QR Ph merchant rules in the Philippines: mistakes to fix now
If you collect payments in the Philippines through personal QR codes, third-party wallets or a chain of intermediaries, the BSP's draft circular makes that your biggest risk: under the draft, a payment that can't be tied to an identified merchant should not go through.
In September 2026 the Bangko Sentral ng Pilipinas (BSP) published a draft circular on strengthening integrity controls in payment transactions. It is not in force yet, but the direction is clear: every payment has to trace back to an identified merchant, and every intermediary answers for the merchants it onboards.
According to the BSP's 2025 e-payments report, digital payments made up 64.69% of retail transaction volume in 2025 (57.45% in 2024), and 74.31% of electronic transactions were merchant payments. With that much at stake, we don't expect the final text to be softer than the draft.
Mistake 1: collecting on P2P QR codes instead of QR Ph
The Philippines has two QR types. QR Ph covers person-to-merchant payments, and the merchant pays the fee. InstaPay QR covers person-to-person transfers, and the sender's institution may charge for it. In high-risk verticals a personal QR is tempting because it skips acquirer onboarding.
The draft requires institutions to identify merchants, intermediaries, accounts, transactions and settlement flows. If a payment can't be attributed and reconciled to a specific merchant, the transaction should not proceed. Collecting on someone else's P2P code fits that description almost word for word.
Mistake 2: stacking intermediaries
A common setup for casinos and betting: the operator plugs into an aggregator, which plugs into another aggregator, and only the last link holds a licence. The draft bars intermediaries from subcontracting merchant acquisition to create another tier.
Existing layered arrangements get a transition: six months after effectivity for a review, then six more months after each review to fix deficiencies. That sounds generous, but your provider runs the review, and your provider decides whether you stay.
Mistake 3: assuming enhanced checks only apply to new merchants
Casinos, virtual asset service providers and money service businesses are treated as higher-risk merchants in the draft, with enhanced due diligence and tighter transaction and settlement controls. Nothing in the reported text exempts existing clients.
The BSP also plans a National QR Code Merchant Database holding identity, registration, settlement, ownership and risk data. An interim repository is due within 90 days of effectivity, the full database within 12 months, and migration and validation of active records within 15 months. Gaps in your KYC file will show up there.
Mistake 4: waiting for new payment companies to enter the market
The draft proposes a 12-month pause on new operator of payment systems (OPS) registrations from effectivity. Pending applications can still be evaluated, but no final decision would be issued until the pause ends. Merchant acquisition licensing sits under a separate framework and is not covered.
For merchants, the pool of payment companies in the Philippines is unlikely to grow over the next year. Choose among registered players rather than holding out for a newcomer.
Where the rules help: the InstaPay for Business limit
On 29 July 2026 the BSP and the payment system association PPMI launched Direct Debit PH, InstaPay Cash-In and InstaPay for Business. The last one lets registered businesses send up to PHP 500,000 per transaction, up from PHP 50,000.
Illustrative example. Say an operator pays affiliates PHP 1.2 million a month. Under the old cap that is at least 24 transfers; under the new one, three. Fewer transfers mean lower fees and less reconciliation, but only for a registered business, which brings you back to mistakes 1 and 2.
Separately, after BSP Circular No. 1238 required interbank transfer fees to reflect actual processing costs, several banks and e-wallets cut or waived retail transfer fees.
First step before the rules take effect
Ask your provider one question: who is recorded as the merchant in your setup, and whose name do settlements go to? If the answer is an agent or an individual, change the setup before the transition clock starts. See payment methods in the Philippines and our iGaming and high-risk pages. If you need a direct, fully identified setup, leave a request and we'll match options to your country and vertical.
Sources
This article was prepared by the PayFlow editorial team with the help of AI, based on the public sources listed above. It is for information only and is not legal or financial advice; provider terms change — check current terms with an operator.