Any founder currently waiting on a payment-operator license from the Bangko Sentral ng Pilipinas just got a very concrete reason to worry about timing. On September 7, the BSP released a draft circular proposing a full 12-month freeze on new Operator of Payment System (OPS) registrations — a pause the central bank says it needs to conduct a “holistic review” of how it classifies and licenses payment operators across the board.
The freeze itself is the headline, but it’s only one piece of a broader tightening that touches crypto platforms, remittance providers, and the banks and payment companies that serve them.
What Actually Stops and What Doesn’t
If finalized as drafted, the circular would take effect 15 days after publication and halt new OPS applications outright for a full year. Applications already submitted before the freeze begins wouldn’t be rejected, but they wouldn’t be approved either — they’d sit in a holding pattern until the BSP completes its review and the freeze lifts. For any startup that hasn’t yet filed, the message is blunt: the door closes for a year the moment this circular is finalized, with no stated fast-track or exception process described in the draft.
Virtual asset service providers get singled out for the strictest treatment. Under the proposal, VASPs would be classified as high-risk alongside gambling platforms and certain money service businesses, and BSP-supervised banks and payment institutions would only be allowed to serve them through direct merchant relationships — no intermediary layers, no reseller arrangements sitting between a crypto platform and its banking partner. That direct-relationship requirement comes bundled with mandatory enhanced due diligence, continuous transaction monitoring, and settlement or transaction limits specific to high-risk categories. Unregistered and offshore crypto platforms would be explicitly cut off from accessing local payment rails at all — a provision aimed squarely at the gray-market exchanges Filipino users currently access through VPNs or informal channels rather than a BSP-licensed local platform.
This isn’t an isolated move. Earlier in 2026, the BSP had already frozen new VASP licensing indefinitely, banned privacy-focused cryptocurrencies from every licensed Philippine platform, and tightened listing and monitoring standards for existing exchanges — a pattern of the regulator moving to consolidate and control a fast-growing payments and crypto sector rather than continuing to expand who’s allowed to operate in it. This September 7 draft reads as the broadest of those moves so far, since it reaches beyond crypto specifically into the entire OPS licensing category that covers conventional e-wallets, payment gateways, and remittance operators alongside virtual asset platforms.
A Database That Follows the Money to a Name
The draft’s other major component is a proposed National QR Code Merchant Database — a centralized system meant to tie every registered merchant’s QR code to a verified business identity, its payment provider, and a risk classification. The stated goal is tracing money back to a real, accountable party rather than an anonymous QR string, closing a gap that’s made QR-based payment fraud and money-laundering investigations harder to pursue than card or bank-transfer fraud, where the paper trail is more established.
Together, the freeze, the VASP tightening, and the merchant database read as one coherent project rather than three separate proposals: the BSP appears to be trying to lock the current landscape in place — stop new entrants from adding to the pool it needs to classify, tighten the highest-risk category it already regulates, and build better tracing infrastructure for the payment volume already flowing through the system — before deciding how the whole framework should actually work going forward.
What’s genuinely unclear from the draft circular itself is how long the public comment period will run, and whether the BSP has committed to any specific criteria it will use to redesign the licensing framework once the review concludes. Neither is spelled out in the version currently circulating, which leaves affected companies planning around a hard freeze date without much visibility into what happens when the freeze actually ends.
What Founders Should Watch Next
If your startup is anywhere near needing an OPS license — a new e-wallet, a payment gateway, a remittance product, anything touching money movement that would require BSP registration — the practical move right now is to check exactly where your own application sits and, if you haven’t filed yet, understand that the window to do so before a potential year-long freeze may already be closing. Filing before the circular is finalized, even an imperfect application, is meaningfully different from filing after, given the draft’s own language about applications already in the pipeline being held rather than rejected outright.
For anyone building on top of a crypto exchange or VASP partner rather than holding a VASP license directly, the direct-merchant-relationship requirement is worth reading closely — any product currently routing through an intermediary layer between a bank and a VASP should assume that structure won’t survive this rule if it’s finalized as drafted, and start mapping a direct-relationship alternative now rather than after the compliance deadline arrives. The National QR Code Merchant Database, meanwhile, is a smaller lift for most legitimate businesses but a real one: any merchant relying on informal or unregistered QR arrangements to save on onboarding friction should expect that shortcut to close as this rolls out.
Share this article