Philippines: A Mature Framework Currently Closed to New Applicants
The Philippines regulates crypto ATMs, it doesn't ban them — but the BSP has not approved a single new operator licence since 2022, so the only way in right now is through one of the handful of companies that already got in before the door shut.
● Orange
|
8–12 VASPs
Already licensed before the freeze — but no new licences since
|
Sept 2022
Moratorium on new VASP applications began — still fully in effect
|
₱50,000 (~$900)
Travel Rule threshold triggering full originator/beneficiary ID
|
Crypto ATMs are explicitly regulated, not prohibited, in the Philippines — the central bank (Bangko Sentral ng Pilipinas, BSP) confirmed as early as 2017 that ATM operators offering virtual-currency purchase or exchange qualify as Virtual Asset Service Providers (VASPs) and must register accordingly, and machines from licensed institutions such as UnionBank have operated in Manila since 2019.1,2,3 The single most important fact for this market, however, is that the BSP has not accepted new VASP licence applications since it imposed a moratorium in September 2022 — a freeze that has been repeatedly extended and remains fully in effect through 2025 and 2026 while the central bank refines its VASP rulebook.4 The advantage is that the underlying framework is genuinely mature — the BSP has regulated this exact activity for close to a decade, and roughly eight to a dozen VASPs already hold licences today; the obstacle is stark and immediate: a brand-new operator without an existing BSP VASP licence simply cannot get one right now, at any price, however well-prepared the application.5,6 As in most markets on our legislation map, General Bytes as a hardware and software vendor is not itself performing a licensable activity; it is the in-country operator of the machines who must hold the BSP VASP registration. For GENERAL BYTES, the Philippines is a market to pursue exclusively through an already-licensed VASP partner — there is currently no path for a new entrant to become that partner from scratch.
Last updated: July 2026
Regulatory Framework and Its Evolution
The Philippines was an early Southeast Asian mover on crypto regulation: BSP Circular No. 944 in February 2017 first required entities converting fiat to virtual currency (or vice versa) to register as Virtual Currency Exchanges, and explicitly named ATM operators as falling within that definition.1,2 BSP Circular No. 1108 (2021) substantially tightened the regime, introducing stricter operational, cybersecurity, and consumer-protection standards for what were now formally termed VASPs.7 A parallel track exists for crypto-assets that qualify as securities: the SEC licenses Crypto-Asset Service Providers (CASPs) under rules that took effect 5 July 2025, meaning an exchange trading security-type tokens alongside ordinary cryptocurrencies may need both a BSP VASP registration and an SEC CASP registration simultaneously.8
| Date | What happened |
|---|---|
| Feb 2017 | BSP Circular 944 first names ATM operators as Virtual Currency Exchanges requiring registration |
| 2019 | UnionBank launches a licensed Bitcoin ATM in Manila |
| 2021 | BSP Circular 1108 tightens operational, cybersecurity and consumer-protection standards, formalising the VASP category |
| Sept 2022 | BSP stops accepting new VASP licence applications — the moratorium begins |
| 5 Jul 2025 | SEC's parallel CASP licensing rules take effect for security-type crypto-assets |
| Jun 2026 | BSP Memorandum M-2026-023 bans licensed VASPs from listing privacy-enhancing tokens |
The regime continues to tighten rather than loosen: BSP Memorandum M-2026-023 (June 2026) newly banned licensed VASPs from listing privacy-enhancing tokens, explicitly aligning with FATF guidance on anonymity-enhancing technologies, and BSP Memorandum M-2026-003 reminds BSP-supervised institutions that regulatory sandbox participation does not exempt anyone from the core VASP licensing requirement.9,10 In August 2025 alone, the SEC publicly flagged five unregistered crypto platforms and the BSP separately warned banks and financial firms against transacting with unregistered VASPs — active, current enforcement, not a dormant rule.
Getting Licensed: The Moratorium Is the Whole Story
Under normal circumstances, a crypto ATM operator would register as a VASP with the BSP under Circular 1108, securing a Certificate of Authority to operate as a Money Service Business, meeting BSP capital, cybersecurity, and AML/CFT governance requirements.3,7 None of that process is currently available to a new applicant. The BSP suspended acceptance of new VASP licence applications in September 2022, and that moratorium has been extended repeatedly through the 2025–2026 period with no announced end date, while the central bank works through rulebook refinements including the privacy-token listing ban and broader circular amendments reportedly under discussion.4,11 This is structurally similar to Poland's situation elsewhere on this map, but the mechanism is different: Poland lacks the enabling law to grant any licence at all, whereas the Philippines has a fully functioning licensing law and an active regulator — it has simply chosen, as a matter of policy, not to accept new applicants while it revises the framework.
The only currently viable path into this market is partnering with, or acquiring, an entity that already holds a BSP VASP licence — roughly eight VASPs were approved before the moratorium, including UnionBank, Coins.ph (Betur Inc.), Rebittance, BloomSolutions, Virtual Currency Philippines, ETranss, Fyntegrate, and ZyBi Tech, some of which may be open to hosting third-party hardware under their existing authorisation.5,6 As with the rest of our legislation map, this registration sits with the in-country operator of the machines, not with General Bytes as hardware and software vendor.
AML and KYC
The Philippines applies a Travel Rule threshold of ₱50,000 (roughly USD 900) — above this, the originating institution in a virtual-asset transfer must obtain and transmit full originator and beneficiary information, with beneficiary institutions equally obligated to collect and verify the same.3 This places the Philippines in the full-KYC category common throughout this series rather than offering a meaningful anonymity tier. The June 2026 privacy-token listing ban adds a further compliance dimension specific to licensed VASPs: any ATM offering privacy-focused assets (Monero, Zcash, and similar) would need those delisted, and existing holdings would need to be moved off-platform or converted.
Banking
Banking access for licensed VASPs is comparatively strong in the Philippines precisely because major banks are themselves active participants — UnionBank, one of the country's leading commercial banks, operates its own BSP-licensed VASP registration and ATM. This signals that BSP-regulated crypto activity is well understood within the domestic banking sector, which should ease banking relationships for any operator working through an existing, licensed VASP partner rather than attempting to build a standalone crypto-only banking relationship from scratch.
The Next 24 Months: Wait for the Moratorium to Lift
The defining question for this market over the next two years is simply when — or whether — the BSP reopens VASP licensing to new applicants. There is no published end date for the moratorium as of mid-2026, and the central bank's recent activity (the privacy-token ban, reminders on sandbox non-exemption, ongoing circular amendment discussions reported by BitPinas) suggests the BSP is actively using this pause to rewrite parts of its rulebook rather than simply waiting out a backlog.4,9,10 Strong underlying demand drivers remain in place regardless of the freeze: remittances account for roughly 10% of Philippine GDP and the country is the world's third-largest remittance recipient, a structural factor that made crypto ATMs commercially attractive enough to justify UnionBank's original 2019 deployment and would support renewed growth once new licensing resumes.12
For GENERAL BYTES, the practical approach is twofold: first, identify which of the roughly eight existing BSP-licensed VASPs might be open to a hardware/software partnership for ATM deployment under their current authorisation, since that is the only route to new machines today; second, monitor BSP announcements for any signal that the 2022 moratorium is lifting, since a reopening would likely trigger a wave of pent-up applications and early positioning would matter. Treat this market as dormant-but-proven rather than closed — the demand case and regulatory maturity are both real, only the door is temporarily shut to new entrants.
Sources and references
1. BSP Circular 944 (2017) naming ATM operators as VCEs — philstar.com
2. BSP requiring VASP/VCE registration for ATM operators — coingeek.com
3. Travel Rule threshold (₱50,000) and VASP Certificate of Authority — notabene.id
4. September 2022 BSP moratorium on new VASP licences, extended through 2025-2026 — cryptobriefing.com
5. ~8 BSP-approved VASPs prior to moratorium (UnionBank, Coins.ph, others) — coingeek.com
6. UnionBank Manila Bitcoin ATM launch (2019) — bitcoinmagazine.com
7. BSP Circular 1108 (2021) tightened operational/cybersecurity standards — lexology.com
8. SEC CASP rules effective 5 July 2025 — dopay.ph
9. BSP Memorandum M-2026-023 banning privacy-token listings — cryptobriefing.com
10. BSP Memorandum M-2026-003 on sandbox non-exemption — bitpinas.com
11. Ongoing BSP Circular 1108 amendment discussions — bitpinas.com
12. Remittances as ~10% of Philippine GDP, third-largest recipient globally — bitcoinmagazine.com
Legal Disclaimer: This article by GENERAL BYTES is for informational purposes only and does not constitute formal legal, financial, or investment advice. The BSP's moratorium on new VASP licences has no published end date and the underlying rulebook is under active revision; always consult specialised local legal counsel and confirm the current status of BSP VASP licensing before considering market entry.