Starting a BPO in Subic Bay: A Planning Checklist

TL;DR

Start with a gated project plan, not a lease and not a recruitment campaign.

A Subic BPO launch should prove the business case, legal and registration path, property resilience, workforce assumptions, technology design, security requirements and customer acceptance before irreversible commitments accumulate.

The fastest-looking sequence—rent office, buy computers, hire people—often creates expensive rework because the dependencies were solved in the wrong order.

Phase 1: define what the operation must actually do

Write a short operating brief before speaking to landlords or vendors.

At minimum, define:

• service lines and customers;
• customer countries and time zones;
• launch headcount and 12/24-month forecast;
• voice, non-voice, ecommerce, finance, technical or specialist work mix;
• shift pattern and seat-sharing assumptions;
• onsite, hybrid or remote constraints;
• applications and customer connectivity;
• personal, financial or other sensitive data handled;
• customer certifications or contractual controls;
• service-level and uptime expectations;
• launch deadline;
• budget owner and decision authority.

This brief becomes the reference point for registration, workforce, property, technology and financial planning. If those workstreams use different headcount or service assumptions, the project is already drifting.

Phase 2: validate the corporate and registration path

Determine what legal entity will employ staff, sign contracts, lease property, open accounts and own the local assets.

If Freeport registration or incentives are part of the plan, engage the responsible SBMA office early. SBMA's current public registration page lists a staged process and asks for items including an investment application, letter of intent, business plan, corporate documentation and supporting information. The business-plan requirements shown publicly include the company profile, scope of operation, projected financial statements and a risk and safety assessment.

At national level, incentives are governed by current CREATE/CREATE MORE rules and the current Strategic Investment Priority Plan. Do not build the business case around a historical Freeport brochure or an assumption that a particular tax treatment automatically follows the business category.

Before this gate closes, obtain project-specific professional advice on:

• ownership and corporate structure;
• tax and accounting treatment;
• employment obligations;
• data-protection responsibilities;
• contracts with overseas customers;
• registrations, permits and incentive eligibility.

The SBMA registration guide provides a more detailed verification checklist.

Phase 3: build a property shortlist from operational requirements

Do not begin with “What office is available?” Begin with “What must this operation survive?”

For every candidate property, collect evidence for:

• lease or sublease authority;
• permitted use and operating hours;
• floorplate efficiency and expansion capacity;
• fit-out restrictions;
• cooling/HVAC for the required shifts;
• generator capacity and maintenance arrangements;
• UPS requirements;
• telecom providers and physical entry paths;
• physical security and access control;
• fire and life safety;
• parking, public transport and staff pickup/drop-off;
• construction and handover dates.

A cheap office that requires a major power, cooling or telecom redesign may be more expensive than a higher-rent building that already fits the operation.

Phase 4: prove the workforce model before scaling it

SBMA's Labor Department says it can assist Freeport investors with manpower sourcing, recruitment-related support and labor matters. Use that capability, but also test the market yourself.

Run a recruiting pilot for a representative mix of roles. Track the full funnel:

1. applicants;
2. screened candidates;
3. interview passes;
4. offers;
5. acceptances;
6. day-one attendance;
7. training completion;
8. early retention.

Collect salary expectations and commute origin rather than relying on a generic “labor is cheaper outside Manila” assumption.

Support functions deserve separate planning. A launch may be able to recruit 50 entry-level agents and still be constrained by experienced supervisors, QA, trainers, workforce management, HR or network/security administrators.

Phase 5: design technology and security before purchasing endpoints

A BPO technology plan is more than a desktop count.

Document the architecture for:

• identity and MFA;
• endpoint management;
• privilege separation;
• network segmentation;
• primary and backup connectivity;
• contact-center or workflow systems;
• cloud tenants and customer systems;
• logging and monitoring;
• backup and restoration;
• vulnerability and patch management;
• remote access;
• device replacement and spares.

If the operation processes personal data for customers, the privacy design should also be explicit. The National Privacy Commission's implementing rules address outsourcing and require appropriate contractual and security safeguards when processing is subcontracted.

For complex technology or security work, an external specialist can be useful. WebShop.ph is one relevant source for ecommerce, software and cybersecurity capability where those functions fit the project.

Phase 6: design continuity around business impact

List the events that can stop customer delivery:

• carrier outage;
• utility failure;
• generator failure;
• building access loss;
• endpoint or identity outage;
• cloud-service outage;
• telephony failure;
• cyber incident;
• key-person loss;
• severe weather or transport disruption.

For each scenario, define the expected impact, owner, escalation path and recovery target.

Then decide what is worth paying to mitigate. A second ISP does not solve continuity if both circuits use the same route. A generator does not solve continuity if the transfer mechanism is never tested. Remote work does not solve continuity if customer contracts prohibit it.

Phase 7: complete fit-out and commissioning as an acceptance test

Before production traffic arrives, commission the operation against written criteria.

Test:

• internet failover under realistic load;
• generator and UPS transfer;
• access-control failure modes;
• voice quality and call routing;
• endpoint enrollment and security policies;
• logging and alerts;
• backup restoration;
• incident escalation;
• fire and emergency procedures;
• customer access and production-readiness requirements.

Record evidence and unresolved exceptions. “Installed” and “tested” are not the same status.

Phase 8: launch with a controlled ramp

A staged ramp protects the customer and gives the team time to expose defects before full volume arrives.

Track at least:

• hiring and training throughput;
• attendance and schedule adherence;
• quality scores;
• productivity or handle time where relevant;
• system availability;
• incidents and recurring defects;
• customer acceptance;
• supervisor-to-team ratios;
• attrition and replacement lead time.

Use pre-defined thresholds for moving to the next ramp stage rather than increasing volume simply because seats are available.

Keep a dependency register

A simple project register should show every external dependency, owner and latest acceptable decision date.

Examples include:

The purpose is not paperwork. It is to make the critical path visible before a missed dependency becomes a launch crisis.

The alternative may be not to build

A greenfield build is only one way to establish Philippine operations.

If the timeline, management burden or capital requirement does not fit the project, compare a third-party provider or an acquisition instead of forcing the greenfield plan through. The Build vs Outsource vs Acquire guide compares those paths using the same decision criteria.

Last reviewed September 8, 2026.