A lender may look legitimate because it has a Facebook page, a mayor’s permit, a professional-looking app, or even a “SEC registered” claim. In the Philippines, however, the safer question is more specific: does this exact company have a valid SEC authority to operate as a lending or financing company, and is this exact online lending app or platform recorded with the SEC? This guide explains how to check that, what documents to look for, which government offices are involved, and what warning signs usually mean a lender may be illegal, suspended, revoked, or unsafe to deal with.
What Makes a Lending Company Legit in the Philippines?
A lending company is not just any person or business that lends money. Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, a lending company is a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons. The law also says a lending company must be established as a corporation and must not conduct business unless it has authority to operate from the Securities and Exchange Commission, or SEC. (Supreme Court E-Library)
That means a legitimate lending company usually needs two separate things:
- SEC corporate registration — proof that the company exists as a corporation.
- SEC Certificate of Authority, or CA — proof that the company is allowed to operate as a lending company.
The second requirement is the one many borrowers miss. A corporation can be registered with the SEC for many purposes. That alone does not automatically mean it may legally lend money to the public.
Financing companies are closely related but governed by a different law: Republic Act No. 8556, or the Financing Company Act of 1998. Financing companies are corporations primarily organized to extend credit facilities through direct lending, factoring, discounting receivables, buying and selling contracts, chattel mortgages, financial leasing, and similar credit transactions. They are also regulated by the SEC, subject to special rules and authority requirements. (Supreme Court E-Library)
Quick Checklist: How to Know If a Lending Company Is Legit
| What to Check | What You Should See | Why It Matters |
|---|---|---|
| Exact company name | Full corporate name, not just app name or Facebook name | The license belongs to the corporation, not necessarily the brand name |
| SEC Registration Number | A valid corporate registration number | Shows the corporation exists |
| Certificate of Authority number | CA number to operate as a lending or financing company | Shows authority to lend legally |
| SEC list status | Company appears in the official SEC list of lending/financing companies | Confirms current regulatory recognition |
| Online lending platform status | App, website, or platform is recorded or listed by SEC | Online lending uses separate platform names |
| Disclosure statement | Written loan terms, total amount financed, finance charges, net proceeds, EIR | Required for transparency under lending laws |
| Collection practices | No threats, public shaming, contact-list harassment, or abusive messages | Abusive collection is prohibited |
A company that cannot provide its full SEC-registered corporate name and CA number should be treated with caution.
Legal Basis for Checking a Lending Company
RA 9474: Lending companies need SEC authority
RA 9474 gives the SEC authority to supervise lending companies, require reports, exercise visitorial powers, and impose sanctions such as suspension, revocation of authority, and fines. It also penalizes persons who engage in lending-company business without valid SEC authority or who hold themselves out as lending companies without authority. (Supreme Court E-Library)
In practical terms, this means:
- A lending company must be a corporation.
- It must have an SEC authority to operate.
- It may not simply use the words “lending company,” “lending investor,” or similar terms without authority.
- SEC can suspend or revoke authority for violations.
RA 8556: Financing companies also need proper authority
Financing companies are not exempt from regulation just because they call their product “installment,” “cash loan,” “salary loan,” “gadget financing,” “buy now pay later,” or “business financing.” Under RA 8556, a financing company is a regulated corporation engaged in extending credit facilities, and the SEC is empowered to enforce the law and issue implementing rules. (Supreme Court E-Library)
RA 3765: Borrowers have a right to know the true cost of credit
The Truth in Lending Act, or Republic Act No. 3765, requires creditors to disclose the true cost of credit before the loan is completed. The written disclosure must include key figures such as the total amount financed, finance charges in pesos, and the rate that shows the cost of borrowing. (Supreme Court E-Library)
BSP Circular No. 730 further explains that, for consumer and small business loans, the disclosure should show the total amount financed, finance charges, net proceeds, and effective annual interest rate or EIR where applicable. It also states that borrowers have the right to demand a copy of the disclosure statement. (Supreme Court E-Library)
For ordinary borrowers, this is important because some lenders advertise a “low interest rate” but deduct large processing fees, service charges, membership fees, insurance, platform fees, or penalties. The meaningful question is not only “What is the interest?” but “How much cash will I actually receive, and how much will I actually pay back?”
RA 11765: Financial consumers have rights
The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, strengthens borrower protection. It requires financial service providers to handle complaints, respect client data privacy, avoid abusive collection or debt recovery practices, and provide clear information on actions taken on consumer concerns. If a consumer is unsatisfied with the provider’s handling of the complaint, the concern may be elevated to the proper financial regulator. (Supreme Court E-Library)
Data Privacy Act: Lending apps cannot misuse your contacts
The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information and gives the National Privacy Commission, or NPC, authority to receive complaints, investigate, issue orders, and impose data-processing bans in proper cases. (National Privacy Commission)
The NPC has specifically stated that online lenders are prohibited from harvesting phone and social media contact lists for harassment or debt-shaming. (National Privacy Commission)
Step-by-Step Guide: How to Check If a Lending Company Is Legit
1. Get the exact legal name of the lender
Before checking any database, first identify the exact entity. Do not rely only on:
- App name
- Facebook page name
- Viber or Telegram display name
- Brand name
- Collector’s name
- Payment wallet name
- “Partner company” name
Ask for the following:
- Full corporate name
- SEC Registration Number
- Certificate of Authority number
- Registered office address
- Official email address
- Name of the online lending platform, app, or website
- Copy of the loan contract and disclosure statement
A common trick is using a friendly brand name while the actual lender is a different corporation. Another is using a legitimate company’s name without authority. The name must match across the loan contract, disclosure statement, app, website, receipts, and SEC records.
2. Check the SEC list of registered lending and financing companies
Go to the official SEC website and look for the page for lending companies and financing companies. The SEC maintains public information on lending and financing companies, including lists relevant to Certificates of Authority and online lending platforms.
When checking, compare carefully:
- Spelling of the corporate name
- SEC registration number
- CA number
- Status of the authority
- Whether the company is listed as lending or financing
- Whether the online platform or app name appears separately
Do not stop at a screenshot sent by the lender. Screenshots can be outdated, cropped, or edited. Use the SEC’s own website or request confirmation through SEC channels.
3. For loan apps, check both the company and the online platform
For online lending apps, there are usually two names:
- The corporate lender that holds the SEC authority.
- The online lending platform, such as the app, website, or digital brand used to offer loans.
Both matter.
A company may be SEC-registered, but the particular app or platform may be unrecorded, newly created, using a different name, or connected to a revoked or suspended entity. SEC issuances on online lending have required disclosures in advertisements and reporting of online lending platforms, including the corporate name, SEC registration number, and CA number in a conspicuous portion of advertisements and online lending platforms. (bdblaw.com.ph)
If the app name does not match the SEC list, check whether it is a registered business name or recorded online lending platform of the authorized company. A mismatch is not automatically illegal, but it is a serious reason to verify before giving personal data or accepting a loan.
4. Confirm the Certificate of Authority, not just SEC registration
Many borrowers ask, “SEC registered po ba?” The better question is:
“Do you have a valid SEC Certificate of Authority to operate as a lending company or financing company?”
A plain Certificate of Incorporation only proves corporate existence. A Certificate of Authority proves regulatory permission to operate in that business.
Be careful with these incomplete claims:
| Claim | What It May Mean | Is It Enough? |
|---|---|---|
| “SEC registered” | The corporation exists | Not enough |
| “DTI registered” | A business name may be registered | Not enough for lending-company operations |
| “With mayor’s permit” | Local business permit exists | Not enough |
| “BIR registered” | Registered as taxpayer | Not enough |
| “Available on Google Play” | App is listed in an app store | Not enough |
| “CIC registered” | May relate to credit information reporting | Not enough |
| “Partnered with payment centers” | Payment channels exist | Not enough |
For lending or financing, the key document is the SEC Certificate of Authority and the current status of that authority.
5. Use SEC iMessage or SEC Express for deeper verification
If the amount is substantial, the lender’s records are unclear, or you are checking a company for business purposes, use official SEC channels.
The SEC iMessage system includes services under the Financing and Lending Companies Department, including Request for Certification of Status on Certificate of Authority and Complaints on Financing and Lending Companies. (Securities and Exchange Commission)
You may also request corporate documents through the SEC Express System, such as Articles of Incorporation, General Information Sheet, audited financial statements, board resolutions, and other company-related documents. SEC Express states that documents can be requested online and are generally delivered within 3 to 5 working days in Metro Manila and up to 7 working days for provincial deliveries after release by the SEC for delivery. (SEC Express)
Useful documents to request or review include:
- Articles of Incorporation
- Latest General Information Sheet
- Certificate of Incorporation
- Certificate of Authority, if available through appropriate SEC channels
- Amendments to corporate name or purpose
- Board resolutions or documents showing authorized business names
6. Read the disclosure statement before accepting the loan
A legitimate lender should be able to give you a clear written disclosure before the loan is finalized.
Check for:
- Principal amount
- Amount actually released to you
- Processing fees
- Service fees
- Interest rate
- Effective interest rate or EIR
- Payment schedule
- Penalties for late payment
- Total amount payable
- Collection charges
- Privacy notice
- Complaint-handling contact details
If the lender refuses to show the disclosure statement until after you click “accept,” that is a serious warning sign.
7. Check the lender’s behavior before giving permissions or documents
A legitimate lender still needs to act legally. Be cautious if the app or agent asks for:
- Access to your entire contacts list
- Access to photos, videos, SMS, call logs, or social media accounts
- Your online banking password
- Your e-wallet PIN or OTP
- A “processing fee” before release of loan proceeds
- Blank checks or signed blank documents
- Your employer’s contact details without a clear and lawful purpose
- Contact details of relatives who are not guarantors or co-makers
The NPC has warned against online lenders harvesting contacts for harassment, and SEC rules prohibit several abusive debt collection practices. (National Privacy Commission)
Red Flags That a Lending Company May Not Be Legit
| Red Flag | Why It Is Risky |
|---|---|
| No full corporate name | You cannot verify the real lender |
| Only a Facebook page or Telegram account | Scammers often avoid formal channels |
| “SEC registered” but no CA number | Corporate registration alone is not authority to lend |
| App name not found in SEC online lending lists | The platform may be unrecorded or unauthorized |
| Requires advance fee before loan release | Common scam pattern |
| Refuses to provide disclosure statement | Violates transparency expectations |
| Uses threats or public shaming | May violate SEC, privacy, civil, or criminal laws |
| Asks for OTP, PIN, or banking password | Strong sign of fraud |
| Sends loan proceeds you did not clearly accept | Common predatory lending tactic |
| Uses many different names for collection | Makes accountability difficult |
What If the Lender Is a Bank, Pawnshop, Cooperative, or Private Person?
Not every credit provider is checked through the SEC lending-company list.
| Type of Lender | Main Regulator or Check |
|---|---|
| Bank, digital bank, rural bank, thrift bank | Bangko Sentral ng Pilipinas directory of banks and non-bank financial institutions |
| Lending company | SEC |
| Financing company | SEC |
| Pawnshop | BSP, for pawnshop operations |
| Cooperative offering credit to members | Cooperative Development Authority |
| Insurance-linked loan or insurer | Insurance Commission |
| Employer salary loan | Employer policy, contract, and labor rules may matter |
| Private person lending occasionally | Civil Code rules on obligations, contracts, interest, and evidence apply |
The BSP maintains a directory of banks and non-bank financial institutions, useful when checking whether a bank or BSP-supervised financial institution is legitimate. (Bangko Sentral ng Pilipinas)
What To Do If You Already Borrowed From a Suspicious Lender
1. Save all evidence immediately
Keep copies of:
- Loan agreement
- Disclosure statement
- Screenshots of app pages
- Screenshots of ads
- Chat messages
- Collection texts
- Call logs
- Proof of loan proceeds received
- Proof of payments
- Receipts
- Names and numbers of collectors
- App permissions requested
- App privacy policy
- Any threats sent to you or your contacts
Do this before uninstalling the app. If you uninstall too early, you may lose evidence.
2. Ask for a written statement of account
Request a written breakdown showing:
- Principal
- Interest
- Fees
- Penalties
- Payments already made
- Remaining balance
- Basis for each charge
This helps you separate a real debt from inflated or unexplained charges.
3. File a complaint with the lender’s consumer assistance channel
Under RA 11765, financial service providers must have a consumer assistance mechanism for complaints, inquiries, and requests. They must provide clear information on actions taken or to be taken. (Supreme Court E-Library)
Your complaint should be simple and factual:
- Identify the loan account.
- State the problem.
- Attach evidence.
- Ask for a written explanation, correction, refund, deletion of unauthorized data, or cessation of abusive collection, depending on the issue.
4. Escalate to the SEC for lending or financing company issues
Use SEC channels if the issue involves:
- No Certificate of Authority
- Unrecorded online lending platform
- Misleading ads
- Hidden charges
- Failure to provide disclosure statement
- Abusive collection
- Suspended or revoked entity still operating
- Use of another company’s name
- Unauthorized lending or financing operations
The SEC iMessage system includes complaints on financing and lending companies under the Financing and Lending Companies Department. (Securities and Exchange Commission)
5. Go to the NPC for data privacy violations
File with the National Privacy Commission when the issue involves:
- Contact-list harvesting
- Messages to your family, friends, employer, or clients who are not guarantors
- Public shaming
- Posting your photo or ID
- Threatening to expose your debt
- Unauthorized use of personal data
- Refusal to delete unlawfully collected data
- Misuse of your ID or selfie
The Data Privacy Act recognizes rights over personal information, including correction, blocking, removal, or destruction of data in proper cases, and the NPC has authority to investigate complaints. (National Privacy Commission)
6. Consider criminal remedies for threats, extortion, identity misuse, or online shaming
Some collection behavior is not merely “rude.” Depending on the facts, it may involve criminal laws such as:
- Grave threats under the Revised Penal Code
- Unjust vexation under Article 287 of the Revised Penal Code
- Libel or cyberlibel when defamatory statements are posted or sent online
- Identity theft or unauthorized access under cybercrime laws
- Data privacy offenses under RA 10173
The strongest complaints are evidence-based: screenshots, URLs, phone numbers, dates, names, recordings where lawful, and witnesses.
Common Real-Life Scenarios
“The lender has a mayor’s permit. Is that enough?”
No. A mayor’s permit means the local government allowed the business to operate at a location for local business-permit purposes. It does not replace the SEC authority required for lending or financing operations.
“The company is SEC registered, but I cannot find a Certificate of Authority.”
Treat that as incomplete verification. A corporation may be validly registered but not authorized to lend to the public. Ask for the CA number and verify it with SEC records.
“The app is on Google Play. Does that mean it is legal?”
No. App-store availability is not a Philippine lending license. An app can be published, removed, renamed, or reuploaded. The legal check is still with the SEC for lending or financing authority and online platform recording.
“The lender is legit, but the collector is harassing me.”
A valid license does not allow harassment. SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies and their third-party service providers. The prohibited acts include threats, obscene or insulting language, false representation, disclosure or publication of borrower information, communicating false loan information to others, contacting borrowers at unreasonable hours, and contacting people in the borrower’s contact list other than named guarantors or co-makers.
The same circular states that the ultimate responsibility for collection practices remains with the financing or lending company even when collection is outsourced.
“I am an OFW or foreigner outside the Philippines. Can I still verify?”
Yes. Most preliminary checks can be done online through SEC, BSP, NPC, and company websites. If you need to submit a sworn statement or foreign document for Philippine proceedings, notarization and authentication may matter. The DFA Apostille system is used for authentication of documents, and DFA appointment pages state that apostille applications are handled through online appointment systems for offices with authentication services. (DFA Appointment System)
For documents executed abroad, check whether the country is an Apostille Convention country. If not, consular authentication may still be required.
Documents to Prepare When Reporting a Suspicious Lender
| Purpose | Useful Documents |
|---|---|
| SEC verification | Corporate name, SEC number, CA number, app name, website, screenshots |
| SEC complaint | Loan contract, disclosure statement, ads, collection messages, proof of payments |
| NPC complaint | Screenshots of contact-list access, messages to third parties, privacy policy, app permissions |
| Police or cybercrime complaint | Threats, defamatory posts, fake profiles, extortion messages, phone numbers, URLs |
| Court or legal demand | Contract, statement of account, receipts, written dispute history |
| OFW or foreign complainant | Passport/ID, proof of location, apostilled or authenticated affidavit if required |
Frequently Asked Questions
How do I check if a lending company is SEC registered in the Philippines?
Check the official SEC list of lending and financing companies, then match the exact corporate name, SEC registration number, and Certificate of Authority number. Do not rely only on “SEC registered” claims in ads or screenshots.
Is SEC registration enough for a lending company?
No. SEC registration only proves the corporation exists. A lending company must also have SEC authority to operate as a lending company. Under RA 9474, no lending company may conduct business without SEC authority. (Supreme Court E-Library)
How do I know if an online lending app is legit?
Check both the company and the app. The corporate lender should have SEC authority, and the online lending platform or app should be properly recorded or listed with the SEC. The app should also disclose the corporate name, SEC registration number, and CA number.
Can a lending company be legal but still violate my rights?
Yes. A company may have SEC authority but still violate rules through hidden charges, poor disclosure, abusive collection, or misuse of personal data. You can report regulatory violations even if the company itself is registered.
Are online lenders allowed to contact my relatives or employer?
They may communicate with guarantors or co-makers when legally relevant, but broad contact-list harassment is not allowed. SEC rules treat contacting people in the borrower’s contact list, other than named guarantors or co-makers, as an unfair collection practice, and the NPC has warned against harvesting contacts for harassment.
Can I ignore a loan if the lending company is illegal?
Not automatically. The lender’s lack of authority may expose it to regulatory or criminal consequences, but whether you still owe money depends on the facts, the contract, payments made, interest charged, and applicable law. Keep records, dispute unlawful charges in writing, and use SEC or court processes where needed.
What if the lender sends money even though I did not clearly accept the loan?
Document everything immediately. Take screenshots showing lack of acceptance, the amount received, and any messages. Do not agree to new terms under pressure. Report the incident if the app used deceptive acceptance screens, automatic disbursement, or hidden charges.
Can a lending company charge any interest rate it wants?
Loan charges must comply with applicable laws and regulations, including truth-in-lending disclosure rules and SEC regulations. Even when parties agree on interest, courts and regulators may scrutinize excessive, hidden, unconscionable, or improperly disclosed charges.
Where do I complain about lending app harassment?
For lending or financing violations, use SEC complaint channels. For misuse of personal data, contact the NPC. For threats, extortion, identity misuse, or online defamation, preserve evidence for law-enforcement or cybercrime reporting.
What is the safest sign that a lending company is legit?
The safest sign is a consistent match among the lender’s full corporate name, SEC registration, valid Certificate of Authority, SEC list status, online platform record, loan contract, disclosure statement, and official contact details.
Key Takeaways
- SEC registration alone is not enough. A lending company must also have SEC authority to operate.
- Check the exact corporate name and CA number, not just the app name or Facebook page.
- For online lending apps, verify both the company and the platform.
- A disclosure statement is important because it shows the true cost of the loan.
- DTI registration, mayor’s permit, BIR registration, or Google Play listing do not replace SEC lending authority.
- Abusive collection is prohibited, including threats, shaming, false statements, unreasonable-hour contact, and contacting unrelated people in your phonebook.
- Data privacy violations should be documented carefully and may be reported to the NPC.
- Use official SEC, BSP, NPC, and DFA channels when verification, complaints, or authenticated documents are needed.