2026 changed how Philippine merchants get paid in two different ways. Six BSP issuances rewrote the rules – pricing, authentication, the line between a merchant account and a personal one, cash thresholds. Then in July, the BSP and PPMI launched three new payment rails, including the country's first interoperable direct debit.
Most of the rule-making was written for banks and payment providers, not for you. The new rails are the opposite; they're capabilities you can actually use.
This page tracks what changed, who it affects, and whether you need to do anything. We update it monthly.
Everything that changed in 2026, at a glance
July 29, 2026 — Three new payment rails, including direct debit
The BSP and Philippine Payments Management, Inc. (PPMI) launched three new services at a ceremony at the BSP head office. This is the most consequential payments infrastructure news of the year for merchants, and unlike the rest of this page it isn't a rule you have to comply with. Instead, it's a capability you can use.
Direct Debit PH
The Philippines now has an interoperable direct debit rail. Bank and e-wallet account holders can authorise a biller to automatically collect payments from their account on scheduled due dates.
Built for recurring obligations: utilities, subscriptions, loan repayments, insurance premiums, and any other scheduled billing arrangement.
If you run a subscription business, a gym, a school, a clinic with payment plans, a SaaS product, or anything else that bills the same customer every month, This addresses a longstanding gap in recurring account-to-account collections. Until now, recurring collection in the Philippines meant card-on-file – which fails when cards expire or get replaced – or chasing customers manually every cycle. Direct debit pulls from the account itself, with the customer's standing authorisation.
Worth asking your payment provider when they'll support it.
InstaPay Cash-In
InstaPay Cash-In lets users request funds from another person through participating banks or e-wallets, with the sender authorizing and completing the transfer from their own account.
For merchants, this isn't a new way to accept customer payments. Instead, it standardizes how customers can fund participating accounts and e-wallets, making it easier for them to move money into the accounts they use for digital transactions. While its primary use case is account funding rather than merchant collections, broader adoption could reduce friction for customers who need to top up their balance before making a purchase or completing a payment.
InstaPay for Business
InstaPay for Business raises the maximum transfer limit for registered businesses from ₱50,000 to ₱500,000 per transaction, allowing companies to make larger digital payments without splitting transfers or relying on other payment channels.
Straightforwardly useful if you pay suppliers, contractors, or payroll digitally and have been splitting transfers to stay under ₱50,000.
BSP Governor Eli M. Remolona, Jr. framed the launch around interoperability and lower transfer costs driving broader participation. Deputy Governor Mamerto E. Tangonan tied it to the National Retail Payment System Framework, the same framework Circular 1238 amended three weeks earlier.
Also reiterated: QR Ph is not InstaPay QR
At the same launch, the BSP and PPMI restated the QR code distinction established in 2024. Merchants mix these up constantly, so:
- QR Ph is for person-to-merchant (P2M) payments. Transaction fees are borne by the merchant.
- InstaPay QR is for person-to-person (P2P) transfers. Fees may apply depending on the institution.
If you are accepting business payments through an InstaPay QR rather than a QR Ph merchant code, you are using a consumer rail for commercial collection. This aligns with BSP's broader effort, including Memorandum M-2026-017, to discourage the use of personal payment channels for commercial collections.
Late July 2026 — BSP clarifies 1238, then asks providers to justify their fees
Two things happened.
First, the clarification. Circular 1238 had been read in some coverage as a zero-fee mandate. It isn't. Following discussions between Monetary Board members and FinTech Alliance PH, the BSP confirmed that 1238 requires cost-based fair pricing, not free transfers. Providers are not required to eliminate electronic fund transfer fees. Off-network person-to-person charges are not strictly limited to technical switch costs. And FAQ No. 7 of the circular should not be treated as a rigid switch-cost-only rule.
Second, the enforcement. In July the BSP called in banks and e-wallets to explain fee structures that hadn't moved after 1238, asking for itemised cost breakdowns. GCash and Maya were among those summoned, and both cut InstaPay fees from ₱15 to ₱10.
That second part is the more useful signal. The BSP is actively checking cost justifications rather than waiting for voluntary compliance, which is why it's worth asking your own provider for a current, written fee schedule.
June 25, 2026 — SMS OTPs retired for high-risk transactions
What changed: Covered institutions had to stop using SMS and email one-time passwords for high-risk transactions by June 25, 2026. This comes from BSP Circular 1213, signed 30 May 2025 and published 10 June 2025, which implements the IT risk management portion of Section 6 of the Anti-Financial Account Scamming Act (Republic Act No. 12010). The circular took effect 25 June 2025 with a one-year transitory period — hence the June 2026 date.
Who's actually covered: This is narrower than most coverage suggests. The strong-authentication mandate binds BSP-supervised institutions engaged in complex electronic payment and financial services and with average monthly network transaction value of at least ₱75 million over the preceding six months. Institutions below that threshold are required to conduct a risk assessment, not to rip out OTPs.
In practice, every bank and e-wallet you'd recognise is covered.
What it applies to and what it doesn't: High-risk transactions and critical account changes: adding a new payee, changing registered contact details, large transfers, logging in from an unrecognised device. Lower-risk transactions may still use SMS OTPs. The BSP has said so directly. This is a targeted restriction on interceptable authentication for high-risk actions, not a blanket ban on OTPs.
What replaced it: Biometrics, FIDO passwordless authentication, and behavioural or adaptive authentication – methods bound to your device rather than sent through the telecom network. An SMS can be intercepted by SIM swap, harvested by a phishing page, or simply read aloud to a scammer on the phone. A fingerprint can't.
What you need to do
- Enable biometric login on every banking and e-wallet app your business uses.
- Update those apps; authentication changes ship through app updates.
- If more than one person touches your business accounts, enrol each of them on their own device. Device-bound authentication doesn't travel.
The deadline held. In January 2026, BSP Deputy Governor Elmore Capule told reporters: "As of now we are not extending it, so they have to catch up." Under AFASA, institutions that leave weak controls in place can be liable to reimburse customers for scam losses — which explains why your bank has been so insistent.
June 17, 2026 — New pricing rules, effective July 4
The biggest rulemaking of the year for merchants. BSP Circular 1238, signed by Governor Eli M. Remolona, Jr., together with Memorandum No. M-2026-025 signed by Deputy Governor Mamerto E. Tangonan. Both dated 17 June 2026. Both took effect 4 July 2026 – the June date is when they were signed, not when they bit.
The circular amends two frameworks: the National Retail Payment System Framework and the Regulatory Framework for Merchant Payment Acceptance Activities.
The BSP cited its own Q4 2025 Consumer Expectations Survey: one in three Filipino consumers said high transaction fees kept them from using digital payments more.
On fund transfers
- Sending to another institution shouldn't cost materially more than sending within one. Off-us person-to-person transfer fees should not materially differ from on-us fees plus the switch cost — what the clearing switch operators charge, meaning BancNet for InstaPay and the Philippine Clearing House Corporation for PESONet.
- Digital should beat the counter. Electronic payment fees are expected to be lower than the equivalent over-the-counter fee.
- The recipient gets the full amount. No deducting fees from money being transferred.
- The moratorium is lifted. M-2026-025 ended the freeze on InstaPay and PESONet fee changes. Pricing can move again — within the rules above.
On merchant fees — read this part
Circular 1238 inserts a new pricing provision into the Manual of Regulations for Payment Systems (Subsec. 503.7(c)) that applies directly to merchant acquirers and gateways. It requires that merchant fees be reasonable, transparent, market-based, and proportionate to the cost of the services offered, and that the pricing be supported by a documented analysis of the costs incurred in providing merchant payment acceptance.
There is no numeric cap on merchant discount rates. But it is wrong to say the circular leaves your processing rate untouched. Your provider now carries a substantiation obligation on what it charges you, and the BSP can ask to see the workings.
If you've been quoted at a rate that nobody can explain, that's now a fair question to ask.
On onboarding
Circular 1238 also eased documentation for low-risk merchants opening an account to accept digital payments — a National ID or other valid ID may be sufficient, with the specifics left to the risk management profile of the provider under a tiered, risk-based due diligence approach.
Separately, the circular uses a micro-enterprise definition – monthly aggregate gross receipts of up to ₱250,000 – in connection with zero-fee treatment for small merchant payments.
These are two different tests and they get conflated constantly. Eased onboarding turns on being low-risk. The ₱250,000 figure relates to the zero-fee treatment.
On zero fees for small merchants: this was widely reported, and the BSP has described it as a condition already in place before the moratorium was lifted, rather than a new obligation created by 1238's text.
June 2026 — Circular 1237 creates a licensed digital marketplace
Circular 1237, signed a day before 1238, establishes the regulatory framework for Digital Financial Marketplaces operated by BSP-supervised financial institutions, such as platforms where banks and e-money issuers can offer products from other providers, including insurers.
Headline requirements: a Type A licence, minimum net worth of ₱1.0 billion, Operator of Payment System registration, and at least three unaffiliated providers on the platform. There's a carve-out for platforms that merely function as a payment facility or gateway. The circular also immediately bars presenting online gambling products.
Relevant to you only if you're building a marketplace that distributes third-party financial products. If you run a store, this isn't your problem.
May 8, 2026 — Tighter rules on merchant accounts and aggregators
Memorandum M-2026-017 is the most under-reported issuance of the year and it goes straight at merchant acceptance.
It reiterates and tightens guidelines on the integrity of payment activities. Payment aggregators carry independent anti-money-laundering and counter-terrorism-financing duties. Banks and e-money issuers must hold sub-merchant transaction-level data and merchant risk profiles, with triggers to restrict or terminate high-risk sub-merchants. The target is mule merchants and QR code misuse.
The part that affects ordinary businesses: it requires payment service providers to clearly distinguish merchant accounts from personal accounts and strengthen controls against the misuse of personal accounts for commercial transactions.
If you have been collecting business sales into a personal GCash or personal bank account, you are now explicitly in scope. This is a common setup among Philippine online sellers, and it is exactly what the memo is designed to surface. Expect providers to ask questions, request reclassification, or restrict activity.
What to do: move business collections onto a proper merchant account. Aside from being what the rules now expect, it gives you clean records for BIR and a real payout trail.
March 14, 2026 — Cash payout reviews now start at ₱1 million
Circular 1230, signed 27 February 2026 and effective 14 March 2026, doubled the threshold that triggers enhanced due diligence on large-value cash payouts, from ₱500,000 to ₱1 million. It replaces the ₱500,000 threshold set by Circular 1218 (September 2025).
Three details that matter:
- Same-day amounts add up. The trigger is a cash payout exceeding ₱1,000,000 in a single transaction or in a series of transactions within one banking day. Splitting a withdrawal across the morning and afternoon doesn't avoid it.
- Banks can set lower thresholds. ₱1 million is the regulatory trigger, not a ceiling on your bank's own risk policy.
- Regular large-cash customers get reviewed once, not every time. Enhanced due diligence is performed at the customer level rather than per transaction, so routine activity shouldn't trigger a fresh review each time.
There's no threshold under this circular for non-cash transactions though risk-based due diligence under the Manual of Regulations for Banks still applies to anything unusual.
The BSP made the change after consultations in which banks reported the ₱500,000 ceiling was repeatedly catching ordinary business activity: payroll runs, loan releases, project-based payments.
Good news if your business still moves real cash. Also a decent argument for moving more collections online.
Still on the roadmap
Announced or in consultation, not yet in force:
- PhilPaSSplus extended hours. The BSP is consulting on expanding the peso real-time settlement system to 22 hours a day, seven days a week, with a two-hour maintenance window. Still at discussion-paper stage as of August 2026.
- Project Nexus cross-border instant payments. BSP's stated target for full onboarding is mid-2027.
- Project Agila. The wholesale central bank digital currency pilot ran in 2024; the BSP published its results in July 2026. No merchant impact yet.
- AI supervision. Memo M-2026-031 (24 June 2026) sets out voluntary AI principles — the STARS framework. Memo M-2026-034 (6 July 2026) is not voluntary: it directs institutions to discontinue passwords and SMS or push authentication for administrative and privileged access.
- VASP dealings. Memo M-2026-003 (January 2026) addresses institutions' dealings with virtual asset service providers.
What this means practically
If you bill customers monthly, ask about Direct Debit PH. For many subscription businesses, this may be the most significant new capability announced this year. Recurring collection in the Philippines has been a card-on-file problem for years. There's now a rail built for it.
Check whether you're on a QR Ph merchant code. If your business collects through an InstaPay QR, you're on a consumer rail, and that aligns with the BSP's effort to curb the misuse of consumer payment channels for merchant collections.
Enable biometrics on every business account. The deadline has passed. If someone in your business still authorises transfers by reading a text message aloud, that's a fraud exposure.
Get your fee schedule in writing. Your provider now has a documented cost-substantiation obligation on both transfer fees and merchant fees, and the BSP has been actively asking providers to justify pricing that didn't move. Ask.
Separate business money from personal money. M-2026-017 makes the merchant-versus-personal-account distinction explicit. If your sales land in a personal wallet, fix that before your provider does it for you.
Accept payments without the compliance homework
Most of this page describes work your payment provider should absorb on your behalf – authentication standards, cost substantiation, settlement rules, AML monitoring, BSP reporting.
PayMongo is a BSP-supervised payment provider. We accept cards, GCash, Maya, QR Ph, online banking, and over-the-counter payments, on a proper merchant account with a clean payout trail.
How this page works
We update it in the first week of each month. New items go at the top of the relevant dated section. Anything superseded gets struck through rather than deleted, so you can see what changed and when.
Spotted something we missed or got wrong? Email isabelle.romualdez@paymongo.com.
This page is for general information and reflects our reading of publicly available BSP issuances as of the last updated date. It is not legal or compliance advice.
Frequently asked questions
What is Direct Debit PH?
An interoperable direct debit rail launched by the BSP and PPMI on 29 July 2026. It lets bank and e-wallet account holders authorise a biller to automatically collect payments from their account on scheduled due dates — built for utilities, subscriptions, loan repayments, and insurance premiums. It's the first standardised way to run recurring collections in the Philippines without relying on card-on-file.
What's the difference between QR Ph and InstaPay QR?
QR Ph is for person-to-merchant payments, with fees borne by the merchant. InstaPay QR is for person-to-person transfers, and fees may apply depending on the institution. If you're collecting business payments, you should be on a QR Ph merchant code — not an InstaPay QR.
Does BSP Circular 1238 mean bank transfers are now free?
No. The BSP clarified in late July 2026 that 1238 requires cost-based fair pricing, not zero fees. Fees must be reasonable, transparent, and proportionate to actual cost, and interbank transfers shouldn't cost materially more than intrabank ones plus the switch fee. Providers can still charge.
How much can a business send through InstaPay now?
₱500,000 per transaction, up from ₱50,000, under InstaPay for Business launched 29 July 2026. It requires a registered business or corporate account.
Does Circular 1238 cap what my payment gateway charges me?
Not with a number. But it does require merchant fees to be reasonable, transparent, market-based, and proportionate to cost — supported by a documented cost analysis the BSP can review. Your provider has to be able to explain your rate.