NextFin News - The Bangko Sentral ng Pilipinas has opened a review of digital payment rules after gambling operators registered merchant accounts under the names of beauty salons and bakeries, using low-risk merchant codes to move money through e-wallets and QR payments outside gambling-specific controls.
The review is the latest escalation in a campaign that began in August 2025, when the central bank gave e-wallets and payment firms 48 hours to remove in-app links to online gambling sites. That order worked quickly: the state gaming regulator's monthly income fell from 5.7 billion pesos ($97.3 million) in May to 2.9 billion pesos ($49.5 million) in September, a drop of roughly half that officials attributed to the delinking. But operators adapted. Rather than relying on visible links inside apps, some began registering as ordinary merchants, classified under codes for beauty salons, bakeries and other low-risk businesses.
The shift matters because merchant category codes determine how a transaction is screened. A payment tagged as a bakery purchase passes through e-wallet and acquiring systems with far less scrutiny than one tagged with the gambling code. The result is a payment chain in which the money moves through a legitimate-looking storefront while the ultimate beneficiary sits elsewhere. The central bank's answer has been to widen the net from links to the merchant accounts themselves — and the stakes reach well beyond the Philippines.
The Mechanics of Merchant Misclassification
The vulnerability sits in the merchant-acquiring model. When a business signs up to accept QR or e-wallet payments, an acquirer or payment aggregator assigns it a merchant category code and a risk rating. That classification travels with every transaction. A bakery sits in a low-risk bucket; a gambling operator sits in a high-risk bucket with enhanced monitoring, transaction limits and, in the Philippines, the possibility of being blocked outright.
Misclassifying a gambling operation as a salon or bakery does three things. First, it lowers the scrutiny applied to each transaction. Second, it fragments the payment trail: the acquirer sees a bakery, the e-wallet sees a low-risk merchant, and the ultimate recipient of the funds is one or more intermediaries downstream. Third, it defeats the central bank's earlier link-removal order, which targeted visible redirects inside apps but did not address the merchant accounts behind the payments.
The response has unfolded in stages. In May 2026, the central bank reminded banks and supervised financial institutions that they retain primary responsibility for anti-money-laundering controls over payment activities, including merchant accounts, payment aggregators and QR-enabled transactions — even when transactions are routed through intermediaries. The regulator also directed firms to detect and prevent "mule merchants," the unauthorized use of registered merchant accounts or QR codes by persons other than the duly registered business. Under the guidance, payment aggregators carry independent anti-money-laundering and counter-terrorism-financing duties, and banks and e-money issuers must hold sub-merchant transaction-level data and merchant risk profiles, with triggers to restrict or terminate high-risk sub-merchants.
The next stage is a draft circular on merchant payment acceptance reported in September 2026. It would prohibit any arrangement that obscures the identity of a merchant, an intermediary, a beneficial owner or an ultimate recipient. It requires acquiring institutions to collect and maintain information on the actual goods and services sold, the business classification, the countries of incorporation and operation, and the transaction channels used. It also calls for a centralized National QR Code Merchant Database so that financial institutions can cross-check merchants and flag problematic ones. Existing layered merchant arrangements would have to be reviewed within six months after the circular takes effect.
Cyclical or Structural: The Flaw Is in the Intermediated Model
The question is whether this is a cyclical enforcement problem — regulators patch a loophole, operators find another — or a structural flaw in how digital payments are built. The evidence points to structural.
The defect is not a single merchant code. It is the layered arrangement between the acquiring institution and the business actually supplying the goods or services. In a direct arrangement, the acquirer maintains the relationship with the merchant and can see the activity. In a layered arrangement, one or more intermediaries sit between the acquirer and the seller. The acquirer sees the intermediary's name; it may not see the underlying seller, its activities, or who ultimately receives the proceeds. Shared accounts, pooled settlement structures and bulk transaction records make attribution harder still.
That is why the May 2026 memorandum insisted that banks retain primary anti-money-laundering responsibility even when transactions are routed through payment aggregators, and why the draft circular requires payment aggregators to carry "independent and commensurate" responsibilities of their own. The regulator is trying to eliminate the accountability gap created by intermediation.
A cyclical reading would say this is a cat-and-mouse game that will settle once the new rules bite. But the mechanism here predates online gambling and will outlast it. Any high-risk activity — scams, unauthorized virtual asset services, prohibited goods — can use the same path: register as a low-risk merchant, route through an aggregator, and let the classification do the hiding. The salon-and-bakery cases are the symptom; the intermediated acquiring model is the condition.
The history reinforces the point. The Philippines was placed on the Financial Action Task Force's gray list of jurisdictions under increased monitoring in June 2021 after $81 million stolen from Bangladesh's central bank in a 2016 cyber heist was funneled through a Manila bank branch to casinos and gambling agents. Casinos were not covered by Philippine anti-money-laundering laws at the time, a gap regulators are still working to close. The country exited the gray list in February 2025, but the central bank governor, Eli Remolona Jr., who also chairs the Anti-Money Laundering Council, has warned that failure to contain online gambling risks could return the Philippines to the watch list.
The Policy Contradiction: Digitize Faster, but Trust Less
There is a second-order tension the market has not fully priced. The central bank is simultaneously pushing the Philippines toward a cashless future and tightening the screws on the channels that make cashlessness work.
The digitization push has moved faster than expected. Digital payments accounted for 57.4% of retail transaction volume and 59% by value in 2024, according to the central bank's status report — ahead of the 52% to 54% target set for that year under the Philippine Development Plan. The share rose to 64.7% in 2025, hitting the 60% to 70% range targeted for 2028 ahead of schedule. The market has grown with it: the Philippines digital wallet market reached $4.1 billion in 2025, growing at an 11.2% annual clip. GCash reports roughly 94 million registered users, and Maya surpassed 50 million users, with its digital banking arm reaching 8.2 million customers and 68 billion pesos in deposits.
But the same infrastructure — QR codes, e-wallets, merchant acquiring, payment aggregators — is the infrastructure being exploited. The central bank's answer is not to slow digitization but to make every merchant and every transaction traceable end to end. That is a defensible position, but it carries a cost. Tighter merchant due diligence, transaction-level data retention, risk profiles and beneficial-owner checks raise compliance costs for acquirers and aggregators. Those costs do not disappear; they are passed through to merchants, and ultimately to consumers. Small merchants, which the central bank has tried to onboard with eased requirements for low-risk businesses, are the ones most exposed to friction.
The contradiction is real: the central bank wants more Filipinos paying digitally, but it now wants every digital payment to be reconstructable. Those two goals are compatible only if the compliance burden does not choke the small merchants who make QR payments ubiquitous. Governor Remolona himself acknowledged in February 2026 that reaching the next phase of digitalization would be more difficult, pointing to sluggish uptake in some segments and rising cybersecurity risks that need urgent action.
The Gambling Economics: Why Operators Keep Coming Back
The incentive to evade controls is large and measurable. Licensed electronic-games operators contributed 69 billion pesos, about $1.2 billion, in license fees in the first seven months of 2025 alone — more than half of all gaming industry revenue for the period. The state gaming regulator's dependence on that revenue helps explain why enforcement has been uneven: the state both regulates gambling and profits from it.
The e-wallet delinking showed how powerful a payment choke point can be. Chairman Alejandro Tengco said online gaming transactions dropped by around 50% in the days after the August 2025 order. The monthly income figures — 5.7 billion pesos in May falling to 2.9 billion pesos in September — quantify the leverage the central bank holds over the sector. That is the leverage it is trying to preserve, and the reason operators moved from visible links to invisible merchant codes. If the new merchant-integrity rules work, the next adaptation will come from the operators again. The question is whether the regulator can keep the compliance burden on the acquirers high enough to make misclassification unprofitable.
"Basically, as before, we just want to put sand in the wheels," Remolona said of the effort to curb online gambling risks at an event organized by the Fintech Alliance Philippines.
The Counter-Thesis: Enforcement Can Win Without Redesigning the System
The strongest case against the structural reading is that enforcement has already worked once, and can work again with targeted rules rather than a redesign of merchant acquiring. The 48-hour link-removal order produced an immediate, measurable result: a roughly 50% drop in gaming transactions and a near-halving of the gaming regulator's monthly income. The May 2026 memorandum already requires banks to hold sub-merchant transaction-level data and merchant risk profiles, with triggers to restrict or terminate high-risk sub-merchants. The central bank has also raised the large-value cash payout review threshold to 1 million pesos, freeing supervisory attention for the digital channels where the risk now sits.
On this view, the salon-and-bakery cases are a manageable enforcement gap, not evidence of a broken model. Payment aggregators already carry independent anti-money-laundering duties; the draft circular mostly codifies what the market should already be doing. Adding a national merchant database and beneficial-owner checks is an incremental step, not a regime change. The gaming regulator itself has backed strict regulation rather than a total ban, and has announced an artificial intelligence monitoring tool aimed at detecting illegal gambling sites in real time.
The counter-thesis has force, but it rests on an assumption that acquirers and aggregators will consistently police merchants whose business they want. The profit incentive runs the other way: more merchants mean more transaction volume and more fees. That is why the central bank is moving from guidance to hard prohibitions — banning arrangements that obscure the ultimate recipient, and making responsibility non-transferable even through outsourcing. The falsifying signal for the structural view is specific: if, within 12 months of the merchant-integrity rules taking effect, the number of misclassified gambling merchants falls materially and stays down without repeated central-bank interventions, then the enforcement-only model is sufficient and the structural critique is wrong.
Who Benefits, Who Is Exposed, and What to Watch
The review is likely to produce three outcomes. First, stricter merchant due diligence: acquirers will need to verify the actual business activity, not just the paperwork, and maintain transaction-level data that lets supervisors reconstruct a payment chain. Second, a shared merchant database that makes it harder for a flagged operator to reappear under a new name with a new acquirer. Third, continued pressure on e-wallets to monitor not just the links in their apps but the merchants on their networks.
The beneficiaries are the compliant end of the market: large acquirers and established e-wallet operators with the compliance infrastructure to absorb the new requirements. GCash and Maya, which dominate the wallet market, are best positioned — though the rules will raise their operating costs. The exposed parties are small payment aggregators and sub-merchants whose economics depend on light-touch onboarding. Consumers are the indirect stakeholder: tighter controls should reduce fraud and laundering, but they may also mean more friction at checkout and higher merchant fees.
The forward look splits by time horizon. In the short term, expect more cease-and-desist orders against individual merchants and aggregators as the central bank tests the new rules. In the medium term, the key signal is whether the merchant-integrity circular is finalized and how much teeth it has — particularly the National QR Code Merchant Database and the beneficial-owner requirements. In the long term, the structural question is whether the Philippines can build a digital payments system that is both fast and traceable, or whether the two goals will keep colliding.
Base case: the central bank finalizes the merchant-integrity rules with the database and transaction-level data requirements intact, and misclassified merchants are pushed toward the fringes. Upside case: the rules work quickly, the Financial Action Task Force keeps the Philippines off the gray list, and digital-payment growth resumes on a cleaner base. Downside case: operators shift to crypto or peer-to-peer channels outside the regulated perimeter, and the cat-and-mouse game moves rather than ends.
The falsifying signal to watch is concrete: if data from the central bank shows merchant-code misclassification rising, not falling, in the two quarters after the new rules take effect, the enforcement approach is failing and a deeper redesign of the acquiring model is on the table. All market figures are as of the latest available reports from the central bank and company disclosures.
The central bank's dilemma is now clear: it is building a cashless future on rails that criminals are racing down, and the only way to stop them is to slow the trains.
Explore more exclusive insights at nextfin.ai.
