Emerson S.

Banez
UP College of Law Fintech Regulations
Fintech Defined
• Fintech does not yet have an established meaning in Philippine law.
• The term is broadly used by policy pronouncements to apply to any
“technological development in finance”.
• For this paper, Fintech applies to offerings that belong to a category
of financial services that are deployed through the Internet and/or
mobile applications.
Technology, Disruption and the law
• Historically, economic activity is conducted within the possibilities
and limitations of a particular setting of technology and applicable
law.
• The law arises from this technological substrate, defining further
constraints at the margin of existing technological capabilities.
• When disruptive technologies arrive, the corresponding benefits
cause market incentives to shift and affect earlier arrangements
structured in part by the rules shaped by the law.
• The greater the disruption and higher level of regulatory mechanisms lead to
a wider regulatory gap.
The Legal Ontology of Financial Services
• Every regulatory regime relies on an ontology.
• The country’s financial regulations were developed along side
contractual arrangements and institutions that have not seen
fundamental changes for decades.
• When confronted with financial innovations, the government is often
constrained to shoehorn these innovations into its traditional
understanding of relevant concepts.
• Resulting in rules that are inconsistent or overlapping jurisdictions.
What is an ontology

• “The philosophical study of the nature of being, becoming, existence, or reality…”

– NOT
• Computer/Information science – A formal naming and definition of the types,
properties, and interrelationships of the entities that really exist in a particular
domain or discourse.
• Applications in artificial intelligence, library science…
The Semantic Web
• From Tim Berners Lee (web of data)
• Aim – to make the web more
“understandable” for computers.
• For example, by making the categories and
relationships of some concepts more explicit
• More relevant search results, easier
navigation through the data
• Can be used also for reasoning,
argumentation support of AI
The Semantic Web
The Semantic Web:RDF
The Semantic Web: RDF
Legal
Knowledge
Interchange
Format
Problems that Arise from Applying Old laws to
New Technology
• Inconsistency of terms
• A concept as understood in the Fintech taxonomy may have materially different content from a
traditional financial taxonomy.
• Overlapping Jurisdictions
• Different agencies may regulate activities covered by different terms that are similar.
• Concepts not covered by existing taxonomies
• Concepts created by new technologies may not be accounted for in traditional taxonomies.
• Implementation mismatch
• Agencies can only interface with a concept at a particular level, level some details absent or
incompatible.
• Policy conflict
• A norm that may not conform with other policy considerations.
Categories of Financial Regulation
• Compliance Laws
• These are rules that are not intended to address the market structure for
specific services.
• These apply to actors in the financial sector regardless of the service they
offer.

• Regulatory Laws
• These are laws and regulations that shape the market.
• These can constrain activities in specific services to fit policy preferences.
Analysis Questions
• What are the laws and regulations that govern the country’s financial industry?
• Who are the actors of the financial sector recognized under the country’s laws?
• What are the objects in the financial sector recognized under the country’s laws?
• What are the processes in the financial sector recognized under the country’s
laws?
• What are the norms applicable to the actors, objects, and processes of the
traditional (i.e. non Fintech) financial sector?
• What are the categories of Fintech services?
• What laws and regulations are directly applicable to Fintech?
• What laws and regulations for the traditional financial sector are applicable to
Fintech?
• What are the potential issues in applying these regulations to Fintech?
The Current Regulatory
Framework
Regulatory Statutes
Business Category Regulatory Statute Regulator
Bank The General Banking Law of 2000 BSP
(RA 8791)
Manual of Regulations for Banks
Quasi-Bank The General Banking Law of 2000 BSP
(RA 8791)
Lending Company Regulation Act
(RA 9474)
Manual of Regulations for Non-
Bank Financial Institutions –
Regulations Governing Non-Bank
Financial Institutions Performing
Quasi-Banking Functions
(MORNBFI – Q Regulations)
Regulatory Statutes
Business Category Regulatory Statute Regulator
Trust Entity The General Banking Law of 2000 BSP
(RA 8791)
Manual of Regulations for Non-
Bank Financial Institutions –
Regulations Governing Trust
Corporations (MORNBFI – T
Regulations)
Pawnshop Pawnshop Regulation Act (PD BSP
114)
Manual of Regulations for Non-
Bank Financial Institutions –
Regulations Governing
Pawnshops (MORNBFI – P
Regulations)
Regulatory Statutes
Business Category Regulatory Statute Regulator
Non-Stock Savings and Loans Revised Non-Stock Savings and BSP
Associations (NSSLA’s) Loan Association Act of 1997 (RA
8367) Manual of Regulations for
Non-Bank Financial Institutions -
Regulations Governing Non-Stock
Savings and Loan Associations
(MORNBFI - S Regulations)
Remittance and Transfer Manual of Regulations for Non- BSP
Companies (RTC’s) Bank Financial Institutions -
Regulations Governing Other
Non-Bank Financial Institutions
(MORNBFI - N Regulations),
Section 4511N, as amended by
BSP Circular No. 942 s. 2017
Regulatory Statutes
Business Category Regulatory Statute Regulator
Money Changer (MC)/Foreign Non-Bank Financial Institutions - BSP
Exchange Dealer (FXD) Regulations Governing Other
NonBank Financial Institutions
(MORNBFI - N Regulations),
Section 4511N, as amended by
BSP Circular No. 942 s. 2017
Investment House Investment House Law (PD 129) SEC
Financing Company Financing Company Act (RA SEC
5980)
Lending Company Lending Company Regulation Act SEC
(RA 9474)
Broker Securities Regulation Code (RA SEC
8799)
Regulatory Statutes
Business Category Regulatory Statute Regulator
Clearing Agency Securities Regulation Code (RA SEC
8799)
Exchange Securities Regulation Code (RA SEC
8799)
Underwriter Securities Regulation Code (RA SEC
8799)
Issuer Securities Regulation Code (RA SEC
8799)
Investment Company Investment Company Act (RA SEC
2629)
Investment Banker Investment Company Act (RA SEC
2629)
Real Estate Investment Trust REIT Act (RA 9856) SEC
(REIT)
Regulatory Statutes
Business Category Regulatory Statute Regulator
Insurance Company Insurance Code (RA 10607) IC
Insurance Agents Insurance Code (RA 10607) IC
Insurance Broker Insurance Code (RA 10607) IC
Professional Reinsurer Insurance Code (RA 10607) IC
Reinsurance Brokers Insurance Code (RA 10607) IC
Holding Company Insurance Code (RA 10607) IC
Holding Company System Insurance Code (RA 10607) IC
Mutual Benefit Associations Insurance Code (RA 10607) IC
Pre-Need Companies Insurance Code (RA 10607) IC
Anti-Money Laundering Act of 2001
• Made to implement the state policy to “protect and [reserve the
integrity and confidentiality of bank accounts and to ensure that the
Philippines shall not be used as a money laundering site for the
proceeds of any unlawful activity”.
• Applies to covered persons as defined by Section X802 of MORB as
amended by Section 1 of BSP Circular No. 950.
• Fintech companies may be considered as covered persons since
their activities are similar to the covered persons.
• However a direct application of the Act proves to be difficult due to
how technology has transformed how financial services are delivered.
Data Privacy Act of 2012
• Since Fintech companies collect personal sensitive information the
Data Privacy Act finds application as this Act applies to anyone who
controls or uses personal information.
• The Act protects Personal Information and Sensitive Personal
Information.
• The Act requires Fintech companies to uphold the data privacy rights
of their clients and to adhere to the general principles of data privacy.
Data Privacy Act of 2012
• There are four areas which Fintech companies are particularly
affected; Consent, Notification and Registration of Automated
Decision-Making Processes, DPO Appointment, and Data Breach
Notification.
• Consent is necessary for Personal or Sensitive Personal Information to
be processed by a data controller.
• The data subject must give his or her consent, specific to the purpose prior to the processing,
or in the case of privileged information, all parties to the exchange have given their consent
prior to processing.
• Consent must also be evidenced by written electronic or recorded means.
• The law also does not accept implied consent of the data subject.
Philippine Competition Act
• The Philippine Competition Act seeks to maintain a healthy level of
competition in the marketplace.
• Under such Act Anti-Competitive Agreements, and Abuse of
Dominant Position are prohibited.
• The Act also allows the Competition Commission to review mergers
and acquisitions.
• Companies are also required to notify the Commission in case a
merger or acquisition reaches a threshold as determined by the
Commission.
SEC Rules on Mass Media
• Mass media refers to any medium of communication designed to
reach the masses, the distinctive feature of which is the
dissemination of information and ideas to the public.
• It is not limited to physical structures and printed materials, it can
cover the internet.
• Hence, the SEC considers corporations that provide an online
platform that brings parties together for increasing sales fall under
mass media.
SEC Rules on Mass Media
• A Fintech company that provides information and makes it available
to the general public is considered a mass media entity.
• This is significant as the Constitution requires mass media to be
wholly owned by Filipinos.
• This limitation on foreign ownership hinders the importation of
potential capital, technology, production, skills, and management
systems.
• This also inhibits healthy competition within the industry.
• It causes the country to loss potential tax revenues from profits of
foreign Fintech Corporations.
Cybersecurity and Cybercrime
• The BSP has the duty to determine the IT profile of all BSFIs and
classify them as Complex, Moderate of Simple.
• Based on such evaluation the BSFI is required to adopt a robust IT risk
management system; IT Governance; Risk Identification and
Assessment; IT controls implementation; and Risk measurement and
monitoring.
• Failure to comply will result in sanctions under RA 7653
Cybersecurity and Cybercrime
• The Supreme Court has also issued the Rule on Cybercrime Warrants.
• It provides for the venue for the warrants
• Preservation orders under the Cybercrime Prevention Act
• Remedies like disclosure orders, real-time collection of content data,
and search and seizure warrants.
• A Warrant to Disclose Computer Data is issued to authorize Law
Enforcement Authorities (LEA) to issue an order to disclose or submit
subscriber’s information, traffic data, or relevant data.
• A Warrant to Intercept Computer Data is granted to authorize the LEA
to listen, record, monitor or surveil the content of communications.
Department of Information and
Communications Technology
• The Department of Information and Communications Technology
(DICT) is the primary policy, planning, coordinating, implementing,
and administrative entity of the executive branch of the government.
• It is tasked to plan, develop and promote the national Information
and Communications Technology development agenda.
• This places the DICT in a crucial role in selecting and adopting
technology standards for the government.
• It affects public procurement and can shape the Fintech market
through public endorsement and network effects that will be made
available to those services that comply with the adopted standards.
Department of Information and
Communications Technology
• This can affect what standard will be imposed upon other played
whether they act in the private sector or if they wish to interface
with the government.
• The DICT also has the power to create guidelines on partnerships
between public and private entities, allowing the DICT to control
relations between Fintech companies and the government in the
integration of Fintech services.
The Philippine Identification System Act
• The Philippine Identification System Act creates a central identification
platform for all citizens and resident aliens in the Philippines.
• This involves the PhilSys Number (PSN), the PhilSys Registry and the PhilID.
• The PSN is a randomly generated, unique, and permanent identification
number that will be assigned to every citizen
• The PhilSys Registry is the repository of all data
• The PhilID is the physical medium issued to convey essential information of
a person such as the PSN, Full name, sex, blood type, marital status, place
of birth, photo, date of birth and address.
The Philippine Identification System Act
• Fintech companies rely on personal information and are covered by the
KYC Policy of the BSP
• Through the PhilID the implementation of the KYC will be fast tracked as
the ID will be sufficient proof of identity to open bank accounts and avail
financial services.
• Refusal to accept the PhilID may result in a monetary fine, if such refusal
was without just and sufficient cause.
• The law also penalizes the unauthorized and willful use or disclosure of the
data.
• The implementation of this system may result in an increase of clients for
Fintech companies.
Secured Transactions Law
• This law seeks to enable financial institutions to rethink how they
view collateral and reduce perceived risks, by providing protection
framework to govern lending transactions that involve the use of
personal property as collateral, as well as the design, establishment,
and operation of a unified, centralized, online based national
collateral registry to assure banks that the collateral being submitted
has not already been utilized for another loan.
Conclusion
The basis for rational policymaking and the modern administrative
state is that legal requirements are supposed to address specific
problems or channel behavior towards desirable outcomes. The
regulation of the country’s financial sector is in place to encourage
stability, build trust, and promote inclusion of traditionally underserved
sections the public.
In case of doubt the rules and requirements for traditional financial
institutions will be applied to Fintech companies. Since policy
preferences could be embedded in Fintech through less onerous
means, the reflexive application of old regulations to new tech is
inefficient and self-defeating. We propose that policymakers adopt a
calibrated “light touch” approach, or the delineation of a “regulatory
sandbox” for Fintech. Vigilance and prudence can be balanced with
innovation at ratios that promote the public welfare.