Compliance is what let the Philippines’ fintech market scale this fast

Every piece written about the Philippines’ digital finance boom follows the same shape: user numbers, wallet adoption, an IPO headline. Mynt, GCash’s parent, has filed for a potential 2026 Philippine IPO that would imply a valuation of roughly USD 8 billion at the upper end of the proposed price range. InstaPay’s monthly transaction volume went from 99.4 million in March 2024 to 693 million in March 2026, a near sevenfold increase in two years. In BSP’s 2024 measurement, digital payments represented 59 per cent of monthly retail payments by value, compared with 20 per cent in 2018.

Read enough of this coverage and you’d think the Philippines got here by moving fast and asking forgiveness later. It didn’t. The regulatory plumbing went in early, well before the growth curve needed it.

Having worked across compliance vendors and the fintechs they serve, I’ve seen the same pattern on repeat. A platform pitches its growth story around user acquisition and product velocity. Compliance runs quietly in parallel, funded once the growth numbers justify the headcount. The platforms that scale without a regulator forcing a pause inverted that order. They built the monitoring and reporting infrastructure before they needed it, not after a deadline made it urgent.

BSP hasn’t been a passive bystander to any of this. In May, it directed BSP-supervised institutions to strengthen AML and counter-terrorism financing controls across merchant payments, aggregators, QR transactions, onboarding, and ongoing monitoring, making clear that banks retain primary responsibility for these risks even when aggregators perform onboarding or monitoring functions. Circular 950 has long required risk-based AML/CFT monitoring, testing, and reporting. The more recent directive puts sharper practical emphasis on whether those controls actually work across payment activity, not just whether they’re documented on paper. Failure to file required suspicious transaction reports can trigger AMLA and supervisory consequences.

Also Read: The Philippines does not need to build AI to have an AI advantage

None of that reads as anti-growth. BSP lifted its moratorium on digital bank licences and raised the cap to ten in January 2025. MariBank became the seventh licensed digital bank in July 2026. Revolut has been discussed as a possible applicant for one of the remaining slots, though that has not been formally confirmed by BSP or the company. A regulator trying to slow the market down doesn’t open more doors while sharpening the rules at the one it already had.

There’s a structural reason this works, and it’s easy to miss because it isn’t in the headlines. The Philippines established interoperable national payment rails, InstaPay and PESONet, under BSP’s National Retail Payment System framework, with QR Ph as the national QR standard. Wallets such as GCash and Maya compete on product and features while also connecting to those shared rails rather than each running a closed loop. Shared standards can make cross-provider monitoring and reconciliation easier, provided institutions actually exchange and use the relevant data. Building the rails was the easy part. Getting institutions to actually share and act on that data is where most compliance teams are still stuck.

The financial inclusion picture is more complicated than the payments headlines suggest. BSP’s own survey work has put formal account ownership at 56 per cent in 2021 and 50 per cent in its 2025 Consumer Finance and Inclusion Survey, a reminder that account ownership doesn’t move in a straight line even as transaction volumes climb. Reaching underserved and rural populations through digital channels can create heightened onboarding and monitoring challenges, particularly where identity, agent, device, and transaction data are limited. Institutions that under-invest in compliance at that end of the market don’t get flagged in a press release. They get flagged later, in an enforcement action.

Also Read: The Philippines doesn’t need more fintech apps; needs rails

Sumsub’s internal data show that 76 per cent of fraud happens after onboarding, not during it. KYC alone isn’t enough. Risk continues well past the point most institutions stop watching. The platforms actually built to scale past this year’s headlines are the ones treating monitoring, not verification, as the product.

It’s easy to look at Indonesia and Vietnam fintechs eyeing this trajectory and see them studying GCash’s growth curve while missing the compliance infrastructure that made it sustainable. Compliance capability is what keeps the regulator from stepping in before you’ve had the chance to scale.

For foreign fintechs and investors watching the Philippines as a template rather than a footnote, the practical takeaway is sequencing, not spend. The compliance build doesn’t need a bigger budget than the growth build. It needs to start at the same time. Any new entrant into a market with ten digital bank operators and a regulator that has just clarified responsibility for AML and counter-financing controls involving payment aggregators is a useful test case to watch. Whether it treats compliance infrastructure as a launch requirement or a post-launch clean-up will say more about its Philippines strategy than any user acquisition target it publishes.

—