Open a popular offshore betting or prediction app from a phone in Manila and the deposit screen offers a QR Ph code, scannable with GCash or Maya, under a merchant name that could belong to a sari-sari store. The platform has no Philippine license and no Philippine bank account. It needs neither. A local aggregator holds the merchant account, collects the pesos, converts them and settles offshore. The wallet on the other side of the transaction sees the aggregator and nothing else.
That arrangement is what the Bangko Sentral ng Pilipinas (BSP, Central Bank of the Philippines) now proposes to end. A draft circular circulated this month rewrites the rules for merchant acquiring. Gambling operators, gaming platforms and affiliates that touch player funds, licensed crypto businesses, money changers and adult-content sellers could be acquired only under a direct merchant arrangement, meaning the BSP-supervised acquirer must hold the contract with the actual platform, verify its owners, set its limits and watch its transactions itself. A merchant could no longer be rated low risk if the party that ends up with the proceeds would be rated high. Intermediaries could not sub-delegate acquiring to create a second tier; every transaction would need a unique merchant identifier or be rejected. A National QR Code Merchant Database would record who really sits behind each code and push status changes to every wallet and bank in the system. New payment-operator registrations would pause for a year while the BSP sorts out its taxonomy. Existing institutions would get six months to audit their books and six more to fix them.
Arden Consult supports this. The reason is the same one we gave in July 2025, when Congress was flirting with a total ban on online gambling. Licensed operators were already heavily regulated. The illegal market enjoyed the same access to Filipino wallets with none of the obligations. Over the past year PAGCOR, the gaming regulator, first made legal operation viable (license fees fell from above 50% of gross gaming revenue to 30%) and then made it demanding, with tougher player checks, advertising pre-clearance, accreditation of the B2B supply chain and a minimum guaranteed fee. When the BSP ordered gambling links out of e-wallet apps in August 2025, licensed online transactions fell by about half almost overnight. The offshore sites lost nothing; their aggregators kept working. Alejandro Tengco, PAGCOR’s chairman, put the point plainly at ICE Barcelona in January. “The greatest threat to both regulators and licensed operators is not higher standards,” he said; the threat was the continued presence of illegal and unregulated actors.
Payments are where that fight is won or lost. Demand for a bet or a token does not vanish when a regulator frowns; it flows down whichever rail is open. The estimates we have are directional, but they move the right way. In August 2025 Mr. Tengco told Congress that more than 60% of Philippine online gambling was illegal. By December, figures he cited put the licensed share above half. Payment enforcement did much of that work. GCash and the government’s cybercrime center reported cutting off more than 3,200 merchants linked to illicit activity in March 2026. The draft turns that ad hoc pruning into a rule.
Other countries reached the same conclusion and learned the hard lessons first. America’s Unlawful Internet Gambling Enforcement Act of 2006 told banks to stop processing bets. The banks complied. The poker sites hired processors who recoded deposits as purchases of golf balls and jewelry, until the Justice Department indicted them in 2011. “We had to do this type of deception,” one processor for PokerStars and Full Tilt told a New York court when he pleaded guilty the following year. Norway banned payments to unlicensed gambling sites in 2010, then admitted nearly a decade later that about NOK6bn ($660m) a year was still leaking out through intermediaries that masked the payments; in 2020 it gave its regulator power to block by company and intermediary, whatever the label on the transfer. Brazil, launching a licensed betting market in 2025, skipped that decade. Because its central bank runs Pix, the instant-payment system that carries nearly all betting money, it simply ordered payment firms to report and close the accounts of unlicensed operators.
The BSP’s draft reads as if someone had studied all three. It attacks the label game directly, by looking through the merchant name to the ultimate beneficiary, and it uses the BSP’s control of the national QR standard the way Brazil used Pix. It also fits the architecture the BSP and the Securities and Exchange Commission (SEC) have been building for crypto. Circular 1108 of 2021 requires virtual-asset service providers (VASPs) to clear and settle only within an unbroken chain of regulated entities. Memorandum M-2026-003, issued in January, told banks and wallets to deal only with BSP VASPs, SEC-registered crypto-asset service providers or foreign firms licensed at home, and barred direct retail access to offshore exchanges. The draft carries the same logic from VASP clearing into merchant acquiring.
Nor is compliance a fantasy. Binance, the world’s largest crypto exchange, began its supervised return to the Philippines this year through BlockShoals, an SEC-registered intermediary in the Commission’s sandbox, with a BSP-licensed VASP handling every peso in and out. (Arden advised throughout, so discount our enthusiasm accordingly.) The SEC’s notice to proceed carried more than fifteen conditions. It took two years. The door is heavy, and it opens. An offshore platform that has looked at that door and preferred a generic QR code has told regulators what it thinks of their rules.
Now the caveats, because the method has failed elsewhere when applied carelessly.
The first danger is that acquirers exit categories wholesale. America has a name for that too. Under Operation Choke Point, from 2013, the Justice Department and the FDIC pressed banks over a list of “high-risk” merchant categories that put payday lenders and gun shops alongside Ponzi schemes; lawful firms lost their accounts, and by 2015 the FDIC had rescinded the list and told banks to judge case by case. The Financial Action Task Force has said since 2014 that the “wholesale cutting loose of entire classes of customer” is a failure of the risk-based approach, because it pushes money into channels nobody can see. The BSP’s categories are risk labels. A compliance officer asked to certify a merchant book under oath will be tempted to read them as prohibitions, and payment firms already decline transfers when a counterparty’s name contains a word like “bet.” The BSP should say, in the final text or in guidance, what the draft implies. A PAGCOR-licensed operator, a BSP VASP or an SEC CASP has passed the probity and fit-and-proper tests its regulator demands and posted capital against its conduct; an acquirer that refuses such a merchant on category alone is doing exactly what the FATF standard forbids.
The second is the database. A shared registry that broadcasts every suspension to every wallet is powerful, and Mastercard’s MATCH list shows what happens when the power runs ahead of due process. A merchant listed there stays for five years; Mastercard does not arbitrate disputes; only the acquirer that filed the entry can withdraw it, and acquirers rarely do, for fear of liability to the next acquirer. Merchants have been listed because their names resembled someone else’s. The draft says the BSP will approve a “correction and dispute process.” It should be quick, and it should not run through the institution that filed the entry. A suspicion flag at one wallet should prompt a review elsewhere; the draft says as much, and the final text should hold that line against automatic termination. The build timetable (an interim repository in 90 days, production in a year, full migration in 15 months) is brisk by the standards of national registries anywhere. Acquirers will act long before the database exists, so the interim reference should be the registers that already exist, starting with PAGCOR’s published list of licensees and accredited suppliers and the BSP’s roster of VASPs.
The third is friction on the legal product. The draft lets acquirers set “appropriate transaction and settlement limits” for high-risk merchants. Set too low, those caps recreate the harm the circular is meant to cure. The Netherlands tightened deposit rules on licensed sites and watched the legal market’s share of gambling revenue slide toward half, with players drifting to operators the rules did not touch. Limits should be sized to each merchant’s verified profile, which is what enhanced due diligence is for. The displaced flow will also go somewhere. In Brazil it went to rented “orange accounts,” individuals’ bank accounts used as pass-throughs. The BSP’s own rules against mule accounts under the Anti-Financial Account Scamming Act must move in step, or the circular will win the merchant fight and lose the personal-account one.
The e-wallet is how Filipinos pay, and for years it has funded platforms that answer to no Philippine regulator… The firms that remain outside have made a choice, and the rails should stop paying for it.
A fourth is smaller. A twelve-month pause on new payment-operator registrations also freezes the compliant entrants the market needs; a year is tolerable, longer is not, and the BSP should clarify whether already-registered operators may still apply for merchant-acquisition licenses in the meantime. The word “affiliates” in the high-risk list should be read as the draft qualifies it, to catch those handling player money and no wider. Game studios and testing labs do not move pesos.
None of this argues for delay. The e-wallet is how Filipinos pay, and for years it has funded platforms that answer to no Philippine regulator. Every license the offshore operators would need is already on offer. The firms that remain outside have made a choice, and the rails should stop paying for it.
ABOUT ARDEN CONSULT
Arden Consult is a premier legal and regulatory advisory firm with cross-sector expertise in iGaming, fintech, digital assets, and technology, media, and telecommunications (TMT). The firm advises clients on regulatory authorization, compliance frameworks, market entry, and stakeholder engagement across Philippine regulators including the SEC, BSP, PAGCOR, AMLC, and NTC.