AUTHOR:

Atty. Harold B. Medina (Associate)

Gorriceta Africa Cauton & Saavedra

QR codes have made accepting payments easier than ever. But with that convenience comes a growing concern: QR codes are increasingly being exploited for fraud and potential money laundering activities.

On 8 May 2026, the Bangko Sentral ng Pilipinas (BSP) issued Memorandum No. M-2026-017, reminding banks and payment providers to tighten controls over QR-enabled payment activities and merchant accounts.

Do You Have Direct Anti-Money Laundering Obligations?

Generally, no. If you accept payments via QR code, you are generally not a “covered person” under the Anti-Money Laundering Act (AMLA), unless you otherwise fall within specific categories under the AMLA, such as certain designated non-financial businesses and professions. Covered persons required to register with the Anti-Money Laundering Council are regulated financial institutions such as banks, e-wallets, pawnshops, and payment processors, among others.

Your payment provider, however, is a covered person and remains primarily responsible for AML compliance over payment activities flowing through your merchant account.

The Threat of “Mule Merchants” and QR Code Misuse

The BSP’s Memorandum specifically flags a concern over mule merchants: registered businesses whose QR codes are used by unauthorized persons or entities to receive and disguise illegal funds. Because the QR code belongs to a legitimate merchant, the transactions may appear genuine on the surface.

The BSP now requires all banks and payment providers participating in QR Ph to adopt risk-based measures to prevent and detect the unauthorized use or misuse of QR codes by persons or entities other than the duly registered merchant. Banks must also establish clear triggers for restricting or terminating relationships with non-compliant merchants.

What QR-Accepting Merchants Should Expect

Your merchant account will be treated differently from a personal account. Banks are required to maintain clear and effective differentiation between merchant accounts and personal accounts based on the nature and purpose of transactions. Expect your account to be assessed according to its declared purpose.

Your account will be periodically reviewed against your declared business activity. Banks are required to conduct ongoing monitoring of merchant accounts, including periodic reviews of account profiles, merchant information, and actual usage against expected activity. Transactions inconsistent with your declared business may be flagged.

Your QR code will be subject to due diligence and risk controls. Banks are required to ensure QR-enabled payment services include proper end-user due diligence. Unauthorized use of your QR code falls within that oversight and reflects on your merchant account.

The Bottom Line

As a QR-accepting merchant, you are not required to file compliance reports or maintain a formal compliance program. However, your payment provider will be held to a higher standard of oversight over your account and transactions.

Using your merchant account for its intended purpose, ensuring your QR code is used only by your business, and cooperating with your payment provider’s verification processes are the most direct ways to stay compliant.

Read the full BSP issuance: Memorandum No. M-2026-017

For general information only. This does not constitute legal advice. Consult Gorriceta for guidance specific to your situation.

HAROLD B. MEDINA is an Associate and a member of the Firm’s Litigation and Labor & Employment Relations, Data Privacy, Cybersecurity, and AI Initiatives, Technology, Media, and Telecommunications (TMT), and Fraud, Financial Crime & Anti-Money Laundering (AML) Practice Groups. Harold handles disputes involving individuals and businesses before courts and quasi-judicial agencies, and advises clients on data privacy, cybersecurity, AI governance, AML, cybercrime, and other regulatory issues arising from the use of emerging technologies.