Coverage reporting and governance for Philippine businesses
AMLA compliance begins with identifying whether your business is a covered person under the Anti-Money Laundering Act, Republic Act No. 9160, as amended. Coverage depends on the business and services involved.
A large payment does not, by itself, turn every seller into an Anti-Money Laundering Council (AMLC) reporting entity. A small business may have obligations because it performs a covered activity.[1]
For owners and managers, the practical task is to assess coverage before accepting transactions, then assign responsibility for customer checks, monitoring, reporting, and records. A policy copied from another industry may overlook the rules that apply to your operations.
This article explains how to assess coverage, distinguish reporting triggers, and organize the controls that follow. Owners should be able to identify who makes each compliance decision, which information supports it, and where the resulting record is kept. Review those arrangements when the business changes its services.
Assessing AMLA compliance by business activity
Covered persons include regulated financial businesses and designated nonfinancial businesses and professions (DNFBPs). Examples include banks, remittance businesses, certain securities and insurance businesses, casinos in relation to relevant casino cash transactions, and real estate developers and brokers.
Certain jewelry businesses, company service providers and providers of specified professional services are also covered.[2]
Company services deserve particular attention. Forming entities for others, providing registered office addresses or arranging nominee shareholders on a regular or continuing basis can bring a business within coverage.
Lawyers and accountants must assess the services they perform: the amended DNFBP guidelines distinguish covered company and financial services from purely legal or accounting work. The AMLA also protects information obtained under professional secrecy or legal professional privilege.[3]
For example, a business that starts providing company formation services alongside ordinary administrative support should review its new activity before expanding. Its earlier business registration and existing customer contracts do not answer the AMLA coverage question.
Prepare an activity inventory using actual engagements, proposals, service descriptions, and payment arrangements. Identify the entity providing each service and the work its staff perform. An AMLA compliance assessment should explain how those facts fit the relevant covered category and identify any unresolved questions.
For a professional firm offering several services, assess each engagement against the applicable rules. A professional designation alone does not resolve coverage. Review the particular service and the information concerned before relying on an exemption or deciding how a reporting obligation interacts with protected information.
Read Republic Act No. 10365 with the later amendments and applicable sector guidance. Keep a dated coverage assessment so management can revisit its conclusion when a new activity, client arrangement, or regulatory requirement changes the facts on which it was based.
Distinguishing covered and suspicious transactions
A covered transaction report (CTR) concerns a transaction meeting the applicable criteria. The general threshold is cash or equivalent monetary instruments exceeding PHP 500,000 within one banking day. Jewelry dealers, casinos and real estate businesses have separate thresholds and payment rules.
For most covered persons, reporting can also include checks, transfers and account debits or credits, subject to applicable exceptions. These thresholds do not turn every business receiving money into a reporting entity.[4]
A suspicious transaction report (STR) concerns the circumstances of a transaction, regardless of amount. Unexplained activity, transactions inconsistent with a customer’s profile and attempts to evade reporting requirements may require assessment.
Completed or attempted transactions may be reportable under the applicable rules. A report records a compliance determination; it does not establish that a customer committed a crime.[5]
AMLA compliance procedures should identify the threshold, payment mode, and aggregation rule relevant to the covered activity. Staff should know which records allow them to apply that test. A threshold from another sector can produce an incorrect result even where the underlying transaction value has been recorded accurately.
Assess suspicious circumstances separately from the amount test. A transaction below a covered transaction threshold may still require review. Record the customer’s explanation and the information available, then refer the matter to the authorized reviewer without treating an unusual feature as conclusive evidence of wrongdoing.
A business outside the covered person framework may still receive questions from its bank about a payment. Prepare legitimate supporting records and respond accurately through the bank’s established process. The bank’s customer checks do not, by themselves, establish that the business has its own AMLC reporting obligation.
Meeting AMLC reporting deadlines
Under the AMLC’s Guidelines on Transaction Reporting and Compliance Submissions (GoTRACS), CTRs are due within five working days from occurrence.
STRs generally must be filed by the next working day after suspicion is established or the suspicious nature of a transaction is determined, within the prescribed determination period.
Deadlines vary by trigger: some sanctions-related reports are due on the day a freeze is implemented. Record the trigger and decision dates, escalate promptly and use the applicable AMLC reporting calendar.[6]
The AMLA compliance workflow should distinguish the transaction date, alert or knowledge date, determination period, final decision, and filing deadline. These dates serve different purposes. A general instruction to report within five days can obscure the shorter filing obligation that applies to an STR.
Assign an approving authority and identify the information needed for a decision. Staff should raise the concern promptly through a restricted channel, with relevant documents and dates. Do not leave an alert unresolved while waiting for the next routine management meeting or the return of one employee.
Keep the review, decision, submission, and filing confirmation together with appropriate access restrictions. Where the decision is not to file, retain the documented assessment required by the applicable rules. AMLA compliance records should show why the action taken followed from the facts available at the time.
Use the AMLC’s GoTRACS reporting guidelines to check the particular trigger, report type, determination period, and supporting documents. Confirm relevant nonworking and declared nonreporting days rather than assuming that every interruption or local holiday extends the filing period.
Building a usable AMLA compliance program
Covered businesses need a prevention program matched to their risks, accountable compliance personnel, customer due diligence, staff training, monitoring and review.
Identify and verify customers and their beneficial owners, including the individuals who ultimately own or control corporate clients. Understand the purpose of the relationship and apply enhanced due diligence where required.
Obtain approval from the board, partners or proprietor, as applicable, and ensure staff can use the program in daily work.[7]
Start with the customers, services, delivery channels, and locations involved in the business. Explain which features create exposure and which controls address it. An AMLA compliance program should connect that assessment to onboarding, monitoring, escalation, and review instead of relying on a generic policy statement.
For corporate customers, examine the ownership and control structure and the authority of the person giving instructions. Beneficial ownership review concerns the relevant natural persons behind the arrangement. Keep a record of the information obtained, the verification performed, and questions requiring further assessment before proceeding.
Customer due diligence continues beyond collecting identification documents. Compare later activity with the purpose and profile established for the relationship. Where material information changes or doubts arise, review the records and the appropriate response under the applicable rules, including enhanced checks or reporting assessment where required.
Explain how staff should handle an incomplete file or an instruction given by someone whose authority remains unclear. Identify who can resolve the issue and assess whether the relationship or transaction may proceed under the applicable rules. Record the decision and any conditions imposed on further activity.
Give compliance personnel access to the records and decision makers needed for their responsibilities. Train frontline staff using examples from the business’s actual services. An AMLA compliance review should test whether staff can recognize a concern, locate the correct procedure, and reach an authorized person promptly.
Management can use the following control record to connect policy requirements with evidence. Assign an owner for each area and review whether the documents reflect current practice. The questions are prompts for supervision and should be adapted to the business’s covered activities and applicable sector rules.
| Control | Evidence to maintain | Management question |
| Coverage assessment | Activities reviewed and reasons for the conclusion | Has a new service changed our obligations? |
| Customer due diligence | Identity checks and beneficial ownership information | Can we explain who controls the customer? |
| Reporting workflow | Escalation records and filing confirmations | Can staff meet the applicable deadline? |
| Training and review | Attendance and corrective action records | Are recurring weaknesses being addressed? |
Registration reporting access and confidentiality
Complete AMLC registration through the Compliance Optimization and Registration System (CORS), maintain current registration details and establish reporting access. Designate an authorized alternate for urgent filings when the primary officer is unavailable. When dealing with a DNFBP client, verify its valid AMLC registration under the applicable directive.[8]
Keep report information confidential and train staff against prohibited disclosures, including tipping off.[9]
Check that the registered entity, responsible officers, and contact information match current operations. Keep evidence of the registration status and authorized reporting arrangements. AMLA compliance should include a workable handover when personnel change, with access controls that prevent former staff from continuing to use business reporting credentials.
Test the alternate officer’s access before an urgent filing is needed. Confirm that authorized personnel can reach the relevant records and understand the submission process. Keep sensitive credentials protected while ensuring that the arrangement does not depend on one person’s device, memory, or availability.
When a client is a DNFBP, check the applicable AMLC registration directive as part of due diligence. Review the relevant certificate and its status, and resolve discrepancies through the prescribed process. A client’s ordinary business registration does not establish that it holds the required AMLC registration.
The AMLC’s directive on dealing with registered DNFBPs should be read alongside the current registration guidance. Allocate responsibility for checking the evidence and recording the outcome so that the requirement is addressed during the relationship review.
Limit report information to authorized personnel who need it for their responsibilities. Train customer facing teams on how to refer questions without disclosing a filing or contemplated report. AMLA compliance procedures should cover email, messaging, shared folders, and discussions with outside service providers as well as the reporting system.
Keeping records and correcting compliance gaps
Transaction records generally require retention for five years from the transaction date.
Customer due diligence records, account files, correspondence and analysis must be kept for at least five years after account closure, termination of the business or professional relationship, or the occasional transaction, as applicable.
If a court case involves the account, retain records beyond five years until the AMLC Secretariat officially confirms final resolution. Use a retention schedule that reflects these different starting points and any continuing duty to preserve records.[10]
An AMLA compliance retention schedule should identify the record category, starting event, responsible owner, and applicable preservation requirement. Staff need to know when a relationship has ended and whether a continuing matter prevents deletion. Avoid applying one automatic deletion date to every document in the customer file.
Check that retained records can be retrieved and understood by authorized reviewers. Include relevant records held in email or by an external provider. Address access restrictions and retrieval arrangements in the business’s procedures so that a filing confirmation or supporting document can be found when needed.
Keep the relevant policy version and staff instructions available with the compliance record. If a procedure changes, record when the revised process took effect and who received the update. This helps management reconstruct how a matter was handled and evaluate whether a later change addressed the original weakness.
Noncompliance can lead to administrative sanctions, while specified conduct may also attract criminal liability. Review gaps promptly and document corrective steps.
Businesses outside the covered person reporting framework can still commit money laundering if the elements of the offense are present; coverage is a separate question from liability for handling criminal proceeds.[11]
For each identified gap, record the issue, relevant period, affected activities, action owner, and completion date. Assess whether further reporting or regulatory action is required. AMLA compliance remediation should address the cause of the weakness and retain evidence that the revised control operates in practice.
Management should review recurring exceptions, delayed escalations, incomplete customer files, and failed access arrangements. Ask whether staffing, system configuration, or unclear authority contributed to the problem. Follow up on overdue corrective actions and update training when the same misunderstanding appears across several engagements.
Reviewing a new company formation service
Consider an administrative support business proposing to form companies for clients and provide a registered office address. Management should review the proposed service before accepting engagements, including how regularly it will be offered, who gives instructions, and what work the business will perform for each client.
The AMLA compliance assessment should then identify the relevant coverage, registration, customer checks, and reporting arrangements. Revise the engagement and internal workflow to obtain the information needed for those functions. Assign responsibility for resolving incomplete ownership information and escalating transactions that require further review.
Before the service begins, walk through a sample file with the staff who will handle it. Confirm that they can identify the customer and authorized representative, record the beneficial ownership review, and locate the reporting contact. Correct gaps in the process before relying on it for live engagements.
After launch, compare early engagements with the assumptions used in the coverage and risk review. A different service package or customer arrangement may require another assessment. Keep the AMLA compliance procedure aligned with the work being delivered and bring material changes back to the responsible reviewer.
Questions on AMLA compliance
Does receiving a large payment make every business a covered person
No. Coverage depends on the business and covered activities. The applicable transaction threshold is assessed within that framework. AMLA compliance for an ordinary seller may include responding to its bank’s due diligence questions without necessarily making the seller an AMLC reporting entity.
Are suspicious transactions reportable only above PHP 500,000
No. Suspicious transactions are assessed regardless of amount. Consider the circumstances and applicable reporting rules, including attempted transactions. Staff should escalate concerns for a documented determination rather than dismissing a transaction solely because its value is below a covered transaction threshold.
Do CTRs and STRs have the same deadline
They generally do not. GoTRACS sets a five working day period for CTRs and generally requires STR filing by the next working day after suspicion is established, subject to the relevant determination rules. AMLA compliance procedures must also account for specific triggers carrying different deadlines.
Are lawyers and accountants always exempt from reporting
No blanket exemption applies to every service they provide. Assess the covered company and financial services, the provisions for purely professional services, and applicable professional secrecy or privilege. The engagement and information involved must be reviewed before reaching a reporting conclusion.
Does AMLC registration complete the compliance program
Registration addresses one part of AMLA compliance. A covered business also needs the applicable prevention program, customer checks, monitoring, reporting, training, and records. Keep registration details current and confirm that the responsible personnel can perform their functions when the usual officer is unavailable.
When should a business reassess its coverage
Review material changes in services, operations, and applicable guidance. Company formation, address services, or other covered work can change an earlier assessment. Keep the reasons for the conclusion and assign responsibility for bringing proposed changes to management before the new service is offered.
Legal assistance with AMLA compliance
ATL Law Firm can help assess whether your activities are covered and review the policies, contracts, and compliance responsibilities that follow. Our corporate practice can assist with the governance and commercial arrangements supporting that review.
[1] Anti-Money Laundering Council (AMLC), Regulatory Issuance No. 2, Guidelines on Transaction Reporting and Compliance Submissions (GoTRACS), ch. I, §§ 2(b), 3 (Dec. 11, 2024) (Phil.).
[2] GoTRACS, ch. I, § 3.
[3] Republic Act No. 10365, §§ 1, 7 (Feb. 15, 2013) (Phil.); AMLC, Regulatory Issuance No. 2, §§ 1–4 (Nov. 10, 2023) (amending the 2021 DNFBP Guidelines).
[4] Republic Act No. 11521, § 2 (Jan. 29, 2021) (Phil.); GoTRACS, ch. I, §§ 2(g), 4.4–4.6, 7.
[5] Republic Act No. 11521, § 2; GoTRACS, ch. I, §§ 2(v)–(x), 5.1–5.4.
[6] GoTRACS, ch. I, §§ 4.2–4.3, 5.4, 6.
[7] AMLC, 2018 Implementing Rules and Regulations of Republic Act No. 9160, as amended (AMLA IRR), rr. 15–16, 18 (Jan. 2021 amend.) (Phil.).
[8] AMLC, Regulatory Issuance No. 1, Guidelines on Compliance Optimization and Registration System, §§ 4–7 (Apr. 16, 2024) (Phil.); AMLC, All Covered Persons to Deal Only with Designated Non-Financial Businesses and Professions Registered with the AMLC.
[9] Republic Act No. 10365, § 7 (amending AMLA § 9(c)); GoTRACS, ch. I, § 5.3(d).
[10] AMLA IRR, r. 20, §§ 1–4.
[11] Republic Act No. 10365, §§ 4, 10 (amending AMLA §§ 4, 14).
Comments are closed