BSP Issues Merchant Payment Rules

The Bangko Sentral ng Pilipinas (BSP) Monetary Board, through Circular No. 1198 dated July 19, 2024, approved the regulatory framework governing merchant payment acceptance activities (MPAA) which will facilitate the safe and efficient flow of funds from customers  of merchants and contribute to the wider adoption of digital payments in the country.

 

The BSP defines ‘merchant payment acceptance activities’ (MPAA) as the “set of services provided to a merchant to receive payment for sale of goods and/or services”. Services include (a) merchant acquisition or the service of accepting and processing payment transactions on behalf of a merchant under an agreement which results in a transfer of funds to the merchant; (b) providing the means to accept various payments instruments and collect, secure, transmit, and process payment information; and (c) providing support services related to the payment.

 

In accordance with the National Payment Systems Act, the National Retail Payment System Framework, and the Payment System Oversight Framework, the Regulatory Framework for MPAA aims to protect the rights and interest of merchants by ensuring that operators of payments systems (OPS) that engage in MPAA adopt minimum standards and good practices to effectively manage risks attendant to their business model, including those related to settlement, operations, information technology, anti-money laundering and countering terrorism and proliferation financing, and end-user protection.

 

The framework applies to any OPS engaged in or intending to engage in MPAA in the Philippines (OPS-MPAA). An OPS is considered engaged in MPAA in the Philippines if the OPS, merchant, or both are located in the Philippines. Moreover, an OPS that has a concurrent banking or Electronic Money Issuers-Non-bank Financial Institutions (EMI-NBFI) license, as well as OPS-MPAA under the regulatory jurisdiction of other local or foreign authorities or overseers of payment systems, shall comply with the provisions on payments to merchants, pricing mechanism, and reportorial requirements in the framework.

 

The provisions under Circular 1198 shall be included in the Manual of Regulations for Payment Systems (MORPS). Notable provisions are outlined below:

 

Licensing and Registration

An authority from the BSP, through the Merchant Acquisition License (MAL), must be secured prior to engaging in merchant acquisition in the Philippines. An OPS engaged in or intending to engage in MPAA other than merchant acquisition shall also register with the BSP. The framework also provides for the minimum required capital for an OPS granted with MAL by the BSP (OPS-MAL).

 

On the governance for merchant acquisition services, an OPS-MAL shall establish a prudent merchant payment acceptance criteria and procedures for managing its relationship with merchants. It shall include:

• risk-based and tiered merchant due diligence (MDD) which constitutes merchant identification risk assessment and periodic monitoring;
• written governing agreement between the merchant and the OPS-MAL covering account maintenance, timing and manner of the transfer to the merchant of the funds collected by the OPS-MAL, and suspension and termination clauses; and
• dispute resolution framework containing details such as the transaction life cycle, types of disputes, process of handling them, responsibilities of all parties, and the turnaround time for each stage.

 

The OPS-MAL shall maintain designated account/s with a Bangko Sentral Supervised Financial Institution (BSFI) where funds received or collected on behalf of merchants are held separate from the OPS-MAL’s own funds. The OPS-MPAA shall also comply with the reportorial requirements for OPS and submit secondary reports to the appropriate supervising department of the BSP such as annual audited financial statements, statistics related to MPAA, and notice to BSP of significant changes.

 

Operation Risk

The OPS-MPAA shall be responsible and accountable for the services outsourced to third-party service providers. Accordingly, it shall be responsible for due diligence review of the third party and the delineation of responsibilities of each party regarding the outsourcing arrangement.

 

Moreover, the OPS-MPAA shall design and implement an Information Technology Risk Management (ITRM) that is risk-based, and commensurate with the size, nature, types of products and services, and complexity of its information technology operations.

 

Anti-Money Laundering/Countering Terrorism and Proliferation Financing (AML/CTPF)

The OPS-MPAA shall adhere to the Anti-Money Laundering Act, The Terrorism Financing Prevention and Suppression Act of 2012, and the targeted financial sanctions-related laws and their respective Implement Rules and Regulations (IRRs).

 

End-user Protection

To ensure the safety of merchants availing of the services of an OPS-MPAA, the latter shall be considered a Bangko Sentral Supervised Institution (BSI) and shall establish mechanisms which comply with existing financial protection laws under the Financial Products and Services Consumer Protection Act (Republic Act No. 11765) and related IRRs.

 

The full Circular can be read here.