Crypto Regulation in the Philippines: BSP Rules on Virtual Assets Explained

The Bangko Sentral ng Pilipinas (BSP) is the primary regulator of cryptocurrency and virtual assets in the Philippines. Under BSP regulations, businesses that facilitate the exchange or conversion of virtual assets to fiat currency must register as Virtual Asset Service Providers (VASPs) and comply with anti-money laundering obligations. The BSP exercises oversight through its authority over payment and settlement systems, treating virtual currency exchanges as reporting entities under Philippine law.

The BSP's Role in Regulating Virtual Assets

The BSP regulates virtual assets through its mandate over financial services and payment systems in the Philippines. While the BSP does not recognize cryptocurrencies as legal tender, it treats virtual assets as property or commodities that may be exchanged, transferred, or traded. The central bank's regulatory framework focuses on entities that provide virtual asset services, rather than on the technology itself.

Under BSP regulations, a Virtual Asset Service Provider (VASP) includes any entity that offers services such as:

• Exchanging virtual assets for fiat currency or other virtual assets
• Transferring virtual assets on behalf of customers
• Safekeeping or administering virtual assets
• Participating in financial services related to virtual asset offerings

The BSP requires VASPs to register with the central bank before operating in the Philippines. This registration process subjects virtual asset businesses to ongoing supervision, including reporting requirements and compliance examinations.

Licensing Requirements for Virtual Asset Service Providers

Businesses seeking to operate as VASPs in the Philippines must obtain a license from the BSP. The application process requires demonstrating compliance with several key areas:

• Corporate governance – adequate board oversight and management structure
• Risk management – policies addressing operational, cybersecurity, and compliance risks
• Anti-money laundering (AML) measures – customer due diligence, transaction monitoring, and record-keeping
• Technology risk management – safeguards for information systems and data protection

The BSP evaluates each application based on the applicant's fitness and propriety, financial capacity, and ability to comply with regulatory requirements. The central bank may impose conditions on the license, such as limits on transaction volumes or additional reporting obligations.

Anti-Money Laundering Compliance for Crypto Businesses

VASPs in the Philippines are classified as reporting entities under the Anti-Money Laundering Act (AMLA), as amended. This designation requires virtual asset businesses to implement comprehensive AML programs that include:

• Customer identification and verification (Know Your Customer or KYC procedures)
• Risk-based assessment of customers and transactions
• Reporting of covered and suspicious transactions to the Anti-Money Laundering Council (AMLC)
• Retention of transaction records for the period required by law
• Training of personnel on AML obligations

The AMLC has issued specific regulations addressing virtual assets, requiring VASPs to submit reports on transactions involving virtual assets. These requirements align the Philippines with international standards set by the Financial Action Task Force (FATF).

The Electronic Commerce Act and Digital Transactions

The Electronic Commerce Act (Republic Act No. 8792) provides the legal foundation for electronic transactions in the Philippines. This law ensures that electronic documents and electronic signatures have the same legal effect as their paper counterparts. For crypto businesses, this means:

• Electronic contracts for virtual asset transactions are valid and enforceable
• Electronic records may be used as evidence in legal proceedings
• Electronic signatures on digital documents carry legal weight

Under Section 6 of the Electronic Commerce Act, information shall not be denied validity or enforceability solely on the ground that it is in the form of an electronic data message. Section 7 extends this recognition to electronic documents, providing that they shall have the legal effect, validity, or enforceability as any other document or legal writing.

Cybercrime Considerations for Virtual Asset Businesses

The Cybercrime Prevention Act of 2012 (Republic Act No. 10175) imposes criminal liability for offenses committed through computer systems. Virtual asset businesses must be aware of these provisions because their operations are inherently digital.

Key offenses under the Cybercrime Prevention Act that may affect crypto businesses include:

• Illegal access – accessing a computer system without right
• Data interference – intentional alteration, damaging, deletion, or deterioration of computer data without right
• Computer-related fraud – unauthorized input, alteration, or deletion of computer data causing damage with fraudulent intent
• Computer-related identity theft – intentional acquisition or use of identifying information belonging to another without right

The implementing rules of the Cybercrime Prevention Act designate the National Bureau of Investigation (NBI) and the Philippine National Police (PNP) as the primary law enforcement authorities for cybercrime offenses. These agencies have the power to investigate cybercrimes, conduct forensic analysis, and preserve electronic evidence.

Frequently Asked Questions

Is cryptocurrency legal in the Philippines?

Yes, cryptocurrency is legal in the Philippines. The BSP regulates virtual asset service providers rather than prohibiting them. However, cryptocurrency is not recognized as legal tender, and businesses facilitating crypto transactions must register with the BSP.

Do I need a license to trade crypto in the Philippines?

Individuals trading cryptocurrency for personal investment purposes do not need a license. However, businesses that offer exchange, transfer, or safekeeping services for virtual assets must register as VASPs with the BSP and comply with AML regulations.

What happens if a crypto business operates without BSP registration?

Operating as a virtual asset service provider without BSP registration constitutes a violation of BSP regulations. The central bank may impose administrative penalties, and the business may be subject to enforcement actions, including cease-and-desist orders.

Practical Takeaways

• The BSP is the primary regulator of cryptocurrency businesses in the Philippines through its VASP registration framework.
• VASP registration is mandatory for businesses offering crypto exchange, transfer, or custody services.
• AML compliance is non-negotiable – VASPs must implement KYC procedures, transaction monitoring, and suspicious transaction reporting.
• The Electronic Commerce Act provides legal recognition for digital contracts and electronic signatures used in crypto transactions.
• Cybercrime laws apply to virtual asset operations – businesses should implement robust cybersecurity measures to prevent illegal access, data interference, and fraud.
• Before launching a crypto business in the Philippines, consult with legal counsel to ensure full compliance with BSP regulations and AMLA requirements.

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.