensed activity and illegal merchant activity to be reported within 24 hours of detection.

A complete incident report would be due within five business days. If an investigation could not reasonably be completed within that period, an interim report would be required, with the full report submitted within a period approved by the supervising department.

These reports would be separate from obligations to report suspicious transactions under applicable Anti-Money Laundering Council rules.

For existing layered arrangements, institutions would have six months from effectivity to review merchant relationships and another six months from completion of the review to address deficiencies.

Relationships remaining noncompliant after 12 months would be subject to enforcement action.