AMLA Philippines: The Complete Compliance Guide (2026)
AMLA, the Anti-Money Laundering Act, is the Philippines’ primary law criminalizing money laundering under Republic Act No. 9160 (enacted 2001). It has been amended five times, most recently by RA 11521 in 2021, which added VASPs, real estate brokers, and POGO operators as covered persons and strengthened AMLC powers.
The Philippines came off the FATF grey list in February 2025 after completing all 18 required reforms under AMLA’s expanded framework. Banks, fintechs, e-wallets, and all covered persons must comply with AMLA’s CDD, reporting, and record-keeping obligations or face imprisonment of 7 to 14 years and fines starting at PHP 3 million.
What Is AMLA? Definition and Meaning
In the Philippines, the abbreviation refers specifically to Republic Act No. 9160, enacted on September 29, 2001. AMLA is the cornerstone of the Philippine legal framework against money laundering and terrorism financing. It defines money laundering, establishes who must comply, sets out which transactions require reporting, and prescribes penalties for violations.
Money laundering under AMLA is the act of transacting, converting, transferring, disposing, moving, acquiring, possessing, or using proceeds of any unlawful activity with the intent to conceal or disguise the illicit origin of those funds. The law does not require a completed concealment. Attempting to launder funds, or assisting someone in doing so, is equally punishable.
The AMLC (Anti-Money Laundering Council) is the body created by AMLA to implement and enforce it. AMLA is the law; AMLC is the enforcer.
AMLA Amendments: From RA 9160 to RA 11521
AMLA has been amended five times since enactment, each time expanding its coverage and strengthening enforcement. Understanding the amendment history matters because compliance obligations have changed substantially over two decades.
| Law | Year | Key Changes |
|---|---|---|
| RA 9160 (AMLA) | 2001 | Original enactment. Established AMLC, defined covered transactions, set reporting obligations for banks and financial institutions. |
| RA 9194 | 2003 | Expanded definition of money laundering. Strengthened AMLC investigation powers. Broadened the list of predicate offenses. |
| RA 10167 | 2012 | Gave AMLC authority to freeze assets and conduct bank inquiries in terrorism financing cases without prior court order. |
| RA 10365 | 2013 | Expanded covered persons to include real estate brokers, dealers in precious metals, and company service providers. Aligned with FATF 2012 recommendations. |
| RA 10927 | 2017 | Added casinos (land-based, online, and ship-based) as covered persons. Set PHP 5 million CTR threshold for casino cash transactions. |
| RA 11521 | 2021 | Added VASPs (crypto exchanges), POGO operators, and their service providers. Added tax crimes as predicate offenses. Strengthened AMLC freeze order powers. Introduced targeted financial sanctions for proliferation financing. |
According to Philippine News Agency reporting on RA 11521 (January 2021), the law was signed specifically to keep the Philippines off the FATF grey list. The grey listing happened anyway in June 2021, but the reforms RA 11521 initiated ultimately contributed to the February 2025 exit.
What Is Money Laundering Under AMLA? Covered Transactions Explained
AMLA distinguishes between two types of reportable transactions: covered transactions and suspicious transactions.
Two types of transactions must be reported. Covered Transaction Reports (CTRs) are mandatory when a single cash transaction, or a series of related transactions, exceeds specific thresholds in a single banking day. The thresholds vary by sector:
- Banks, e-wallets, and most financial institutions: cash transactions exceeding PHP 500,000
- Casinos: cash transactions exceeding PHP 5,000,000
- Real estate developers and brokers: single cash transactions exceeding PHP 7,500,000 (introduced by RA 11521)
STRs work differently. Suspicious Transaction Reports carry no minimum threshold. Any transaction, regardless of amount, must be reported if it has no clear legal purpose, is inconsistent with the customer’s known profile, appears to be structured to avoid reporting, or otherwise raises AML red flags. Patterns like smurfing and structuring, where large sums are broken into sub-threshold amounts, are explicitly covered under STR obligations.
Both CTRs and STRs must be filed with the AMLC within five working days of the triggering transaction through the GoTRACS digital reporting system.
Who Are Covered Persons Under AMLA?
AMLA’s compliance obligations apply to all “covered persons,” which include:
- Banks, quasi-banks, trust entities, and BSP-supervised institutions
- Insurance companies, pre-need companies, and HMOs
- Securities dealers, brokers, and investment companies
- Money service businesses: remittance agents, money changers, foreign exchange dealers
- Virtual asset service providers (VASPs): crypto exchanges and digital asset platforms
- Financing and lending companies
- Real estate developers and brokers for qualifying transactions
- Casinos, including online and ship-based casinos
- Jewelry dealers and dealers in precious metals for transactions above PHP 1 million
- Company service providers, lawyers, and accountants in specific circumstances
AMLA Compliance Obligations for Covered Persons
Every covered person has four core obligations under AMLA regardless of size or sector.
Customer Due Diligence (CDD)
Covered persons must verify the identity of all customers at account opening, maintain those records, and update them on a risk-based schedule. CDD includes collecting source of funds documentation for high-risk customers. For PEPs and elevated-risk customers, Enhanced Due Diligence (EDD) applies. According to BSP Circular 1230 (February 2026), the EDD threshold for cash withdrawals was raised from PHP 500,000 to PHP 1 million.
Transaction Reporting
CTRs and STRs must be filed within five working days via GoTRACS. Tipping off a customer about a filed STR carries criminal liability. Once that deadline is missed, institutions must still maintain reporting procedures that allow compliance teams to catch up consistently.
Record Keeping
Customer identification documents and transaction records must be kept for a minimum of five years after the transaction date or termination of the relationship, and made available to the AMLC on request without delay.
AML/CTF Compliance Program
Each covered person must conduct an institutional risk assessment and maintain a written compliance program covering internal controls, staff training, audit procedures, and escalation protocols. The program must be regularly reviewed and updated to reflect changes in the institution’s risk profile and regulatory guidance.
AMLA Penalties for Money Laundering in the Philippines
According to Republic Act No. 9160 as amended by RA 11521, the penalties are:
| Offense | Imprisonment | Fine |
|---|---|---|
| Money laundering conviction | 7 to 14 years | PHP 3 million minimum, up to twice the laundered amount |
| Negligent money laundering (unknowing facilitation) | 4 to 7 years | PHP 1.5 million to PHP 3 million |
| Failure to report covered/suspicious transactions | 6 months to 4 years | PHP 100,000 to PHP 500,000 per transaction |
| Tipping off | 3 to 8 years | PHP 500,000 to PHP 1 million |
These penalties apply to both the institution and the individual officers responsible. A bank that fails to file an STR faces exposure; so does the compliance officer who missed it.
AMLA and the FATF Grey List: The Philippine Compliance Context
The FATF grey-listed the Philippines in June 2021 for strategic deficiencies in its AML/CTF framework, despite the country having just passed RA 11521 months earlier. That listing brought direct consequences: heightened correspondent bank scrutiny, slower international transfers, and reputational risk for Philippine financial institutions operating internationally.
Between 2021 and 2025, the AMLC and Philippine government implemented all 18 required reforms under the FATF action plan, including strengthened VASP supervision, expanded DNFBP coverage, improved AMLC investigation capacity, and sustained high-profile enforcement. In February 2025, the FATF removed the Philippines from its grey list.
For covered persons, the grey list exit raises the baseline. What counted as acceptable compliance in 2019 no longer clears the bar. Enforcement actions that used to be inconsistent under FATF scrutiny are now standard practice. Covered persons that have not updated their AMLA compliance programs since before 2021 are running on outdated frameworks.
AMLA in Banking: What Does It Mean for a Bank Customer?
When a bank asks customers about their source of funds, requests additional documentation for large deposits, or declines a transaction without explanation, this is AMLA in action. Banks are not being intrusive arbitrarily. Under AMLA, they are legally required to understand the nature and purpose of their customers’ funds and to report anything that does not fit the picture.
Individual customers feel AMLA compliance in three concrete ways: having documentation ready for large transactions, expecting additional questions when transaction patterns look unusual, and understanding that a bank’s CDD procedures are a legal obligation, not optional customer service.
Frequently Asked Questions About AMLA in the Philippines
- What does AMLA stand for in the Philippines?
- AMLA stands for Anti-Money Laundering Act, officially Republic Act No. 9160, enacted on September 29, 2001. It is the Philippines’ primary law criminalizing money laundering and establishing compliance obligations for banks, fintechs, and other covered persons.
- What is the AMLA threshold in the Philippines?
- The general cash transaction threshold triggering a Covered Transaction Report (CTR) is PHP 500,000 per banking day for most financial institutions. The threshold is PHP 5 million for casinos and PHP 7.5 million for real estate transactions. These are reporting thresholds, not laundering thresholds. Any transaction regardless of amount must be reported if it raises suspicious activity indicators.
- What are predicate offenses under AMLA?
- Predicate offenses are the underlying crimes whose proceeds can constitute money laundering. Under AMLA as amended by RA 11521, these include drug trafficking, kidnapping, robbery, estafa, plunder, trafficking in persons, illegal gambling, terrorism financing, tax crimes, and violations of the Strategic Trade Management Act, among others.
- Did the Philippines pass the FATF review?
- Yes. In February 2025, the FATF removed the Philippines from its grey list after the country completed all 18 required reforms. The Philippines had been under increased monitoring since June 2021. The grey list exit reflects sustained improvements in AMLA enforcement, VASP supervision, and AMLC investigation capacity.
- What is the difference between AMLA and AMLC?
- AMLA is the law (Republic Act No. 9160). AMLC is the Anti-Money Laundering Council, the government body established by AMLA to implement and enforce it. AMLA defines obligations and penalties; AMLC has the authority to investigate, freeze assets, and prosecute violations.
- Is AMLA compliance required for fintech companies in the Philippines?
- Yes. Fintech companies operating as e-money issuers, lending companies, financing companies, or virtual asset service providers are covered persons under AMLA as amended by RA 11521. They must register with the AMLC, implement CDD, file CTRs and STRs, and maintain a written AML/CTF compliance program.
AMLA Compliance Is Not a One-Time Setup
Ironically, the institutions most likely to face AMLC scrutiny are not those that tried to cheat the system. They are those that set up compliance once, then stopped. The most common AMLA compliance failure among Philippine fintechs and digital banks is treating compliance as a setup task rather than an ongoing operational function. AMLA obligations do not stop after the AMLC registration is approved. They require live CDD at every onboarding, STR review on every flagged transaction, record archiving on every customer interaction, and program updates every time regulations change.
The identity verification layer is where this starts. eKYC Philippines infrastructure needs to be capable of verifying government IDs, detect synthetic identities, and support ongoing monitoring at scale. Verihubs eKYC API provides that layer, covering 15+ Philippine government ID types with AI liveness detection and deepfake prevention, built for the compliance requirements of BSP, AMLC, and RA 11521.
Talk to the Verihubs team about building AMLA-compliant eKYC into your onboarding workflow.
