KYC for Online Brokers and Securities Firms in PH
Securities brokers and dealers in the Philippines count as covered persons under RA 9160, the country’s AML law. That means they must identify every client, rate each client’s risk, screen for politically exposed persons and sanctions, and hold KYC files for no less than five years. Online brokers meet these duties remotely by checking a government ID, matching it to a live selfie, and logging each step for SEC and AMLC review.
KYC Duties for Securities Firms: SEC and AMLA
Two layers of rules shape broker KYC. The AMLA sets the core duties, while the SEC, as supervisor, issues guidelines on how securities firms apply them. On top of that, exchange-level bodies review trading participants for compliance.
| Duty | What it requires | Where brokers usually slip |
|---|---|---|
| Customer identification | Confirm identity before the account opens | Accepting ID photos with no record check |
| Risk rating | Assign each client a risk level and refresh it | Ratings set once and never reviewed |
| PEP and sanctions screening | Screen at onboarding and when lists change | Screening only at account opening |
| Ongoing monitoring | Watch trading and fund flows against the client profile | Alerts with no documented follow-up |
| Reporting | File covered and suspicious transaction reports with the AMLC | Late or incomplete reports |
| Record-keeping | Retain KYC and trade files for five years or longer | Files scattered across email and drives |
SEC guidelines for its covered institutions translate these duties into specific procedures. So compliance teams should map each control in their onboarding flow to a line in those guidelines. For the wider legal frame, see our AMLA guide.
Remote Account Opening for Online Brokers
Retail investors now expect to open a trading account in one sitting. Brokers that still ask for couriered forms lose sign-ups to rivals that onboard on a phone. Fortunately, a remote flow can meet AMLA duties just as well as a branch visit.
- Capture the ID. First, the investor takes a photo of a government ID, and OCR reads the fields into the application.
- Confirm the record. Next, the system looks up the ID details in official sources, which rules out invented identities.
- Prove presence. Then a liveness check confirms a real person is taking the selfie.
- Compare faces. After that, face matching sets the selfie beside the ID portrait.
- Screen and rate. Finally, the platform runs the client through PEP and sanctions lists and assigns a risk level before approval.
SEC rules also allow simplified onboarding for small retail investors. Under SEC MC 21 s.2020, an account opened by a Filipino individual counts as low risk while total deposits and investments stay at or below P50,000, and the firm may complete identity verification within 15 days. Even so, the identity check itself should still happen at the start, because funds can move quickly once trading is enabled.
For the first three steps, Verihubs ID Verification validates government ID data at the source, from PhilSys and LTO records to SSS and NBI, before matching the verified person with a live selfie. Brokers then feed the verified identity into their screening and risk engine.
Customer Risk Rating for Investors
Not every investor carries the same risk. For example, a salaried employee buying index funds each month looks very different from a newly formed company moving large sums through a margin account. Therefore, a risk model should weigh factors such as these.
- Client type. Individuals, corporations, trusts, and foreign clients each need different checks.
- Source of funds. Deposits should match the declared occupation and income.
- Trading behavior. Sudden large trades in thinly traded stocks can signal manipulation or laundering.
- Geography. Clients linked to high-risk jurisdictions need closer review.
- PEP status. Politically exposed persons and their relatives always need enhanced checks.
High-risk clients move into enhanced due diligence, which usually means proof of income, senior approval, and tighter monitoring. Our article on enhanced due diligence describes what that review covers.
PEP and Sanctions Screening for Brokerage Clients
Screening fails most often because it happens only once. Lists change, and clients change roles, so a clean result at onboarding may be wrong six months later.
- Screen at onboarding. Check every new client, including directors and beneficial owners of corporate accounts.
- Rescreen on list updates. UN Security Council lists and designations under the Anti-Terrorism Act change without notice.
- Handle name matches carefully. Common Filipino surnames create many false hits, so use birth date and ID number to resolve them.
- Document every decision. Record why a possible match was cleared or escalated.
Accurate identity data makes screening cleaner. Once the name, birth date, and ID number come from a verified source rather than a typed form, false positives drop. For more depth, read our guides to PEP screening and sanctions checks.
Record-Keeping and Audit Readiness
Under the AMLA, identification and transaction files must stay on hand for five years or more. Yet storing files is only half the job, since examiners also want to see how each decision was made.
| Record | What to store |
|---|---|
| Identity evidence | ID images, record check result, selfie match score, timestamps |
| Screening results | Lists checked, matches found, reviewer decision and reason |
| Risk rating | Score, factors used, date of last review |
| Monitoring alerts | Alert, investigation notes, outcome, any report filed |
A single case file per client, built automatically during onboarding, saves days during an examination. Besides, it protects the firm if a client later disputes how staff handled their account.
The eKYC Stack for Online Brokers
Most brokers assemble KYC from a few parts rather than one system. Here is a typical stack, from the investor’s first tap to ongoing monitoring.
- Identity verification: ID capture, OCR, government record check, liveness, and face comparison.
- Screening: PEP, sanctions, and adverse media checks, rerun when lists change.
- Risk engine: rules that combine identity, screening, and profile data into a risk level.
- Transaction monitoring: scenarios tuned for securities, such as layering through rapid buy and sell cycles.
- Case management: one place for alerts, notes, approvals, and reports.
When comparing vendors, test how well the parts pass data to each other. A strong identity check loses value if its results have to be typed into the screening tool by hand.
Common KYC Gaps Found at Brokerages
Examiners and auditors tend to flag the same weaknesses at securities firms. So it pays to check your own process against this list before anyone else does.
- Dormant accounts reactivated without review. An account that sat idle for years may now belong to someone else in practice, so request a fresh selfie before large trades resume.
- Corporate clients with unclear owners. Brokers often verify the authorized trader but never trace the beneficial owner behind the company.
- Stale risk ratings. A client rated low risk at opening may have become a PEP since then.
- Third-party deposits. Funds from accounts in other names deserve questions, because they are a classic layering signal.
- Manual overrides without notes. If staff clear a screening hit, the file should say why.
Most of these gaps share one cause: KYC treated as a single event at sign-up. Instead, treat identity and risk as data that you refresh whenever the client’s behavior or status changes. Our overview of beneficial ownership checks helps with the corporate account problem in particular.
Frequently Asked Questions
Are stockbrokers covered by the AMLA in the Philippines?
Yes. The AML law lists securities brokers, dealers, and salesmen as covered persons. So they must perform customer due diligence, report covered and suspicious transactions, and keep records.
Can you open a stock trading account online in the Philippines?
Yes. Many brokers onboard investors fully online using an ID photo, a record check, and a live selfie, followed by screening and risk rating before the account is activated.
How long must brokers keep KYC records?
The AMLA sets a minimum retention period of five years for identification and transaction files. However, some firms hold them longer because of internal policy or other rules.
Do brokers need to screen for PEPs?
Yes. Politically exposed persons and their close associates need enhanced due diligence, so brokers screen them when the account opens, then repeat the check each time a list or the client’s role changes.
What IDs do online brokers accept?
Most accept the PhilID, passport, driver’s license, and UMID, among other government IDs. Foreign clients usually present a passport plus proof of address.
Verified Investors, Defensible Files
Online brokers win clients with speed, but they keep their licenses with evidence. In practice, a remote flow can meet AMLA duties without slowing sign-ups: read the ID, validate it at the source, match a live face, then screen and rate the investor. So build the case file while onboarding happens, not after an examiner asks for it.
Reviewing your investor onboarding before the next SEC examination? Request a broker onboarding demo and test it with real investors.
