The Central Bank of the Philippines has issued new rules for BSP-supervised financial institutions that operate digital financial marketplaces, tightening standards for how these platforms are run and how customers are protected. Under Circular No. 1237, operators must meet requirements on risk governance, data governance, consumer protection and customer due diligence, and must hold at least PHP 1 billion in capital to support ongoing technology and cybersecurity investment. The framework applies to platforms that offer financial products and services from multiple providers, including loans, insurance and investments, and can also include related non-financial offers tied to a bank or e-wallet product. It defines the responsibilities of both marketplace operators and third-party financial service providers, covering accreditation, performance reviews, platform security, complaints handling, recourse mechanisms, data protection and compliance with applicable laws and regulations. To support consumer choice and competition, platforms must present financial products in a neutral and impartial way and include at least three service providers that are not affiliated with the operator's group or conglomerate. The circular also makes clear that financial information can be shared only with the customer's consent, through secure channels and in line with applicable laws and regulations. The measures respond to the growing use of digital financial marketplaces and the operational and consumer protection risks they can create. The circular also builds on existing Central Bank of the Philippines outsourcing rules and complements the cross-selling framework.
Central Bank of the Philippines2026-06-26
Central Bank of the Philippines tightens digital financial marketplace rules and sets PHP 1 billion capital requirement
The Central Bank of the Philippines has issued new rules for digital financial marketplaces operated by BSP-supervised financial institutions. The framework sets governance, consumer protection, data and due diligence standards, requires at least PHP 1 billion in capital, and imposes neutrality and unaffiliated-provider requirements to support competition. It also restricts sharing of financial information to cases where the customer has consented and secure channels are used.