BSP Certification Philippines: Which Payment License Does It Actually Mean?

Which License Does 'BSP Certification' Actually Mean

Talk to enough payment providers in the Philippines and eventually one of them will say it is 'BSP-certified' or 'BSP-approved.' The phrase itself is vague, because Bangko Sentral ng Pilipinas (BSP) does not hand out one all-purpose certificate. Instead, it approves different licenses depending on what a business is actually doing. What 'BSP certification' usually points to is one of two things: an institution that processes payments or fund transfer solutions is classified by BSP as an Operator of Payment Systems (OPS); an institution that issues e-wallet balances itself needs an Electronic Money Issuer (EMI) license. Both licenses are approved by BSP, and the review looks at whether the applicant has real financial capacity, operating capability, and governance — the process typically runs on a quarterly timeline, not a matter of weeks. So the next time someone says 'we're BSP-certified,' the right follow-up question is: which license, specifically — OPS, EMI, or both? If a provider can't answer that clearly, treat it as a warning sign.

What BSP Actually Regulates in Payments, Beyond Licensing

Treating BSP's oversight as 'just licensing' misses two other things it regulates just as closely, and understanding them fills out the full picture behind the phrase 'BSP certification.'

The first is the QR Ph (QRPH) standard. QRPH is a nationwide, unified QR code standard led by BSP — it is not a code invented by any single wallet. A merchant that displays one QRPH code can be scanned by GCash, Maya, and dozens of participating banks' apps, without needing a separate code for each wallet. The standard runs on the internationally used EMVCo QR framework, the same logic behind Singapore's SGQR and Thailand's PromptPay. So sometimes when a merchant hears 'BSP certification,' what's really being described is whether that provider's collection code is actually compliant with the QRPH standard — a question about the product, not about whether the entity itself holds an OPS or EMI license. Those are two different things and shouldn't be conflated.

The second is clearing channel rules. Starting February 2026, BSP requires digital banks and e-wallets to route transfers through the two standardized clearing channels, InstaPay and PESONet, rather than building their own private rails. That means even a provider that holds a valid license still has to settle its transfers through these two BSP-mandated channels — it can't route around them. Merchants rarely see this layer directly, but it determines how funds actually move and clear behind the scenes.

Put the three together: the entity-level license (OPS/EMI) answers 'is this institution allowed to do this'; the QRPH standard answers 'can its collection product be universally scanned by mainstream wallets'; the clearing channel rules answer 'how does the money actually move between banks.' All three fall under BSP, but they answer different questions — worth keeping separate when verifying a provider's claims.

How Merchants Can Verify a 'BSP Certification' Claim

Because 'BSP certification' has no single fixed meaning, it helps to break the claim down into steps rather than take it at face value:

• Ask specifically which license the provider holds — OPS, EMI, or both. A provider handling fund collection or disbursement on behalf of merchants typically needs OPS; one that also opens e-wallet balance accounts for users needs EMI.
• Once you have a license number and registered company name, cross-check them against BSP's public list — BSP publishes a public list of registered Electronic Money Issuers and Operators of Payment Systems, which lets you verify the license number and registered company name a provider gives you. A mismatched name or a number that doesn't show up is an obvious red flag.
• Ask whether the collection code is actually integrated with QRPH — can it be scanned universally by GCash, Maya, and other participating banks' apps, or only recognized by one wallet? That determines whether a merchant needs to post one code or several.
• Keep in mind: not every business that claims to do 'payment integration' actually holds BSP's OPS or EMI license. Sub-licensing and reselling arrangements are not uncommon, so this is worth verifying independently rather than taking a provider's pitch at face value.

Working through these steps turns a vague phrase like 'BSP certification' into a handful of facts you can actually check one by one.

After the License Is Confirmed: Integration Form, Settlement, and Process Still Need Clarifying

Even after confirming a provider's license, integration itself involves details that fall outside BSP's approval scope — these are things a merchant has to work out directly with the provider. Two common integration forms exist: redirecting to a third-party checkout page (the customer briefly leaves the merchant's own site or app), or 'native' integration, where the customer scans a code or triggers the app directly on the merchant's own page, without ever leaving it. Three common activation methods go with these: web-based H5 activation (suited to merchants without their own app), in-app SDK integration (suited to merchants with an existing native app and a mobile team to support integration work), and offline static or dynamic QR codes (for storefronts and restaurants, paired with a single QRPH code that works across multiple wallets).

Settlement speed is also worth clarifying upfront. Two common terms come up: 'D0 same-day settlement' (funds arrive the same day) and 'T1 next-day settlement' (funds arrive the next day). Not every provider defaults to D0, so it's worth confirming which applies and whether there are exceptions. The broader integration process typically runs: submitting company documentation for due diligence (to satisfy BSP's KYC/anti-money-laundering requirements) → sandbox testing, where technical teams integrate order placement, payment callbacks, and refunds → pre-launch acceptance testing (transaction reconciliation, payment success rates, risk-alert mechanisms) → going live in production → ongoing reconciliation and anomaly monitoring through the merchant's transaction dashboard. During sandbox testing, a few details are worth asking about early: whether payment results come through active polling or a pushed webhook callback; whether a duplicate notification for the same payment could cause double-booking (i.e., whether the interface is idempotent); and whether refunds go back through the original payment method or as a separate transfer, and whether the arrival time matches the original payment.

Working with a licensed provider doesn't mean handing everything off — KYC/AML documentation that's supposed to come from the merchant's own company still has to come from the merchant. Fee structures, settlement cycles, and the number of supported channels vary by provider, so it's worth comparing a few. GCash and QRPH systems also get interface upgrades and rule changes from time to time, so integration isn't a one-time setup — someone needs to keep following up afterward. The company itself has to be established first (through SEC registration), since a payment provider's due diligence will ask for incorporation documents, director information, and a business address — none of which exist until the entity is set up, which is why many cross-border sellers line up company formation and corporate bank account setup alongside payment integration on the same timeline.

For the full picture of integration — licensing, settlement, and QRPH in one place — see Philippines Payment Gateway: GCash/QRPH Merchant Integration Guide. When it comes to verifying licenses and comparing providers, one licensed provider we're aware of is SmartPay (paysmartph.com), which offers native GCash integration, QRPH aggregated collection, and Maya disbursement, and holds BSP-issued OPS and EMI qualifications — merchants can verify the license details themselves and compare quotes, and their team is reachable on Telegram for business inquiries.

Official Sources

For authoritative information on the QRPH standard and license approvals, check BSP directly: Bangko Sentral ng Pilipinas (BSP). For company registration matters, check: Securities and Exchange Commission (SEC). License numbers and specific registration details should be verified against BSP's current public list. Last checked: September 2026.

About this guide and Yixing

Want someone to check your documents against the current requirements? → Yixing can review your case with you

Yixing is a private consulting company registered in the Philippines (SEC Reg. No. CS202009551; BI Accreditation No. CA-202624381-1). This guide does not name or rate other providers and does not promise any outcome; approval rests with the competent authority, and the rules in force are those it currently publishes. For legal disputes or case-specific judgments, consult a practising lawyer — this is not legal advice.