Philippines KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Philippines.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Guide d’implémentation portable
Obtenir la checklist PDF
11 domaines de contrôle · 39 contrôles d’implémentation
Dernière revue: 25 September 2026 · Version 1.0
Télécharger la checklistRéponse directe
Que couvre la checklist de conformité pour Philippines ?
La checklist pour Philippines traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 39 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- FIU
- Anti-Money Laundering Council (AMLC)
- Primary AML rules
- AMLA, as amended, implementing rules and sector-supervisor regulations
- CTR / STR timing
- Generally within 5 working days from occurrence; AMLC may prescribe a different period not exceeding 15 working days
- General covered transaction
- Cash or equivalent monetary instrument exceeding PHP 500,000 within 1 banking day; separate sector thresholds apply
- AML retention
- Generally 5 years, with transaction, account-closure or relationship-end triggers depending on record type
- Banking BO test
- 20% is an ownership indicator, followed by control-by-other-means and senior-managing-official fallback
- Privacy breach
- Notify the NPC and affected data subjects within 72 hours when the mandatory-notification test is met
- FATF public lists
- Not listed at 19 June 2026; exited increased monitoring on 21 February 2025
Détail d’implémentation
Exigences et actions de conformité pour Philippines
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingClassify the entity, activity and competent supervisor before relying on a control or launching a service.4 éléments+
Determine whether each activity is performed by a covered person.
- Action d’implémentation
- Map financial institutions, securities and insurance businesses, casinos, designated non-financial businesses and professions, real-estate developers and brokers, and other in-scope activities to the current AMLA and implementing rules; document exclusions and the supervising authority.
- Preuves à conserver
- Entity chart, activity and funds-flow inventory, statutory mapping, supervisor analysis and counsel sign-off.
- Source primaire
- AMLA, section 3(a), as amended; 2018 IRR, Rule 4, as amended
Register with the AMLC where the covered-person rules require it.
- Action d’implémentation
- Complete current covered-person registration, appoint authorised users and compliance personnel, maintain AMLC portal access and keep registration particulars current before filing reports.
- Preuves à conserver
- Certificate or provisional certificate of registration, appointments, portal enrolment, user-access review and change log.
- Source primaire
- AMLA, sections 7 and 9; AMLC covered-person registration requirements
Obtain each sector licence or registration before regulated activity.
- Action d’implémentation
- Confirm BSP, SEC, Insurance Commission, PAGCOR or other applicable authority requirements for the actual service, including payment-system operation, merchant acquisition, money service, casino and financial-product activity.
- Preuves à conserver
- Perimeter memorandum, application, licence or registration, conditions, regulator correspondence and renewal calendar.
- Source primaire
- Applicable sector law and supervisor issuance; National Payment Systems Act and current BSP payment rules where applicable
Do not treat offshore gaming as a licensable AMLA activity.
- Action d’implémentation
- Block any business model involving prohibited offshore gaming, POGO content, services, hubs or facilitation; treat detected activity as a legal and suspicious-transaction escalation, not as a registration opportunity.
- Preuves à conserver
- Product prohibition, customer and merchant screening, escalation record, exit decision and STR assessment.
- Source primaire
- Republic Act No. 12312, sections 4, 5 and 8
02Governance and ML/TF/PF risk assessmentThe programme must be risk-based, approved, resourced and tested for the entity's actual exposure.3 éléments+
Maintain a documented institutional ML, TF and PF risk assessment.
- Action d’implémentation
- Assess customers, countries, products, services, transactions, delivery channels, technology and outsourcing and update the assessment before material change and when official risk information changes.
- Preuves à conserver
- Methodology, current assessment, data sources, approval, residual-risk decisions and remediation plan.
- Source primaire
- 2018 IRR, Rules 15 and 16, as amended; applicable sector-supervisor AML rules
Maintain an approved prevention programme and accountable compliance function.
- Action d’implémentation
- Assign board and senior-management oversight and a sufficiently independent compliance officer; document controls for CDD, monitoring, reporting, sanctions, records, training and regulatory response.
- Preuves à conserver
- Approved programme, appointments, committee minutes, reporting packs, training and issue log.
- Source primaire
- AMLA, section 9; 2018 IRR, Rule 16, as amended
Independently test programme design and operation.
- Action d’implémentation
- Use a risk-based audit scope and competent reviewers to test customer files, beneficial ownership, reporting clocks, sanctions, data quality and remediation to verified closure.
- Preuves à conserver
- Audit plan, independence assessment, sample record, findings, management response and closure tests.
- Source primaire
- 2018 IRR, Rule 16, as amended; applicable BSP, SEC, IC or PAGCOR rules
03Natural-person identificationCDD applies at relationship, relevant occasional-transaction, suspicion and prior-data-doubt triggers.4 éléments+
Identify and verify every natural-person customer using reliable sources.
- Action d’implémentation
- Collect the prescribed identity attributes, verify official identity evidence or other reliable independent data, resolve inconsistencies and prohibit anonymous or fictitious-name accounts.
- Preuves à conserver
- Customer record, identity evidence, source provenance, verification result, timestamp and discrepancy resolution.
- Source primaire
- AMLA, section 9(a); 2018 IRR, Rules 17 and 18; BSP MORB section 921 for BSP-supervised institutions
Apply the correct CDD trigger and threshold.
- Action d’implémentation
- Configure relationship opening, relevant occasional transactions, suspicion and doubt about prior identification; for BSP-supervised institutions apply the current relevant-business-transaction thresholds and linked-transaction aggregation without generalising them to other sectors.
- Preuves à conserver
- Sector trigger matrix, aggregation logic, tested scenarios, rule version and exceptions.
- Source primaire
- 2018 IRR, Rule 18; BSP MORB section 921(b)-(d)
Verify representatives and authority.
- Action d’implémentation
- Identify and verify each person acting for a customer and establish the mandate and its limits before accepting instructions or granting access.
- Preuves à conserver
- Representative KYC, authority document, verification result, scope limits and activity log.
- Source primaire
- AMLA, section 9(a); 2018 IRR, Rule 18
Control failed CDD and tipping-off risk.
- Action d’implémentation
- Where required CDD cannot be completed, do not open or perform the transaction, or terminate the relationship as the applicable rule requires, and consider an STR. If continuing CDD would tip off the customer, stop that inquiry and follow the authorised STR and monitoring procedure.
- Preuves à conserver
- CDD gap, restriction or exit record, decision approval, suspicion assessment and filing receipt where applicable.
- Source primaire
- 2018 IRR, Rule 18; BSP MORB section 921(a)
04KYB, registries, and beneficial ownershipVerify legal existence, authorised persons, ownership and control; keep AML tests separate from corporate disclosure.4 éléments+
Verify legal-person or arrangement identity and existence.
- Action d’implémentation
- Obtain current registration, constitutional, address, business-purpose, officer, partner, trustee and authority information from the SEC, another competent registry and reliable independent sources.
- Preuves à conserver
- Registry extract, constitutional documents, licences, officer list, mandates and discrepancy log.
- Source primaire
- AMLA, section 9(a); 2018 IRR, Rule 18
Identify the natural persons who ultimately own or control the customer.
- Action d’implémentation
- Trace the ownership chain and control by other means. For BSP-supervised institutions, treat at least 20% ownership as an ownership indicator, then apply control-by-other-means and senior-managing-official fallback rules; do not export that sector formulation without checking the governing rule.
- Preuves à conserver
- Layered ownership chart, percentage calculations, registry evidence, control analysis, verified identities and fallback rationale.
- Source primaire
- BSP MORB definition of beneficial owner and section 921(a); 2018 IRR, Rule 18
Identify relevant legal-arrangement parties.
- Action d’implémentation
- For trusts and comparable arrangements, identify and verify the trustee or equivalent, settlor, beneficiaries or classes, protectors and every other natural person exercising ultimate effective control as the applicable rule requires.
- Preuves à conserver
- Trust deed, party schedule, control powers, entitlement analysis and verified identities.
- Source primaire
- 2018 IRR, Rule 18; applicable sector-supervisor CDD rules
Maintain current SEC beneficial-ownership disclosures separately.
- Action d’implémentation
- Apply SEC Memorandum Circular No. 15, series of 2025, and the current HARBOR Beneficial Ownership Declaration process; reconcile filings to the customer file but do not treat a filing as conclusive AML ownership evidence.
- Preuves à conserver
- BO analysis, declarations, HARBOR receipt, annual filing, change log and discrepancy escalation.
- Source primaire
- SEC Memorandum Circular No. 15, series of 2025; SEC 2026 reportorial requirements
05PEPs, enhanced due diligence, and remote onboardingPolitical exposure, higher risk and non-face-to-face delivery require stronger, documented measures.3 éléments+
Identify relevant politically exposed persons and relationships.
- Action d’implémentation
- Screen customers and beneficial owners for domestic, foreign and international-organisation PEP status and applicable immediate-family and close-associate relationships; refresh results risk-sensitively.
- Preuves à conserver
- Screening result, source, relationship map, rationale and refresh history.
- Source primaire
- 2018 IRR, Rule 18; BSP MORB section 923 for BSP-supervised institutions
Apply enhanced due diligence when risk or the applicable rule requires it.
- Action d’implémentation
- Obtain required senior approval, corroborate source of wealth and source of funds, obtain additional purpose information and increase monitoring frequency and depth.
- Preuves à conserver
- Trigger, approval, source corroboration, enhanced monitoring plan and periodic reviews.
- Source primaire
- 2018 IRR, Rule 18; BSP MORB section 923
Control remote identity and biometric risk.
- Action d’implémentation
- Validate document authenticity, liveness, impersonation and device risk; assess the legal basis, necessity, proportionality and security of biometric processing before use.
- Preuves à conserver
- Method assessment, fraud tests, consent or other lawful basis, privacy impact assessment, vendor diligence and exceptions.
- Source primaire
- Data Privacy Act, sections 12, 13 and 20; NPC Circular No. 2023-06; applicable sector e-KYC rules
06Monitoring and suspicious transaction reportingMonitor against expected activity and report suspicion to the AMLC without waiting for a monetary threshold.4 éléments+
Conduct ongoing due diligence and transaction monitoring.
- Action d’implémentation
- Keep identity, ownership and risk information current and scrutinise activity against the customer's profile, purpose, capacity and expected source of funds; investigate deviations promptly.
- Preuves à conserver
- Monitoring scenarios, alerts, case analysis, refresh record and dispositions.
- Source primaire
- 2018 IRR, Rule 18; BSP MORB section 921(a)
Identify suspicious transactions and attempts regardless of amount.
- Action d’implémentation
- Assess the statutory indicators, including no lawful purpose, failed identification, inconsistency with capacity or profile, structuring and connection to unlawful activity; include unsuccessful attempts where the rule applies.
- Preuves à conserver
- Alert chronology, facts reviewed, indicator mapping, decision-maker and outcome.
- Source primaire
- AMLA, section 3(b-1); applicable implementing and sector rules
File CTRs and STRs within the applicable reporting clock.
- Action d’implémentation
- Submit through the current AMLC electronic route generally within five working days from occurrence, subject to any current AMLC-prescribed alternative not exceeding fifteen working days. For an STR, record when suspicious nature was determined and apply the sector rule governing that determination period.
- Preuves à conserver
- Occurrence and decision timestamps, report, validation output, AMLC acknowledgement and any supplemental submission.
- Source primaire
- AMLA, section 9(c); BSP MORB section 922; current AMLC portal and reporting notices
Protect report confidentiality and prevent tipping off.
- Action d’implémentation
- Restrict CTR, STR, suspicion and AMLC-request information to authorised need-to-know access and review every disclosure against the statutory safe harbour and prohibition.
- Preuves à conserver
- Access matrix, disclosure log, legal review, training and incident record.
- Source primaire
- AMLA, section 9(c)
07Threshold reports, wires, payments, and virtual assetsAmounts, aggregation, report type and licensing are activity-specific.4 éléments+
Apply the general covered-transaction threshold only to its statutory scope.
- Action d’implémentation
- Report cash or equivalent monetary-instrument transactions exceeding PHP 500,000 within one banking day when the general rule applies; aggregate as required and keep the amount distinct from CDD or sector thresholds.
- Preuves à conserver
- Transaction data, aggregation result, scope analysis, CTR and AMLC acknowledgement.
- Source primaire
- AMLA, section 3(b), as amended
Apply casino and real-estate thresholds only to those covered persons.
- Action d’implémentation
- For casinos assess a single casino cash transaction exceeding PHP 5 million; for real-estate developers and brokers assess a single cash transaction exceeding PHP 7.5 million. Do not apply either amount outside its statutory sector and transaction type.
- Preuves à conserver
- Sector classification, cash evidence, threshold calculation, report and exception analysis.
- Source primaire
- AMLA, section 3(b), as amended by Republic Act No. 11521; Republic Act No. 10927 for casinos
Carry required originator and beneficiary information through wire transfers.
- Action d’implémentation
- For BSP-supervised institutions, collect, validate and transmit the fields required for transfers below and at or above PHP 50,000, preserve traceability and repair, reject or restrict incomplete transfers according to the governing rule.
- Preuves à conserver
- Field matrix, payment-message samples, validation tests, repair queue and rejection record.
- Source primaire
- BSP MORB section 923, fund/wire transfer provisions
Obtain current payment and virtual-asset authority before launch.
- Action d’implémentation
- Register as an operator of payment systems and obtain a merchant-acquisition licence where applicable. For VASP activity, assess BSP Circular No. 1108, current MORNBFI rules and the continuing new-licence moratorium before making any availability claim.
- Preuves à conserver
- Service and funds-flow map, OPS registration, merchant-acquisition licence, VASP legal analysis, authority and conditions.
- Source primaire
- National Payment Systems Act; BSP Circular Nos. 1049, 1108 and 1198; BSP Memorandum No. M-2025-031
08Targeted financial sanctionsSanctions controls must detect designated persons, ownership and control and support immediate preservation.3 éléments+
Screen relevant persons and transactions against current designations.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives and transactions at onboarding, during the relationship and when UN, AMLC or Anti-Terrorism Council designations change; assess indirect ownership and control.
- Preuves à conserver
- List inventory, update logs, configuration tests, match analysis and disposition.
- Source primaire
- Republic Act No. 10168; Republic Act No. 11479; AMLA section 10(b) as amended
Freeze and preserve covered property without delay.
- Action d’implémentation
- On an applicable designation or freeze order, immediately block dealing and availability, preserve the specified and related property, follow the current AMLC return and notification route and release only under verified authority.
- Preuves à conserver
- Match and ownership-control analysis, freeze timestamp, return or report, system blocks and authority correspondence.
- Source primaire
- Republic Act No. 10168, sections 11 and 16; Republic Act No. 11479, section 36; AMLA section 10(b)
Maintain distinct terrorism- and proliferation-financing procedures.
- Action d’implémentation
- Map the applicable designation, freeze, exemption, delisting and unfreezing route for terrorism and UN proliferation sanctions and test both direct and indirect availability scenarios.
- Preuves à conserver
- Legal map, procedure, list-update record, scenario tests, training and escalation log.
- Source primaire
- Republic Act No. 10168; AMLA sections 3(o)-(p), 7(15) and 10(b), as amended by Republic Act No. 11521
09Records and regulator accessRecords must reconstruct identity, ownership, transactions and reporting from the correct retention trigger.3 éléments+
Retain transaction records for at least five years from the transaction date.
- Action d’implémentation
- Preserve sufficient data and documents to reconstruct each transaction, subject to any longer legal hold, sector requirement or AMLC direction.
- Preuves à conserver
- Retention schedule, archive sample, reconstruction test, holds and deletion approvals.
- Source primaire
- AMLA, section 9(b); BSP MORB section 924
Retain customer records from the correct relationship trigger.
- Action d’implémentation
- Keep customer identification and transaction documents while the account exists and for at least five years after account closure, relationship termination or the occasional transaction, as applicable; preserve longer when a case remains unresolved.
- Preuves à conserver
- Trigger calculations, customer archive, case hold, retrieval test and deletion log.
- Source primaire
- AMLA, section 9(b); BSP MORB section 924
Make records securely and promptly available to competent authorities.
- Action d’implémentation
- Use stable identifiers and access controls so CDD, beneficial ownership, monitoring, reports, approvals and correspondence can be reconstructed and produced without delay through an authenticated route.
- Preuves à conserver
- Sample case pack, access review, request register, production index and delivery receipt.
- Source primaire
- AMLA, sections 7 and 9; applicable sector-supervisor access rules
10Privacy, biometrics, breaches, and transfersKYC data remains subject to purpose, proportionality, security and accountability controls.4 éléments+
Document the lawful basis and proportionality of KYC processing.
- Action d’implémentation
- Map each identity, biometric, screening and monitoring field to consent, legal obligation or another valid basis; provide the required notice, minimise collection and keep data accurate.
- Preuves à conserver
- Data inventory, lawful-basis map, notices, consent where used, field justification and correction process.
- Source primaire
- Data Privacy Act, sections 11-13 and 16; DPA IRR
Conduct privacy impact assessment and implement current security measures.
- Action d’implémentation
- Assess each personal-data processing system, designate accountable privacy personnel, maintain the required privacy management and incident programmes, and implement risk-appropriate organisational, physical and technical controls.
- Preuves à conserver
- PIA, DPO and system registration analysis, privacy programme, access reviews, tests and training.
- Source primaire
- Data Privacy Act, section 20; NPC Circular Nos. 2022-04 and 2023-06
Notify qualifying personal-data breaches within 72 hours.
- Action d’implémentation
- Assess the mandatory-notification test and notify the NPC and affected data subjects within 72 hours upon knowledge or reasonable belief that a notifiable breach occurred, using available information and documenting any authorised delay.
- Preuves à conserver
- Incident chronology, risk assessment, NPC submission, data-subject notice, delay rationale and remediation.
- Source primaire
- DPA IRR, section 38; NPC Circular No. 16-03
Control processors and cross-border transfers.
- Action d’implémentation
- Use contracts and due diligence to preserve confidentiality, security, incident cooperation, deletion and audit; remain accountable for transferred personal data and document the applicable recipient protections.
- Preuves à conserver
- Vendor assessment, contract, subprocessor register, transfer map, safeguards and monitoring.
- Source primaire
- Data Privacy Act, sections 14 and 21; DPA IRR, sections 43-45
11Practical evidence packsEvidence should reproduce onboarding, reporting, sanctions and launch decisions end to end.3 éléments+
Maintain a reconstructable onboarding pack.
- Action d’implémentation
- Bundle identity, representative authority, KYB, ownership and control, PEP and sanctions screening, risk, approvals, privacy records and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack and retrieval result.
- Source primaire
- Operational control supporting AMLA section 9 and 2018 IRR Rule 18
Maintain a reconstructable reporting and sanctions pack.
- Action d’implémentation
- Link transactions, alerts, analysis, occurrence and decision times, report, acknowledgement, supplements, freeze actions, authority communications and access logs.
- Preuves à conserver
- Complete sampled case pack, timeline and controlled access log.
- Source primaire
- Operational control supporting AMLA sections 9(c) and 10 and Republic Act No. 10168
Maintain a regulator-scoped launch pack.
- Action d’implémentation
- Record covered-person analysis, permissions, current sources, reporting readiness, BO filing, sanctions procedure, privacy registration scope, vendor controls, prohibited POGO screening and validation before launch or material change.
- Preuves à conserver
- Signed launch pack, source register, regulator map, uncertainty log, tests and approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
22 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Anti-Money Laundering Act of 2001Bangko Sentral ng Pilipinas · Primary legislation
- Republic Act No. 11521 - AMLA amendmentsLawphil · Primary legislation
- BSP regulations and current manuals indexBangko Sentral ng Pilipinas · Official regulatory index
- BSP AML/CFT Regulations - MORB Part IXBangko Sentral ng Pilipinas · Official supervisory regulation
- AMLC portal for registration and reportingAnti-Money Laundering Council · Official filing portal
- AMLC covered persons - other covered personsAnti-Money Laundering Council · Official perimeter and registration guidance
- Terrorism Financing Prevention and Suppression ActLawphil · Primary legislation
- Anti-Terrorism Act of 2020Lawphil · Primary legislation
- Anti-POGO Act of 2025Lawphil · Primary legislation
- BSP Circular No. 1108 - VASP guidelinesBangko Sentral ng Pilipinas · Official supervisory regulation
- BSP Memorandum No. M-2025-031 - continued VASP licence moratoriumBangko Sentral ng Pilipinas · Official supervisory issuance
- BSP payments and settlements regulatory frameworkBangko Sentral ng Pilipinas · Official regulatory guidance
- SEC Memorandum Circular No. 15, series of 2025Securities and Exchange Commission · Official beneficial-ownership rules
- SEC reportorial requirements for corporationsSecurities and Exchange Commission · Official registry guidance
- Data Privacy Act of 2012National Privacy Commission · Primary legislation
- Implementing Rules and Regulations of the Data Privacy ActNational Privacy Commission · Official regulation
- NPC advisories and circularsNational Privacy Commission · Official regulatory index
- FATF Philippines country profileFATF · Authoritative current assessment
- FATF Philippines exit from increased monitoring - 21 February 2025FATF · Authoritative status statement
- FATF jurisdictions under increased monitoring - 19 June 2026FATF · Authoritative current status
- FATF high-risk jurisdictions subject to a call for action - 19 June 2026FATF · Authoritative current status
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Réponses directes
Questions KYC, KYB et AML pour Philippines
Who receives covered and suspicious transaction reports?+
The Anti-Money Laundering Council, the Philippines' financial intelligence unit, through its current authorised electronic reporting route.
When must an STR be filed?+
Generally within five working days from occurrence, subject to a different AMLC-prescribed period not exceeding fifteen working days. For suspicion, occurrence is tied to the determination of suspicious nature under the applicable sector rule, so the decision chronology must be recorded.
What is the general covered-transaction threshold?+
Cash or another equivalent monetary instrument exceeding PHP 500,000 within one banking day. Casinos and real-estate covered persons have separate statutory cash thresholds and transaction scopes.
Is there one universal CDD threshold?+
No. Relationship opening, suspicion and doubt about prior data can trigger CDD without a monetary threshold. Occasional-transaction thresholds are sector-specific and must not be confused with CTR amounts.
How is beneficial ownership determined?+
Trace ultimate ownership and control to natural persons. For BSP-supervised institutions, 20% ownership is an indicator, followed by control by other means and a senior-managing-official fallback. Current SEC disclosure is separate and does not replace AML CDD.
How long are AML records retained?+
Generally at least five years, but the clock differs by record: transaction date, account closure, relationship termination or occasional-transaction date. Records connected to an unresolved case may need longer preservation.
Can an offshore gaming operation obtain a Philippine licence?+
No. Republic Act No. 12312 bans offshore gaming operations and related services and revoked the authority to issue such licences. Older AMLA references do not create a lawful route.
Can a new VASP obtain a BSP licence?+
Do not assume so. BSP Memorandum No. M-2025-031 continued the moratorium on new VASP licences from 1 September 2025, subject to reassessment. Confirm current BSP policy before planning launch.
What happens on a sanctions match or freeze order?+
Confirm identifiers and ownership or control, immediately preserve covered property and prevent dealing as the applicable order and law require, file the current AMLC return or report and release only under verified authority.
When is a personal-data breach notified?+
When the mandatory-notification test is met, notify the NPC and affected data subjects within 72 hours upon knowledge or reasonable belief that the qualifying breach occurred, subject only to the limited authorised-delay rules.
Is the Philippines on a FATF public list?+
No. The Philippines exited increased monitoring on 21 February 2025 and was absent from both FATF public lists dated 19 June 2026. FATF asked it to sustain improvements with APG; absence from a list is not a low-risk finding.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 25 September 2026. Confirm the covered-person perimeter, current AMLC reporting specifications and portal notices, sector-supervisor rules, sanctions orders, licensing availability, SEC HARBOR filing requirements and privacy registration scope with the competent authority and qualified Philippine counsel before launch.