How to Register As a VASP in the Philippines (step‑by‑step, 2026)

VASP registration Philippines is the single most important regulatory gateway for any business that intends to exchange, transfer or custody virtual assets for Philippine customers. The Bangko Sentral ng Pilipinas (BSP) regulates Virtual Asset Service Providers under BSP Circular No. 1108 (Series of 2021) and related issuances, and in 2026 the practical expectations around anti‑money‑laundering controls, technical security and governance are materially higher than they were when the regime first took shape. This guide sets out the procedure as a regulator‑style published walkthrough: eligibility, the step‑by‑step application sequence, the documents you must file, realistic time spans, indicative cost categories, and the pitfalls that most frequently lead to rejection.

Treat it as a project plan rather than an overview, each section is written to be executed, and you should verify all requirements against the current BSP and AMLC issuances before you rely on them.

1. Overview: What is a VASP and who must register?

A Virtual Asset Service Provider (VASP) is, in broad terms, any entity that offers services or engages in activities providing facility for the conduct of virtual asset transactions as a business, exchanging virtual assets for fiat or for other virtual assets, transferring virtual assets on behalf of another person, or providing custody and administration of virtual assets or the instruments that control them. The BSP is the primary regulator for these activities under its VASP framework, and the Anti‑Money Laundering Council (AMLC) treats VASPs as covered persons for anti‑money‑laundering purposes.

1.1 Who is regulated as a VASP?

You will generally fall within the VASP perimeter if you operate a crypto exchange, run a custodial wallet service, or facilitate the transfer of virtual assets between parties as a business. A key determining factor is whether you conduct a virtual asset business targeting or serving Philippine users. This is the point at which VASP registration Philippines becomes mandatory rather than optional, and it is the trigger foreign providers most often misjudge. Because the BSP previously placed a moratorium on the acceptance of new VASP licence applications, confirm the current application window and any phased reopening directly with the BSP before you plan your market entry.

1.2 Who is exempt or out of scope?

Activity that is purely personal and non‑commercial, or the use of virtual assets solely within a closed‑loop system that cannot be exchanged for fiat or other virtual assets, may fall outside the perimeter. However, the boundaries are fact‑specific. Where tokenised instruments carry the characteristics of securities, oversight shifts toward the Securities and Exchange Commission (SEC). Confirm your classification in writing before building a compliance programme on an assumption.

2. Eligibility: Do you need BSP VASP registration or another licence?

Before investing in a full application, determine which regulator owns your activity. The BSP VASP path governs exchange, transfer and custody of virtual assets. The SEC governs instruments that are securities in substance, including certain tokenised securities and crypto‑asset offerings that qualify as investment contracts, while the Department of Finance and the Bureau of Internal Revenue perspective matters for tax treatment. Many applicants discover mid‑process that part of their product set sits under the SEC, which forces a restructuring of the application.

2.1 BSP vs SEC vs other licences

As a rule of thumb: if your core business is moving, exchanging or holding virtual assets, the BSP VASP path applies. If your tokens represent an investment contract or other security, expect SEC involvement in parallel. Confirm with both regulators where products overlap rather than guessing.

3. Step‑by‑step: How to apply for VASP registration Philippines (numbered)

The sequence below is the core procedure. Work through it in order, each stage depends on outputs from the one before, and starting the BSP filing before your AML framework and corporate documents are complete is the most common cause of delay. Exact durations vary with the applicant’s readiness and the BSP’s current processing capacity.

1. Pre‑application due diligence. Conduct know‑your‑business (KYB) on all shareholders and beneficial owners, assess capital adequacy against your intended activity, and draft the skeleton of your AML and governance policies. Indicative duration: several weeks.
2. Company formation and corporate documents. Incorporate the Philippine entity (or amend an existing one) through the SEC, secure the correct primary purpose clause covering virtual asset activity, and obtain the supporting corporate registrations. Indicative duration: several weeks.
3. AML compliance framework and AMLC registration. Finalise the AML/CFT manual, appoint and document a qualified compliance officer, stand up transaction monitoring and reporting workflows, and complete registration with the AMLC as a covered person. Run this in parallel with company formation where possible.
4. BSP application submission. Assemble and file the full BSP application pack, corporate, governance, AML, technical and fit‑and‑proper evidence, together with the applicable fees. Indicative duration: 1–2 weeks to prepare and lodge.
5. BSP review, technical assessment and inspection. Respond to BSP queries, provide independent security assessment evidence, and host any on‑site or remote examination of systems and controls. This is typically the longest phase.
6. Approval, registration and commencement. On approval, satisfy any conditions, pay any remaining fees, and commence regulated operations in line with the terms of the registration.

3.1 Pre‑application due diligence

This stage determines whether your later filing survives scrutiny. Build a complete ownership chart down to ultimate beneficial owners, collect identity and source‑of‑funds evidence for each, and run adverse‑media and sanctions screening. Produce a capital assessment that ties your proposed activity to realistic operating costs and prudential buffers. Draft, at minimum, the AML/CFT manual, the risk assessment methodology, and the governance charter. Applicants who treat due diligence as a formality rather than the foundation of the file are the ones who later receive extensive BSP clarification requests.

3.2 Company formation and corporate documents

Incorporate through the SEC with a primary purpose clause that expressly covers your virtual asset activities. Prepare the Articles of Incorporation, By‑Laws, the General Information Sheet, and board resolutions authorising the application and appointing signatories. Where foreign ownership is involved, confirm the applicable equity limits for your activity before finalising the cap table, because restructuring ownership after filing is disruptive and signals weak planning to the regulator.

3.3 AML compliance framework and AMLC registration

VASPs are covered persons under the Anti‑Money Laundering Act of 2001 (Republic Act No. 9160, as amended), which means registration with the AMLC and a functioning AML/CFT programme are not optional add‑ons but core requirements of VASP registration Philippines. Register with the AMLC through its registration and reporting portal, finalise your AML manual, and ensure your monitoring system can generate suspicious transaction reports and covered transaction reports in the required formats. Appoint a compliance officer whose qualifications and independence you can evidence on paper.

3.4 BSP application submission

With the foundations complete, compile the BSP application pack. The file should be internally consistent, names, figures and dates across corporate, AML and technical documents must match. Inconsistencies between, say, the beneficial owners named in the KYB pack and those on the General Information Sheet are a frequent trigger for queries. Lodge the application with the applicable fees and retain proof of filing.

3.5 BSP review, technical assessment and inspection

Expect the BSP to probe your IT security architecture, key management, custody arrangements and incident response. Have an independent security assessment ready; where the BSP requests penetration testing or a controls review, the absence of recent evidence will extend the timeline. During inspection, make knowledgeable staff available, the compliance officer, a technical lead and an authorised corporate officer, and be prepared to demonstrate, not merely describe, your controls.

3.6 Approval, registration and commencement

Approval frequently comes with conditions. Clear them promptly, pay any remaining fees, and ensure your go‑live state matches exactly what you represented in the application. Launching functionality you did not disclose is a direct route to supervisory action. Document your commencement date and begin your ongoing reporting obligations from day one.

4. Required documents (complete checklist)

The table below sets out the documents a VASP applicant should expect to prepare. Prepare originals or certified true copies, have signature pages notarised where required, and provide certified English translations of any foreign‑language document. Keep a master index so that reviewers can navigate the pack quickly. Confirm the definitive documentary requirements against the BSP’s current VASP application checklist.

4.1 Corporate and governance documents

Ensure the primary purpose clause, board resolutions and the GIS present a coherent picture. A single mismatch, an unlisted director, an outdated GIS, invites broader scrutiny of the whole pack.

4.2 Compliance and AML/KYC policies

Your AML/CFT programme must map to your actual business model and products. Reviewers can tell the difference between a bespoke programme and a template populated with another firm’s risk profile.

4.3 Technical / IT / security evidence

Treat security evidence as a deliverable with its own lead time. Commission the independent assessment early; audit scheduling is one of the longest external dependencies in the process.

4.4 Personnel and fit‑and‑proper evidence

Directors, senior officers and the compliance officer should each have a documented, verifiable track record. Gaps in experience for key control functions are a recognised rejection risk.

5. Timeline and deadlines (typical durations and milestones)

From the start of pre‑application work to registration, a well‑prepared applicant should budget several months, with the exact span driven by readiness and the BSP’s current processing posture. The single largest variable is readiness: files that arrive complete and internally consistent move faster, while those that generate repeated clarification rounds drift toward the longer end. Where parallel workstreams are possible, for example, running AMLC registration alongside company formation, use them to compress the critical path. Note that the BSP has at times limited or suspended the acceptance of new VASP applications, so confirm the current application window before committing to a schedule.

5.1 Fast‑track tips

• Complete the AML framework before filing. Do not submit with a draft manual expecting to finalise it during review.
• Commission the security assessment early. External assessment slots are a long‑lead item; book them during pre‑application.
• Reconcile every document. Names, figures and dates must match across corporate, AML and technical files.
• Nominate a single point of contact. A responsive liaison shortens each clarification cycle.

5.2 What to expect during BSP inspection

Inspection is evidence‑led. Expect requests to demonstrate live controls, transaction monitoring in action, key management procedures, access logs and incident response readiness. Have the compliance officer, a technical lead and an authorised officer present and prepared to walk through systems rather than slides.

6. Costs and fees

The categories below are for planning only. Government fees, capital expectations and third‑party costs change, and you should verify every line with the BSP and AMLC and your advisers before committing budget. The BSP sets minimum capital requirements for VASPs scaled to the services offered and the entity type; do not rely on any single figure without confirming it against the current BSP issuance applicable to your activity.

All figures must be verified with the regulator before you rely on them.

6.1 Ongoing compliance costs

Budget beyond approval. A compliant VASP carries recurring costs for AML staffing and training, transaction monitoring tooling, periodic security testing, and the preparation of regulatory reports. These recurring obligations are central to lawful operation, and under‑resourcing them is a route to later supervisory problems.

7. AMLC and AML obligations for VASPs

VASPs are covered persons under the Anti‑Money Laundering Act, so AML compliance is inseparable from the registration itself. Core obligations include customer due diligence, ongoing monitoring, recordkeeping, the appointment of a designated compliance officer, and staff training. International expectations, including those articulated by the Financial Action Task Force (FATF) for virtual asset service providers, such as the “travel rule” for originator and beneficiary information, inform how the BSP and AMLC assess the adequacy of your programme.

7.1 Registering as a covered person with AMLC

Complete AMLC registration before or alongside your BSP filing. The BSP will expect to see that your AML obligations are already operational, registration, a tailored manual, a qualified compliance officer and a functioning monitoring capability, rather than aspirational.

7.2 Reporting timelines and penalties

• Suspicious transaction reports (STRs). File within the reporting window prescribed under the AMLA and AMLC issuances after the covered person determines a transaction to be suspicious.
• Covered transaction reports (CTRs). Report qualifying transactions that exceed the covered‑transaction threshold set under the AMLA and its implementing rules, within the applicable deadline.
• Recordkeeping. Retain customer and transaction records for the statutory retention period and make them available to the AMLC on request.
• Penalties. Non‑compliance exposes the firm and responsible officers to administrative and, in serious cases, criminal liability under the AMLA.

8. What to watch in 2026 (key regulatory trends)

The practical thrust of recent change is a higher bar on substance. Regulators now expect demonstrable, not merely documented, AML and security controls, and applicants report closer scrutiny of beneficial ownership and technical resilience. The SEC has also advanced its own framework for crypto‑asset service providers and digital financial products that qualify as securities, so firms offering token‑based investment products should track SEC developments in parallel. The likely practical effect for 2026 applicants is longer review where evidence is thin, and a premium on files that prove controls are operational from the outset.

8.1 Immediate effects for applicants

Plan for deeper technical review and more detailed questions on ultimate beneficial ownership. Applications supported by independent security assessments and a mature AML programme tend to move through review with fewer clarification rounds.

8.2 Transitional arrangements and application windows

Where transitional provisions or application moratoria apply to existing or in‑flight applicants, confirm the applicable cut‑off dates and current acceptance status directly with the BSP and align your remediation plan to them. Do not assume grandfathering; verify it against the current regulator text.

9. Common pitfalls and how to avoid application rejection

Most rejections are avoidable and trace back to the same small set of weaknesses. Address them before filing rather than in response to a BSP query.

9.1 Top reasons for rejection

• Incomplete or generic AML policies. A manual that does not reflect your actual products and risks signals an unprepared programme.
• Insufficient KYB. Gaps in beneficial ownership evidence, or undisclosed owners, undermine the whole file.
• Weak IT security or missing audit evidence. No recent independent assessment is a recurring blocker.
• Unqualified compliance officers. Control functions staffed without demonstrable competence invite rejection.
• Unclear corporate governance. Opaque reporting lines and undocumented decision‑making weaken confidence.
• Inconsistent documentation. Mismatched names, figures or dates across the pack trigger broad scrutiny.
• Undisclosed beneficial owners. The most serious category, treated as a material integrity concern.

9.2 Remediation checklist

• Reconcile the pack. Cross‑check every name, figure and date across corporate, AML and technical documents.
• Tailor the AML manual. Map every control to a specific product and risk.
• Refresh security evidence. Obtain a current independent assessment of the production environment.
• Evidence fit‑and‑proper. Document the qualifications and independence of key officers.
• Disclose fully. Resolve any ownership ambiguity before filing, not after a query.

10. Comparison: BSP VASP registration vs alternative regimes

Choose the BSP VASP path when virtual asset exchange, transfer or custody is the heart of your product. Where some instruments are securities, expect a parallel SEC dimension and structure the application accordingly. Confirm overlaps with both regulators rather than selecting a single track by default.

12. Next steps

Completing VASP registration Philippines is a disciplined, evidence‑led exercise rather than a form‑filling task. Start with rigorous due diligence, build an AML and security programme that is operational before you file, keep every document internally consistent, and plan your timeline and budget against the stages set out above, and confirm the current BSP application window early. Prepare the required‑documents checklist in Section 4 as your working project tracker, and seek specialist advice early where product classification, foreign ownership or securities overlap are in play, these are precisely the areas where an avoidable misstep costs months.

Sources

1. Bangko Sentral ng Pilipinas (BSP)
2. Anti‑Money Laundering Council (AMLC)
3. Official Gazette, Republic Acts
4. Securities and Exchange Commission Philippines (SEC)
5. Financial Action Task Force (FATF), Guidance on Virtual Assets and VASPs
6. LawPhil (Arellano Law Foundation)