In brief
On 19 July 2024, pursuant to the National Payment Systems Act, the Bangko Sentral ng Pilipinas (BSP; Philippine Central Bank) issued Circular No. 1198, Series of 2024 on the Regulatory Framework for Merchant Payment Acceptance Activities (MPAA). The regulatory framework aims to establish standards and best practices to safeguard customer funds and protect merchants’ rights when dealing with operators of payment systems (OPS) engaged in MPAA.
BSP Circular No. 1198 took effect on 8 August 2024, 15 days after the circular’s publication in a newspaper of general circulation.
Key takeaways
BSP Circular No. 1198 provides for licensing and registration requirements applicable to OPS engaged in MPAA, as well as special rules related to settlement, operations, information technology, anti-money laundering, counter-terrorism financing, counter-proliferation financing of weapons of mass destruction, and end-user protection.
MPAA refers to services provided to a merchant to receive payment in exchange for goods and services. These include merchant acquisition; providing the means to accept payment instruments and collect, secure, transmit, and process payment information; and providing support services related to the payment.
Businesses engaged in MPAA should assess whether their current business models are covered by the new licensing requirements and obligations under BSP Circular No. 1198.
Quisumbing Torres can advise on the regulatory requirements under BSP Circular No. 1198, and assist in assessing existing business models and policies, with a view to ensuring compliance with this new regulation.
In more detail
Below are the salient terms of BSP Circular No. 1198:
1. Scope and applicability. The circular covers any OPS engaged in or intending to engage in MPAA in the Philippines. An OPS is considered engaged in MPAA in the Philippines if the OPS, merchant, or both, are located in the Philippines. A merchant refers to an end-user that uses MPAA.
2. Licensing and registration. An OPS that engages in or intends to engage in merchant acquisition must obtain a Merchant Acquisition License (MAL) from the BSP. An OPS with a MAL (OPS-MAL) must also comply with, on the date of the application, minimum capital requirements based on the entity’s average monthy value of collected funds transferred to merchants.
Merchant acquisition refers to the service of accepting and processing payment transactions on behalf of a merchant under an agreement, resulting in a transfer of funds to the merchant.
An OPS engaged in or intending to engage in MPAA other than merchant acquisition must also register with the BSP under existing regulations governing OPS.
An OPS with a concurrent banking or electronic money issuer-non-bank financial institutions (EMI-NBFI) license, as well as an OPS-MPAA under the regulatory jurisdiction of other local or foreign authorities or overseers of payment systems, must comply with the provisions of BSP Circular No. 1198 on payments to merchants, pricing mechanism, and reportorial requirements.
3. Governance. An OPS-MAL must have prudent payment acceptance and procedures for managing its relationship with merchants approved by its board of directors. These procedures include: (i) merchant due diligence, identification, risk assessment and monitoring; (ii) a written governing agreement between each merchant and the OPS-MAL to cover the business relationship; and (iii) a dispute resolution framework for prompt and effective resolution of cases with merchants and third-party service providers.
In addition, an OPS-MAL should maintain designated accounts with a BSP-supervised financial institution where funds received/collected on behalf of merchants are segregated from the OPS-MAL’s own funds.
4. Reportorial requirements. An OPS-MPAA must comply with existing reportorial requirements applicable to an OPS. In addition, an OPS-MPAA must periodically submit secondary reports to the BSP such as annual audited financial statements, statistics related to the MPAA, and notices of significant changes in the OPS-MPAA’s operations.
5. Operational risk. An OPS-MPAA is responsible and accountable for services outsourced to third-party service providers, such as by conducting due diligence of such third parties. An OPS-MPAA should also design and implement information technology risk management that is risk-based and commensurate with the size, nature, types of products and services, and complexity of the OPS-MPAA’s information technology operations.
6. Anti-Money Laundering/Countering Terrorism and Proliferation Financing (AML/CTPF). An OPS-MPAA will adhere to and comply with the Philippine Anti-Money Laundering Act, the Terrorism Financing Prevention and Suppression Act of 2012, and targeted financial sanctions-related laws and regulations.
7. End-user protection. An OPS-MPAA will be considered as a BSP-supervised institution and must have mechanisms in place to ensure the safety of end-users that comply with existing financial consumer protection laws such as the Financial Products and Services Consumer Protection Act and related regulations.
* * * * *
Please contact QTInfoDesk@quisumbingtorres.com for inquiries.
