BSP to banks: Tighten payment controls vs money laundering risks

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) has reminded banks and other supervised financial institutions to tighten controls over payment activities, including merchant accounts, payment aggregators and QR-enabled transactions, to prevent the financial system from being used for money laundering and other illegal activities.

In a memorandum, BSP Deputy Governor Bernadette Romulo-Puyat said all BSP-supervised institutions should make sure that their anti-money laundering and counter-terrorism and proliferation financing (AML/CTPF) controls remain effective and proportionate to risks across all payment activities.

The BSP said these controls should cover account opening, customer onboarding and ongoing account monitoring, especially as electronic fund transfers and retail payment use cases continue to expand through branches, online platforms, mobile apps, QR-enabled channels and other payment services.

“BSP-supervised institutions are enjoined to strictly ensure that their AML/CTPF controls, including account onboarding controls and ongoing account monitoring, remain effective and commensurate with risk across all payment activities,” the central bank said.

Under the directive, supervised institutions were reminded to comply with applicable AML rules under the Manual of Regulations for Banks and relevant provisions of the Manual of Regulations for Non-Bank Financial Institutions.

They were also told to observe expectations on merchant due diligence under the Manual of Regulations for Payment Systems, including merchant identification, risk assessment and monitoring.

The BSP said integrity controls for payment activities should be anchored on sound account opening, onboarding and monitoring practices.

These measures are meant to ensure that customer and account relationships remain consistent with their stated purpose, while allowing financial institutions to prevent, detect and respond to the possible misuse of accounts.

The central bank said banks and other supervised institutions retain primary responsibility for AML compliance in merchant payment activities, whether they act as the originating or receiving financial institution.

This responsibility remains even if payment transactions are coursed through payment aggregators or similar intermediaries. Payment aggregators are entities that facilitate the acceptance and processing of payment transactions for multiple merchants by allowing access to payment services, settlement systems or payment rails.

The BSP said payment aggregators and similar entities also carry independent responsibilities arising from their role in onboarding, monitoring and controlling sub-merchant access to payment services.

These include merchant due diligence, risk-based onboarding and monitoring, risk mitigation measures and suspicious transaction reporting.

The regulator also directed supervised institutions to implement measures to prevent and detect “mule merchants,” including the unauthorized use or misuse of QR codes by persons or entities other than the duly registered merchant.

In a separate statement, the BSP warned the public against dealing with unauthorized virtual asset service providers, which facilitate crypto-related activities such as exchange, trading, transfers, safekeeping and payments.

The central bank said transacting with unlicensed VASPs exposes consumers to possible loss of funds or assets due to fraud, limited legal recourse, lack of consumer assistance in cases of market misconduct and restricted access when government enforcement actions are taken against illegal operators.

The BSP said it would continue working with relevant government agencies and the private sector to monitor the market and restrict Filipinos’ access to unauthorized VASP platforms.