Three dates frame the rules in force. In June 2021 the FATF placed the Philippines under increased monitoring. On 21 February 2025 it removed the country after nine action items were completed. On 12 February 2026, Memorandum Circular 113 directed agencies to help draft the 2026 to 2030 national AML strategy before the mutual evaluation by the Asia/Pacific Group on Money Laundering (APG) that it expects in 2027.
Legal framework: which AML laws apply in the Philippines?
The core statute is Republic Act 9160, the Anti-Money Laundering Act of 2001, signed on 29 September 2001. Its main amendments are RA 9194 (7 March 2003), RA 10167 (6 June 2012, freeze and bank inquiry), RA 10365 (15 February 2013), RA 10927 (14 July 2017) and RA 11521 (29 January 2021). Later acts add unlawful activities, among them RA 11930 of 30 July 2022 (online child sexual abuse) and RA 12312 of 23 October 2025 (offshore gaming, ss. 8 and 17). In this guide, AMLA means RA 9160 as amended.
The AMLC turns the Act into binding regulation. Its 2018 Implementing Rules and Regulations (IRR), in the consolidated text with the amendments in force since 31 January 2021, set the program duties. GoTRACS, AMLC Regulatory Issuance No. 2, Series of 2024, sets the reporting clocks.
Two terrorism laws sit beside the AMLA. Under RA 10168, the Terrorism Financing Prevention and Suppression Act of 2012, the AMLC can freeze terrorist funds ex parte and without delay (s. 11). Under the Anti-Terrorism Act of 2020 (RA 11479), the Anti-Terrorism Council automatically adopts the UN Security Council Consolidated List of designated terrorists and terrorism financiers, and it can designate others on probable cause (s. 25).
Which regulatory bodies oversee AML in the Philippines?
Five bodies share the work, as of November 2026.
| Body | Role in AML | Covers | Basis |
|---|---|---|---|
| Anti-Money Laundering Council (AMLC) | Financial intelligence unit and regulator: receives CTRs and STRs, investigates, seeks freeze orders, files forfeiture cases, issues rules | General AML supervision of all covered persons | AMLA s. 7; IRR Rule 7 s. 1 |
| Bangko Sentral ng Pilipinas (BSP) | Supervising authority | Banks, quasi banks, trust entities, pawnshops, money changers, remittance firms, electronic money issuers, VASPs | AMLA s. 3(a)(1); BSP Circular 1108 |
| Securities and Exchange Commission (SEC) | Supervising authority | Securities dealers and brokers, investment houses, mutual funds | AMLA s. 3(a)(3) |
| Insurance Commission | Supervising authority | Insurers, pre-need companies | AMLA s. 3(a)(2) |
| PAGCOR and other gaming regulators | Issue casino AML rules jointly with the AMLC | Casinos | AMLA s. 18, as amended by RA 10927 s. 5 |
The AMLC is a council of three: the BSP Governor as chairman, with the Insurance Commissioner and the SEC Chairman as members, and it acts unanimously (s. 7). It asks the Court of Appeals for freeze orders, which run 20 days and at most six months in total (s. 10, as amended by RA 11521). Under IRR Rule 7 it supervises every covered person, and the BSP, SEC and Insurance Commission assist it within their sectors.
Who must comply? AML obligations for covered persons
Section 3(a) of the AMLA, as amended, lists the covered persons:
- (1) Banks, quasi banks, pawnshops, money changers, remittance firms and others under the BSP.
- (2) Insurers and pre-need companies.
- (3) Securities dealers, brokers and mutual funds.
- (4) and (5) Dealers in precious metals or stones, for transactions above PHP 1,000,000.
- (6) Company service providers.
- (7) Persons managing client money, accounts or companies.
- (8) Casinos, internet and ship casinos included, for their casino cash transactions.
- (9) Real estate developers and brokers.
- (10) Offshore gaming operators and their service providers regulated by PAGCOR or another agency; RA 12312 revoked their licenses in 2025 (s. 5).
IRR Rule 4 s. 1(b), as amended in January 2021, treats groups 4 to 10 as designated non financial businesses and professions (DNFBPs). Lawyers and accountants are excluded when they act as independent legal professionals in relation to client information, or where disclosure would compromise client confidences or the attorney client relationship, provided they are authorized to practice in the Philippines and stay bound by their codes of conduct. Under s. 9(c), lawyers and accountants acting as independent legal professionals need not report information held under professional secrecy or legal professional privilege.
AML in banking, fintech, casino and crypto sectors
Banks, electronic money issuers and remittance firms answer to the BSP and carry every duty in the table below. The Anti-Financial Account Scamming Act (AFASA, RA 12010) of 20 July 2024 makes money muling a crime: using, borrowing, buying, renting, selling or lending a financial account or allowing its use, or opening one under a fictitious name or another person's identity, to obtain, receive, deposit, transfer or withdraw proceeds known to come from crimes, offenses or social engineering schemes, or recruiting others to do so (s. 4(a)). Institutions may hold disputed funds for the period the BSP sets, at most 30 calendar days unless a court extends the hold, and must tell the BSP (s. 7).
Casinos report casino cash only, above PHP 5,000,000 per single transaction (GoTRACS 4.5). Virtual asset service providers follow BSP Circular 1108 of 2021.
What are the primary compliance requirements? The obligations table
Twelve duties apply to covered persons, in force as of November 2026, each with its basis in the AMLA, the IRR or GoTRACS. The last column maps each duty to complead, formerly Sanction Scanner. Sanction Scanner, the screening product, is part of complead.
| Obligation | Legal basis | What a program must do | How complead does it |
|---|---|---|---|
| Prevention program and compliance officer | IRR Rule 15; Rule 16 ss. 1, 2, 5, 6 | Assess institutional risk; adopt a written, risk based program the board approves; designate a compliance officer at senior management level; keep an independent internal audit. | Rules, thresholds and their edits are versioned, and each edit is logged with its author, its date and its reason. |
| Customer due diligence (CDD) | AMLA s. 9(a); IRR Rule 18 | Establish and verify true identity from official documents; for corporate clients, verify legal existence, structure and who acts for them; no anonymous or fictitious accounts (peso and foreign currency non checking numbered accounts are allowed). | Onboarding checks, screening hits and monitoring alerts feed one engine and one risk score per customer. |
| Beneficial owner | IRR Rule 18 s. 6; Rule 23 | Identify the natural persons who own or control the customer and take reasonable measures to verify them. | KYB and UBO verification traces owners and parent entities upward to natural persons and flags any layer it cannot resolve as unresolved. |
| Targeted financial sanctions | RA 10168 s. 11; RA 11479 s. 25; AMLA s. 7(15) | Screen against the UN Security Council Consolidated List, Anti-Terrorism Council designations and UNSCR 1718 and 2231 designations; freeze without delay on an AMLC order. | Name checks use 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. |
| Politically exposed persons | IRR Rule 19 s. 1 | Identify PEPs, family and close associates; for foreign PEPs, and for domestic or international organization PEPs in a higher risk relationship, get senior management approval, take reasonable measures to establish source of wealth and funds and monitor more closely. | PEP lists can run at their own fuzzy matching threshold, apart from the sanctions lists, because thresholds are set per list type and per list. |
| Enhanced due diligence | IRR Rule 18 s. 10; Rule 19 s. 8 | Apply enhanced measures where risk is higher, including high risk jurisdictions. | Rules can be scoped to a jurisdiction, so a rule can send customers tied to listed countries to a stricter review. |
| Suspicious transaction report | AMLA ss. 3(b-1), 9(c); GoTRACS 5.3, 5.4 | Decide within the determination period (10 or 60 calendar days; promptly on the day for terrorism and its financing, trafficking, child exploitation and highly unusual cases); file by the next working day after suspicion is established, attempts included; document any decision not to file; never tip off. | Agents build each case with the evidence, a narrative in the examiner's format and a work log; case management carries reporting support; the compliance officer makes the filing call. |
| Covered transaction report | AMLA ss. 3(b), 9(c); GoTRACS 4.2 to 4.4 | Report transactions above PHP 500,000 in one banking day within five working days, whatever the mode of settlement outside casinos and real estate, except low risk transactions deferred under GoTRACS Ch. I s. 7. | A no code rule adds up each customer's covered amounts per banking day and is backtested on 30, 60 or 90 days of history before release. |
| Ongoing monitoring | IRR Rule 18 s. 8 | Monitor customers and transactions against their profile, on the basis of materiality and risk. | API triggers start or stop monitoring for each name, so customers who have left drop out of the screening run. |
| Wire transfers and VASPs | IRR Rule 19 s. 6; BSP Circular 1108 | Carry full originator and beneficiary data on cross border wires at the BSP threshold (names and account or reference numbers below it) and on virtual asset transfers of PHP 50,000 or more. | Payments are screened on both sides, sender and receiver, through the API during processing. |
| Record keeping | AMLA s. 9(b); IRR Rule 20 | Keep records five years from the transaction; for closed accounts, five years from closure; longer while a court case on the account is open. | Screening searches are logged with the searcher, the query, the time and the result, empty results included. |
| Training | IRR Rule 16 s. 4 | Run continuing education for directors, officers and employees and document attendance. | Alerts name the rule that fired and the signals that matched, so trainers can work from live cases. |
The STR row carries the tightest conditions. A covered person has 10 calendar days from the transaction or the determination date to establish the suspicious circumstances in s. 3(b-1), and 60 where the transaction or person may be linked to an unlawful activity (GoTRACS 5.4(c)). The same section sets other clocks: suspicions tied to terrorism, terrorism financing, trafficking in persons or child sexual abuse or exploitation, and highly unusual transactions such as one with a person on a sanctions list, are established promptly on the day; a sanctions freeze is reported the same day; AMLC referrals and alerts from periodic monitoring runs count from receipt or case creation. The clock then runs from the day the compliance officer or review committee named in the program decides with finality, and a report filed after 11:59:59 pm of the next working day is late (GoTRACS 5.3, 5.4(d)). Nothing can be filed before the covered person registers with the AMLC's electronic reporting system (IRR Rule 4 s. 3.2; Rule 22 s. 4).
Which peso thresholds and deadlines apply in 2026?
The four CTR lines are "in excess of" their amounts, so exactly PHP 500,000 is not covered; the VASP line applies from PHP 50,000 ("P50,000.00 or more", BSP Circular 1108). The CTR is the local form of a currency transaction report.
| Line | Who | Basis | Report | Clock |
|---|---|---|---|---|
| Above PHP 500,000 in cash or equivalent within one banking day | All covered persons not listed below | AMLA s. 3(b), as amended by RA 11521 | CTR | 5 working days; late after 11:59:59 pm of day 5 (GoTRACS 4.2, 4.3) |
| Above PHP 1,000,000 | Dealers in precious metals or stones | AMLA s. 3(a)(4), (5); GoTRACS Ch. I s. 2(g) | CTR | 5 working days |
| Single cash transaction above PHP 7,500,000 | Real estate developers and brokers | AMLA s. 3(b), as amended by RA 11521; GoTRACS 4.6 | CTR, cash only | 5 working days |
| Single casino cash transaction above PHP 5,000,000 | Casinos | AMLA s. 3(b), as amended by RA 10927 and RA 11521 | CTR, casino cash only | 5 working days |
| Any amount with a suspicious circumstance | All covered persons | AMLA s. 3(b-1) | STR, attempts included | 10 or 60 calendar days to decide (promptly on the day for high priority and highly unusual cases), then next working day (GoTRACS 5.4) |
| Virtual asset transfer of PHP 50,000 or more | VASPs | BSP Circular 1108 | Originator and beneficiary data | With the transfer |
| Records | All covered persons | AMLA s. 9(b); IRR Rule 20 | Keep | 5 years |
Lines in force, November 2026.
Picture an illustrative remittance customer paying in PHP 300,000 in cash at 10am and PHP 250,000 at 3pm on one banking day. The PHP 550,000 total is covered, and the CTR is due by 11:59:59 pm on the fifth working day. PHP 490,000 on each of three days triggers no CTR. Structuring to avoid reporting is a suspicious circumstance under s. 3(b-1), though, so the STR clock applies.
When is enhanced due diligence required for high risk scenarios?
IRR Rule 18 s. 10 has covered persons examine complex, unusually large or unusual transactions with no apparent economic or lawful purpose, and apply enhanced due diligence (EDD) where risk is higher: source of wealth and funds documents, extra validation, senior management approval and closer monitoring. Rule 19 s. 8 adds EDD for high risk jurisdictions.
What are the penalties and consequences of noncompliance in the Philippines?
Failing to report is itself money laundering. Under the last paragraph of AMLA section 4, as amended by RA 10365, a covered person commits it by knowingly failing to report a covered or suspicious transaction that must go to the AMLC. Prosecution runs independently of the case on the underlying crime (s. 6(b)), and AMLC administrative sanctions apply without prejudice to criminal charges (s. 14(f)).
| Offense or breach | Basis | Penalty |
|---|---|---|
| Money laundering | AMLA s. 4(a) to (d); s. 14(a), as amended by RA 10365 s. 10 | Prison of 7 to 14 years plus a fine of at least PHP 3,000,000 and at most twice the value involved |
| Aiding, abetting, assisting or counseling, or facilitating by act or omission | AMLA s. 4(e), (f); s. 14(a) | 4 to 7 years and a fine of PHP 1,500,000 to 3,000,000 |
| Knowing failure to report a covered or suspicious transaction | AMLA s. 4, last paragraph; s. 14(a) | 6 months to 4 years, or a fine of PHP 100,000 to 500,000, or both |
| Failure to keep records | AMLA s. 9(b); s. 14(b) | 6 months to 1 year, or a fine of PHP 100,000 to 500,000, or both |
| Malicious or bad faith reporting of completely unwarranted or false information | AMLA s. 14(c), as amended by RA 9194 | 6 months to 4 years and a fine of PHP 100,000 to 500,000; no probation |
| Breach of confidentiality, including tipping off, or of information security | AMLA ss. 9(c), 8-A; s. 14(d), as amended by RA 11521 | 3 to 8 years and a fine of PHP 500,000 to 1,000,000 |
| Knowing participation by a covered person, its directors, officers or personnel | AMLA s. 14(e) | 4 to 7 years and a fine of up to 200% of the value laundered |
| Breach of the AMLA, the IRR or AMLC orders | AMLA s. 14(f) | After notice and hearing: sanctions including a warning, reprimand or a fine of up to PHP 500,000 per violation |
Penalties in force, November 2026 (statute texts read 4 November 2026).
What are the major money laundering cases in the Philippines?
In February 2016, hackers sent fraudulent SWIFT messages from Bangladesh Bank's network and stole USD 81 million from its account at the Federal Reserve Bank of New York, the US Justice Department later charged. Press reports trace the money to accounts at Rizal Commercial Banking Corporation (RCBC) in Manila, then through casinos.
Casinos were not covered persons in 2016; RA 10927 brought them in from July 2017.
RA 11521 made offshore gaming operators and their service providers covered persons in January 2021. Executive Order 74 of 5 November 2024 then banned Philippine offshore gaming operators (POGOs) and other offshore gaming operations and ordered licensed operators to cease and wind up by 31 December 2024 (s. 2(d)). RA 12312 of 23 October 2025 put the ban into law and made its violations unlawful activities under the AMLA (ss. 4, 8).
Is the Philippines still on the FATF gray list? Status in 2026
No. The FATF took the Philippines off its gray list of jurisdictions under increased monitoring on 21 February 2025, and its list of 19 June 2026 does not name the country. FinCEN's notice on the FATF plenary of 30 October 2026 names only four removals. The February 2025 statement lists nine completed AML/CFT items:
- DNFBP supervision. Effective risk based supervision is occurring.
- Casino junkets. Supervisors use AML/CFT controls on junket risk.
- Remittances. New registration rules for money transfer services, with sanctions on unregistered and illegal operators.
- Beneficial ownership. Faster law enforcement access to accurate, current owner data.
- Financial intelligence. More use, and more laundering investigations and prosecutions in line with risk.
- Terrorist financing. More cases identified, investigated and prosecuted.
- Nonprofits. Measures that do not disrupt legitimate activity, unregistered nonprofits included.
- Targeted financial sanctions. A more effective framework for terrorist and proliferation financing.
- Cross border controls. At all main international sea and airports, in line with risk.
What changed in 2025 and 2026
- 21 February 2025. Removed from the FATF gray list.
- 1 May 2025. First GoTRACS provisions strictly enforced (Chapter IV s. 5.2).
- 23 October 2025. RA 12312 bans offshore gaming by law and adds its violations to the AMLA's unlawful activities.
- 12 February 2026. MC 113 directs agencies to help draft the 2026 to 2030 strategy, which draws on the third national risk assessment (2021 to 2024).
- 2026. BSP Memorandum M-2026-023 bars VASPs from listing or supporting privacy virtual assets.
- 30 October 2026. FATF plenary; FinCEN's notice names four removals only.
What comes next:
- 31 March 2027. Technical compliance submission due to the APG (APG schedule).
- 2027 to 2028. Fourth mutual evaluation: MC 113 says 2027, the APG lists the 2028 plenary.
- Up to three years from effectivity. GoTRACS fully in force; the 2021 guidelines apply until then.
How do screening and monitoring apply in the Philippines?
Three rows of the table become daily system work.
For the CTR, a team writes the PHP 500,000 daily sum per customer as a no code rule in transaction monitoring, backtests it over 30, 60 or 90 days and ships it with a record of who changed it, when and why.
For sanctions, client screening and ongoing monitoring refreshes its lists every 15 minutes and logs every search, no match results included. Ask any vendor, complead included, how fast an Anti-Terrorism Council designation reaches its lists.
For the STR, agents close routine cases and attach the evidence and the work log; on the rest, the compliance officer decides whether to file, and the record shows who decided.
This week: run the CTR rule on last month's transactions and compare it with the CTRs filed; check that every alert records its determination date; confirm that the compliance officer's AMLC registration details were updated in the last two years.
What the 2026 PDF adds. The guide above is complete without it. The 16 page PDF, 2026 edition, collects the paperwork a compliance file needs: a 14 point program checklist with the legal basis of each check, a customer risk factor template for the Philippines and a suspicious transaction decision record that also logs cases reviewed and not reported. Button: Get the PDF checklist (opens the form in the template's side panel).
