BSP Moves to Tighten Rules on Layered Payment Arrangements

Recently, the Bangko Sentral ng Pilipinas (BSP) proposed tighter controls on merchant payments, including a 12-month suspension of the acceptance and processing of new applications to register as Operators of Payment Systems (OPS). The goal is to make payment activity more traceable and strengthen safeguards against fraud and illicit transactions.

The principle behind the draft is simple: financial institutions and payment providers should be able to identify the merchant behind a transaction and establish who is ultimately entitled to the proceeds.

For casinos, gambling operators and certain other high-risk businesses, the draft would require direct merchant arrangements with the BSP-supervised institution handling the payment. These businesses would also face enhanced due diligence, closer monitoring and risk-based transaction and settlement limits.

Importantly, this is not a blanket ban on intermediaries across the Philippine payments system. For other merchants, intermediaries could still be used as long as the parties can be identified, funds can be traced and the regulated institution maintains effective oversight. What the BSP wants gone are the layers that hide the actual merchant.

The proposal comes amid reports that more than 8,000 merchant accounts have been shut down following investigations into suspected payments for illegal online gambling. The issue is not simply that money passes through an intermediary. It is whether the payment chain gives enough visibility to establish who the merchant actually is, who is entitled to the proceeds and how the funds moved through the system.

Under the proposed rules, a BSP-supervised institution authorised to conduct merchant acquisition would not be permitted to process, or continue processing, a transaction where the merchant cannot be identified, or where the transaction cannot be attributed and reconciled to that merchant. Intermediaries would also be barred from delegating merchant acquisition to another intermediary, which limits the creation of additional layers.

The proposal also introduces a National QR Code Merchant Database, a centralised repository for businesses accepting payments through the National QR Code Standard. The database would hold merchant identities, registration and licensing information, payment providers, settlement accounts, ownership details and risk classifications. It would also record whether a merchant is active, restricted, suspended or terminated.

The draft calls for an interim secure merchant information repository within 90 calendar days of effectivity, followed by a fully operational database within 12 months. Active merchant records would then need to be migrated and validated within 15 months.

The proposed rules would also tighten incident reporting. Material fraud or scam incidents, sanctions breaches, cybersecurity or data-access breaches, unlicensed activity and illegal merchant activity would have to be reported to the BSP within 24 hours of detection. A complete report would generally follow within five business days, with allowances for cases where investigations cannot reasonably be completed in that time.

For existing layered merchant arrangements, institutions would have six months from the circular's effectivity to review relationships, followed by another six months to address any deficiencies.

The proposed 12-month pause on new OPS registrations is meant to give the BSP time to review its OPS taxonomy and licensing framework. Under the draft, applications received before the suspension would continue to be evaluated, but could not be approved or denied until the suspension is lifted.

The proposal builds on a separate BSP measure from last year. On August 14, 2025, the central bank instructed supervised financial institutions to remove links and other in-app access points leading to online gambling platforms from their payment apps and websites within 48 hours. That measure focused on access through financial apps rather than imposing a general ban on gambling payments.

GCash and Maya subsequently removed gambling links from their apps. The new proposal addresses a different part of the ecosystem: how merchants connect to payment infrastructure and how clearly those transactions can be traced.

PAGCOR has also been developing its regulatory framework for gaming-related B2B providers, adding another layer of oversight around businesses that support licensed gaming operations.

For payment providers, the proposed framework puts greater weight on merchant onboarding, ownership information, licensing, transaction monitoring and reconciliation.

For gambling operators and gaming-related businesses, the direct-arrangement requirement means reviewing how their payment relationships are structured and whether they comply. It also pays not to wait for the final circular. Banks and payment providers often start reviewing higher-risk merchants well before a rule takes effect, so operators that move early are likely to have more options than those that don't.

For aggregators and other intermediaries, the key question is whether their role still lets the regulated institution keep a clear view of the underlying merchant and the movement of funds. The draft does not eliminate intermediaries, but it places tighter controls on how they can be used.