VASP License Philippines Requirements: How to Get a BSP Certificate of Authority

A Virtual Asset Service Provider (VASP) in the Philippines must secure a Certificate of Authority (COA) from the Bangko Sentral ng Pilipinas (BSP) to operate as a money service business (MSB). The application is filed through the appropriate supervising department of the BSP, following the registration procedures in Appendix N-7 and submitting the Application for Registration and notarized Deeds of Undertaking in Appendices N-8 and N-9. Applicants must also meet the minimum paid-in capital requirement and pass the BSP's evaluation of fitness and propriety of beneficial owners.

Who needs a VASP license in the Philippines

Under BSP Circular No. 1108, a VASP is any entity that offers services or engages in activities providing a facility for the transfer or exchange of virtual assets (VA), involving one or more of the following:

• Exchange between VAs and fiat currencies
• Exchange between one or more forms of VAs
• Transfer of VAs
• Safekeeping and/or administration of VAs or instruments enabling control over VAs

A VASP performing the fourth activity is a VA Custodian. Virtual Currency Exchanges previously defined under BSP Circular No. 944 are now referred to as VASPs.

The guidelines cover VASPs offering services or engaging in VASP activities in the Philippines. They do not cover businesses involved in the participation and provision of financial services related to an issuer's offer or sale of a VA, which falls within the jurisdiction of the Securities and Exchange Commission, nor entities acting solely on their own behalf.

The licensing path: COA as a money service business

The BSP treats VASPs as money service businesses subject to its regulatory authority and examination powers. Under Circular 1108, a VASP secures a COA to operate as an MSB, pursuant to and upon compliance with the requirements of the MORNBFI provision on money service business operations.

In the course of the COA application, the BSP takes into account and extends its evaluation over the fitness and propriety of the VASP's beneficial owners. The applicant must also adhere to the registration procedures under Appendix N-7 and submit the Application for Registration and notarized Deeds of Undertaking (Appendices N-8 and N-9) through the appropriate supervising department.

A VASP must pay the registration and annual service fees provided under the same MORNBFI provision on money service businesses.

Minimum capital requirements

Circular 1108 sets two capital tiers:

• VASP with safekeeping and/or administration services for VAs (VA Custodian): P50.0 million minimum paid-in capital
• VASP without safekeeping and/or administration services for VAs: P10.0 million minimum paid-in capital

Ongoing compliance obligations

Securing the COA is only the first step. A VASP must comply with pertinent BSP rules on outsourcing, liquidity risk management, operational risk management, IT risk management including IT outsourcing and vendor management, business continuity management, internal control, anti-money laundering, financial consumer protection, and sound corporate governance.

Key operational duties include:

• Wallet security. VASPs providing wallet services must establish an adequate cybersecurity framework and adopt security measures to protect data and infrastructure from malware, cyber-attacks, and emerging threats.
• Customer due diligence. This is required when establishing business relations, undertaking occasional but relevant transactions, where money laundering or terrorist financing is suspected, or where there is doubt about previously obtained customer identification data. A relevant business transaction means any single transaction of P5,000 or more, or two or more linked transactions aggregating P5,000 or more.
• Dealing only with regulated entities. A VASP may engage only with other VASPs, financial institutions, and remittance and transfer companies duly authorized and licensed by the appropriate regulators. Clearing and settlement must be undertaken only with regulated VASPs and platforms.
• Transaction rules. VA transfers are treated as cross-border wire transfers. For transfers of P50,000 or more, originator and beneficiary information must be obtained, held, and transmitted. Large value pay-outs of more than P500,000 require enhanced due diligence and must be made via check, direct credit to deposit accounts, or electronic fund transfer.
• Recordkeeping. Transaction and due diligence records must be maintained for at least five (5) years.

Reporting requirements

A VASP must submit to the appropriate supervising department:

• Audited financial statements, annually, not later than 120 calendar days after the close of the fiscal year
• Quarterly Report on Total Volume and Value of VCs transacted, within ten (10) business days from the end of the reference quarter
• List of operating offices and websites, quarterly, within the same ten-day period

Reports marked for certification must be duly certified by the proprietor, managing partner, president, or an officer of equivalent rank.

Penalties for operating without authority

Appropriate monetary penalties, sanctions, and enforcement actions under the MORNBFI provision on money service businesses may be imposed on a VASP, its directors, and officers for violations. Under the National Payment Systems Act (Republic Act No. 11127), the Monetary Board may impose fines of up to P1,000,000 for each transactional violation or P100,000 per day for each continuing violation, and the Monetary Board may suspend, disqualify, or remove directors or officers for willful violations.

Frequently asked questions

Do I need a VASP license to operate a crypto exchange in the Philippines? Yes. Any entity offering VA exchange, transfer, or custody services in the Philippines must secure a COA from the BSP as a money service business under Circular 1108.

How much capital does a VASP need in the Philippines? A VASP without safekeeping or administration services needs P10.0 million minimum paid-in capital. A VA Custodian needs P50.0 million.

What happens if a VASP operates without BSP approval? The Monetary Board may impose fines, and the entity may face enforcement action. Under RA 11127, fines can reach P1,000,000 per transactional violation or P100,000 per day for continuing violations.

Practical takeaways

• A VASP must secure a BSP Certificate of Authority as an MSB, filed through the appropriate supervising department with Appendices N-7, N-8, and N-9.
• Minimum paid-in capital is P10.0 million, or P50.0 million for VA Custodians.
• The BSP evaluates the fitness and propriety of beneficial owners during the COA application.
• Ongoing compliance covers cybersecurity, customer due diligence, dealing only with regulated entities, wire transfer rules, and five-year record retention.
• Quarterly and annual reports must be filed on the timelines set in Circular 1108.

Primary sources

The rules discussed above are drawn from the following primary sources. Where the firm's library holds the document as a PDF it is embedded here in full; the rest are cited by title.

Guidelines for Virtual Asset Service Providers (VASP)Open in Law LibraryDownload PDF

• REPUBLIC ACT NO. 11127 - AN ACT PROVIDING FOR THE REGULATION AND SUPERVISION OF PAYMENT SYSTEMS

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.