Anti-money laundering compliance in the Philippines is no longer a concern only for big banks. Today, it affects remittance businesses, pawnshops, lending and financing companies, virtual asset service providers, casinos, real estate developers and brokers, jewelry dealers, accountants, lawyers performing covered services, company service providers, and many other businesses that handle money, property, valuable assets, or client funds. A business that ignores AML compliance can face delayed bank account opening, rejected transactions, regulatory findings, administrative fines, criminal exposure for responsible officers, and reputational damage that is difficult to repair.

This guide explains how anti-money laundering compliance works for businesses in the Philippines: who must register, what “covered” and “suspicious” transactions mean, what documents and systems are expected, how to file reports, what foreign-owned or foreign-managed businesses should watch out for, and what practical steps help a business stay compliant.

What Anti-Money Laundering Compliance Means in the Philippines

Anti-money laundering compliance, often shortened to AML compliance, means having controls that prevent criminals from using your business to hide, move, convert, or legitimize money or property from illegal activity.

Under the Philippine Anti-Money Laundering Act, money laundering is not limited to depositing “dirty money” in a bank. It may involve any transaction, attempted transaction, act, or omission that helps make proceeds of an unlawful activity appear legitimate.

In practice, AML compliance usually means your business must:

Know who your customer really is.
Identify the beneficial owner behind a company, trust, nominee, or representative.
Understand the purpose and source of funds for transactions.
Monitor transactions for unusual patterns.
Report covered and suspicious transactions to the Anti-Money Laundering Council.
Keep records securely and retrievably.
Train staff and document internal AML procedures.
Avoid tipping off customers that a suspicious transaction report has been or may be filed.

The Philippines has also aligned its AML framework with counter-terrorism financing and counter-proliferation financing rules. The Anti-Money Laundering Council, or AMLC, is the country’s central AML/CTF authority and financial intelligence unit under the AMLA and the Terrorism Financing Prevention and Suppression Act. The 2024 Guidelines on Transaction Reporting and Compliance Submissions, known as GoTRACS, expressly describe AMLC as the Philippines’ central AML/CTF authority and financial intelligence unit.

Legal Basis of AML Compliance in the Philippines

The main law is Republic Act No. 9160, the Anti-Money Laundering Act of 2001, as amended by several laws including RA 9194, RA 10167, RA 10365, RA 10927, and RA 11521. GoTRACS identifies the AMLA as RA 9160 as amended by those laws.

Important laws and issuances include:

Legal basis	Why it matters
RA 9160, as amended	Main AML law; defines money laundering, covered persons, reporting duties, recordkeeping, penalties, freeze orders, and AMLC powers.
RA 9194	Strengthened reporting duties and lowered the general covered transaction threshold to ₱500,000.
RA 10167	Expanded AMLC authority, especially on bank inquiries and freeze-related powers.
RA 10365	Expanded “covered institutions” into “covered persons” and added more predicate offenses and sectors.
RA 10927	Added casinos as covered persons.
RA 11521	Further expanded coverage to real estate developers and brokers, offshore gaming operators and service providers, targeted financial sanctions, proliferation financing, tax crimes meeting statutory conditions, and related AMLC powers. (Supreme Court E-Library)
RA 10168	Terrorism Financing Prevention and Suppression Act of 2012; terrorism financing is a predicate offense to money laundering and subject to suspicious transaction reporting. (Supreme Court E-Library)
2021 Sanctions Guidelines and TFS issuances	Cover targeted financial sanctions related to terrorism, terrorism financing, and proliferation financing. (amlc.gov.ph)
GoTRACS, AMLC Regulatory Issuance No. 2, Series of 2024	Current major reporting framework for covered transaction reports, suspicious transaction reports, report formats, timelines, KYC uploads, beneficial ownership templates, and related submissions. (PAGCOR)

RA 11521 states the national policy clearly: the Philippines must protect the integrity and confidentiality of bank accounts while ensuring that the country is not used as a money laundering site for proceeds of unlawful activity. It also recognizes cooperation in transnational investigations and targeted financial sanctions for terrorism, terrorism financing, and proliferation financing. (Supreme Court E-Library)

Who Must Comply: Covered Persons and Businesses

A covered person is a business or professional required by AML law to register, conduct customer due diligence, keep records, monitor transactions, and submit reports to the AMLC when required.

The AMLC registration portal lists many covered business categories, including banks, offshore banking units, quasi-banks, trust entities, pawnshops, foreign exchange dealers, money changers, remittance and transfer companies, electronic money issuers, payment system operators, virtual asset service providers, insurance companies, securities brokers and dealers, lending and financing companies, real estate brokers and developers, jewelry dealers, casinos, offshore gaming operators, company service providers, lawyers, accountants, and other professionals performing covered services. (portal.amlc.gov.ph)

Common businesses that often need AML registration

Your business may be a covered person if it falls under any of these categories:

Business or profession	AML concern
Banks, rural banks, digital banks, quasi-banks	Deposit, lending, trust, and payment flows
Remittance centers, money changers, FX dealers	Cross-border transfers, cash conversion, layering
Pawnshops	Cash-heavy transactions and pledged valuables
Electronic money issuers and payment operators	E-wallets, digital transfers, merchant flows
Virtual asset service providers	Crypto-related transfers and conversion risk
Lending and financing companies	Source of funds, loan repayments, corporate borrowers
Insurance companies, brokers, pre-need companies, HMOs	Premium payments, investment-linked products, claims
Securities brokers, dealers, investment houses, fund managers	Market transactions and beneficial ownership concerns
Casinos and gaming operators	High-value cash transactions and junket risks
Real estate developers and licensed brokers	High-value property purchases, nominees, foreign funds
Jewelry, precious metals, and precious stones dealers	Portable high-value assets
Company service providers	Formation and management of companies or nominee arrangements
Lawyers and accountants performing covered services	Managing client money, securities, assets, companies, or accounts

For lawyers and accountants, coverage is not because they give ordinary legal or accounting advice. The AML risk arises when they perform specified covered services such as managing client money, securities, or other assets; managing bank, savings, or securities accounts; organizing contributions for creating or operating companies; creating, operating, or managing juridical persons or arrangements; or buying and selling business entities.

Covered Transactions vs. Suspicious Transactions

Many business owners confuse covered transactions with suspicious transactions. They are different.

A covered transaction is reportable because it crosses a legal threshold. A suspicious transaction is reportable because the facts look unusual, inconsistent, or potentially connected to unlawful activity — even if the amount is small.

Covered transaction thresholds

Under current GoTRACS definitions, a covered transaction includes the following:

Transaction type	Threshold
General cash or equivalent monetary instrument transaction	More than ₱500,000
Jewelry dealers, precious metals dealers, precious stones dealers	Cash or equivalent monetary instrument transaction of more than ₱1,000,000
Real estate developers or brokers	Single cash transaction of more than ₱7,500,000 or foreign currency equivalent
Casinos	Casino cash transaction of more than ₱5,000,000 or foreign currency equivalent

For casinos and real estate developers or brokers, GoTRACS states that the reportable covered transaction is the covered cash transaction.

Suspicious transactions

A suspicious transaction does not depend on the amount. RA 11521 lists suspicious circumstances such as:

no underlying legal or trade obligation, purpose, or economic justification;
the client is not properly identified;
the amount is not commensurate with the client’s business or financial capacity;
the transaction appears structured to avoid reporting requirements;
the transaction deviates from the client’s profile or past transactions;
the transaction is related to an unlawful activity; or
the transaction is similar or analogous to the foregoing. (Supreme Court E-Library)

Examples:

Scenario	Why it may be suspicious
A newly incorporated corporation with ₱25,000 paid-up capital buys multiple condominium units in cash.	Transaction amount may not match business profile or financial capacity.
A client asks to split one ₱900,000 payment into three ₱300,000 payments under different names.	Possible structuring to avoid reporting thresholds.
A foreign client uses a local “friend” as buyer but provides all funds and instructions.	Possible nominee or beneficial ownership issue.
A customer refuses to provide IDs, source of funds, or beneficial ownership information.	Client not properly identified.
Payments come from unrelated third parties with no clear business purpose.	No clear economic justification.
A customer’s name appears in sanctions, terrorism financing, fraud, trafficking, corruption, or cybercrime alerts.	Possible link to unlawful activity or targeted financial sanctions.

GoTRACS requires covered persons to have systems that alert responsible officers or employees to circumstances that may give rise to suspicion of money laundering or terrorism financing.

Core AML Obligations of Covered Businesses

1. Register with the AMLC

Covered persons must register through the AMLC system before they can properly submit required reports. The AMLC portal supports online registration, updating of registration, and submission of supporting documents; hardcopy submission is no longer required through the portal process. (portal.amlc.gov.ph)

In practical terms, a covered business should prepare:

SEC Certificate of Incorporation or DTI business name registration;
latest General Information Sheet or ownership documents;
business permits and relevant regulatory licenses;
board or management authorization appointing the compliance officer;
details of the compliance officer, alternate compliance officer, and authorized users;
official email addresses and contact numbers;
tax identification details;
data privacy or information security contact, if required by the system;
scanned IDs of authorized officers.

Common bottlenecks include inconsistent business names across SEC, BIR, business permit, and bank documents; outdated GIS; missing board authorization; and officers using personal emails instead of official company-controlled accounts.

2. Appoint a compliance officer and create an AML program

A covered business needs a clear person or unit responsible for AML. For small businesses, this may be a senior officer wearing more than one hat. For larger institutions, it usually means a dedicated compliance office.

Your Money Laundering and Terrorism Financing Prevention Program should explain:

Who approves customers.
What IDs and documents are required.
How customer risk is rated.
How beneficial owners are identified.
How source of funds and source of wealth are checked.
What red flags staff must escalate.
Who decides whether to file an STR.
How CTRs and STRs are prepared and filed.
How records are stored.
How staff are trained and tested.
How sanctions screening is done.
How internal audit or compliance testing is performed.

For BSP-supervised financial institutions, BSP guidance emphasizes that the board of directors and senior management have ultimate responsibility for AML/CTPF compliance and should manage beneficial ownership risk through institutional risk assessment and risk-based controls. (Bureau of the Treasury)

3. Conduct customer due diligence and know-your-customer checks

Customer due diligence, or CDD, means identifying and verifying the customer and understanding the purpose of the transaction or relationship.

For an individual customer, this normally includes:

full legal name;
date and place of birth;
nationality;
present and permanent address;
mobile number and email;
government-issued ID;
occupation or business;
source of funds;
purpose of transaction;
specimen signature or digital authentication record, when applicable.

For a corporation, partnership, association, foundation, or foreign entity, this normally includes:

SEC registration or equivalent foreign registration;
articles of incorporation, bylaws, partnership documents, or charter documents;
latest General Information Sheet;
beneficial ownership declaration;
board resolution or secretary’s certificate authorizing the transaction;
IDs of directors, officers, signatories, and beneficial owners;
proof of business address;
source of funds and nature of business;
ownership chart if there are multiple layers of companies.

GoTRACS defines a beneficial owner as a natural person who ultimately owns or controls the customer, on whose behalf a transaction is conducted, who has ultimate effective control over a juridical person or arrangement, or who owns at least 20% shares, contributions, or equity interest.

The practical rule is simple: do not stop at the company name. Ask who the real human beings behind the transaction are.

4. Identify beneficial ownership and control

Beneficial ownership is one of the biggest AML problem areas in the Philippines because criminals often use corporations, nominees, relatives, employees, drivers, helpers, or “business partners” to hide the real owner.

For corporate customers, check:

Who owns at least 20%.
Who controls voting rights.
Who appoints directors or officers.
Who funds the transaction.
Who receives the economic benefit.
Who gives instructions, even if not named in the papers.
Whether there are foreign shareholders, nominee shareholders, bearer-like arrangements, trusts, or layered corporations.

BSP’s beneficial ownership guidance warns that legal persons can be abused through ambiguous ownership structures, nominee shareholders and directors, bearer shares, family members, close associates, shell companies, and complex corporate layers. (Bureau of the Treasury)

A useful practice is to require an ownership chart up to the natural-person level. For high-risk customers, do not rely only on the GIS. Cross-check SEC documents, public records, corporate websites, sanctions lists, adverse media, and the documents provided by the customer.

5. Monitor and report transactions

Covered persons must submit Covered Transaction Reports (CTRs) and Suspicious Transaction Reports (STRs) through AMLC’s File Transfer and Reporting Facility, or FTRF, which GoTRACS identifies as the AMLC Portal.

Under GoTRACS:

CTRs must be complete, accurate, and filed electronically through the AMLC reporting facility.
STRs must be filed promptly, including attempted suspicious transactions.
STRs are filed within the next working day from the “occurrence,” meaning the establishment of suspicion or determination that the transaction is suspicious.
Covered persons must have a reporting chain for review, validation, escalation, and final decision-making.
Controls must prevent tipping off, meaning telling the customer that an STR has been or may be filed.

This is where many businesses fail in practice. They notice a red flag but do not document who reviewed it, when it was escalated, why the transaction was or was not considered suspicious, and when the final decision was made.

6. Keep records securely

Covered persons must keep records so transactions can be reconstructed and reviewed by regulators, AMLC, or courts.

Older AMLA implementing rules state that records of transactions must be maintained and safely stored for five years from the dates of transactions, closed-account records must be kept for at least five years from closure, and records connected to a money laundering case filed in court must be retained until the case is finally resolved or terminated. (Supreme Court E-Library)

In practical terms, your business should be able to retrieve:

customer IDs;
KYC forms;
transaction receipts;
invoices and contracts;
proof of source of funds;
beneficial ownership documents;
internal risk rating;
red flag review notes;
CTR and STR submission confirmations;
sanctions screening results;
staff training records;
internal audit findings.

Step-by-Step AML Compliance Setup for Philippine Businesses

Step 1: Confirm if your business is a covered person

Check your SEC registration, mayor’s permit, regulatory license, and actual business activities. A company may not think of itself as financial, but it may still be covered if it operates as a remittance agent, payment operator, lending company, financing company, real estate developer, broker, jewelry dealer, company service provider, or professional service provider performing covered services.

Step 2: Register with the AMLC

Prepare company documents, appoint authorized personnel, and complete online registration. Make sure the compliance officer has access to official company email and can receive AMLC notices.

Step 3: Draft or update your AML manual

Your AML manual should match your actual operations. A copied template that mentions products you do not offer, departments you do not have, or approvals no one follows is a common audit problem.

Step 4: Build your KYC checklist

Use different checklists for:

individual customers;
Philippine corporations;
foreign corporations;
partnerships;
sole proprietorships;
non-profit organizations;
politically exposed persons;
foreign customers;
high-value cash transactions;
representatives or agents.

Step 5: Create a customer risk rating system

At minimum, classify customers as low, normal, or high risk. Consider:

nationality and residence;
source of funds;
occupation or business;
transaction amount;
product or service used;
cash intensity;
ownership structure;
presence of nominees or representatives;
adverse media;
sanctions or watchlist results;
politically exposed person status.

Step 6: Screen customers and beneficial owners

Screen not only the direct customer but also:

signatories;
directors;
authorized representatives;
beneficial owners;
payors and payees;
third-party funders;
counterparties, where relevant.

For targeted financial sanctions, the AMLC’s sanctions guidelines cover terrorism, terrorism financing, and proliferation financing obligations. (amlc.gov.ph)

Step 7: Train frontliners and decision-makers

Frontliners are usually the first to notice suspicious behavior. Train them to recognize red flags such as:

reluctance to provide IDs;
inconsistent explanations;
unnecessary secrecy;
unusual urgency;
use of unrelated third-party payors;
structuring of payments;
sudden change in transaction behavior;
mismatch between customer profile and transaction size.

Training should be documented with attendance sheets, materials, dates, topics, and test results.

Step 8: Test your system

At least periodically, test whether:

KYC files are complete;
beneficial ownership was properly identified;
CTRs were filed on time;
STR decisions were documented;
sanctions screening is working;
records can be retrieved quickly;
staff know escalation procedures.

Practical Issues for Foreigners and Foreign-Owned Businesses

Foreign investors, expatriates, and foreign-controlled companies often encounter AML questions when opening Philippine bank accounts, buying property, remitting funds, investing, lending, or setting up companies.

Common documents requested include:

passport;
visa status or ACR I-Card, if applicable;
proof of Philippine address or foreign address;
employment, business, or investment documents;
tax identification number, where applicable;
source of funds documents, such as bank statements, sale documents, tax returns, payslips, audited financial statements, or remittance records;
corporate registration documents for foreign companies;
apostilled or consularized documents when foreign public documents must be used in the Philippines.

For documents issued in the Philippines for use abroad, the DFA uses the apostille process through its apostille system and appointment channels. (appointment.apostille.gov.ph) For foreign documents to be used in the Philippines, the usual practical requirement is authentication from the issuing country according to that country’s apostille or consular process, then local acceptance by the Philippine institution requesting the document.

Foreigners should also remember that AML clearance is different from foreign ownership legality. For example, a foreigner may be able to prove source of funds but still face constitutional or statutory restrictions on owning land in the Philippines. In real estate transactions, this is why developers, brokers, banks, and lawyers often ask both AML questions and ownership-eligibility questions.

Common AML Compliance Mistakes

Treating AML as a one-time registration

AMLC registration is only the start. Regulators look at actual implementation: KYC files, transaction monitoring, reporting logs, escalation records, training, and audit results.

Relying only on thresholds

A transaction below ₱500,000 can still be suspicious. A ₱90,000 payment from a customer linked to fraud, trafficking, terrorism financing, cybercrime, or a sanctions list may be far more serious than a routine ₱600,000 transaction from a well-documented customer.

Ignoring beneficial ownership

A corporation is not the final answer. Ask who owns, controls, funds, and benefits from the transaction.

Allowing staff to warn customers

Telling a customer, “We might report you to AMLC,” can create tipping-off risk. Staff should be trained to ask ordinary due diligence questions without revealing internal suspicion or reporting decisions.

Filing incomplete reports

A timely but poor-quality report can still cause problems. STR narratives should explain what happened, why it is suspicious, who is involved, dates, amounts, related accounts or documents, and what supporting files exist.

Not documenting “no STR” decisions

If a red flag is reviewed and the business decides not to file an STR, document the reason. Regulators may later ask why a suspicious-looking transaction was not reported.

Penalties and Consequences of Non-Compliance

AML failures can lead to administrative, criminal, and business consequences.

GoTRACS states that failure to comply with its requirements may subject covered persons and responsible directors, officers, and employees to administrative sanctions, without prejudice to possible criminal liabilities for money laundering under Section 4 of the AMLA.

Older AMLA rules also provide penalties for failure to keep records, malicious reporting, and criminal liability for covered persons and responsible officers. For example, failure to keep records may be punished by imprisonment of six months to one year or a fine of ₱100,000 to ₱500,000, or both. (Supreme Court E-Library)

Other practical consequences include:

bank account opening delays;
closure or freezing of accounts;
requests for explanation from banks or regulators;
inability to transact with registered covered persons;
failed due diligence by investors or counterparties;
suspension, revocation, or non-renewal of licenses;
reputational damage with customers, banks, and regulators.

The Supreme Court has recognized the importance of AMLC tools such as bank inquiry, freeze orders, and civil forfeiture in cases involving suspected unlawful proceeds, while also requiring compliance with legal procedure and due process. Cases such as Republic v. Eugenio, Republic v. Glasgow Credit and Collection Services, Inc., and later AMLC-related cases show that AML enforcement can move from compliance review to court-supervised asset restraint and forfeiture when facts justify it. (Lawphil)

Why AML Compliance Still Matters After the Philippines’ FATF Grey List Exit

In February 2025, the Financial Action Task Force stated that the Philippines was no longer subject to increased monitoring. (FATF) That was good news for the country, banks, OFWs, investors, and businesses because grey-listing can increase due diligence burdens and transaction friction.

But the exit does not mean AML rules became relaxed. It means the Philippines must sustain reforms. Businesses should expect regulators and banks to continue asking for better beneficial ownership information, stronger reporting controls, sanctions screening, and proof that AML programs are working in practice.

Frequently Asked Questions

Do all businesses in the Philippines need AMLC registration?

No. Only covered persons under the AMLA must register. Ordinary retailers, restaurants, small service providers, and manufacturers are usually not covered unless they also perform covered activities such as money remittance, lending, financing, payment services, real estate development or brokerage, casino operations, jewelry or precious metals dealing, virtual asset services, or covered professional services.

Is a cash transaction above ₱500,000 automatically illegal?

No. A covered transaction is not automatically illegal. It is reportable because it crosses the legal threshold. The transaction may be perfectly legitimate if the customer is properly identified and the source of funds and purpose are clear.

Can a suspicious transaction be below ₱500,000?

Yes. Suspicious transaction reporting is based on circumstances, not amount. Even a small transaction can be suspicious if it lacks economic purpose, uses fake or incomplete identity documents, appears structured, involves a sanctioned person, or is linked to unlawful activity.

What is the deadline for filing an STR?

Under GoTRACS, STRs must be filed through the AMLC’s reporting facility within the next working day from the occurrence, meaning the establishment of suspicion or determination that the transaction is suspicious. The internal review period must be controlled and documented so the business can show when suspicion was actually established.

What is beneficial ownership in simple terms?

Beneficial ownership asks: “Who is the real human being behind this customer or transaction?” It is not enough to identify the corporation named in the contract. You must identify the natural person who ultimately owns, controls, funds, instructs, or benefits from the transaction.

What happens if a customer refuses to provide KYC documents?

The business should not proceed blindly. Depending on the facts, it may refuse the transaction, terminate the relationship, or consider whether an STR should be filed. A refusal to provide identity, source of funds, or beneficial ownership documents is itself a serious red flag.

Are lawyers and accountants always covered persons?

No. Lawyers and accountants are covered only when they perform specific covered services, such as managing client money, securities, or other assets; managing bank or securities accounts; organizing contributions for companies; creating or managing juridical persons or arrangements; or buying and selling business entities. Ordinary legal advice, court representation, tax advice, or accounting work does not automatically make every engagement a covered service.

Do foreign clients need extra AML documents?

Often, yes. Foreign clients may be asked for passports, visa or residency documents, proof of address, source of funds, foreign company registration documents, ownership charts, tax records, bank statements, and apostilled or authenticated documents. The exact requirement depends on the risk profile and the institution’s policies.

Can a business tell a customer that it filed an STR?

No. Covered persons must maintain confidentiality and avoid tipping off. Staff should not tell the customer that a report has been filed or that the customer is under AML review.

How long should AML records be kept?

As a practical baseline, AML records should be kept for at least five years, and longer if the account is closed, the relationship ends, or a money laundering case has been filed and remains unresolved. Records should be stored securely and be retrievable when required by regulators, AMLC, or courts.

Key Takeaways

AML compliance in the Philippines applies to many businesses beyond banks, including remittance centers, pawnshops, payment operators, lending and financing companies, VASPs, casinos, real estate developers and brokers, jewelry dealers, company service providers, and certain lawyers and accountants.
The main law is RA 9160, as amended by RA 9194, RA 10167, RA 10365, RA 10927, and RA 11521.
A covered transaction is reportable because it crosses a threshold; a suspicious transaction is reportable because the facts are unusual or risky, regardless of amount.
Current key thresholds include more than ₱500,000 for general cash or equivalent monetary instrument transactions, more than ₱1,000,000 for jewelry and precious metals or stones dealers, more than ₱7,500,000 cash for real estate developers or brokers, and more than ₱5,000,000 casino cash transactions.
Beneficial ownership is central: identify the real natural person who owns, controls, funds, instructs, or benefits from the transaction.
AMLC registration is only the beginning. Businesses must maintain a working AML program, KYC process, reporting chain, sanctions screening, recordkeeping system, and staff training.
STRs require careful internal review, prompt filing after suspicion is established, complete narratives, supporting documents, and strict confidentiality.
Foreign-owned and foreign-managed businesses should prepare for additional KYC, source-of-funds, beneficial ownership, apostille, and ownership-eligibility checks.
Non-compliance can lead to administrative sanctions, criminal exposure for responsible persons, account closures, license issues, frozen assets, and serious reputational harm.