Buying or Selling a Fintech in the Philippines (2026): Regulatory Approvals, Due Diligence & Deal Checklist

Fintech M&A Philippines deals in 2026 demand far more regulatory planning than they did even two years ago, as the Bangko Sentral ng Pilipinas, the Anti-Money Laundering Council and the National Privacy Commission have each intensified scrutiny of ownership changes, licence transfers and data handling. For founders, in-house counsel, investors and acquirers, the difference between a clean closing and a stalled transaction now hinges on pre-filing regulator engagement, disciplined due diligence and conditional deal structuring. This guide delivers a transaction-ready playbook: a deal decision matrix, a diligence checklist tailored to Philippine licence types, a regulator-by-regulator approvals map, and practical drafting pointers for the sale and purchase agreement.

It is written to help you take a position quickly and protect value through to post-closing compliance integration.

Executive summary: the 2026 fintech M&A Philippines landscape

The Philippine fintech sector remains one of Southeast Asia’s most active, spanning e-money issuers, operators of payment systems (OPS), virtual asset service providers (VASPs) and remittance platforms. What has changed is the regulatory posture around deals. The Bangko Sentral ng Pilipinas (BSP) treats changes in ownership or control of licensed entities as a supervisory event, the Anti-Money Laundering Council (AMLC) expects uninterrupted AML/CFT compliance through any transition, and the National Privacy Commission (NPC) expects controllers to manage personal data responsibly during restructurings.

The practical takeaway is simple and worth stating plainly: do not sign a letter of intent for any regulated fintech without first mapping the licence-transfer path and the regulator’s likely conditions. Our recommendation throughout this guide is to front-load regulatory planning, make approvals explicit conditions precedent, and use escrow and indemnities to allocate the compliance risk that diligence uncovers.

Quick checklist snapshot for buyers and sellers

• Sellers. Prepare a clean disclosure schedule, resolve outstanding regulator correspondence, and document your AML program and data-processing records before you go to market.
• Buyers. Confirm licence transferability early, quantify AML and data-privacy remediation cost, and price regulatory risk into escrow and indemnity terms.
• Both. Engage the relevant regulators before filing, and sequence the deal so that regulatory approvals are the gating condition to closing.

1. Quick deal decision matrix: share sale vs asset sale vs licence carve-out

The first decision in any fintech M&A Philippines transaction is structure. The three live options, a share sale, an asset sale, or a licence transfer / business carve-out, have materially different consequences for regulatory approval, tax, liability and speed. Take a position early, because the structure dictates the entire diligence and approvals workflow. The table below sets out the trade-offs side by side.

Decision framework for fintech M&A Philippines deals

• Choose a share sale when the buyer wants continuity of contracts and customer relationships, the licences are transferable with regulator consent, and the buyer will accept some legacy liability in exchange for speed and operational continuity.
• Choose an asset sale when the buyer wants to avoid unknown contingent liabilities, prefers to cherry-pick assets such as IP and customer lists, and the regulated licence is either not core or will be re-applied for separately.
• Choose a licence carve-out or assignment when the licence and its holder are central to the deal, the regulator requires specific consent and conditions for transfer, or the acquirer lacks an applicable licence and must acquire a licensed entity or apply for a new one.

A fintech-focused transaction lawyer earns their fee here: translating commercial intent into the structure that the regulator will actually approve, then drafting conditionality so the deal does not close ahead of its licence. If you are unsure which route fits, default to the share sale for continuity-driven strategic buyers and the asset sale for buyers who prize a clean liability slate.

2. Pre-deal commercial and regulatory screening: what to check before the LOI

Before you spend money on full diligence, run a fast pre-LOI screen. The goal is to kill or re-price a deal early if the regulatory transfer path is blocked. This screening stage is where most avoidable surprises in a fintech acquisition Philippines process are caught.

2.1 Corporate and ownership screening

Confirm the target’s shareholding structure, any foreign ownership limits applicable to the regulated activity, pledged or encumbered shares, and any shareholder consents or pre-emption rights that could frustrate the deal. Verify the entity’s good standing with the Securities and Exchange Commission (SEC) and that corporate approvals under the Revised Corporation Code are achievable.

2.2 Licence and regulatory status

Identify exactly which authorisations the target holds, e-money issuer, OPS, VASP, payment system participant, or remittance operator, and read the conditions attached to each. Under BSP supervision, a change in ownership or control of a licensed entity is a regulated event, so establish up front whether the target’s licence can be transferred with BSP consent or whether a fresh application will be required. Screen for pending BSP examinations, AMLC advisories, NPC complaints or investigations, and any undertakings the target has given to a regulator. A live enforcement matter can delay or defeat approval, so surface it before committing to exclusivity.

This early licence mapping is the single most valuable step in any fintech M&A Philippines screen because it determines deal structure, timeline and price.

2.3 Material contracts and third-party dependencies

Fintech value often sits in rails, not just code. Review payment service provider contracts, sponsor-bank arrangements, settlement and clearing relationships, API and cloud providers, and any exclusivity or change-of-control clauses that a buyer could trip. A change-of-control trigger in a sponsor-bank agreement can unravel a transaction’s commercial logic, so flag these before the LOI and plan for consents in parallel with regulatory filings.

2.4 Financial and tax red flags

Check revenue recognition practices, the treatment of float and customer funds, VAT on fee income, withholding tax compliance, and any open assessments with the Bureau of Internal Revenue (BIR). Share and asset sales carry different tax consequences, so an early read of the tax profile informs the structuring decision and the purchase-price model.

3. Fintech due diligence Philippines checklist

Full diligence in a fintech M&A Philippines deal runs across six streams. For each, we set out the documents to request and the risk indicators to watch. Treat this as a punchlist: gaps are either priced out, remediated pre-closing, or covered by specific indemnity.

3.1 Corporate and governance

• Articles of incorporation and by-laws, with amendment history.
• Board and shareholder minutes, especially authorisations relevant to the deal.
• Complete, reconciled capitalisation table and stock-and-transfer book.
• Shareholder agreements, options, convertible instruments and SAFEs.
• Subsidiaries, joint ventures and affiliate arrangements.
• Change-of-control clauses across key contracts and financing documents.

Risk indicators include an unreconciled cap table, undocumented share transfers, and consent rights that could block the transaction. Corporate approval mechanics for mergers and capital changes are governed by the Revised Corporation Code (Republic Act No. 11232) and SEC rules, so confirm the required majorities and filings are deliverable.

3.2 Regulatory and licences

• All BSP licences, certificates of authority and registrations, with attached conditions.
• Full regulatory correspondence file, including examination findings and responses.
• Records of any supervisory actions, directives, sanctions or undertakings.
• Capital adequacy and liquidity records required for the licence type.
• Fitness-and-propriety documentation for directors, officers and significant owners.
• Status of any pending licence applications, renewals or variation requests.

This is the most consequential stream. BSP guidance treats the transfer of ownership or control of licensed fintechs as requiring notification and, in many cases, prior approval, so verify not only that the licences exist but that they are capable of surviving the proposed structure. Unresolved supervisory directives are a leading cause of delayed approvals; price them, remediate them, or make their clearance a condition precedent.

3.3 AML/CFT and KYC

• The written AML/CFT program, risk assessment and internal policies.
• Customer due diligence and KYC files, including enhanced due diligence records.
• Transaction monitoring systems, tuning records and alert-handling logs.
• Suspicious transaction reporting history and covered transaction reports.
• AMLC registrations, correspondence and any advisories received.
• Independent AML audit reports and remediation status.

The AMLC expects AML programs to run without interruption through a change of ownership and continued reporting of suspicious transactions. A buyer inherits the target’s AML posture, so quantify any monitoring, KYC backlog or reporting gaps and tie remediation to the deal timeline. Expect the regulator to want evidence of continuity and a credible remediation plan. These obligations arise under the Anti-Money Laundering Act (Republic Act No. 9160, as amended) and its implementing rules.

3.4 Data protection and NPC compliance

• Privacy management program, privacy notices and consent records.
• Data Privacy Impact Assessments (DPIAs) for core processing activities.
• Data processing and data sharing agreements with vendors and partners.
• Records of cross-border data transfers and their legal bases.
• Breach register and any prior NPC complaints or investigations.

Under the Data Privacy Act (Republic Act No. 10173) and NPC issuances, controllers are expected to assess privacy risk when personal data moves in a corporate transaction. Where customer data transfers to the buyer, a DPIA, a review of consent and legal bases, updated privacy notices and any required NPC engagement are standard. Flag NPC data-privacy issues early because remediation can require customer communications that affect deal confidentiality.

3.5 Tax

• Income tax, VAT and withholding tax returns for the relevant periods.
• BIR rulings, assessments and any open audits.
• Transfer pricing documentation for related-party dealings.
• Tax treatment of float, fees and incentives.

Share and asset sales attract different BIR consequences, including VAT exposure on asset transfers and differing income and transfer-tax treatment. Verify the position against current BIR guidance and build tax indemnities for identified exposures.

3.6 Commercial, technology and IP

• Ownership of core software, codebase and relevant registered IP.
• Open-source usage and licence compliance; code escrow where relevant.
• Key customer and merchant contracts and standard terms.
• Information security certifications and incident history.

Confirm the company actually owns or validly licenses the technology it runs on, and that founder or contractor IP has been properly assigned.

4. Regulatory approvals and licence transfer: BSP, AMLC, NPC, SEC and BIR

Approvals are the critical path. Our firm position: engage regulators before you file, not after. Pre-filing meetings surface likely conditions, let you fix documentary gaps, and compress the review period. The approvals needed depend on the licence type and the deal structure.

4.1 BSP approvals by licence type

For BSP-licensed entities, a change in ownership or control is a supervisory event. In practice this means notification and, in many cases, prior BSP approval before the transaction can complete. Documentary requirements generally include ownership and control disclosures, fitness-and-propriety information for incoming owners, directors and officers, evidence of capital adequacy, and the incoming group’s AML/CFT program and business plan.

• E-money issuers. Expect scrutiny of the acquirer’s capacity to maintain float safeguarding, settlement arrangements and consumer protection obligations.
• Operators of payment systems (OPS). Continuity of participation arrangements and settlement risk management typically feature in the review.
• Virtual asset service providers (VASPs). These transfers draw the heaviest scrutiny; where a licence cannot be cleanly transferred, the acquirer may need to apply afresh, which extends the timeline. For anyone buying a crypto company in the Philippines, assume a full regulatory review and build it into the schedule.
• Remittance and transfer operators. Review focuses on continuity of agent networks, settlement and AML controls.

Verify the specific requirements and any applicable circular for the relevant licence type against current BSP issuances, as documentary requirements and thresholds vary by licence.

4.2 AMLC considerations

The AMLC’s concern is continuity. It expects the AML/CFT program to keep functioning through the ownership change, suspicious transaction reporting to continue uninterrupted, and any monitoring or KYC deficiencies to be remediated on a committed timeline. Prepare to demonstrate that the incoming owner has the capability and governance to maintain the program, and address AML compliance risks in the transaction through diligence findings, indemnities and a remediation covenant.

4.3 NPC and data privacy

Where personal data moves as part of the transaction, the NPC expects controllers to assess and manage privacy risk. Standard steps include conducting or updating a DPIA, confirming the legal basis for the transfer of customer data, reviewing and where necessary refreshing consent, updating privacy notices, and making any required NPC engagement. Clarify controller and processor roles for the post-closing structure, and plan customer communications so they align with deal confidentiality.

4.4 SEC and corporate filings

Mergers, increases or decreases in capital, and certain changes in ownership require SEC filings, and the mechanics are governed by the Revised Corporation Code. Foreign investment clearances may apply depending on the activity and the acquirer. Confirm the required corporate approvals, quorum and voting thresholds are achievable before relying on the structure.

4.5 BIR and tax clearances

Tax treatment and any clearances turn on whether the deal is a share or asset transfer. Factor in capital gains, documentary stamp tax, VAT on asset transfers where applicable, and any tax clearance steps relevant to the structure. Build the tax position into the purchase-price mechanism and the indemnity package.

Sample SPA regulatory condition (summarised), adapt and verify with counsel against current BSP, AMLC and NPC issuances: completion is conditional on receipt of all required BSP approvals or non-objection for the change in ownership or control of the target’s licences, in form and substance reasonably satisfactory to the buyer, without conditions that are materially adverse to the acquired business.

5. Deal structuring and SPA drafting checklist

Good drafting converts diligence findings into enforceable protection. For any fintech M&A Philippines transaction, the SPA should treat regulatory approval as the central gating event and allocate compliance risk clearly between the parties.

5.1 Conditions precedent and regulatory undertakings

Make the receipt of all required BSP approvals or non-objections, together with any necessary AMLC and NPC steps, express conditions precedent to closing. Add a regulatory-efforts covenant specifying who leads regulator engagement, how the parties cooperate on filings, and how materially adverse approval conditions are handled, including walk-away or price-adjustment rights. Interim covenants should keep the business running in the ordinary course and, critically, preserve AML/CFT and data-protection safeguards between signing and closing.

5.2 Escrow, purchase price adjustments and insurance

Use escrow or holdbacks sized to the regulatory and AML remediation risk uncovered in diligence. Consider a dedicated regulatory escrow that releases once remediation milestones are met and the regulator confirms the position. Warranty and indemnity insurance can supplement, but it rarely covers known regulatory deficiencies, so those remain for escrow and specific indemnities. Build purchase-price adjustments for working capital, float and any identified tax exposures.

5.3 Warranties, caps, baskets and tax indemnities

Secure robust warranties on licence status and compliance, AML/CFT program adequacy, data-protection compliance, and tax. Pair general warranties with specific indemnities for identified risks, particularly AML failures, data-privacy breaches and tax exposures, which should sit outside the general cap and basket. Calibrate caps, baskets and survival periods to the risk profile, with longer survival for tax and regulatory matters.

5.4 Transition planning and integration

Where the target relies on seller systems, people or licences during a transition, a transition services agreement (TSA) maintains continuity. For regulated fintechs, the TSA should preserve compliance functions, transaction monitoring, reporting and data handling, until the buyer’s own systems and, where needed, the buyer’s own licence are fully operational.

All sample clauses and headings above are illustrative only, adapt and verify with counsel against current issuances; this is general information, not legal advice.

6. Transaction timeline and practical filing steps per licence type

Sequence the deal so regulatory approval gates closing: LOI and exclusivity, then regulatory pre-engagement, then due diligence, then SPA signing, then regulatory filings, then closing, then post-closing compliance. Starting regulator engagement in parallel with diligence is the single most effective way to shorten the overall timeline.

6.1 Indicative timeline bands

Timelines vary significantly with licence type, deal complexity and the regulator’s workload, so treat the following as indicative planning assumptions rather than guarantees. In each case, confirm current processing expectations directly with the relevant regulator.

• E-money issuer sale (share sale): plan for a multi-month process driven by BSP review of the change in control.
• VASP transfer: expect a longer process where the regulator requires a full review or re-application; build in remediation time.
• Non-regulated asset sale: often shorter where no licence is involved and consents are straightforward.

6.2 Who to engage

Assemble local transaction counsel, a compliance auditor for AML and data diligence, tax advisers for the structuring decision, and BSP-facing specialists for pre-filing engagement. Early, coordinated engagement is what keeps a fintech acquisition Philippines process on schedule.

7. Post-closing integration and compliance roadmap

Closing is not the finish line for a regulated fintech. The first months after completion determine whether the deal’s compliance risk is contained.

7.1 A phased post-closing compliance checklist

• First phase (early days). Stand up or confirm transaction monitoring, continue suspicious transaction reporting without interruption, update NPC and internal data records, and begin agreed AML remediation.
• Second phase. Integrate KYC and monitoring systems, refresh privacy notices and consents where required, and file any post-closing reports or notifications with BSP and AMLC.
• Third phase. Complete priority remediation milestones tied to escrow release, confirm licence conditions are being met, and close out the TSA items that have transitioned to the buyer’s own systems.

For deeper treatment, see our related guidance on post-deal compliance covering AML and NPC integration and on BSP licence transfers for e-money issuers, which expand each stream into step-by-step workflows.

Conclusion: taking a position on fintech M&A Philippines in 2026

A successful fintech M&A Philippines transaction in 2026 is won before signing. Decide structure early using the decision framework above, run diligence as a disciplined punchlist across corporate, regulatory, AML, data, tax and IP, engage BSP, AMLC and NPC ahead of filing, and draft the SPA so that regulatory approval gates closing and escrow and indemnities absorb the compliance risk you uncover. Buyers who price regulatory remediation accurately and sellers who present a clean, well-documented compliance record consistently achieve faster, more certain outcomes. For bespoke pre-deal regulatory planning and SPA drafting on a fintech M&A Philippines transaction, consult the expert profile linked below.

For broader licensing context, see our Fintech licensing, Philippines (practical guide), and for tailored advice review the expert profile.

This guide is general information, not legal advice. Consult counsel for specific transactions.

Sources

1. Bangko Sentral ng Pilipinas (BSP)
2. Anti-Money Laundering Council (AMLC)
3. National Privacy Commission (NPC)
4. Securities and Exchange Commission (SEC), Philippines
5. Bureau of Internal Revenue (BIR)
6. Official Gazette, Republic Act No. 11232 (Revised Corporation Code)