How Can Crypto Startups Obtain BSP VASP Licenses?
Introduction
Cryptocurrency exchanges and other virtual asset businesses in the Philippines are subject to Bangko Sentral ng Pilipinas (BSP) supervision when they perform activities falling within the definition of a Virtual Asset Service Provider (VASP). A startup that exchanges virtual assets, transfers them for customers, or safeguards customer wallets cannot lawfully operate on the assumption that ordinary business registration alone is sufficient.
The principal regulatory concerns are BSP authorization, minimum capitalization, anti-money laundering and counter-terrorist financing controls, cybersecurity, governance, and consumer protection. The applicable rules are found principally in the BSP’s consolidated regulations for money service businesses and VASPs.
What Is a Virtual Asset Service Provider?
Under the BSP’s current rules, a VASP is regulated as a type of money service business when it performs covered virtual-asset activities in the Philippines. These activities generally include the exchange of virtual assets, the transfer of virtual assets, and the safekeeping or administration of virtual assets or instruments that enable control over them.
The BSP treats VASPs as money service businesses because the conversion of fiat currency into virtual assets can enable the rapid transfer of funds. VASPs are therefore subject to the BSP’s regulatory and examination powers under the New Central Bank Act, as amended by Republic Act No. 11211. See [BSP Circular No. 1206 (2024)](#I4.32).
The rules do not cover every business connected with virtual assets. Businesses involved in financial services relating to an issuer’s offer or sale of a virtual asset fall within the jurisdiction of the Securities and Exchange Commission, while an entity acting solely for its own account is generally outside the VASP rules if it is not actively facilitating virtual-asset activities for others. [BSP Circular No. 1206 (2024)](#I4.32).
What BSP Authorization Is Required?
A VASP must secure a Certificate of Authority (COA) to operate as a money service business. The BSP evaluates the applicant’s compliance with the applicable registration requirements, including the fitness and propriety of its beneficial owners.
The applicant must also follow the BSP registration procedures and submit the required application documents, including the application for registration and notarized deeds of undertaking. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2949).
The company should therefore determine its regulatory classification before launching its platform, accepting customer funds, listing assets, or offering wallet and transfer services. Incorporation with the Securities and Exchange Commission does not, by itself, authorize the company to conduct regulated VASP activities.
Minimum Capitalization Requirements
The minimum paid-in capital depends on whether the VASP provides safekeeping or administration services for virtual assets.
| VASP activity | Minimum paid-in capital |
|---|---|
| VASP providing safekeeping or administration services for virtual assets, including custodial wallet services | PHP 50 million |
| VASP not providing safekeeping or administration services | PHP 10 million |
The distinction is significant. An exchange that merely facilitates transactions may fall within the lower capitalization category if it does not hold or administer customer virtual assets. By contrast, a platform that controls customer wallets, private keys, or comparable instruments enabling control over virtual assets may be treated as a custodial VASP and become subject to the PHP 50 million minimum.
The company should not characterize itself as non-custodial merely because customers can technically withdraw their assets. The actual operation of the platform, including who controls the wallets, private keys, and transaction process, should be examined. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2949).
Anti-Money Laundering Requirements
VASP licensing is inseparable from anti-money laundering (AML), counter-terrorist financing (CTF), and proliferation-financing controls. The BSP’s VASP rules expressly require compliance with the applicable AML provisions of the Manual of Regulations for Non-Bank Financial Institutions, including Sections 601-N and 602-N. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2949).
In practical terms, a compliant crypto startup should establish controls addressing at least the following matters:
- Customer identification and verification: the platform should identify customers and verify relevant information before permitting regulated transactions.
- Beneficial-owner identification: the startup should determine who ultimately owns or controls a customer account or business relationship.
- Risk classification: customers, products, transactions, and geographic relationships should be assessed according to their money-laundering and terrorism-financing risks.
- Transaction monitoring: the platform should monitor activity for unusual transaction patterns, rapid movement of assets, structuring, use of high-risk jurisdictions, and other indicators requiring review.
- Suspicious transaction reporting and recordkeeping: the startup should maintain records and make reports required by applicable AML laws, regulations, and supervisory rules.
The exact procedures must be adapted to the company’s business model. A custodial exchange, a remittance-oriented virtual-asset platform, and a broker that does not hold customer assets may face different operational risks even though all may fall within BSP supervision.
The BSP has recognized that virtual assets present heightened risks because of anonymity, transaction speed, price volatility, and global accessibility. The regulatory approach is intended to prevent the Philippine financial system from being misused for money laundering, terrorism financing, and proliferation financing. [BSP Circular No. 1108 (2021)](#I1.1).
Governance, Risk Management, and Technology Controls
VASP applicants must comply not only with capitalization and AML requirements but also with requirements concerning governance, outsourcing, liquidity risk, operational risk, information-technology risk, business continuity, internal controls, and financial consumer protection. These obligations are expressly identified in the BSP’s VASP regulations. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2949).
A startup should prepare written policies and evidence addressing:
- board and senior-management responsibility for compliance;
- segregation of duties between technology, operations, compliance, and finance;
- cybersecurity and wallet-security controls;
- incident response and business-continuity procedures;
- outsourced service-provider supervision;
- complaint handling and customer disclosures; and
- internal audit, compliance testing, and reporting to management.
For wallet services, the platform must maintain an adequate cybersecurity program and appropriate safeguards for the confidentiality, integrity, and availability of information processed by the virtual-asset system. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2949).
Does the National Payment Systems Act Apply?
A crypto business may also encounter payment-system regulation depending on how its products are structured and whether it operates or participates in a designated payment system. Under the National Payment Systems Act, an operator of a designated payment system must secure a certificate of authority from the Monetary Board before the Securities and Exchange Commission may register its articles of incorporation or issue a license to do business. [Republic Act No. 11127](#L2.14).
VASP authorization and payment-system authorization are not automatically interchangeable. A startup should analyze separately whether its services involve a regulated payment system, remittance or money-service activity, securities-related activity, or another regulated financial service.
Foreign Ownership and Corporate Structure
Foreign investment is not automatically prohibited merely because the business involves virtual assets. The permitted ownership structure depends on the precise activity, applicable nationality restrictions, land ownership issues, and the rules governing financial and payment services.
For example, Republic Act No. 10881 permits financing companies and investment houses to be owned up to 100 percent by foreign nationals, subject to the law’s conditions and the continuing regulatory powers of the BSP. That statute does not, by itself, determine whether a particular crypto exchange may be foreign-owned or whether it is properly classified as a financing company or investment house. [Republic Act No. 10881](#L4.4).
Foreign companies that transact business in the Philippines must also consider Philippine registration and licensing requirements. A foreign corporation doing business without the required authority may face limitations on its capacity to sue, although the legal effect depends on the facts and the applicable corporate law. [Home Insurance Company v. Eastern Shipping Lines, et al., G.R. No. 34382, 1983](#J2.9).
Are New VASP Licenses Currently Available?
The BSP previously closed the regular application window for new VASP licenses for three years beginning September 1, 2022, subject to reassessment based on market developments. The cited BSP material identifies that period as a moratorium on new licensing applications. [Manual of Regulations for Non-Bank Financial Institutions (2023)](#I5.2946).
Because that three-year period ended on September 1, 2025, a startup should not assume that licensing is automatically open or that the earlier moratorium has been extended. Before incurring substantial launch expenses, the applicant should obtain confirmation from the BSP regarding the current application window, documentary requirements, and any subsequent issuance affecting new VASP applicants.
Typical Startup Scenarios
Non-custodial exchange
A platform that matches buyers and sellers but does not hold customer assets may potentially qualify for the PHP 10 million minimum capitalization category. This conclusion depends on the actual technical and operational design of the platform, not merely on how the company describes itself.
Custodial exchange
An exchange that holds customer virtual assets, controls private keys, or administers customer wallets will generally need to prepare for the PHP 50 million minimum paid-in capital requirement and more extensive custody, cybersecurity, reconciliation, and operational controls.
Virtual-asset payments business
A company that converts virtual assets into fiat currency or facilitates transfers may be treated as a money service business and may also raise issues under the National Payment Systems Act, depending on its role in the payment arrangement. A separate regulatory analysis is required before launch.
Token issuer or investment product
A business involved in the offer or sale of a virtual asset, or in financial services connected with that offer or sale, may fall within SEC jurisdiction rather than solely within the BSP VASP rules. The classification depends on the rights attached to the token and the nature of the services offered.
Recommended Licensing Preparation
Before filing an application, a crypto startup should complete the following steps:
- Map every product and transaction flow, including fiat on-ramps, crypto transfers, custody, staking, lending, and wallet services.
- Determine whether the company is a VASP, a payment-system operator, a securities-related entity, or a combination of regulated businesses.
- Confirm the appropriate minimum paid-in capital based on whether the company safeguards or administers customer assets.
- Prepare AML, customer-identification, beneficial-owner, transaction-monitoring, reporting, and recordkeeping policies.
- Establish governance, cybersecurity, wallet-security, outsourcing, business-continuity, and consumer-protection controls.
- Review ownership, foreign-investment, corporate-registration, tax, and data-protection implications.
- Confirm with the BSP whether applications for new VASP Certificates of Authority are being accepted and what current forms and documentary requirements apply.
Conclusion
Operating a cryptocurrency exchange in the Philippines requires more than SEC incorporation and a functioning technology platform. A covered business must obtain BSP authorization as a VASP, satisfy the applicable capitalization requirement, and demonstrate effective AML, cybersecurity, governance, operational-risk, and consumer-protection controls.
The principal financial threshold is PHP 50 million for a VASP that provides safekeeping or administration services and PHP 10 million for a VASP that does not. The final classification depends on the company’s actual activities, custody arrangements, customer relationships, and transaction flows.
Startups should complete a regulatory classification and product-risk assessment before accepting customers or customer assets. They should also verify the BSP’s current licensing position, since the earlier three-year moratorium on new VASP applications ran from September 1, 2022, and was scheduled to end on September 1, 2025.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
