Vendor Due Diligence in the Philippines: A Practical Compliance Guide

Vendor due diligence in the Philippines is the process of verifying a third party's corporate existence, ownership, officers, and risk profile before entering into a contract. It matters because Philippine law imposes duties on companies that go beyond the contract itself: the Revised Corporation Code governs who may serve as directors and officers, the Anti-Money Laundering Act framework reaches financial intermediaries and payment system providers, and Republic Act No. 11930 requires reporting of online sexual abuse or exploitation of children, including materials distributed through internet intermediaries. A sound program combines corporate records verification, sanctions and blacklist screening, and contract controls.

What vendor due diligence covers in the Philippine setting

Vendor due diligence typically answers four questions: Is the vendor a real, existing entity? Who owns and controls it? Is it exposed to legal or regulatory risk? Does the contract allocate that risk properly?

The first question is answered by corporate records. Under the Revised Corporation Code of the Philippines (Republic Act No. 11232), a private corporation commences its corporate existence and juridical personality from the date the Securities and Exchange Commission (SEC) issues the certificate of incorporation. A corporation that does not formally organize and commence business within five (5) years from incorporation has its certificate deemed revoked. A corporation that commences business but becomes inoperative for at least five (5) consecutive years may be placed under delinquent status, and failure to resume operations within the period given by the SEC can lead to revocation of its certificate.

These provisions mean a vendor's SEC registration should not be treated as permanent. Verification should confirm current good standing, not merely that a certificate once existed.

Verifying the vendor's corporate identity and officers

The articles of incorporation must state the corporation's name, specific purpose or purposes, principal office, term, and the names, nationalities, and residence addresses of incorporators and initial directors or trustees. For stock corporations, the articles must also state the authorized capital stock, the number of shares, par value, and the original subscribers with amounts subscribed and paid.

Two practical checks follow. First, confirm that the vendor's stated business purpose covers the transaction being contemplated. Second, confirm the authority of the signatory. The board of directors or trustees exercises corporate powers, conducts all business, and controls all properties of the corporation. Immediately after election, the directors must elect a president, who must be a director; a treasurer, who must be a resident; and a secretary, who must be a citizen and resident of the Philippines.

Within thirty (30) days after the election of directors, trustees, and officers, the corporate secretary or another officer must submit to the SEC the names, nationalities, shareholdings, and residence addresses of those elected. A vendor that cannot produce a current report of election should be asked why.

Screening for disqualification and integrity risk

The Revised Corporation Code disqualifies a person from being a director, trustee, or officer of any corporation if, within five (5) years prior to election or appointment, the person was convicted by final judgment of an offense punishable by imprisonment exceeding six (6) years, of violating the Code, or of violating the Securities Regulation Code; found administratively liable for an offense involving fraudulent acts; or sanctioned by a foreign court or equivalent foreign regulatory authority for similar acts.

For higher-risk vendors, this disqualification list is a useful screening template. It should be paired with adverse media checks and, where relevant, screening against the registry of blacklisted aliens maintained under the implementing rules of Republic Act No. 11930. Under those rules, the National Coordination Center against OSAEC and CSAEM maintains an updated registry based on information from the Department of Foreign Affairs, the Bureau of Immigration, and the Department of Justice, covering convicted offenders of OSAEC, CSAEM, or equivalent crimes in other jurisdictions, and aliens monitored for conducting such activities.

Special rules for internet, payment, and content-related vendors

If the vendor provides infrastructure, platforms, access, hosting, transmission, or indexing of third-party content, it may fall within the definition of an internet intermediary under the IRR of Republic Act No. 11930. That definition expressly includes internet service providers, web hosting providers including domain name registrars, internet search engines and portals, e-commerce intermediaries, internet payment system providers, and participative network platform providers including social media intermediaries.

Two consequences follow for due diligence. First, payment system providers are defined to include banks, fiat or digital money service businesses including cryptocurrencies, credit card companies, and other financial institutions — so payment vendors sit inside a regulated perimeter. Second, internet intermediaries have data preservation obligations: subscriber or registration information and traffic data must be preserved within six (6) months from the date of transaction, and content data for one (1) year from receipt of an order from law enforcement authorities requiring preservation.

Vendors in this space should be asked directly about their preservation capabilities, their reporting channels, and their ability to act on lawful orders. Any person with direct knowledge of prohibited acts under the Act has a duty to report to designated bodies, including the barangay, local social welfare office, law enforcement, or member agencies of the national coordinating center.

Building the due diligence file

A defensible file typically contains: current SEC registration and good standing evidence; the articles of incorporation and bylaws; the latest report of election of directors, trustees, and officers; identification and authority documents for signatories; beneficial ownership information where required; screening results; and the executed contract with compliance representations.

Retention matters. Where a vendor is an internet intermediary, preservation periods run from the date of transaction or from receipt of a law enforcement order, and if preserved data is used as evidence, further preservation continues until final termination of the case. Contractual records retention should be aligned with these timelines rather than set arbitrarily.

Frequently asked questions

How do I verify if a company is registered in the Philippines? Check the certificate of incorporation issued by the Securities and Exchange Commission. Corporate existence and juridical personality begin on the date the SEC issues that certificate. Confirm the entity has not been deemed revoked for non-use or placed under delinquent status.

Who is allowed to sign contracts for a Philippine corporation? The board exercises corporate powers and controls corporate property. Day-to-day authority usually rests with the president, treasurer, and secretary elected by the board, subject to the bylaws and board resolutions. Obtain a secretary's certificate covering the signatory.

What is the five-year rule for Philippine corporations? A corporation that does not formally organize and commence business within five years from incorporation has its certificate of incorporation deemed revoked. A corporation that becomes inoperative for at least five consecutive years may be placed under delinquent status.

Practical takeaways

• Verify SEC registration and current good standing, not just the existence of a certificate.
• Confirm the vendor's stated purpose covers the transaction and that the signatory is authorized by the board.
• Screen directors and officers against the statutory disqualification grounds and applicable government blacklists.
• For internet, hosting, and payment vendors, confirm data preservation and reporting capabilities.
• Align records retention with statutory preservation periods and keep the due diligence file current.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• IRR of REPUBLIC ACT NO. 11930 - THE IMPLEMENTING RULES AND REGULATIONS OF REPUBLIC ACT NO. 11930, OR AN ACT PUNISHING ONLINE SEXUAL ABUSE OR EXPLOITATION OF CHILDREN, PENALIZING THE PRODUCTION, DISTRIBUTION, POSSESSION AND ACCESS OF CHILD SEXUAL ABUSE OR EXPLOITATION MATERIALS, AMENDING REPUBLIC ACT NO. 9160, OTHERWISE KNOWN AS THE "ANTI-MONEY LAUNDERING ACT OF 2001", AS AMENDED AND REPEALING REPUBLIC ACT NO. 9775, OTHERWISE KNOWN AS THE "ANTI-CHILD PORNOGRAPHY ACT OF 2009"

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.