There are about 374 rural and cooperative banks in the Philippines, whose total assets amount to roughly ₱385.45 billion as of 30 June 2025, collectively smaller than the balance sheets of many individual universal banks. In the Manual of Regulations for Banks, the anti-money laundering and counter-terrorism financing requirements are included in Part IX and set out as a general provision applicable to all types of bank, rather than a tiered system that reduces requirements for smaller institutions the way capital adequacy rules do. A rural bank employing three or four compliance staff has the same obligations on customer due diligence, suspicious transaction reporting, record-keeping and audit as a universal bank with a compliance department of hundreds. The duties do not decrease because the institution is smaller. The resources available to meet them usually do.
The regulation doesn't scale down. Capital adequacy does.
Philippine banking regulation does vary by institution type in certain areas. Capital adequacy is the clearest example: universal and commercial banks sit under Basel III, while standalone thrift, rural and cooperative banks remain under Basel II-based guidelines, a genuine and intentional distinction based on different risk profiles and systemic impact.
AML and counter-terrorism financing regulation is not built the same way. It sits in the Manual of Regulations for Banks as a general provision, a section type that applies by default to every bank category, with exceptions only where the Manual specifically carves one out. A rural bank's Money Laundering and Terrorism Financing Prevention Programme has to cover the same elements as a universal bank's: customer identification, ongoing monitoring, reporting of suspicious and covered transactions, record retention, training and independent audit. BSP has made the same principle explicit in its digital banking framework, stating that digital banks are “subject to the same standards on corporate governance, risk management, compliance, internal control and audit, and reporting governance” as other bank types.
A sector of 374 separate institutions, many with total assets smaller than a single mid-sized branch of a universal bank, makes consistency its main operational problem.
The scale of the sector
On 30 June 2025 the rural and cooperative banking sector consisted of about 374 institutions, total assets roughly ₱385.45 billion. Most are small. BSP asset-ranking data shows the largest rural bank groups holding tens of billions of pesos, while most of the sector's institutions hold only a fraction of that.
The sector has been consolidating for years, a process carrying into 2025 and 2026. BSP has made the drive for consolidation its official stance on risk management: in February 2025 the merger between Zambales Rural Bank and Bridgeway Rural Banking Corp was announced by Deputy Governor Chuchi Fonacier, presented explicitly as part of the central bank's effort to strengthen the financial sector through consolidation. BDO Network Bank, now one of the largest rural bank groups by assets, began as a consolidation of three separate rural banks in Mindanao. AGRIBANK was formed in 2025 from the merger of four previously independent rural banks.
The fact of consolidation is itself significant. When institutions merge specifically to improve their capacity for risk management, they are effectively admitting that meeting supervisory requirements, including AML obligations, is harder alone at small scale than with pooled resources.
A rural bank employing three or four compliance staff has the same obligations as a universal bank with a compliance department of hundreds. The duties do not decrease because the institution is smaller.
What "common provision" actually means
The Manual of Regulations for Banks gives sections that apply generally to all bank types a particular prefix in its own numbering system, distinguishing them from provisions specific to one kind of bank. The AML/CFT rules in Part IX are organised this way: a general set of rules applicable throughout the banking system, not a chapter for a bank type with built-in adjustments for smaller institutions.
That is a deliberate and genuine contrast to how the Manual treats other prudential requirements. Capital adequacy is explicitly tiered: universal and commercial banks follow Basel III, while standalone thrift, rural and cooperative banks remain on Basel II-based guidelines, an actual regulatory recognition that a rural bank's risk profile and systemic importance differ from a universal bank's, reflected in a less stringent capital framework.
The same substantive elements a universal bank's prevention programme must include, customer due diligence, ongoing monitoring, reporting of suspicious and covered transactions, record retention, employee training and independent audit, are also required of a rural bank's board-approved written prevention programme. Unlike the capital rules, the difference in size does not appear in the AML framework.
Where the resource gap actually bites
This is not a criticism of the regulation. A next-working-day STR clock, a five-year record retention period and independently tested internal controls exist because the risk of money laundering doesn't decrease as an institution gets smaller either. A rural bank can be, and has been, used as a layering point precisely because it's assumed to face lighter oversight. The obligation should be uniform. It's in the funding required to meet it that the gap becomes apparent.
Headcount
A universal bank can have specialists handling screening, monitoring, investigation and regulatory reporting as separate roles. A rural bank with a small compliance team has the same few people take on all of it, usually alongside other operational duties, with no room to specialise.
Technology
An AML programme is expected to deliver sanctions screening, behavioural transaction monitoring and audit-trail infrastructure, even though buying technology to do it isn't explicitly mandated. It's substantially harder to achieve those outcomes manually at any meaningful transaction volume. For a universal bank, AML technology spend is a line item. For an institution with total assets in the low hundreds of millions of pesos, the same spend is a much larger share of its overall budget.
Independent testing
Independent AML testing requires that the people reviewing controls weren't involved in designing or operating them. A compliance function of three or four people has limited internal capacity to run that review, which pushes testing outside the institution, another cost a larger bank absorbs more easily.
Examination readiness
BSP's supervisory approach increasingly requires institutions to show, case by case, that a decision was made correctly: audit trails, logs of rule changes, documented reasons for escalation or clearance. Producing that evidence reliably needs the right infrastructure. A small compliance function with good intentions is more likely to fail under examination pressure not because its original decisions were wrong, but because the evidence behind them was never recorded in retrievable form.
The new pressure: digital channels without digital-scale compliance
The resource gap is worsening, not staying level, because rural banks are adopting digital channels faster than their compliance departments have traditionally been staffed.
BSP has responded with new prudential requirements aimed specifically at digital-centric thrift, rural and cooperative banks. Under this framework, a rural bank operating digital platforms must keep no more than 30% of its customers outside the geographic areas where it has physical branches, and exceeding that limit gives BSP the authority to reclassify the institution as a digital bank, a status carrying a more stringent regulatory regime. The rule reveals BSP's central concern: rural banks using digital channels to expand well beyond their traditional footprint without scaling the risk management and compliance systems that growth demands.
That single limit illustrates the resourcing problem. A rural bank that successfully extends its digital services simultaneously increases transaction volume, customer diversity, and exposure to exactly the activity, mule accounts, structuring, rapid onboarding followed by transactions, that AML controls exist to detect. Digital growth without a corresponding rise in AML capability isn't a hypothetical risk. It's the exact pattern BSP's new framework was built to address.
Closing the gap
Fyscal ARCX was built on a no-code architecture because the cost of engineering involvement in configuration scales inversely with institution size: the smaller the compliance team, the greater the real-world cost of a development queue for every rule change.
Its Name Screening and Transaction Monitoring modules cover sanctions, PEP and adverse media screening together with behavioural pattern detection, so a rural bank doesn't need to build and staff each as a separate specialist function. Case Management keeps a continuous, accumulating record per customer, letting a team of three or four answer an examiner's questions on how a decision was reached without reconstructing history from memory or scattered files. Regulatory Reporting fills STR and CTR forms directly from case data with deadline tracking, closing the gap between having the right process on paper and reliably executing it on the same next-working-day timetable that applies regardless of institution size.
The regulation still asks for the same thing. Whether an institution can deliver it should not depend on a headcount it doesn't have.