Quick answer

A lending company is not legally authorized to operate merely because it has a website, app, business permit, DTI registration, SEC Certificate of Incorporation, or convincing social-media page. Under the Lending Company Regulation Act of 2007, a lending company must generally be:

organized as a stock corporation;
registered with the Securities and Exchange Commission (SEC); and
covered by a valid SEC Certificate of Authority to Operate as a Lending Company.

Check the lender’s exact corporate name, SEC registration number, and Certificate of Authority number through the SEC’s official Check with SEC service. For an app or website, also confirm that the platform is connected to that same authorized company. Then check SEC advisories and lists of suspended or revoked companies.

Registration is an important first test, but it is not a government guarantee that every loan offer, collector, account number, advertisement, or contract using the company’s name is genuine or lawful.

The two SEC records that matter

A legitimate lending company should be able to show both its primary registration and its authority to conduct lending operations.

1. SEC registration

The Certificate of Incorporation establishes the corporation’s legal existence. It normally identifies the corporate name and SEC registration number.

This alone is not enough. An ordinary corporation cannot lawfully operate as a lending company simply because it is SEC-registered.

2. Certificate of Authority

The Certificate of Authority is the SEC’s authorization for the corporation to engage in the lending business. The SEC explains this distinction in its official lending-company guidance and frequently asked questions.

Treat claims such as “SEC registered,” “DTI registered,” “with mayor’s permit,” or “BIR registered” as incomplete unless the lender can also identify its current Certificate of Authority.

How to verify a lender step by step

Step 1: Obtain the lender’s full legal identity

Before submitting an application, sending identification, or paying anything, ask for:

the complete corporate name;
SEC registration number;
Certificate of Authority number;
registered business address;
official telephone number and email address;
name of the app, website, or social-media page;
name of any loan agent, broker, or collection agency involved; and
written loan terms and disclosure statement.

Do not search only the brand or app name. An app called “Pinoy Fast Cash,” for example, may claim to be operated by a corporation with a completely different legal name. You must verify the corporation behind the brand.

SEC rules require lending and financing companies to display their corporate name, SEC registration number, and Certificate of Authority number conspicuously in advertisements and online lending platforms. They must also advise prospective borrowers to study the disclosure statement before proceeding. See SEC Memorandum Circular No. 19, Series of 2019.

Missing information is a serious warning sign. Information that is displayed but cannot be independently matched is equally concerning.

Step 2: Search the exact corporate name through Check with SEC

Use the SEC’s official Check with SEC service. Enter the exact corporate name, trying the name without punctuation or abbreviations if necessary.

Confirm that the search result matches the lender’s representations, particularly:

corporate name;
SEC registration number;
company type;
authority or secondary licence to conduct lending or financing activities; and
any status information displayed by the system.

A close or similar name is not a match. Scammers sometimes impersonate a registered company, change one word in its name, or copy its SEC and Certificate of Authority numbers.

If the service is unavailable or the result is unclear, do not treat the lender as verified. Use the SEC’s iMessage portal to request confirmation directly from the Commission.

Step 3: Match the Certificate of Authority number

Compare the number shown in the SEC record with the number appearing on the lender’s:

website or app listing;
advertisement;
loan agreement;
disclosure statement;
official receipt;
email domain; and
Certificate of Authority presented to you.

A screenshot or photocopy supplied by the lender is not independent proof. Names, dates, numbers, and digital images can be altered.

If the company refuses to provide its Certificate of Authority number, gives inconsistent numbers, or says the certificate is “still processing,” do not proceed. A company that has merely applied for authority is not yet authorized to operate as a lending company.

Step 4: Verify the app, website, or online brand

For an online loan, establish the chain between the public-facing platform and the authorized corporation.

Check whether:

the app or website identifies its operator by full corporate name;
that operator matches the SEC record;
the SEC registration and Certificate of Authority numbers match;
the privacy notice names the same corporation;
the loan contract names that corporation as creditor;
payments are made only through accounts officially identified by that corporation; and
the platform has been properly reported to the SEC as the company’s online lending platform.

A valid company can be impersonated. Finding the company’s name in an SEC record does not prove that a Facebook page, mobile app, text-message sender, agent, or bank account actually belongs to it.

Contact the company through independently verified details—not the number supplied by the person soliciting the loan—and ask it to confirm the app, agent, payment account, and offer.

Step 5: Check for suspension, revocation, and SEC enforcement action

A company may have been registered in the past but later suspended, revoked, or ordered to stop particular operations.

Review the SEC’s official:

list of revoked and suspended lending companies;
advisories and notices; and
current information available through SEC iMessage.

Some published lists are historical or updated only as of the date stated on the page. Absence from an old revocation list is not positive proof of current authority. When records conflict or appear outdated, obtain written confirmation from the SEC before proceeding.

Do not confuse different regulators

The correct verification method depends on the type of lender:

Lending and financing companies: generally regulated by the SEC.
Banks and many other BSP-supervised financial institutions: verify through the Bangko Sentral ng Pilipinas.
Credit cooperatives: verify through the Cooperative Development Authority, although cooperative banks are BSP-supervised.
Government lending programs: confirm through the official website and contact details of the relevant government agency.

A person making an isolated private loan is not necessarily operating a “lending company.” Whether repeated private lending amounts to an unauthorized lending business depends on the actual facts. Do not assume that every private creditor should appear under the name of an SEC-licensed lending company.

Red flags even when a registration number is shown

Stop and verify further if the lender:

asks for an advance “release,” “processing,” “insurance,” “tax,” “verification,” or “unlocking” fee before disbursing the loan;
requires payment to a personal bank or e-wallet account that the company will not independently confirm;
guarantees approval regardless of identity, income, or repayment capacity;
communicates only through a personal account or disappearing messages;
pressures you to act immediately;
refuses to provide a written contract or disclosure statement;
asks for your ATM card, PIN, online-banking password, one-time password, or remote access to your device;
uses an SEC number belonging to another company;
gives a corporate name that differs across the app, privacy notice, contract, and payment instructions;
requests unnecessary access to contacts, photographs, messages, social-media accounts, or device storage;
threatens arrest merely for nonpayment of an ordinary debt;
threatens violence, public shaming, or disclosure of the debt to unrelated contacts; or
tells you not to contact the SEC or the corporation’s head office.

The SEC specifically advises borrowers not to surrender their ATM cards as collateral or for another purpose.

Review the loan—not just the lender

SEC authorization does not make every proposed term lawful, fair, accurate, or affordable.

Before accepting, insist on a completed written disclosure statement. Under the Truth in Lending Act, the creditor must provide the required written credit-cost disclosures before the transaction is consummated. Depending on the transaction, these include the amount financed, itemized charges, finance charge in pesos, and the percentage that the finance charge bears to the amount financed as a simple annual rate on the outstanding unpaid balance.

Compare:

amount you will actually receive;
principal stated in the contract;
interest rate and how it is calculated;
service, processing, membership, insurance, and other fees;
repayment dates and installment amounts;
late-payment and collection charges;
total amount payable;
security or collateral;
automatic-debit authority;
consequences of default; and
rules on the collection and sharing of personal data.

Do not rely on a daily or monthly rate alone. Fees deducted before disbursement can make the real cost much higher than the advertised rate.

The Financial Products and Services Consumer Protection Act protects financial consumers’ rights to fair treatment, disclosure and transparency, protection of assets against fraud and misuse, data privacy, and timely complaint handling. The precise remedy in a dispute still depends on the contract, evidence, applicable rules, and regulator with jurisdiction.

Protect your personal information

An online lender should not indiscriminately harvest your phone or social-media contacts or use personal information for harassment and public shaming.

Under the National Privacy Commission’s rules for loan-related transactions, an online lending application must provide a separate way for a borrower to select character references or guarantors. Access to a contact list must be limited to the minimum necessary for that selection; the lender cannot use the entire list for debt collection. See NPC Circular No. 2022-02, which amended the earlier loan-processing rules.

Before installing an app:

read its privacy notice;
inspect every requested permission;
deny access that is unnecessary for the stated service;
do not upload more identification than reasonably required;
verify where and how complaints or data-rights requests may be submitted; and
take screenshots of the app page, developer name, permissions, privacy notice, and representations made before applying.

Removing an app later does not necessarily erase information already collected.

Evidence to preserve

If anything appears irregular, save evidence before pages, messages, or app listings disappear:

screenshots and screen recordings showing the app or website;
URL, app-store link, app developer, version, and download date;
advertisement and social-media profile;
full corporate name and all claimed registration numbers;
Certificate of Authority image supplied by the lender;
loan application, contract, promissory note, and disclosure statement;
amortization schedule and statement of account;
proof of disbursement;
receipts and payment records;
bank or e-wallet account names and numbers;
email, text, chat, and call records;
names and numbers used by agents or collectors;
privacy notice and app permissions;
threats, contact-list messages, or public posts; and
your SEC verification result and the date checked.

Keep original electronic files where possible. Do not edit screenshots in a way that removes timestamps, sender details, URLs, or other context.

What to do if the lender cannot be verified

Do not send money, IDs, selfies, signatures, OTPs, or banking credentials. Do not continue installing or granting permissions to its app.

Report the matter through the SEC’s iMessage portal, identifying the corporate name, app or brand, claimed registration numbers, contact details, and the reason verification failed. Attach clear supporting evidence.

For a formal complaint against a lending or financing company, follow the SEC’s current complaint instructions. The SEC’s published instructions require:

a fully and accurately completed complaint form;
one complaint form for each respondent company;
supporting evidence; and
a valid government-issued ID.

Use the filing channel and contact details currently shown on that official page, because office arrangements and electronic channels can change.

For unauthorized access to contacts, unlawful disclosure, or other personal-data misuse, consult the National Privacy Commission’s complaint process. If the lender is a bank or other BSP-supervised institution, use the BSP’s official consumer-assistance channels instead of assuming that the SEC is the proper regulator.

When help is urgent

Act immediately if you have:

disclosed an OTP, PIN, password, card security code, or online-banking credentials;
surrendered an ATM or credit card;
installed remote-access software;
paid an advance fee to a suspected impostor;
noticed unauthorized transactions;
received threats of violence or another immediate threat to safety;
discovered that intimate, confidential, or identifying information has been posted or distributed; or
received court papers, a subpoena, foreclosure notice, demand involving collateral, or another document with a response deadline.

Contact your bank or e-wallet provider through its official channel to secure the account and dispute unauthorized transactions. Change compromised credentials from a trusted device. Preserve evidence before blocking accounts or removing applications. For threats, extortion, identity theft, or fraud, consider reporting promptly to the appropriate law-enforcement authority.

Seek advice from a Philippine lawyer if money or property is at substantial risk, the contract or identity of the creditor is disputed, litigation has begun, or you need a ruling on the enforceability of loan terms. The SEC itself notes that it cannot cancel a debt, rewrite payment terms, or judicially declare a contract or interest stipulation void.

Common mistakes

Treating a Certificate of Incorporation as a lending licence

A corporation needs the separate Certificate of Authority to conduct lending operations.

Searching only the app or brand name

Verify the legal corporation behind the platform and match every identifying number.

Assuming an SEC number proves that the person contacting you is genuine

Impostors can copy public corporate information. Independently contact the verified company.

Checking only whether the company once existed

Authority can be suspended or revoked. Confirm current status and review enforcement notices.

Paying first to “activate” or “release” the loan

Advance-payment demands are a major fraud warning, particularly when payment goes to a personal account.

Signing before receiving the disclosure statement

Read the completed contract and credit-cost disclosure before accepting or authorizing disbursement.

Deleting messages after harassment begins

Preserve complete, unedited evidence first.

Assuming registration makes abusive collection acceptable

Authorized lenders and their agents remain subject to consumer-protection, privacy, and fair-collection rules, including SEC Memorandum Circular No. 18, Series of 2019.

Frequently asked questions

Is DTI registration enough?

No. A DTI business-name registration does not establish that a lender is an SEC-authorized lending company. Under the general rule for lending companies, look for an SEC-registered stock corporation with a valid Certificate of Authority.

Is an SEC Certificate of Incorporation enough?

No. It confirms corporate registration, not authority to engage in the lending business.

What if the company is SEC-registered but its app is not listed or cannot be matched?

Do not proceed until the SEC or the company, through independently verified contact details, confirms that the company owns or operates that exact platform.

Does SEC registration prove that a loan offer is genuine?

No. A scammer may impersonate a real corporation. Verify the agent, domain, app, contract, and payment account directly with the registered company.

Does absence from a revoked-company list mean the lender is legitimate?

Not by itself. Lists may be historical or updated only through the date shown. Positive confirmation of current registration and authority is still necessary.

Can a legitimate lender ask for my ATM card or PIN?

You should not surrender your ATM card, PIN, OTP, password, or other authentication credentials. The SEC expressly advises ATM-card owners not to relinquish possession of their cards to lenders.

Can a lender contact everyone in my phone?

It should not indiscriminately access or use your entire contact list for debt collection. NPC rules restrict contact-list processing and require borrowers to be able to choose their own character references or guarantors.

Does reporting an unregistered lender cancel the loan?

Not automatically. Regulatory action against a lender and the enforceability or amount of a particular obligation are different legal questions. The answer may depend on the documents, facts, and a court’s determination.

What is the safest rule before borrowing?

Verify the corporation and its Certificate of Authority through an official SEC source, confirm that the exact app or agent belongs to it, and read the completed contract and disclosure statement before sharing sensitive information or accepting funds.

This article provides general Philippine legal information, not legal advice. Application of the law depends on the lender’s regulatory category, current SEC status, contract, communications, and other facts. Official sources and procedures were checked as of September 3, 2026.