Guidelines on the Re-registration of Virtual Currency Exchanges

OFFICE OF THE DEPUTY GOVERNOR FINANCIAL SUPERVISION SECTOR 013 MEMORANDUM No. M-2021-_____ To : ALL CONCERNED BSP-SUPERVISED FINANCIAL INSTITUTIONS (BSFIs) Subject : Guidelines on the Re-registration of Virtual Currency Exchanges All Virtual Currency Exchanges (VCEs), now referred to as Virtual Asset Service Providers (VASP), with existing Certificate of Registration (COR), shall observe the following re-registration guidelines. This is pursuant to Circular No. 1108 dated 26 January 2021 on the requirements for the issuance of Certificate of Authority (COA). A. Submission Procedures 1. A letter of intent (LOI) shall be submitted within three (3) months from the effectivity date of Circular No. 1108 or not later than 16 May 2021. 2. In addition to the LOI, subject BSFIs shall submit an accomplished gap assessment template attached herewith as Annex A. 3. Email submissions should be sent to [email protected] using the following prescribed format as subject: <Submission Date> _VASP<space>LOI_<Name of BSFI>, as illustrated below: To: [email protected] Subject: DDMMYYYY (e.g. 31012021)_VASP LOI_<Name of BSFI> B. Important Reminders 1. Entities involved in the conduct of one or more of the following activities: exchange between VAs and fiat currencies or one or more forms of VAs; transfer of VAs; and safekeeping and/or administration of VAs or instruments enabling control over VAs, fall within the definition of VASP as provided under Circular No. 1108 and are required to secure a COA from the BSP. 2. All BSFIs are reminded to engage only with duly authorized and licensed institutions. Following the Financial Action Task Force (FATF) guidance1, BSFIs are advised that, at a minimum, VASP should be licensed/registered in the country where they were created or in the jurisdiction where their business is located in cases where they are a natural person. Meanwhile, businesses 1 Guidance for A Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, June 2019 A. Mabini St., Malate 1004 Manila, Philippines • (632) 7087701 • www.bsp.gov.ph • [email protected]

engaged in initial coin offering (ICO) are within the regulatory purview of the Securities and Exchange Commission (SEC). 3. Queries regarding VASP and its related regulations may be sent via email to: [email protected]. For compliance. Digitally signed by Chuchi G. Fonacier Date: 2021.02.18 15:51:17 +08'00' CHUCHI G. FONACIER Deputy Governor 18 February 2021 Att.: A/S

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s Key provisions/requirements under Indicate level Provide brief statement Identify specific gap/s vis-à- Indicate action plan/s Circular No. 1108 dated 26 January 2021 of compliance on the BSFI’s existing vis the regulatory require- and the committed (i.e., Complied, policies and processes. ment/s timeline Partially Com- plied, or Not Complied) 1. Capitalization. VASPs shall have a minimum paid-in capital as follows: Category Minimum Required Capital VASP with safekeeping and/or ad- P50.0 Million ministration services for VAs (i.e., VA Custodian) as defined in Circular No. 1108. VASP without safekeeping and/or P10.0 Million administration services for VAs 2. Wallet Security. VASPs providing wallet services for holding and storing VAs must establish an adequate cybersecurity framework and adopt appropriate security measures/controls in their VA platform to ensure confidentiality, integrity and availability of data/information uploaded, stored, processed and transmitted into and out of the system and protect the infrastructure from malware, cyber-attacks and other evolving and emerging threats. Likewise, the framework shall cover provisions on the protection of fiat currency, if any, and VA wallets against cyber- threats and other technology risks. 3. Technology Outsourcing. VASPs shall adopt a sound risk management system to mitigate risks arising from

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s outsourcing (i.e., confidentiality of information, data privacy, data management, contract management, security, performance monitoring and business continuity, among others). The VASP shall be responsible for the performance of the service in the same manner and to the same extent as if it were directly performing the said activity. 4. Internal Control. All VASPs shall maintain an internal control system commensurate to the nature, size and complexity of their respective businesses. Critical control functions such as risk management, audit, compliance, anti-money laundering, information secu- rity and other essential roles must be performed by competent officers. The suitability of the board of directors and management must also be assessed in adherence to sound corporate governance procedures (e.g., fitness and propriety tests). 5. Financial Consumer Protection. VASPs shall adopt customer awareness measures to educate their customers which includes, among others: (i) safeguarding of VA and/or fiat currency wallets as well as protection of client information such as log-in credentials; (ii) use of the mobile platform and wallets; (iii) actual fees and charges related to the use of the mobile platform and withdrawal transactions; and (iv) problem resolution procedures. 6. Financial Consumer Protection (cont.) VASPs shall clearly communicate and explain to their customers the terms and conditions prescribing the manner on how the losses and liabilities from security breaches, system failure, or human error will be settled between the VASP and its customers.

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s VASPs shall disclose, prior to entering into an initial transaction and on an ongoing basis, all material risks to their clients in a manner that is clear, fair and not misleading. Disclosure shall provide information regarding the risks associated with the acquisition, possession, and trading of VAs. VASPS shall also disclose whether they are holding VAs in custody and the attendant risks or whether the customers have full control and responsibility of protecting and safeguarding their VAs. Lastly, VASPs shall adopt a mechanism in handling customer complaints and ensure that effective controls are in place for timely resolution thereof. 7. Customer Due Diligence. VASPs shall conduct customer due diligence when (1) it establishes business relations with any customer; (2) undertakes any occasional but relevant business transaction for any customer who has not otherwise established business relation with the VASP; (3) where there is suspicion of money laundering or terrorist financing; or (4) where there is doubt about the veracity or adequacy of previously obtained customer identification data. Relevant business transaction shall mean any single transaction amounting to P5,000 or more, or two or more transactions believed to be linked and with an aggregate value of P5,000 or more. For this purpose, the VASP should have appropriate system to identify and determine occasional customer or transaction.

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s 8. Additional Requirements. A VASP shall only engage with other VASPs, financial institutions, and/or remittance and transfer companies that are duly authorized and licensed by the appropriate regulatory authorities. VASPs shall establish a robust due diligence and accreditation process in selecting VAs that will be listed or traded in their platform. In addition, VASPs shall adopt a fraud risk management system which sophistication and effectiveness are commensurate to the risks associated with particular VA types or specific VA activities. VASPs shall also comply with the requirements, rules and regulations of the Bangko Sentral regarding the application for registration and activities requiring prior Bangko Sentral approval or notification. 9. Additional Requirements (cont.) Clearing and settle- ment of transactions of VASP, as well as other activities inherent to their business models, shall only be undertaken with regulated VASPs and platforms to ensure that all VASP activities are executed within an unbroken chain of regulated entities. 10. Additional Requirements (cont.) A VASP that creates and maintains fiat wallets to facilitate the conversion or exchange of fiat currency to VA or vice versa shall maintain sufficient unencumbered liquid assets to ensure that VA redemptions are adequately met at all times. The VASP shall have in place control mechanisms to ensure prompt recording of receipt of fiat money. VA Custodians wholly responsible for custody of customers' VAs, either through proprietary or

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s outsource arrangements, shall adopt measures to ensure adequate reserves for the VAs held in custody. Said VA Custodians shall adopt. effective mechanism to properly record and segregate customers' VAs from their proprietary VAs. 11. Transactional Requirements for VASPs. For VA transfers amounting to P50,000.00 or more, or its equivalent in foreign currency, the originating institution in a VA transfer must obtain and hold the required and accurate originator information as well as the required beneficiary information, and transmit said information to the beneficiary institution. Beneficiary institutions must obtain and hold required originator information as well as required and accurate beneficiary information. All the information gathered shall be made available on request to competent authorities. The required information for VA transfers, including transactions associated with a VA transfer, includes the following: a) originator's name (i.e., the sending customer); b) originator's account number used to process the transaction (e.g., the VA wallet); c) originator's physical (geographical) address, or national identity number, or customer identification number (i.e., not a transaction number) that uniquely identifies the originator to the ordering institution, or date and place of birth; d) beneficiary's name; and

Annex A [Name of BSFI] Gap Assessment on Circular No. 1108 dated 26 January 2021 BSP Regulatory Provisions BSFI’s Existing Controls Gap/s Action Plan/s e) beneficiary account number where such an account is used to process the transaction (e.g., the VA wallet). The required information must be transmitted immediately and in a secure manner. VASPs shall uphold the confidentiality, integrity and availability of the required information to facilitate recordkeeping and use of such information by receiving VASPs or other covered entities, as well as to prevent unauthorized disclosure. Entities should also submit the required information simultaneously or concurrently with the transfer itself.