Onboarding is where your compliance programme starts, and where examiners start looking. Every account you open has to prove who stands behind it. You run those checks yourself, or on Onboarding & Verification as a Service.
The rules come from the Anti-Money Laundering Act and the BSP’s AML regulations. This guide quotes the BSP’s Manual of Regulations for Banks, Part Nine. Non-banks follow a parallel manual.
It summarises published rules. Your compliance officer sets your policy.
Individuals: what you collect
For an average-risk customer, the BSP sets a minimum set of information.
| What you collect | What the rules add |
|---|---|
Identity Full name or PhilSys number, with date and place of birth. | A PhilSys ID counts as a government-issued ID. |
Contact Address and contact details. | Keep them current through the relationship. |
Nationality Citizenship or nationality. | Foreign nationals present a passport or Alien Certificate of Registration. |
Signature A specimen signature or a biometric. | A biometric capture meets this in a digital flow. |
Valid ID An official document issued by the Philippine government, its agencies or its corporations. | For low-risk customers, you may accept other documents your policy deems sufficient. |
Businesses: what KYB has to establish
| What you collect | Where it comes from |
|---|---|
Registration A certificate of registration, plus any secondary licences. | The SEC for corporations and partnerships. The DTI for sole proprietors’ business names. The CDA for cooperatives. |
Constitution Articles of incorporation or partnership, and the latest General Information Sheet. | The sheet lists principal stockholders owning at least 20%. |
Authority A board or partners’ resolution naming authorised signatories. | Collect each signatory’s name, address and nationality. |
Beneficial owners The name, address and nationality of each beneficial owner. | A person holding at least 20% indicates direct ownership. Listed companies under disclosure rules are exempt from verification. |
A DTI business name registration is valid for five years. Check that it has not lapsed.
Match the review to the risk
The rules set three levels of review: reduced, average and enhanced due diligence.
Reduced fits lower-risk customers. For accounts used purely for digital payments, you may define your own reduced procedures.
Enhanced applies to high-risk customers. A foreign politically exposed person needs senior management approval, source of wealth and funds, and closer monitoring.
Sanctions screening is mandatory. Screen against UN Security Council designations and freeze a match without delay. File a return with the AMLC within 24 hours.
Onboarding without a branch
The rules require face-to-face contact at onboarding. Video and other technology can stand in, if you mitigate the risks and document the whole procedure.
You may verify identity after the account opens. It must happen as soon as reasonably practicable, keep business moving, and carry managed risk.
What the examiner asks to see
| The evidence | The rule |
|---|---|
Identification records Every document and data point collected at onboarding. | Kept for the life of the account, then at least five years after it closes. |
Transaction records Every movement on the account. | Kept five years from the transaction date. |
Covered transaction reports Cash or equivalent transactions over ₱500,000. | Filed with the AMLC within five working days. Copies kept at least five years. |
Suspicious transaction reports Suspicion established within 10 calendar days of the transaction. | Filed within five working days of that finding. Copies kept at least five years. |
Ongoing monitoring Customer records reviewed and kept current. | Reviewed most often for higher-risk customers. |
Records tied to a pending case are kept until the case closes.
How onboarding runs on TNKR
TNKR Onboarding handles an account’s lifecycle: create it, verify its authorised representative, then activate it. See Onboarding
PayMongo’s business verification collects DTI or SEC registration, BIR Form 2303 and the articles. Corporations add the General Information Sheet, a beneficial-owner declaration and a notarised secretary’s certificate.
Already licensed to run KYC? Partner verification accepts your result as evidence. You send a selfie with your sanctions and PEP screening results.
Partner verification needs approval from PayMongo Risk and Compliance first. Your own rules then evaluate each request.
Run it on your licence and your compliance team owns the policy TNKR runs. Run it on ours and PayMongo’s policy applies.
Get started
Read documentation — see the onboarding objects, documents and verification flow.
Talk to an expert — walk your onboarding policy through with our team.
Frequently asked questions
Originally published