Checking the Legitimacy of Lending Companies in the Philippines
A practitioner‑oriented legal guide (July 2025 edition)
1. Why legitimacy matters
Unlicensed lenders expose borrowers to usurious pricing, abusive collection, malicious data harvesting, and the loss of the legal remedies that exist only against regulated entities. At the policy level, they also undermine financial‑system stability, tax collection, and the credibility of the government’s financial‑inclusion agenda.
2. Core legal framework
| Statute / issuance | Key purpose | Principal regulator |
|---|---|---|
| Republic Act No. 9474 (Lending Company Regulation Act of 2007, “LCRA”) & IRR | Creates the licensing regime for lending companies (LCs) and penalizes “colorum” lending | Securities and Exchange Commission (SEC) |
| Securities Regulation Code (RA 8799) | Gives the SEC corporate‑registration and investigatory powers used in LCRA enforcement | SEC |
| SEC Memorandum Circular (MC) No. 19‑2019 (as amended by MC 10‑2021) | Requires separate approval and disclosure obligations for online lending platforms (OLPs) | SEC |
| Truth in Lending Act (RA 3765), RA 7394 (Consumer Act), and Bangko Sentral ng Pilipinas (BSP) Circular 830‑2014 on Effective Interest Rate disclosure | Mandate cost‑of‑credit transparency | SEC for LCs; BSP for banks and quasi‑banks |
| Monetary Board (MB) Resolution 268‑1‑2022 & SEC MC 3‑2022 | Impose interest‑rate and penalty‑charge ceilings on loans ≤ ₱10,000 and a term ≤ 4 months (6 % simple interest per month; penalties capped at 5 % per month) | SEC / BSP |
| Financial Consumer Protection Act (RA 11765, 2022) & BSP/SEC joint implementing regulations | Elevate abusive collection, mis‑selling, and data privacy violations to statutory offenses; introduce restitution and disgorgement | BSP & SEC |
| Data Privacy Act (RA 10173) & NPC Circular 16‑01 | Regulate contact scraping, public‐shaming texts, and other data‑processing practices common among rogue apps | National Privacy Commission (NPC) |
| Anti‑Money Laundering Act (RA 9160, as amended) | Requires customer identification, transaction reporting, and compliance officers | Anti‑Money Laundering Council (AMLC) |
| Civil Code (Interest provisions), Supreme Court jurisprudence | Govern conventional obligations and small‑claims enforcement | Courts |
3. Who may operate a lending company
| Requirement | Details |
|---|---|
| Organizational form | Stock corporation only; sole proprietorships and partnerships were outlawed for new lending business after 30 June 2008. |
| Paid‑in capital | Minimum ₱1 million (may be increased by the SEC in proportion to branch network and digital scale). |
| Corporate name | Must contain “Lending Company,” “Lending Investor,” or “Lending Corporation.” Using “Finance,” “Credit,” or “Microfinance” without proper authority is misleading and sanctionable. |
| Certificates | 1️⃣ Certificate of Incorporation under the SRC, and 2️⃣ Certificate of Authority (CA) to operate as an LC under RA 9474. Both documents display the company’s SEC Registration Number and CA Document Number. |
| Branch & OLP approval | Each new physical branch and each distinct mobile app or website must secure prior SEC approval. |
| Special cases | Microfinance NGOs (RA 10693) and pawnshops (PD 114) have separate charters; banks and quasi‑banks fall under BSP licensing. |
Operating without a CA is a criminal offense (sec. 12, RA 9474), punishable by ₱10,000–₱50,000 fine or 6 months–10 years imprisonment, plus possible civil damages and daily SEC administrative fines.
4. Ongoing compliance duties
Annual filings – Audited Financial Statements (AFS) and General Information Sheet (GIS) within 120 days of fiscal year‑end; late filing triggers per‑day fines and risk of suspending the CA.
AML/CTF – Registration with the AMLC’s goAML portal, adoption of a Manual of Operations, and quarterly submission of Covered and Suspicious Transaction Reports.
Transparent pricing – The effective interest rate (EIR), total finance charge, and amortization schedule must be disclosed in conspicuous Filipino or English before contract signing, pursuant to RA 3765 and BSP Circular 730‑2011.
Interest‑cap compliance – For small‑value, short‑tenor loans (≤ ₱10k, ≤ 4 months):
- Simple interest ≤ 6 % per month
- Penalty 5 % per month, applied only to the unpaid installment (not to the entire principal)
- No hidden “processing,” “service,” or “collection” fees beyond the cap.
Debt‑collection conduct – Prohibited acts now codified under RA 11765 and SEC MC 18‑2019 (e.g., public shaming, obscene language, threatening violence, contacting people in the borrower’s phonebook without separate consent). Violations may result in CA suspension, fines up to ₱1 million per act, disgorgement of profits, and mandatory customer restitution.
Data‑privacy safeguards – NPC requires data‑sharing matrices, privacy manuals, and DPO appointment; excessive app permissions (camera, contact list, geolocation) absent demonstrable necessity are prima facie unlawful.
Reportorial audits – SEC may conduct onsite or desk audits; failure to present books within five days of notice constitutes prima facie evidence of unlawfulness.
5. Step‑by‑step verification for borrowers, lawyers, and compliance officers
Search the SEC digital portal (https://www.sec.gov.ph ➔ Verify Company). If the name is absent, the entity is automatically illegal.
Open the entity profile – Confirm the CA Number and its validity period; note that expired CAs are grounds for immediate cease‑and‑desist orders (CDOs).
Compare with the SEC’s public lists –
- List of Licensed Lending Companies (updated monthly)
- List of Registered Online Lending Platforms
- Advisories Against Unregistered Entities and List of Revoked/Suspended Companies
Inspect corporate documents – Legit LCs display the CA in the place of business and embed it in mobile apps under “About Us.” Tampering is a separate SEC administrative violation.
Check the business permit with the city/municipal Business Permits and Licensing Office (BPLO). A valid permit does not substitute for the SEC CA but its absence is a red flag.
Validate AML and privacy compliance – Request for the Data‑Processing Consent Form and the AML Customer Identification procedures; refusal or ignorance often signals non‑compliance.
Ascertain pricing legality – Ask for the Pre‑Contract Disclosure Statement; if EIR exceeds legal caps or cannot be computed, you may report the lender immediately.
Pro tip: If the company claims BSP supervision, search the BSP’s Financial Institutions Portal. Many bogus actors misuse the term “BSP‑licensed” when, in fact, only thrift/rural banks and finance companies possessing a quasi‑bank license fall under BSP’s primary jurisdiction.
6. Available remedies against rogue lenders
| Issue | Primary forum | Typical outcome |
|---|---|---|
| Operating without CA; overcharging; abusive collection | SEC (CGFD) – file verified complaint with annexes; summary proceedings possible | Cease‑and‑desist order; revocation; fines; referral for criminal prosecution |
| Harassment or privacy breach | NPC – online complaint portal | Compliance order; corrective action plan; up to ₱5 million fine; public naming |
| Excessive interest/fees but lender is a bank | BSP Consumer Protection and Market Conduct Office | Monetary penalty; restitution; directive to revise product |
| Individual recovery of money paid | Small Claims Court (amount ≤ ₱400,000; no lawyers required) | Judgment for sum of money; execution through sheriff |
| Large‑scale fraud | DOJ / NBI Cybercrime Division | Criminal information for estafa, cyber‑libel, RA 11765 offenses |
7. Key jurisprudence and policy trends
- People v. Castillo (G.R. No. 196510, 2015) – affirmed conviction of a “5‑6” operator for violating RA 9474 despite a DTI permit, clarifying that local permits cannot cure the absence of an SEC CA.
- SEC v. Bintang8 Lending Corp. – 2021 en banc ruling sustained the SEC’s power to freeze bank accounts and assets of unlicensed digital lenders ex parte to protect the public.
- NPC v. Fexi Lending (NPC Case No. 19‑019, 2022) – NPC imposed a ₱3‑million fine for contact scraping and “viral shaming,” establishing that consent must be manifest, informed, and freely given.
- Policy direction (2023–2025) – The Department of Finance’s Financial Inclusion Framework aims to merge the SEC licensing database with the state‑owned Credit Information Corporation (CIC) so that only data from duly licensed lenders feed borrowers’ credit scores; sandbox‑type exemptions for buy‑now‑pay‑later products now require pairing with a licensed LC or BSP‑regulated EMI.
8. Practical borrower checklist
- Screenshot the CA and Disclosure Statement before signing.
- Compute the EIR: use any online Truth‑in‑Lending calculator; if figures differ, walk away.
- Avoid granting phone‑book or gallery access; legitimate lenders do not need them.
- Keep proof of payments – receipts, bank confirmation emails, or GCash screenshots.
- Escalate early – The SEC and NPC respond faster when contacted before harassment escalates.
9. Conclusion
The Philippine legislative and regulatory architecture for lending companies is now one of the most stringent in Southeast Asia: dual licensing (corporate plus activity), capped charges for small loans, explicit debt‑collection rules, data‑privacy enforcement, and statutory consumer protections under RA 11765. Yet no regime can fully eliminate malpractices; effective protection ultimately depends on borrowers’ vigilance and practitioners’ readiness to invoke the tools outlined above.
By systematically verifying SEC licensing, scrutinising disclosures, and invoking the appropriate remedies, both consumers and counsel can separate legitimate lending companies from “colorum” actors and ensure credit fosters—rather than frustrates—financial inclusion.