Crypto Exchange KYC Philippines: SEC and BSP Rules

Crypto exchange KYC in the Philippines means verifying every customer before they trade, under rules from the SEC, the BSP, or both. The SEC’s 2025 CASP rules require crypto-asset service providers to register, and BSP Circular 1108 governs virtual asset service providers. Either way, exchanges carry anti-money laundering duties, so identity checks, screening, and records must hold up to review.

Who Regulates Crypto Exchanges in the Philippines

In short, two regulators share the space. On 30 May 2025, the SEC issued Memorandum Circular No. 4, the SEC Rules on Crypto-Asset Service Providers, alongside MC No. 5 on how those providers must operate. Under these rules, platforms that offer crypto-asset services in the country need SEC registration and a license first.

Separately, the BSP has supervised virtual asset service providers since 2021 under BSP Circular 1108. However, that framework mainly covers services that link virtual assets with money and payments.

Framework	Regulator	Main focus
CASP Rules and Guidelines (MC 4 and 5, 2025)	SEC	Crypto-asset service providers, trading platforms, offerings, and marketing
VASP Guidelines (Circular 1108, 2021)	BSP	Virtual asset services tied to payments, transfers, and fiat exchange
Anti-Money Laundering Act	AMLC	Customer due diligence, reporting, and record keeping for covered persons

Which regime applies depends on the services you offer, and some platforms need both. So confirm your scope with counsel before you design onboarding, since the KYC depth follows from it.

KYC and AML Duties for Crypto Platforms

According to law firm summaries of the 2025 rules, licensed crypto-asset service providers count as covered persons for AMLA purposes. In practice, that brings bank-style duties to crypto onboarding. Our guide to AMLA obligations explains them in full, but these are the ones that shape the sign-up flow.

• Identify and verify. Collect identity details and check them against a reliable source, not just a photo of an ID.
• Rate the risk. Assign each customer a risk level, and apply enhanced checks to high-risk users such as politically exposed persons.
• Screen names. Check customers against sanctions and watchlists before they trade.
• Know the money. For larger accounts, ask where funds come from and keep the answer on file.
• Report and keep records. Report suspicious transactions to the AMLC and retain KYC records as the law requires.

Beyond onboarding, transfers add one more layer. The FATF travel rule expects providers to pass sender and recipient details along with crypto transfers between platforms. So your KYC data must be complete enough to share, not just enough to approve an account.

Crypto Onboarding Risks Specific to the Philippines

Crypto platforms face the same fraud as e-wallets, but it moves faster. Funds can leave the platform minutes after a deposit, so weak onboarding turns into losses quickly.

Mule Accounts for Scam Proceeds

First, scammers need accounts to receive and convert stolen money. Often, they pay real people for their IDs and selfies, then run the accounts themselves. Our explainer on money mule networks shows how these rings recruit.

Synthetic Faces and Deepfake Selfies

Because crypto attracts tech-savvy attackers, deepfake selfies and injected camera feeds show up here early. As a rule, a plain selfie upload without liveness and device checks is the weakest point in many flows.

Unregistered Offshore Platforms

The SEC keeps warning the public about unregistered crypto platforms that target Filipinos. For licensed exchanges, that pressure is an opening as well. Strong, visible KYC is part of what separates a registered platform from those warnings.

A Practical KYC Flow for Crypto Exchanges

Good crypto KYC uses risk tiers. Low-limit accounts get a quick check, while higher limits unlock only after deeper review. The flow below shows one common setup.

1. Capture and read the ID. The user scans a PhilID, passport, or driver’s license, and OCR fills the form.
2. Validate against records. Next, compare what the user typed or scanned with official data held by the issuing agency.
3. Confirm the person. A liveness check and a face match prove that a live user owns the ID.
4. Screen and score. Run sanctions and PEP screening, then assign a risk level.
5. Set limits by tier. Grant starter limits right away, and ask for source of funds before raising them.
6. Re-check on risk events. Finally, repeat the selfie check on new devices, password resets, and large withdrawals.

Step 6 matters more for crypto than for most products. Withdrawals are usually final, so a step-up check on risky actions prevents losses that no refund process can undo.

How Verihubs Supports Crypto Exchange KYC

Verihubs handles the identity core of that flow. For record checks, ID verification that reaches government records confirms that user details match the PhilSys, driver’s license, SSS, or NBI record. Then face recognition and liveness for crypto sign-ups confirms a live person who owns the ID.

Besides onboarding, the same face checks serve step-up moments like a device change or a large withdrawal. That way, one integration covers both onboarding and the riskiest actions after it.

Frequently Asked Questions

Is KYC mandatory for crypto exchanges in the Philippines?

Yes. Platforms under SEC or BSP rules must verify customers. Also, law firm summaries of the 2025 SEC rules say AMLA due diligence duties apply to licensed providers.

What is a CASP in the Philippines?

A crypto-asset service provider is a business that offers crypto-asset services, such as trading platforms. The SEC regulates CASPs under its 2025 CASP Rules and Guidelines.

What is the difference between a CASP and a VASP?

CASP is the term in the SEC’s 2025 rules, while VASP is the term in BSP Circular 1108 from 2021. Which applies depends on the services a platform offers.

What IDs can crypto exchanges accept?

Most accept primary government IDs such as the PhilID, passport, or driver’s license. Then the platform should check the ID details against official records instead of trusting a photo.

Can a crypto exchange use eKYC?

Yes. Remote checks with ID validation, liveness, and face matching are standard, as long as the platform keeps records that show how it verified each customer.

Building Crypto Exchange KYC That Regulators Trust

Today, Philippine crypto rules look much like banking rules, only newer. Platforms that verify identity against records, confirm a live person, and re-check on risky actions meet that bar. They also stop the mule accounts and deepfake sign-ups that make crypto a scam magnet. In short, tight KYC is no longer a growth tax but the price of a license.

Preparing your exchange for SEC or BSP review? Discuss crypto KYC checks with Verihubs for your sign-up flow.