VASP License Philippines Requirements (2026): BSP Circular 1108, Moratorium Exceptions, Capital & Travel Rule

Last updated: June 16, 2026

Understanding the VASP license Philippines requirements is the essential first step for any crypto exchange, custodial wallet provider or fintech platform that wants to operate lawfully in one of Southeast Asia’s fastest-growing digital-asset markets. The Bangko Sentral ng Pilipinas (BSP) governs virtual-asset service providers through BSP Circular No. 1108, which sets out the definitions, eligibility criteria, anti-money-laundering obligations and Travel Rule thresholds that every applicant must satisfy. Complicating the picture is the BSP moratorium on new VASP licenses, first announced in 2022 and, as of mid-2026, still applicable with only narrow exceptions for BSP-supervised financial institutions.

This guide walks compliance teams, general counsel and founders through every requirement, from entity formation and capital evidence to ongoing AML reporting, and explains the realistic options that remain for market entry under the current regulatory framework.

Quick Answer: Can You Still Get a VASP License in the Philippines in 2026?

For readers who need the headline verdict before the detail, here is the position as of June 2026:

• Primary regulation. BSP Circular No. 1108 (Series of 2021) is the governing framework. It defines covered VASP activities, sets out application requirements and imposes AML/Travel Rule obligations.
• Moratorium status. The BSP moratorium on the grant of new VASP Certificates of Authority (COA), effective since September 1, 2022, remains in place. Industry observers expect it to continue until BSP issues a formal lifting notice. Exceptions exist only for institutions already supervised by the BSP (e.g., banks and quasi-banks).
• Travel Rule threshold. Licensed VASPs must transmit originator and beneficiary information for virtual-asset transfers that reach or exceed PHP 50,000, in line with FATF standards adopted by BSP.
• Capital evidence. BSP evaluates capital adequacy on a case-by-case basis. Industry commentary reports thresholds as high as PHP 100 million for certain activity profiles, though no single statutory minimum has been published. Applicants should prepare audited financial statements and bank certifications.
• Who is licensed. The BSP publishes an official list of registered VASPs. Before planning any market-entry strategy, prospective operators should consult that register and seek legal advice on the moratorium exceptions.

What Is a VASP Under Philippine Law?

BSP Circular No. 1108 defines a virtual-asset service provider as any person or entity that conducts one or more of the following activities as a business for or on behalf of another person:

The definition mirrors the FATF’s international standard and captures on-shore activity, meaning any entity that targets Philippine customers or maintains operations within the country triggers BSP jurisdiction, regardless of where the platform is technically hosted. A VASP license from BSP takes the form of a Certificate of Authority (COA) to operate as a VASP or a registration as a remittance and transfer company with VASP functions, depending on the applicant’s corporate profile.

Who Needs a VASP License Philippines? Covered Entities and Exemptions

Any entity performing covered VASP activities in the Philippines must hold a BSP-issued COA before it can lawfully operate. The requirement extends to the following entity types:

• Crypto exchanges, both centralised order-book platforms and peer-to-peer matching services that take custody of user assets.
• Custodial wallet providers, services that hold private keys on behalf of users.
• Virtual-asset brokers and dealers, entities that intermediate between buyers and sellers of virtual assets.
• Remittance and transfer companies, operators whose transfer activities use virtual assets as a payment rail.
• Token-offering facilitators, platforms that provide financial services connected to the issuance or sale of virtual assets.

Certain categories fall outside the licensing perimeter or enjoy partial exemptions. Purely non-custodial software (e.g., open-source wallet interfaces that never hold private keys) is generally not treated as a VASP, although BSP retains discretion to re-classify activities that effectively amount to custodial control. BSP-supervised banks and quasi-banks that wish to add VASP functions are processed through the existing supervisory framework and may fall within the exceptions to the moratorium discussed below.

How BSP Treats Foreign Intermediaries and Cross-Border Service Providers

A foreign crypto platform that actively solicits Philippine-resident customers, through peso-denominated trading pairs, local payment-gateway integrations or targeted marketing, is treated as conducting covered activities within BSP’s jurisdiction. The practical effect is that an unlicensed offshore operator risks enforcement action and cannot legally on-board Philippine users. Where direct licensing is blocked by the moratorium, foreign operators must explore partnership or technology-service arrangements with an already-licensed VASP or a BSP-supervised institution.

BSP Moratorium on New VASP Licenses: Status, Scope and Exceptions

The BSP announced a moratorium on the processing and grant of new VASP Certificates of Authority effective September 1, 2022. The stated rationale was to allow the central bank to assess the risks posed by the rapid growth of virtual-asset activity and to strengthen its supervisory capacity. As of June 2026, BSP has not published a formal notice lifting the moratorium, and the likely practical effect is that most standalone applicants cannot obtain a fresh COA.

Who Qualifies for an Exception?

Early indications suggest that the narrow exceptions to the BSP moratorium on VASP licensing cover:

• BSP-supervised financial institutions, universal banks, commercial banks, thrift banks, rural banks and quasi-banks already holding a BSP license can apply to add VASP functions to their existing authority.
• Electronic money issuers (EMIs), EMIs already regulated by BSP may seek approval to offer virtual-asset-related services, subject to enhanced supervisory review.
• Entities with pending applications filed before September 1, 2022, applications that were already in BSP’s pipeline when the moratorium took effect may still be processed to completion, though progress varies case by case.

Any entity considering an application in 2026 should engage Philippine legal counsel to confirm the current moratorium status directly with BSP before incurring formation and compliance costs.

VASP License Philippines Requirements: Minimum Application and Entity Formation Standards

For applicants who qualify, whether because the moratorium is lifted or they fall within an exception, BSP Circular No. 1108 and related guidance set out the following baseline requirements for the VASP application process in the Philippines:

• Philippine corporate entity. The applicant must be registered with the Securities and Exchange Commission (SEC) as a domestic corporation. The articles of incorporation must include virtual-asset activities in the stated business purpose.
• Fit-and-proper persons. All directors, officers and significant shareholders must satisfy BSP’s fit-and-proper test, demonstrating integrity, competence, financial standing and the absence of disqualifying criminal or regulatory records.
• AML/KYC compliance programme. The applicant must present a comprehensive anti-money-laundering and know-your-customer framework that meets the requirements of the Anti-Money Laundering Act (AMLA), as amended, and BSP’s implementing regulations. This includes a board-approved AML manual, customer-identification procedures, transaction-monitoring systems and a designated compliance officer.
• Technology and cybersecurity. BSP expects documented IT governance policies, business-continuity plans, penetration-testing reports and data-privacy measures aligned with the Data Privacy Act of 2012.
• Internal-audit and risk-management functions. A dedicated internal-audit capability and risk-management framework must be in place prior to submitting the application.

Required Documents Checklist

Industry practitioners and BSP guidance indicate that the following documents are typically required when filing a VASP COA application:

• SEC Certificate of Registration and Articles of Incorporation
• Biodata, CVs and NBI clearances of all directors, officers and major shareholders
• Audited financial statements for the most recent fiscal year (or a bank certification of capital if newly formed)
• Board-approved AML/KYC manual and compliance-officer appointment letter
• IT security assessment report and business-continuity plan
• Corporate governance manual
• Risk-management framework
• Proof of physical office address in the Philippines
• Draft customer-facing terms and conditions

The application timeline varies significantly. Industry sources report a typical processing window of six to twelve months from complete submission to COA grant, though delays are common when BSP requests additional documentation or site inspections. Application fees are assessed on a case-by-case basis; applicants should budget for both BSP filing fees and the professional costs of preparing compliance documentation.

VASP Capital Requirements Philippines: How BSP Assesses Financial Standing

Unlike some jurisdictions that prescribe a fixed statutory minimum capital, BSP evaluates VASP capital requirements on a case-by-case basis, considering the nature, scale and complexity of the proposed activities. This approach gives the central bank broad discretion, and it means applicants cannot rely on a single published figure as the definitive threshold.

Accepted forms of capital evidence include:

• Bank certification. A certification from a BSP-supervised bank confirming the applicant’s available cash or cash-equivalent balances.
• Audited financial statements. Statements prepared by an independent auditor showing total equity, liquidity ratios and proof that the entity can sustain operations and absorb potential losses.
• Proof of reserves or insurance. For custodial operators, BSP may request evidence of segregated customer reserves or third-party insurance coverage.

The PHP 100 million figure frequently cited in industry commentary should be treated with caution, it reflects market reporting rather than a hard regulatory floor. Applicants should engage legal counsel to obtain a preliminary assessment from BSP before committing capital.

AML, Travel Rule and Reporting Obligations for VASPs in the Philippines

The Travel Rule for crypto in the Philippines is one of the most operationally demanding requirements for licensed VASPs. Consistent with the FATF Recommendation 16 framework adopted by BSP through Circular No. 1108 and related AML guidance, VASPs must transmit specific originator and beneficiary data when processing virtual-asset transfers that meet or exceed PHP 50,000.

Required Data Fields Under the Travel Rule

For qualifying transfers, the originating VASP must collect and transmit the following information to the beneficiary VASP:

• Originator data: full name, account number (or unique transaction reference), and either the physical address, national identity number, or date and place of birth.
• Beneficiary data: full name and account number (or unique transaction reference).

The beneficiary VASP is required to verify this information before making the transferred value available to the recipient. Where the required data is missing or incomplete, the receiving VASP must determine whether to reject, suspend or proceed with the transfer under a risk-based approach, and must file a suspicious-transaction report (STR) where the circumstances warrant.

Broader AML Reporting Obligations

Privacy coins, virtual assets with built-in anonymity features that obscure transaction trails, present heightened risk under BSP’s framework. Licensed VASPs that choose to list such assets must demonstrate that their transaction-monitoring tools can adequately de-anonymise or flag suspicious activity, failing which BSP may require delisting.

Practical Compliance Checklist and Timeline to Prepare a VASP License Philippines Application

Even where the moratorium prevents immediate filing, building a compliance-ready posture positions an applicant to submit rapidly once the moratorium lifts or an exception is secured. The following phased timeline reflects common industry practice:

Phase 1: Formation and Corporate Setup (Months 0–3)

• Incorporate a Philippine domestic corporation with SEC; include VASP activities in the articles of incorporation.
• Appoint directors and officers who satisfy BSP’s fit-and-proper criteria.
• Secure a physical office address and IT infrastructure in the Philippines.
• Engage legal counsel and external auditors.

Phase 2: Policy Development and Technology (Months 3–6)

• Draft and obtain board approval for the AML/KYC manual, corporate-governance manual and risk-management framework.
• Appoint a designated compliance officer and internal-audit function.
• Implement transaction-monitoring, Travel Rule and customer-identification systems.
• Conduct penetration testing and prepare the cybersecurity assessment report.

Phase 3: Application and Regulatory Engagement (Months 6–12)

• Compile and file the complete COA application package with BSP.
• Prepare audited financial statements or bank certifications for capital evidence.
• Respond to BSP queries and facilitate site inspections.
• Secure banking relationships for fiat-gateway operations (this step often proves the most time-consuming).

Red Flags That Commonly Lead to Rejection

• Insufficient or non-existent KYC/AML programme at the time of application.
• Support for privacy coins without a credible risk-mitigation strategy.
• Directors or officers with disqualifying criminal, regulatory or bankruptcy records.
• Inadequate IT-security documentation or failure to pass penetration testing.
• Capital evidence that does not demonstrate sustainable operational capacity.

If the BSP Moratorium Applies: Alternative Go-to-Market Strategies

For operators who cannot obtain a standalone VASP license under current conditions, several alternative strategies may allow a lawful presence in the Philippine market, each carrying its own legal risks that demand careful analysis:

• Partnership with a BSP-supervised institution. A bank or quasi-bank with existing BSP authority can add VASP functions under the moratorium exception. A foreign platform may white-label its technology to such a partner, with the licensed institution remaining the regulated entity. Risk: the partner bears full regulatory liability, and commercial terms can be restrictive.
• Non-custodial model. Operating a purely non-custodial interface (where users retain sole control of private keys) may fall outside the VASP definition. Risk: BSP retains discretion to reclassify activities; if the platform provides any custodial, matching or financial intermediation function, the exemption collapses.
• Technology-as-a-service (TaaS). Supplying back-end infrastructure to a licensed VASP without directly interfacing with end users may avoid the licensing trigger. Risk: the contractual boundary must be tightly drawn; any overlap with covered activities re-exposes the technology provider.
• Licensing in an adjacent jurisdiction. Some operators obtain a VASP license in another jurisdiction and restrict Philippine-facing activity to referrals or information only. Risk: if marketing or on-boarding targets Philippine residents, BSP may assert jurisdiction regardless of where the license was issued.

None of these alternatives removes the need for Philippine legal analysis. Each must be stress-tested against BSP’s current position and the evolving enforcement posture of the Anti-Money Laundering Council (AMLC).

Next Steps

Whether you are assessing eligibility under a moratorium exception, preparing a compliance-ready corporate structure for future application, or evaluating alternative market-entry strategies, early legal engagement significantly reduces the risk of regulatory missteps. A Philippines-focused regulatory lawyer can:

• Confirm the real-time status of the BSP moratorium and advise on exception eligibility.
• Conduct a gap assessment against BSP Circular No. 1108 requirements.
• Prepare and review the full application package, including the AML/KYC manual, governance documents and capital-evidence filings.
• Liaise directly with BSP on behalf of the applicant during the review process.

To connect with a Philippines-based business and regulatory compliance lawyer, visit the Global Law Experts lawyer directory.

Sources

1. Bangko Sentral ng Pilipinas, Circular No. 1108 (Guidelines for Virtual Asset Service Providers)
2. Bangko Sentral ng Pilipinas, List of Virtual Asset Service Providers (VASP)
3. Bangko Sentral ng Pilipinas, Official Website
4. Ocampo & Suralvo, BSP to Suspend Grant of VASP Licenses
5. Emerhub, VASP License in the Philippines
6. Tetra Consultants, Philippines Cryptocurrency License Overview
7. Eternity Law International, Philippines Crypto License Commentary
8. Multilaw, Philippines Jurisdiction Guide (Certificate of Authority)