Two Ways to Obtain Cryptocurrency Licenses in the Philippines: BSP VASP & SEC CASP
In the Philippines there are currently two regulators that govern the issuances of licenses to cryptocurrency exchanges: the Bangko Sentral ng Pilipinas (BSP) through BSP Circular 1108, Virtual Asset Service Provider (VASP) and the Securities and Exchange Commission (SEC) through the SEC CASP (Crypto Asset Service Provider) under Memorandum Circular (MC) 04-2025 and 05-2025, effective 5 July 2025.
Overview
In the Philippines, there are two parallel cryptocurrency licensing regimes. The BSP has licensed VASPs since BSP Circular No. 1108 took effect on January 26, 2021. But the BSP has frozen new VASP licenses since September 2022 and extended that moratorium indefinitely from September 1, 2025.
The SEC issued the new CASP Rules (MC 04-2025 and Operational Guidelines MC 05-2025) on May 30, 2025. This took effect on July 5, 2025, capturing crypto-asset service providers offering tokens that are securities or conducting public offerings or marketing.
In 2026, the reality is that new BSP VASP applications are not being accepted. If a crypto provider wanted to enter the market, they would have to do it in two ways: through the SEC CASP or by acquiring one of the 13 BSP-licensed VASPs (PDAX, Coins.ph, Maya, UnionBank, GCrypto, and others) on the register of the BSP.
Cryptocurrency Regulators
The BSP issues licenses for VASPs under BSP Circular No. 1108, amending the Manual of Regulations for Non-Bank Financial Institutions (MORNBFI). Activities included in the scope exchanges between virtual assets (VAs such as cryptocurrency) and fiat (money like Philippine pesos), exchange between VAs, transfer of VAs, safekeeping or administration of VAs and provision of financial services related to issuer offers. The Philippine SEC licenses CASPs under the SEC Rules on Crypto-Asset Service Providers (MC 04 / 05-2025). An exchange between cryptocurrency assets that are securities and converting to or from Philippine pesos needs both BSP VASP and SEC CASP registration.
Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) obligations are supervised by the Anti-Money Laundering Council (AMLC). Tax administration falls under the responsibility of the Bureau of Internal Revenue (BIR), with corporate registration supported by the Department of Trade and Industry (DTI).
Track 1: BSP VASP under Circular 1108
BSP Circular 1108 requires minimum paid-up capital for two capital tiers (see Table 1 below). BSP Circular 1108 also requires fit-and-proper directors and senior officers, an AML/CFT program aligned with AMLC rules and BSP issuances, the Travel Rule, technology-risk management, and a progressive customer-protection framework.
Table 1: Capital Tiers
Tier | Activities | Minimum Paid-Up Capital |
Type A | With safekeeping and/or administration of VAs (custody) | PHP 50,000,000 |
Type B | Without safekeeping/administration of VAs | PHP 10,000,000 |
Application Fees (BSP VASP)
The application fees below are set alongside the paid-up capital requirements in Table 1 above and the ongoing cost base for AMLC compliance, external audit, and technology-risk management.
Filing fee: PHP 1,000 (non-refundable), payable on submission.
Registration fee: PHP 100,000 on grant of the VASP authority.
Annual supervisory fee: PHP 300,000, payable each year a VASP holds the BSP authority.
SEC CASP registrants pay separate SEC filing fees scaled to paid-up capital under the SEC Memorandum Circular No. 03-2020 schedule.
Enforcement Against Unregistered Cryptocurrency Operators
Operating a VASP or CASP in the Philippines without the necessary BSP or SEC authority is treated as an unauthorized financial activity. On August 25, 2025, the SEC publicly flagged five unregistered crypto platforms, while the BSP issued a reminder to banks and financial firms not to transact with unregistered VASPs. Penalties under the General Banking Law, the Securities Regulation Code and the Anti-Money Laundering Act include monetary fines, cease-and-desist orders, asset freezes by the AMLC, and criminal liability for respective company officers. Foreign exchange platforms catering to Filipino residents without SEC CASP registration fall within the same enforcement jurisdiction. Moreover, CASP Rrules apply extraterritorially where marketing targets the Philippine public.
BSP Moratorium Extended Indefinitely
The Bangko Sentral ng Pilipinas (BSP) imposed a three-year freeze on new VASP licenses from September 1, 2022. The freeze was extended indefinitely by BSP Memorandum dated August 20, 2025. This was effective from September 1, 2025, and cited consumer protection and cybercrime concerns. The Monetary Board approved the extension of the freeze, and the BSP indicated it will “periodically review” the freeze in line with industry and global trends. New BSP VASP applications are currently not being accepted.
Practical Market-Entry Options
To enter the Philippine market as a cryptocurrency exchange, you have three market entry options:
- Acquire an existing BSP-licensed VASP. The BSP register currently lists about 13 VASPs.
- Operate under SEC CASP if the activities fall under the jurisdiction of the SEC and do not require BSP licensure (e.g., security-token offerings without Philippine peso or other fiat currency conversion).
- Wait for the periodic review of the BSP on the freeze, and ensure a file is ready for the moment the freeze is lifted.
Track 2: SEC CASP under Memorandum Circular 04-2025 and 05-2025
SEC Memorandum Circular No. 04, Series of 2025 (Rules on Crypto-Asset Service Providers) and SEC MC No. 05, Series of 2025 (Operational Guidelines) were issued on May 30, 2025, and took effect on July 5, 2025.
Key Requirements
- Entity: SEC-registered domestic stock corporation.
- Minimum Paid-Up Capital: PHP 100,000,000 in cash or property, excluding crypto-assets.
- Physical office in the Philippines
- Robust AML/CFT program aligned with Anti-Money Laundering Council (AMLC) rules
- Public offering and marketing of crypto-assets subject to CASP Rules, disclosures, risk warnings. There should be no misleading marketing.
High-Level Checklist
Below is a high-level checklist, or the major requirements to obtain and keep a crypto license, for both the BSP and the SEC:
- Domestic stock corporation registered with the SEC, with a physical office in the Philippines
- Minimum Capital Requirements Satisfied: PHP 10M (BSP Type B), PHP 50M (BSP Type A), or PHP 100M (SEC CASP)
- Fit-and-proper directors and key officers; controlling-shareholder review
- AML/CFT program aligned with AMLC, BSP Manual, or SEC CASP rules
- Travel Rule integration for VA transfers.
- Customer protection framework, disclosures, complaints, and suitability assessment
- Technology-risk management framework, custody architecture, and segregation
- Three-year business plan, financial projections, and AML risk assessment
- File application: BSP via the Manual of Regulations process (currently frozen) or SEC via the new CASP rules
- Post-licensing: ongoing reporting, periodic on-site inspections, and AMLC compliance
Process and Timeline
The table below lays out the time it takes for each step in the application process for both the BSP and the SEC.
Step | BSP VASP | SEC CASP |
Pre-application, entity, capital, AML program | 3–6 months | 4–6 months |
Regulator review | 6–12+ months (frozen) | 5–12+ months (settling) |
Total Realistic Timeframe | Frozen | 9–18+ months |
AMLC registration, CTR/STR Thresholds and the Travel Rule
Both BSP-licensed VASPs and SEC-registered CASPs are covered persons under the Anti-Money Laundering Act. Covered-person registration with the AMLC are required for both the BSP and SEC license; it is not optional. The program must be risk-based, board-approved, independently reviewed, and aligned with AMLC issuances as well as the BSP Manual or the SEC CASP rules applicable to the license held.
Reporting requirements are divided into to kinds of reports: Covered Transaction Reports (CTRs) and Suspicious Transaction Reports (STRs). Single transactions above the AMLA threshold trigger a CTR within the reporting window set by AMLC rules, while STRs are triggered by red-flag indicators regardless of amount. Record-keeping requirements run for five years at minimum, and the AMLC has direct power to freeze assets of covered persons. A missed or late CTR is treated as an administrative breach, while a missed STR where indicators were present is read as a governance failure and scored against the AML compliance officer’s fit-and-proper file.
On the FATF Travel Rule, BSP Circular 1108 already requires VASPs to obtain, transmit, and preserve originator and beneficiary information on virtual asset transfers above the regulatory threshold, in line with FATF Recommendation 16. SEC CASPs under MC 04-2025 and MC 05-2025 must run an AML/CFT program aligned with AMLC rules within which Travel Rule integration is assumed.
Practical implementation routes include IVMS-101 messaging, sunrise-issue mitigations for non-compliant counterparty VASPs, and sanctions screening calibrated to the AMLC and OFAC lists. The AML compliance officer, appointed in writing and cleared by the regulator, signs off on Travel Rule policy and on counterparty due diligence used to accept or reject transfers.
Bank Account Access: A Real Source of Bottlenecks
A license as a VASP or CASP is necessary but not sufficient for crypto exchanges. Philippine banks apply enhanced due diligence to VASPs and CASPs under BSP AML guidance, and even applicants who already have licenses routinely see 3–6-month onboarding cycles, monitored-account conditions, limited U.S. dollar corridors, and declined correspondent-bank relationships. Since BSP’s August 2025 reminder to financial firms not to transact with unregistered VASPs, banks have tightened both sides: they verify license status against the BSP register and the SEC CASP list before opening operating accounts.
DOPAY as a Cryptocurrency Provider (VASP)
DOPAY, through its parent company WIBS PHP INC., is regulated by the Bangko Sentral ng Pilipinas (BSP) and has licenses as an Electronic Money Issuer (EMI) and as a Virtual Asset Service Provider (VASP).
Powered by blockchain technology, DOPAY provides payment, remittance, and financial accessibility through electronic money issuance with its E-Wallet and cryptocurrency exchange with its Crypto Wallet.
DOPAY is an easy-to-use and convenient app that safeguards your information and your money through the policies and procedures required by the BSP.
DOPAY protects its customers through its complaints and disclosures procedures, its constant technology risk assessments, its compliance with BSP rules and regulations, and its religious observance of post-licensing reporting and compliance.
With DOPAY, any Filipino with the app and an approved account can send funds, receive remittances, and trade cryptocurrencies. Moreover, freelancers, BPO owners, and SMEs can hold, receive, and transfer funds and payments in global currencies through DOPAY’s large wallet sizes. App users such as digital content creators can receive payment of influencer services without exchange rate fees by utilizing the global account features of the DOPAY app.
Download the DOPAY app today!
