I. Introduction

In the Philippines, lending companies play a major role in giving individuals, small businesses, employees, online borrowers, and informal entrepreneurs access to credit. Many legitimate lenders operate under Philippine law, but the lending market has also attracted illegal operators, fake loan apps, abusive collectors, unregistered online lenders, and entities that misuse corporate names to appear lawful.

Before borrowing money, signing a loan agreement, installing a loan app, giving personal information, or paying “processing fees,” a borrower should verify whether the lending company is legitimately registered and authorized to operate.

This article explains how to check whether a lending company is legitimate in the Philippine context, what government registrations matter, what red flags to watch for, and what remedies may be available if a borrower deals with an illegal lender.

This is general legal information, not a substitute for advice from a Philippine lawyer or direct verification with the relevant government agencies. Laws, circulars, and agency lists may change after August 2025, so official records should always be checked directly.

II. What Makes a Lending Company “Legitimate” in the Philippines?

A lending business is not legitimate merely because it has a Facebook page, website, mobile app, business permit, barangay clearance, DTI certificate, or SEC registration as an ordinary corporation.

In the Philippines, lending companies are primarily regulated by the Securities and Exchange Commission under the Lending Company Regulation Act of 2007, or Republic Act No. 9474.

A legitimate lending company generally needs:

SEC registration as a corporation, and
Authority from the SEC to operate as a lending company, usually evidenced by a Certificate of Authority to Operate as a Lending Company.

For online lending companies or lending apps, legitimacy also requires compliance with SEC rules on online lending platforms, disclosure, data privacy, fair debt collection, and consumer protection.

A business name registration alone is not enough.

III. Difference Between SEC Registration and Authority to Lend

This is one of the most important points.

A. SEC Registration

SEC registration means that the entity is registered as a juridical entity, usually a corporation. It confirms that the corporation exists on SEC records.

However, SEC registration alone does not automatically authorize a corporation to engage in lending.

A company may be registered with the SEC for one purpose but may not have authority to operate as a lending company.

B. Certificate of Authority to Operate as a Lending Company

A lending company must have a specific authorization from the SEC. This authority is separate from ordinary incorporation.

The relevant question is not only:

“Is the company registered with the SEC?”

The better question is:

“Is the company registered with the SEC and does it have a valid Certificate of Authority to operate as a lending company?”

A company that lends money without this authority may be operating illegally, even if it has a corporate registration number.

IV. The Governing Law: Republic Act No. 9474

The main law is the Lending Company Regulation Act of 2007.

Under this law, a lending company is generally a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than a limited number of persons, subject to legal and regulatory requirements.

The law places lending companies under SEC supervision and requires them to register and secure authority before operating.

The law was enacted to regulate lending companies, prevent abuses, and establish rules for lawful lending operations.

V. Entities That May Be Confused With Lending Companies

Not every entity that grants credit is a “lending company” under the same regulatory framework. The proper regulator may depend on the type of entity.

A. Banks

Banks are regulated by the Bangko Sentral ng Pilipinas. Examples include universal banks, commercial banks, thrift banks, rural banks, and digital banks.

A bank does not need to be checked in the same way as a private lending company. Its legitimacy is usually verified through BSP records.

B. Financing Companies

Financing companies are regulated under a different framework and may also be supervised by the SEC. They may provide financing, leasing, factoring, or similar services.

A financing company is not necessarily the same as a lending company.

C. Pawnshops

Pawnshops are regulated by the BSP. They operate under pawn transactions, not ordinary unsecured lending.

D. Cooperatives

Credit cooperatives may be regulated by the Cooperative Development Authority, not the SEC as lending companies.

E. Microfinance NGOs

Microfinance NGOs may have their own regulatory framework and accreditation requirements.

F. Informal Lenders

Private persons or informal lenders may lend money, but habitual lending as a business can raise regulatory issues. Illegal “5-6” schemes, coercive collection, confiscation of IDs, and abusive interest practices may trigger legal consequences.

VI. How to Check If a Lending Company Is Legitimately Registered

Step 1: Get the Exact Legal Name

Before checking anything, get the lender’s exact name.

Many illegal lenders use trade names, app names, page names, or misleading brand names that are different from the real corporate name.

Ask for:

Registered corporate name;
SEC registration number;
Certificate of Authority number;
Principal office address;
Names of officers or representatives;
Official website or app name;
Contact number and email address;
Copy of the SEC Certificate of Authority, if available.

Be careful with names that sound almost identical to legitimate companies.

For example, a fake lender may use a name similar to a real company but with small changes in spelling, punctuation, or abbreviation.

Step 2: Check the SEC Registration

The SEC keeps records of registered corporations. A legitimate lending company should appear in SEC records under its exact corporate name.

You should check:

Whether the corporation exists;
Whether the name matches exactly;
Whether the registration number matches;
Whether the company’s registration status is active, suspended, revoked, or otherwise problematic.

However, again, ordinary SEC registration is not enough. It only confirms corporate existence.

Step 3: Check the SEC Certificate of Authority

The most important document is the Certificate of Authority to Operate as a Lending Company.

Check whether the company appears on the SEC’s list of authorized lending companies. The SEC has historically published lists of:

Lending companies with Certificates of Authority;
Financing companies;
Online lending platforms;
Revoked or suspended lending companies;
Entities subject to SEC advisories.

A company may show you a certificate, but you should verify it with SEC records because fake certificates can be edited or fabricated.

Step 4: Check Whether the Online Lending App Is Registered

For lending apps, check not only the corporate name but also the app name.

An app may be operated by a corporation, but the app itself may not be properly disclosed or approved in the required manner.

Verify:

App name;
Developer name;
Corporate operator;
SEC registration;
Certificate of Authority;
Whether the app appears on SEC lists of registered online lending platforms;
Whether the app or company appears in SEC advisories.

Be especially careful where the app:

Has no clear corporate name;
Uses only a generic brand;
Uses foreign-looking names with no Philippine corporate records;
Offers instant approval with no proper disclosure;
Demands access to contacts, photos, SMS, or social media;
Threatens public shaming or harassment.

Step 5: Check SEC Advisories

The SEC issues advisories against entities that may be operating without authority, soliciting investments illegally, or engaging in unauthorized lending.

If the lender appears in an SEC advisory, that is a serious warning sign.

An SEC advisory does not necessarily replace a full court judgment, but it is a strong regulatory notice that the public should be cautious.

Step 6: Check the Business Permit, But Do Not Rely on It Alone

A mayor’s permit or barangay clearance may show that the business has local permission to operate at a location. It does not prove that the entity is authorized by the SEC to lend.

A business permit cannot cure the absence of a required SEC Certificate of Authority.

A lending company with only a barangay permit, DTI registration, or mayor’s permit should not be treated as fully legitimate unless its SEC authority is verified.

Step 7: Check DTI Registration Only for Sole Proprietorship Names

The Department of Trade and Industry registers business names for sole proprietorships. DTI registration does not create a corporation and does not grant authority to operate as a lending company.

A lending company under RA 9474 is generally expected to be a corporation. Therefore, if a supposed lending company shows only a DTI certificate, that is a red flag.

Step 8: Check BSP Only If the Entity Claims to Be a Bank, Pawnshop, Remittance Agent, or BSP-Supervised Institution

If the entity says it is a bank, digital bank, e-money issuer, pawnshop, remittance agent, or financing-related BSP-supervised entity, then BSP records may be relevant.

But for ordinary lending companies, the main regulator is the SEC.

Step 9: Check the National Privacy Commission for Data Privacy Issues

Online lenders often collect personal data. If a lending app abuses personal information, accesses contacts, threatens borrowers, or sends defamatory messages to third parties, the Data Privacy Act of 2012 may be involved.

The National Privacy Commission may be relevant where the issue is improper collection, use, processing, disclosure, or retention of personal data.

However, NPC registration or privacy policy statements do not automatically prove that a lending company is authorized to lend.

VII. Documents a Legitimate Lending Company Should Be Able to Provide

A borrower may ask for the following:

SEC Certificate of Incorporation;
SEC Certificate of Authority to Operate as a Lending Company;
Articles of Incorporation and By-Laws, where relevant;
Official business address;
Official receipts or proof of payment channels;
Written loan agreement;
Truthful disclosure of interest, penalties, charges, and repayment terms;
Privacy policy for online lending platforms;
Customer service and complaints contact details;
Name of the corporate operator behind the app or platform.

A legitimate lender should not refuse to identify its registered corporate name.

VIII. Red Flags of an Illegal or Abusive Lending Company

A lending company may be suspicious if it does any of the following:

A. No SEC Certificate of Authority

The biggest red flag is operating as a lender without a Certificate of Authority from the SEC.

B. Uses Only a Facebook Page, Telegram Account, or Mobile Number

Legitimate lenders normally have formal business information. A lender operating only through Messenger, Telegram, Viber, WhatsApp, or SMS should be treated cautiously.

C. Requires Upfront Fees Before Loan Release

A common scam involves asking borrowers to pay:

Processing fees;
Insurance fees;
Verification fees;
Anti-money laundering clearance fees;
Wallet activation fees;
Documentary stamp tax in advance;
Release charges.

After payment, the lender disappears or demands more money.

A legitimate lender may charge lawful fees, but suspicious advance payments before any loan release are a major warning sign.

D. No Written Loan Agreement

A legitimate loan should have clear written terms, including principal amount, interest rate, fees, penalties, maturity date, and payment schedule.

E. Unclear or Excessive Interest and Charges

If the lender hides the actual cost of borrowing, changes charges after approval, or refuses to provide a schedule of payments, the borrower should be cautious.

F. Threats, Harassment, or Public Shaming

Debt collection must still comply with law. Threatening to post a borrower’s face online, contact relatives, shame the borrower’s employer, accuse the borrower of a crime without basis, or send abusive messages may create legal liability.

G. Unauthorized Access to Contacts or Photos

Loan apps that demand excessive permissions may violate privacy rights, especially if they use contacts or images to harass borrowers.

H. Misuse of Government Names

Scammers sometimes claim they are “approved by the government,” “under BSP,” “under SEC,” or “partnered with NBI/PNP/courts” without proof.

I. Fake SEC Certificates

Borrowers should not rely on screenshots. Fake certificates are common. Always verify with official records.

J. Uses a Name Similar to a Known Company

Some illegal operators imitate legitimate lenders, banks, or financing companies. Minor differences in spelling may matter.

IX. Online Lending Apps: Special Concerns

Online lending apps are particularly risky because they can collect large amounts of personal data quickly.

Common abuses include:

Accessing phone contacts;
Sending collection messages to friends and family;
Posting defamatory statements;
Threatening arrest;
Creating fake legal notices;
Using shame tactics;
Charging hidden fees;
Requiring repeated rollover payments;
Using multiple app names under one operator;
Operating without SEC authority.

Borrowers should check whether both the company and the online lending platform are properly registered or recognized by the SEC.

X. Can a Lending Company Charge High Interest?

Philippine law does not impose a single universal interest rate for all private loans in every situation. However, interest, penalties, and charges may still be challenged if they are unconscionable, iniquitous, excessive, hidden, or contrary to law, regulation, or public policy.

Courts may reduce unconscionable interest rates depending on the circumstances.

Also, lending companies are expected to disclose charges clearly. Hidden charges and deceptive loan terms may raise issues under consumer protection, lending regulation, and unfair collection rules.

XI. Is Nonpayment of a Loan a Criminal Case?

As a general principle, failure to pay a debt is usually a civil matter, not automatically a criminal offense.

The Philippine Constitution prohibits imprisonment for debt. However, criminal liability may arise in related situations, such as:

Fraud or estafa, if deceit existed from the beginning;
Issuance of bouncing checks under applicable law;
Falsification of documents;
Use of fake identities;
Cyberlibel, harassment, or threats by collectors;
Data privacy violations by lenders.

Collectors who threaten borrowers with automatic arrest for nonpayment are often misleading them.

A lender may sue civilly to collect a debt, but it cannot simply have a borrower jailed for ordinary nonpayment.

XII. Debt Collection Rules and Borrower Protection

Lending companies and collectors are not free to collect debts by any means they choose.

Prohibited or abusive practices may include:

Threats of violence;
Profanity and insults;
Harassment at unreasonable hours;
False representation as police, lawyers, court officers, or government agents;
Threatening criminal prosecution without basis;
Disclosure of debt to unrelated third parties;
Public shaming;
Use of personal data for intimidation;
Contacting employers or relatives to embarrass the borrower;
Publishing defamatory posts.

Borrowers should preserve evidence of abusive collection, including screenshots, call logs, recordings where lawfully obtained, payment records, and names or numbers used by collectors.

XIII. Data Privacy Issues in Lending

The Data Privacy Act of 2012 protects personal information. Lending companies and loan apps that collect personal data must have a lawful basis, collect only what is necessary, inform users how data will be used, protect the data, and avoid unauthorized disclosure.

Problematic conduct may include:

Accessing contact lists unnecessarily;
Using photos or IDs for harassment;
Sending debt messages to contacts who are not parties to the loan;
Publicly posting borrower information;
Retaining borrower data indefinitely without basis;
Sharing data with third-party collectors without proper safeguards.

A borrower may consider filing a complaint with the National Privacy Commission if personal data is misused.

XIV. What If the Lending Company Is Not Registered?

If a company is lending without proper authority, several consequences may follow.

The SEC may:

Issue advisories;
Investigate;
Impose penalties;
Suspend or revoke authority;
Order cessation of operations;
Refer matters for prosecution where appropriate.

Borrowers may still need legal advice regarding whether they must repay amounts actually received. The illegality of the lender’s operations does not automatically mean every borrower can ignore the debt. The answer may depend on the contract, the facts, interest rates, charges, and applicable law.

However, unauthorized lending, abusive collection, hidden charges, or privacy violations may give the borrower defenses, complaints, or counterclaims.

XV. Practical Checklist Before Borrowing

Before borrowing from a lending company, ask:

What is the exact registered corporate name?
Is it registered with the SEC?
Does it have a valid Certificate of Authority to Operate as a Lending Company?
Is the app or platform listed under the company’s authorized online lending operations?
Does the company appear in any SEC advisory?
Does the loan agreement clearly state the principal, interest, fees, penalties, and due date?
Are all charges disclosed before release?
Are there upfront fees before the loan is released?
Does the app request excessive permissions?
Are collection practices lawful and professional?
Is there an official address, email, and customer service channel?
Are payments made to a corporate account or suspicious personal accounts?
Are receipts issued?
Does the lender pressure you to decide immediately?
Does the lender threaten arrest, public shaming, or contact with your employer?

If several answers are concerning, do not proceed until verified.

XVI. Where to Verify or Complain

Depending on the issue, a borrower may approach:

A. Securities and Exchange Commission

For:

Unregistered lending companies;
Lending without Certificate of Authority;
Unauthorized online lending platforms;
Abusive lending company practices;
SEC advisories and verification.

B. National Privacy Commission

For:

Misuse of personal data;
Unauthorized contact list access;
Public posting of borrower information;
Data privacy violations by loan apps or collectors.

C. Bangko Sentral ng Pilipinas

For:

Banks;
Digital banks;
pawnshops;
certain BSP-supervised financial institutions;
complaints involving BSP-regulated entities.

D. Department of Trade and Industry

For:

Consumer complaints involving trade practices;
misleading business representations;
business name concerns for sole proprietorships.

E. Philippine National Police or National Bureau of Investigation

For:

Cyber harassment;
threats;
extortion;
identity theft;
fake loan scams;
online fraud.

F. Courts or Lawyers

For:

Collection suits;
defense against abusive claims;
injunctions or damages;
contract review;
settlement negotiations;
criminal or civil remedies.

XVII. Common Scenarios

Scenario 1: “The company has a DTI certificate. Is it legitimate?”

Not necessarily. DTI registration only registers a business name for a sole proprietorship. It does not authorize lending company operations under SEC rules.

Scenario 2: “The company has SEC registration. Is that enough?”

No. SEC registration as a corporation is not the same as a Certificate of Authority to operate as a lending company.

Scenario 3: “The app is on Google Play. Is it legitimate?”

No. App store availability does not prove Philippine regulatory authority. An app may be downloadable but still unauthorized.

Scenario 4: “They sent me a certificate. Can I rely on it?”

Not without verification. Certificates can be forged or outdated. Check official records.

Scenario 5: “They threatened to post my face and contact my relatives.”

That may involve harassment, privacy violations, cyber-related offenses, or unfair collection practices. Preserve evidence and consider reporting to the proper agency.

Scenario 6: “They said I will be arrested if I do not pay.”

Ordinary nonpayment of debt is generally civil, not automatic grounds for arrest. Threats of arrest may be abusive or misleading unless there is a separate legitimate criminal issue.

Scenario 7: “They require me to pay a release fee first.”

This is a common scam pattern. Be extremely cautious, especially if payment is requested through personal e-wallet accounts.

XVIII. Legal Importance of the Loan Agreement

A legitimate lender should provide a written agreement before or upon release of the loan.

The agreement should state:

Principal amount;
Amount actually released;
Interest rate;
Effective interest or total cost of credit, where applicable;
Service fees;
Penalties;
Due dates;
Payment method;
Consequences of default;
Collection policy;
Data privacy consent;
Dispute mechanism.

Borrowers should compare the stated principal against the amount actually received. Some lenders deduct large hidden charges upfront, causing the borrower to owe much more than what was actually received.

XIX. The Role of Receipts and Payment Records

Borrowers should keep proof of every payment.

Important records include:

Official receipts;
Bank transfer confirmations;
GCash or Maya screenshots;
Deposit slips;
Acknowledgment messages;
Loan statements;
Updated balance computations.

Payments to personal accounts are risky. A legitimate company should have traceable payment channels.

XX. Warning About Fake “Legal Departments”

Illegal lenders sometimes send fake notices using names like:

Legal Department;
Court Sheriff;
Barangay Legal Office;
NBI Complaint Unit;
Police Cybercrime Division;
Warrant Processing Office;
Small Claims Court Notice.

Borrowers should verify whether a notice is real. A real court document will come from an actual court and contain identifiable case details. A lender cannot create a real warrant or court order by sending a text message.

XXI. What Borrowers Should Do If Harassed

A borrower experiencing harassment should:

Stop engaging emotionally with abusive collectors.
Save screenshots, call logs, messages, and recordings where lawful.
Identify the lender’s company name, app name, and contact details.
Check SEC records and advisories.
Send a written request for a statement of account.
Demand that collection communications be lawful and limited.
Report privacy violations to the NPC where applicable.
Report unauthorized lending to the SEC.
Report threats, extortion, or cyber harassment to law enforcement.
Consult a lawyer if a case is filed or threats escalate.

XXII. What Lenders Should Remember

Lending companies should ensure that they:

Are properly incorporated;
Hold a valid SEC Certificate of Authority;
Disclose all loan charges;
Use fair and lawful collection practices;
Protect borrower data;
Register or disclose online lending platforms as required;
Avoid deceptive advertising;
Avoid harassment, shaming, threats, and unauthorized third-party disclosures;
Maintain proper records and official receipts;
Comply with SEC, data privacy, consumer protection, tax, and local business requirements.

Operating without authority exposes the company and its officers to regulatory and legal risk.

XXIII. Key Takeaways

A lending company in the Philippines is legitimate only if it is properly registered and authorized. The most important proof is not merely a business permit, DTI certificate, app listing, or ordinary SEC registration. The critical requirement is authority from the SEC to operate as a lending company.

For borrowers, the safest approach is to verify before borrowing. Confirm the exact corporate name, SEC registration, Certificate of Authority, app registration, business address, loan terms, and collection practices.

For online lending apps, be especially careful. Many abuses involve data privacy violations, harassment, hidden fees, and fake legal threats.

The core rule is simple:

Do not borrow from a lender unless you can verify who they are, whether they are authorized, how much the loan truly costs, and how they will handle your personal data and repayments.