How to Check if a Lending App Is Legit: SEC Verification Guide (Philippines)

Prepared as a general legal explainer for consumers in the Philippines. This is not legal advice.

The one-minute answer (TL;DR)

A legit Philippine lending app must be backed by a corporation that:

Is registered with the Securities and Exchange Commission (SEC) and
Holds a valid Certificate of Authority (CA) to Operate as a Lending or Financing Company.

On the app (and its website/store listing) you should clearly see:

The corporate name (not just a brand), SEC Registration No., and SEC CA No.
A physical office address in the Philippines and working contact details
Transparent pricing (interest rate/effective rate, fees, total cost, due dates) and a privacy notice
No abusive collection language or access-grabbing permissions (e.g., scraping all your contacts)

If any of these are missing or shady, don’t borrow.

Why this matters

“App-first” lenders can be convenient, but many operate illegally or engage in unfair debt collection and privacy violations. Philippine law requires lenders to be corporate entities under the SEC and to obtain a specific license (CA) before they can lend to the public. A flashy app or social page is not a license.

Legal framework at a glance

Lending Company Regulation Act of 2007 (R.A. 9474) – Only corporations may engage in lending to the public and they must secure a Certificate of Authority from the SEC (on top of corporate registration).
Financing Company Act of 1998 (R.A. 8556) – Similar regime for financing companies (often bigger ticket/asset-based/lease-type credit). Many consumer apps sit under either lending or financing structures; both require an SEC CA.
Truth in Lending Act (R.A. 3765) – Requires clear disclosure of finance charges and total cost.
Data Privacy Act of 2012 (R.A. 10173) – Requires lawful, proportional data collection, a privacy notice, and safeguards; abusive “contact scraping” and shaming are red flags.
Financial Products and Services Consumer Protection Act (R.A. 11765) – Enshrines fair treatment, transparency, and redress mechanisms across financial providers, including those supervised by the SEC.
Anti-Money Laundering Act (R.A. 9160, as amended) – Many SEC-supervised lenders are “covered persons”; while this is mostly back-end compliance, it signals a real, regulated business.
Cybercrime Prevention Act (R.A. 10175) and the Revised Penal Code – May be triggered by threats, doxxing, defamation, or harassment during collections.

Key point: SEC registration alone is not enough. The Certificate of Authority (CA) is the license that allows the company to lend. No CA = illegal lending.

Step-by-step: Verify a lending app in minutes

1) Identify the legal entity

Open the app store listing and the app’s “About/Legal/Help/Contact” pages.
Write down the corporate name, SEC Registration Number, and SEC Certificate of Authority Number (often labeled “CA No.”, “SEC CA No.”, or “Certificate of Authority to Operate as a Lending/Financing Company”).
If you see only a DTI certificate or a business permit—that’s not enough. Lending companies must be SEC-registered corporations with a CA.

2) Cross-check the license details

Compare the brand/app name, website/app-store name, and the corporate name. They don’t have to be identical, but there should be a clear link (e.g., “XYZ App operated by ABC Lending Corporation”).
Check that the address and email/phone look professional and reachable (not just a web form or anonymous email).

3) Inspect disclosures before you borrow

A legitimate app should present, before you accept the loan:

Nominal interest and the effective rate (APR/EIR)
All fees (processing, disbursement, convenience, late fees, penalty interest)
Total amount due and repayment schedule
Cooling-off/cancellation terms (if any), and complaint channels

Tip: If an app shouts “0% interest” but charges a large “processing fee” upfront, your effective interest rate can be very high. Ask for the total cash you receive and the total you must pay back—that’s the reality.

4) Check privacy & permissions

There must be a Privacy Notice and Data Sharing disclosures, including a Data Protection Officer (DPO) contact.
Red flags: demands to access your contacts, photos, messages, social media, or location without a clear, proportionate reason; threats to “message your contacts” if you’re late.

5) Review collection practices

Legit lenders will never:
- Harass, threaten, shame, or dox you
- Spam your employer, family, or entire contact list
- Use slurs or abusive language
Fair collections use formal notices, reasonable follow-ups, and official channels. Anything else is grounds for complaint.

6) Follow the money trail

Disbursement and repayment should go through accounts in the company’s name (bank, e-money, or payment partners). Being asked to pay a personal account is a major red flag.
Never prepay “approval fees” just to get approved. That’s a common scam pattern.

Quick legitimacy checklist (print/save)

Corporate name shown (not only a brand)
SEC Registration Number shown
SEC Certificate of Authority Number shown (Lending/Financing)
Physical address and working contacts in PH
Transparent pricing (rates, fees, total cost, schedule)
Privacy Notice + DPO contact; limited, proportionate app permissions
No bullying or shaming language in T&Cs or messages
Funds come from/return to corporate accounts
No upfront “approval/insurance” payments
App-store developer or operator matches/links to the corporate entity

If you can’t tick all the boxes, walk away.

Common red flags (don’t ignore these)

“We’re DTI-registered” (but no SEC CA). ❌
“Guaranteed approval in minutes, pay a small processing/insurance fee now.” ❌
“We’ll message your contacts if you’re late.” ❌
Sky-high charges hidden as “service fees” with “0% interest” marketing. ❌
No office address, disposable emails, or only social pages for contact. ❌
Personal bank/GCash numbers for repayment. ❌
Copycat use of another company’s license numbers. ❌

Lending vs. Financing companies (what you’ll see on paper)

Lending companies – Typically focus on consumer loans (salary, cash, small-ticket). Must be SEC-registered corporations with a CA to operate as a Lending Company.
Financing companies – May offer installment financing, leasing, business credit, sometimes consumer installments. Must be SEC-registered corporations with a CA to operate as a Financing Company.

Both must disclose pricing, follow fair collection, and comply with privacy and consumer protection rules. The CA label will say which type they are authorized for.

Pricing basics you should understand

Nominal interest vs. Effective rate (APR/EIR): Fees deducted upfront (e.g., “processing fee”) inflate your true cost. Ask for the effective rate or compute:
- Effective Rate ≈ (Total Repayment − Cash Received) ÷ Cash Received, scaled to a per-year rate based on your loan term.
Penalties & late fees: Know exactly when they apply and whether interest compounds.
Refundability: Upfront fees are often nonrefundable—be wary.

If something goes wrong: where to complain

SEC (Enforcement and Investor Protection Department / relevant SEC department): For unregistered/illegal lending, no CA, unfair collection, or false licensing claims. Attach screenshots and proof.
National Privacy Commission (NPC): For privacy violations, excessive permissions, contact shaming, or data misuse.
NBI Cybercrime Division / PNP Anti-Cybercrime Group: For threats, extortion, doxxing, or identity fraud.
Your bank/e-money issuer/payment channel: To dispute unauthorized charges or request blocking.
Local government (business permits) & telco/app store reporting portals: Secondary pressure points for takedown and blocking.

Evidence to keep: app pages, license numbers, chat/email logs, call recordings, SMS, payment proofs, screenshots of app permissions, and the app-store listing (save/print to PDF).

Practical FAQs

Q: The app shows an SEC registration number but no CA. Is that fine? A: No. The CA is the authority to lend. Without it, public lending is illegal.

Q: The brand name and the corporate name don’t match. A: That can be OK if the app clearly states it is operated by the corporate entity that holds the SEC CA. There must be a traceable link (same address, contacts, disclosures).

Q: Are there legal caps on interest? A: The old Usury Law cap was effectively lifted decades ago. That said, lenders must still meet transparency and fairness standards; abusive or deceptive pricing can be sanctioned under consumer protection rules.

Q: The app wants my contacts to “assess risk.” A: That’s a red flag. Under the Data Privacy Act, data collection must be necessary and proportional. Mass contact scraping and shaming are not legitimate.

Q: Is a bank lending app different? A: Banks are BSP-supervised and don’t need an SEC CA. If the app is clearly a bank’s official app, you verify against BSP and the bank’s official channels instead.

Borrowing safely: a pre-loan routine

Screenshot the app’s corporate/SEC/CA details and save the app-store page.
Request a cost breakdown (cash out, total payback, due dates, fees).
Decline if asked to pay fees before you receive funds.
Use your own device and never share OTP or remote access.
Repay only to accounts in the company’s name; keep receipts.
Say no to intimidations—document them and report.

Final word

Legitimate lending apps in the Philippines are easy to spot when you know the basics: SEC corporation + SEC Certificate of Authority, clear disclosures, clean privacy practices, and professional collections. If even one pillar is missing, don’t proceed—there are safer options.

If you want, tell me the app’s corporate name and the license numbers you see and I’ll walk you through a quick plausibility check.