BSP Circular 1108 VASP Guidelines: Licensing, Capital, and Compliance Rules

BSP Circular No. 1108, Series of 2021, issued by the Bangko Sentral ng Pilipinas, replaced the old rules on Virtual Currency Exchanges with the current guidelines for Virtual Asset Service Providers (VASPs). It amended in its entirety Section 902-N of the Manual of Regulations for Non-Bank Financial Institutions (MORNBFI). Under the Circular, a VASP is any entity that facilitates the transfer or exchange of virtual assets through activities such as exchanging virtual assets for fiat currency, exchanging one form of virtual asset for another, transferring virtual assets, or safekeeping and administering virtual assets. VASPs are treated as money service businesses and must secure a Certificate of Authority to operate.

Who and what the VASP guidelines cover

The Circular applies to VASPs offering services or engaging in VASP activities in the Philippines. It does not cover businesses involved in financial services related to an issuer's offer or sale of a virtual asset, which fall under the jurisdiction of the Securities and Exchange Commission, nor entities acting solely on their own behalf rather than actively facilitating virtual asset activities for the account of others.

The rules are based on leading standards such as the Financial Action Task Force Recommendations on anti-money laundering and counter-terrorist financing, and serve as the Bangko Sentral's baseline requirement for all VASPs.

What counts as a virtual asset

A virtual asset is any type of digital unit that can be digitally traded or transferred and used for payment or investment purposes. It may be treated as property, proceeds, funds, or other corresponding value, and is used as a medium of exchange or a form of digitally stored value created by agreement within the community of virtual asset users. Virtual assets are not issued or guaranteed by any jurisdiction and do not have legal tender status.

Digital units used only to pay for goods and services provided by their issuer or a limited set of merchants specified by the issuer, such as gift checks, are not considered virtual assets. Neither are units used to pay for virtual goods and services within an online game, such as gaming tokens. Virtual currencies as previously defined under Bangko Sentral Circular No. 944 are now referred to as virtual assets, and Virtual Currency Exchanges under that Circular are now referred to as VASPs.

Licensing: the Certificate of Authority

A VASP must secure a Certificate of Authority to operate as a money service business, following the requirements under Section 901-N. In evaluating the application, the Bangko Sentral also assesses the fitness and propriety of the VASP's beneficial owners.

Applicants must follow the registration procedures under Appendix N-7 and submit the Application for Registration and notarized Deeds of Undertaking under Appendices N-8 and N-9 to the Bangko Sentral through the appropriate supervising department. A VASP must also pay the registration and annual service fees provided under Section 901-N.

Capitalization and key compliance areas

Minimum paid-in capital depends on the services offered. A VASP with safekeeping and/or administration services for virtual assets, meaning a VA Custodian, must have at least P50.0 million. A VASP without such services must have at least P10.0 million.

VASPs must also comply with Bangko Sentral rules on outsourcing under Section 702-N, liquidity risk management under Section 724-N, operational risk management under Section 725-N, IT risk management including IT outsourcing and vendor management under Section 726-N, business continuity management under Section 727-N, internal control under Section 737-N, anti-money laundering under Sections 607-N and 502-N, and financial consumer protection under Sections 707-N, 702-N and 703-N, among others.

Wallet security, consumer protection, and due diligence

VASPs providing wallet services must establish an adequate cybersecurity framework and adopt security measures to protect the confidentiality, integrity, and availability of data, and to protect infrastructure from malware, cyber-attacks, and other threats. The framework must also cover protection of fiat currency, if any, and virtual asset wallets.

On consumer protection, VASPs must educate customers on safeguarding wallets and login credentials, using the mobile platform and wallets, actual fees and charges, and problem resolution procedures. They must clearly communicate how losses and liabilities from security breaches, system failure, or human error will be settled, and must disclose material risks before the initial transaction and on an ongoing basis, including whether the VASP holds the virtual assets in custody.

Customer due diligence is required when a VASP establishes business relations, undertakes an occasional but relevant transaction for a customer without an existing business relationship, suspects money laundering or terrorist financing, or doubts the veracity of previously obtained identification data. A relevant business transaction means a single transaction of P5,000 or more, or two or more linked transactions with an aggregate value of P5,000 or more.

Transactional and reporting requirements

VASPs and other covered institutions that engage in or facilitate virtual asset transfers must treat all such transfers as cross-border wire transfers and comply with the pertinent wire transfer rules in the Manual. For transfers amounting to P50,000.00 or more, or its equivalent in foreign currency, the originating institution must obtain and hold accurate originator and beneficiary information and transmit it to the beneficiary institution.

For large value pay-outs of more than P500,000, or its equivalent in foreign currency, in any single transaction, enhanced due diligence must be conducted, and pay-outs may only be made by check, direct credit to deposit accounts, or account-to-account transfer using electronic fund transfer facilities.

VASPs must maintain transaction and due diligence records for at least five years and submit reports to the appropriate supervising department, including audited financial statements annually, a quarterly report on total volume and value of virtual currency transacted, and a quarterly list of operating offices and websites.

Transitory period

Bangko Sentral-registered Virtual Currency Exchanges, as well as VASPs operating without Bangko Sentral approval, were required to apply for a Certificate of Authority not later than three months from the effectivity of the Circular. Upon submission of the application, these entities may continue to operate unless instructed otherwise. All VASPs must comply with the requirements within six months from effectivity. The Circular takes effect fifteen calendar days following publication in the Official Gazette or any newspaper of general circulation.

Frequently asked questions

Is a VASP license the same as a BSP Certificate of Authority? Yes. Under Circular No. 1108, a VASP must secure a Certificate of Authority to operate as a money service business, following the requirements under Section 901-N.

How much capital does a VASP need in the Philippines? A VASP with safekeeping and/or administration services for virtual assets needs at least P50.0 million in paid-in capital. A VASP without those services needs at least P10.0 million.

When is customer due diligence required for virtual asset transactions? It is required when establishing business relations, for occasional but relevant transactions of P5,000 or more, when money laundering or terrorist financing is suspected, or when there is doubt about previously obtained customer identification data.

Practical takeaways

• A VASP must obtain a Certificate of Authority and comply with Section 901-N, Appendix N-7, and the Deeds of Undertaking in Appendices N-8 and N-9.
• Minimum paid-in capital is P50.0 million for VA Custodians and P10.0 million for VASPs without safekeeping or administration services.
• Virtual asset transfers are treated as cross-border wire transfers, with originator and beneficiary information required for transfers of P50,000.00 or more.
• Records must be kept for at least five years, with annual and quarterly reporting to the Bangko Sentral.
• Consumer protection, cybersecurity, and clear risk disclosure are mandatory parts of VASP operations.

Primary sources

The rules discussed above are drawn from the following issuances, embedded here in full for your reference.

Guidelines for Virtual Asset Service Providers (VASP)Open in Law LibraryDownload PDF

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.