Philippines: technology regulation at a glance

Framework: Dual regime: Bangko Sentral ng Pilipinas (BSP) supervises Virtual Asset Service Providers under Circular No. 1108 (2021) and related issuances; the Securities and Exchange Commission (SEC) supervises Crypto-Asset Service Providers under Memorandum Circular No. 04-2025 (Rules) and MC 05-2025 (Operational Guidelines), effective 5 July 2025. Tax treatment is applied by the Bureau of Internal Revenue (BIR) under existing Tax Code provisions.

Crypto is legal in the Philippines and covered by an active dual-regulator regime: the BSP licenses VASPs (exchanges, wallets, transfers) under Circular 1108 with FATF-aligned AML/Travel Rule requirements, while the SEC's 2025 CASP Rules regulate crypto-asset service providers, public offerings and tokens that qualify as securities. The BSP has kept its moratorium on new VASP licenses in place (extended to at least September 2025) and, via Memorandum M-2026-023 (June 2026), tightened token-listing due diligence and effectively barred privacy coins. A peso-backed stablecoin (PHPC) was approved in the BSP regulatory sandbox and formally exited in June 2025.

Framework: National AI Strategy for the Philippines (NAIS-PH / National AI Strategy Roadmap 2.0), led by the Department of Science and Technology (DOST) and DTI; no binding cross-cutting AI law in force, with comprehensive bills pending in Congress.

The Philippines governs AI primarily through a non-binding national strategy: President Marcos approved the National AI Strategy for the Philippines (NAIS-PH) on 20 May 2025, setting a whole-of-government roadmap to 2028 across infrastructure, workforce, innovation, data governance/policy, and deployment. There is no comprehensive binding AI statute yet; several 'AI Act'-style bills (e.g. Senate Bill 25 'AIRA' and House proposals for an AI development authority and an AI Bill of Rights) remain pending. Binding rules exist only in narrow sectors, most notably COMELEC's regulation of AI in election campaigns.

Framework: Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), with its 2016 Implementing Rules and Regulations, enforced by the National Privacy Commission (NPC).

The Philippines has a comprehensive, GDPR-style data-protection regime under the Data Privacy Act of 2012 (RA 10173), which applies to personal information processing in both the public and private sectors and has extraterritorial reach. It is administered and enforced by the National Privacy Commission, an independent body attached to the Department of Information and Communications Technology, which issues regulations, registers data processing systems, investigates complaints, and imposes penalties. The law took effect in 2012, its Implementing Rules and Regulations were issued in 2016, and full NPC enforcement began in 2017.

Framework: Bangko Sentral ng Pilipinas (BSP) is the lead regulator under the National Payment Systems Act (Republic Act No. 11127, 2018) and BSP Circular No. 1049, with Electronic Money Issuer rules in the Manual of Regulations (Sec. 702 / Circular No. 1166, 2023) and the Open Finance Framework (Circular No. 1122, 2021); consumer lending/BNPL falls under the SEC via the Lending Company Regulation Act (RA 9474) and Financing Company Act (RA 8556).

The Philippines has a clear, mature licensing and registration regime for digital payments and fintech, anchored by the BSP. The National Payment Systems Act requires all operators of payment systems to register with the BSP, e-money issuers must be separately licensed, and an Open Finance framework plus the InstaPay/PESONet instant-payment rails are operational. Consumer credit products such as BNPL are licensed either by the BSP (if bank/quasi-bank backed) or the SEC (as financing/lending companies).

Framework: Executive Order No. 86, s. 2025 (signed 24 April 2025), establishing the Digital Nomad Visa (DNV); issued by the Department of Foreign Affairs (DFA) with support from the Bureau of Immigration, and complemented by long-standing residency routes administered by the Philippine Retirement Authority (SRRV) and Board of Investments (SIRV).

The Philippines has a dedicated digital-nomad pathway: Executive Order No. 86 (April 2025) created a Digital Nomad Visa allowing foreign remote workers earning income from outside the country to stay up to one year, renewable for a second year, with multiple-entry privileges. The DFA issues the visa and the program began rolling out within 60 days of the EO (i.e., from ~June 2025). Separately, the country offers established residency routes for retirees (SRRV) and investors (SIRV).

Framework: No single comprehensive online-safety statute. A patchwork of sector-specific laws governs the space: the Cybercrime Prevention Act of 2012 (RA 10175), the Anti-OSAEC and Anti-CSAEM Act of 2022 (RA 11930), the Internet Transactions Act of 2023 (RA 11967, fully effective 20 June 2025), and the SIM Registration Act of 2022 (RA 11934). Several comprehensive social-media-regulation bills are pending in the 20th Congress.

The Philippines regulates online content and safety through a fragmented set of laws rather than a single DSA/OSA-style regime: cyber-libel and core cyber-offenses (RA 10175), strong child-protection mandates with platform takedown duties (RA 11930), e-commerce platform liability and government takedown/blacklist powers (RA 11967), and SIM registration (RA 11934). There is no general statutory duty-of-care or systemic-risk framework for large platforms, and broad social-media accountability and age-restriction bills remain at the proposal stage. Enforcement currently relies on agencies like the CICC, NTC and DTI, as seen in the 2026 push to compel Roblox to adopt child-safety measures.

Framework: No single comprehensive cybersecurity statute is yet in force. The regime is a patchwork: the Cybercrime Prevention Act (RA 10175), the Data Privacy Act (RA 10173) administered by the National Privacy Commission, sector-specific rules from the Bangko Sentral ng Pilipinas (BSP) for financial institutions, and the policy-level National Cybersecurity Plan 2023-2028 (adopted by Executive Order No. 58), coordinated by the Department of Information and Communications Technology (DICT). A comprehensive Cybersecurity Act bill remains pending in Congress.

The Philippines lacks an omnibus, NIS2-style cybersecurity law; obligations instead arise from sector-specific and cross-cutting instruments. Cybercrime is criminalized under RA 10175, personal-data breach duties flow from RA 10173 and NPC rules, and financial institutions face detailed BSP information-security and cyber-incident reporting circulars. A comprehensive Cybersecurity Act is under deliberation in Congress and has been backed as priority legislation but is not yet enacted as of 2026.

Framework: Foreign Investments Act of 1991 (RA 7042, as amended by RA 8179 and RA 11647), implemented via the Foreign Investment Negative List, currently the 13th FINL under Executive Order No. 113 (2026); company registration under the Revised Corporation Code (RA 11232) administered by the Securities and Exchange Commission (SEC).

The Philippines permits up to 100% foreign ownership in any activity not restricted by the Foreign Investment Negative List (13th FINL, EO 113, effective 2 May 2026), and recent liberalization opened telecoms, airlines, domestic shipping and railways to full foreign equity. However, foreign-owned domestic-market enterprises generally face a USD 200,000 minimum paid-in capital requirement, key sectors remain capped at 40% or fully closed, and incorporation still requires sequential registration with the SEC, BIR and local government units. Company formation itself is now largely online (SEC eSPARC/OneSEC) and can be fast, but the capital and ownership rules make it more demanding than fully open jurisdictions.