Custodial wallet / SaaS in Philippines
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Philippines with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Register as a VASP with BSP under Circular 1108 (or as a CASP with SEC if the custody assets involve securities tokens)
- Maintain a written AML/CTF program compliant with the AMLA as supervised by the Anti-Money Laundering Council (AMLC)
- Perform customer due diligence (CDD) and know-your-customer (KYC) on all end users of the custodial wallet
- Report covered transactions and suspicious transactions to the AMLC as required under the AMLA
- Submit regular reports to the SEC and AMLC with detailed documentation at least 30 days prior to any activity (if registered as a CASP)
- Maintain transaction monitoring and record-keeping systems for fund flows between the SaaS operator and white-label clients
Key Restrictions
- New VASP licenses are frozen indefinitely as of 2025 — only existing licensees or grandfathered applicants can operate
- Must maintain PHP 50M minimum capitalization for a VASP license (or PHP 100M if also registered as a CASP with SEC)
- 60% Filipino ownership may apply to the local entity
- Must have a physical incorporation and local office in the Philippines
- SaaS operator (custodian) bears primary AML/CTF compliance responsibility; white-label clients may also have separate registration obligations depending on their own activities
- Custodial wallet services that touch securities tokens require dual registration as VASP (BSP) and CASP (SEC) under the split oversight framework
Key Risks
- VASP license moratorium means no new entrants can obtain a license — only viable path is partnership with an existing licensed VASP or acquisition of a licensed entity
- Aggressive enforcement against unlicensed operators — Binance was geo-blocked in 2024, and 50+ platforms (Coinbase, Gemini, OKX, Bybit, KuCoin) were ordered blocked in 2025 by BSP/NTC for operating without authorization
- Regulatory ambiguity around whether custodial wallet + SaaS model requires VASP-only classification or dual VASP + CASP registration if the wallet supports tokenized securities
- White-label client's activities may trigger their own licensing obligations, creating chain-of-compliance risk for the SaaS provider
- Penalties include website/app blocking, cease-and-desist orders, and criminal complaints for non-compliance
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SEC Philippines — Securities token oversight, warnings against unlicensed offerings
BSP Circular 1108 (2021) — VASP licensing framework
VASP: VASP License from BSP (Circular 1108/2021). PHP 50M (~$900K USD) minimum capitalization. 6-12 months. BSP imposed moratorium on new VASP licenses in 2022 to assess existing licensees; partially lifted 2024. Coins.ph and PDAX are major licensed operators. 60% Filipino ownership may apply.
CUSTODY: Included under VASP license; IT risk management requirements
Oversight splits: BSP handles custody, exchanges, on/off-ramps, and payment roles via Circular 1108; Securities and Exchange Commission (SEC) governs issuance, marketing, and trading under its Crypto-Asset Service Provider (CASP) regime.
Crypto asset service providers (CASPs) must register with the Philippine Securities and Exchange Commission (SEC) and maintain a minimum capital of ₱100 million with physical incorporation in the Philippines
Strict compliance with anti-money laundering (AML) procedures is mandatory
CASPs must submit regular reports to the SEC and the AML Council with detailed documentation 30 days prior to any activity
New VASP licenses are frozen indefinitely as of 2025, prioritizing existing licensees.
Entity: Binance (world’s largest crypto exchange).
Entities: ~50 platforms including Coinbase, Gemini, and overlaps like OKX/Bybit/KuCoin (unlicensed virtual asset service providers/VASPs).
Violation: Operating without BSP authorization (BSP Circular No. 1108 for VASP regulations); non-compliance with AMLA via AMLC oversight.
Penalty: NTC directive to ISPs for website/mobile app blocks (effective by December 25, 2025 via PLDT/Smart/Globe); part of broader risk controls for money laundering/terrorist financing.
SEC Advisory (August 4): https://www.binance.com/en/square/post/27892371667002; https://bitpinas.com/regulation/sec-flags-10/
AMLA/AMLC for VASPs: https://fincrimecentral.com/sec-philippines-crypto-platforms-compliance/; https://www.lightspark.com/knowledge/is-crypto-legal-in-philippines
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet / SaaS operator can serve PH residents only by partnering with or acquiring a licensed VASP (since new VASP licenses are frozen), maintaining local incorporation with PHP 50M-100M capital, and complying with BSP/SEC AML obligations; pure custody falls under BSP oversight but assets involving securities tokens trigger dual BSP + SEC CASP registration.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?