Comprehensive guide for consumers, in-house compliance teams, and MSMEs

1) Why “SEC-registered” matters

In the Philippines, lending companies are regulated by the Securities and Exchange Commission (SEC) under the Lending Company Regulation Act of 2007 (Republic Act No. 9474) and its Implementing Rules and Regulations (IRR). A lending company must:

Incorporate with the SEC (certificate of incorporation); and
Obtain a Certificate of Authority (CA) to Operate as a Lending Company from the SEC before starting business.

A business name registration, mayor’s permit, DTI certificate (for non-corporate businesses), or BIR registration is not enough. Lending companies must be corporations and must have an SEC CA. (Financing companies are covered separately by RA 8556, but the legitimacy checks below are largely similar.)

Running a lending operation without a CA is illegal, exposes operators to cease-and-desist orders, fines, criminal liability, and makes their contracts vulnerable to regulatory action.

2) The quick legitimacy checklist

Use this sequence when vetting a lender—brick-and-mortar, website, social-media page, or lending app:

Ask for the SEC documents.
- SEC Registration Number (from the Certificate of Incorporation).
- SEC Certificate of Authority (CA) Number (explicitly states “to operate as a Lending Company”).
- Check that the company name matches exactly (spelling, punctuation, “Inc.”/“Corp.”).
- Verify the issue date and status (still valid, not revoked/suspended).
Look for mandatory disclosures in-store, on the website, and inside the app:
- Company’s registered corporate name, principal office, and CA number prominently displayed.
- Email/landline customer-care channels, and complaint-handling procedure.
Confirm local permits.
- Latest Mayor’s/Business Permit and BIR registration (these don’t prove SEC authority but are good hygiene checks).
Review the contract and cost disclosures.
- Clear statement of total loan amount, finance charges, fees, repayment schedule, and effective interest rate.
- Compliance with the Truth in Lending Act (RA 3765)—no hidden charges.
- No blank or undated post-dated checks; no forced waivers of statutory rights.
Check data-privacy practices.
- Data Privacy Act (RA 10173): presence of a Privacy Notice, defined purpose for data use, and consent mechanics.
- The app should not demand phonebook scraping or excessive permissions unrelated to credit evaluation.
- Existence of a Data Protection Officer (DPO) and a working privacy-complaints channel.
Evaluate collection practices (before you borrow).
- Must follow SEC rules on unfair debt collection (e.g., no threats, profanity, doxxing, or “shaming”; no contacting people not party to the loan, except allowed references/guarantors).
- Collection agents should identify themselves and the creditor, state the exact amount due, and call only during reasonable hours.
Cross-check the product features against current caps and rules.
- SEC has imposed interest/fee caps for certain small, short-term, unsecured consumer loans from lending and financing companies. (Exact caps and coverage may be updated from time to time; verify the current circular that applies to your loan size and tenor.)
- Look out for front-loaded fees, daily penalties, or stacked “processing” charges that attempt to circumvent caps.
Sanity-check the business model.
- No deposit-taking (that’s a bank/BSP function).
- No guaranteed approvals without any KYC—responsible lenders comply with AMLA KYC rules (many lending/financing companies are “covered persons” if they meet asset thresholds).
- No pyramid/referral income as the primary “earnings” source.
Search for regulatory red flags.
- Repeated consumer complaints about harassment or bait-and-switch pricing.
- Company operating under multiple brand names that don’t trace back to a single corporate entity with a CA.
- App relaunches after takedowns, with the same operators.

Tip: Keep screenshots or copies of all disclosures and IDs you reviewed. They can be crucial evidence if you need to file a complaint.

3) Understanding the documents

A. Certificate of Incorporation

Shows the corporate name, SEC registration number, and date of registration.
Confirms the entity is a Philippine corporation—a prerequisite, but not sufficient authority to lend.

B. Certificate of Authority (CA) to Operate as a Lending Company

The key license.
States the company name and authority “to operate as a Lending Company” pursuant to RA 9474.
Check for signs of revocation/suspension (if any). CA must be valid and current.

C. Other supporting items

Articles of Incorporation/By-Laws: often show “primary purpose” as lending.
General Information Sheet (GIS): lists directors/officers—useful for background diligence.
Local permits and BIR registration: operational compliance.

4) Online Lending Platforms (OLPs) and mobile apps

If you’re dealing with a lending app or website:

The app publisher/operator must be a licensed lending or financing company with an SEC CA.
Many apps use a brand name different from the corporate name; the app/site must still disclose the legal entity and CA number.
Apps must adhere to SEC debt-collection rules, Truth in Lending, Data Privacy, and Financial Consumer Protection Act of 2022 (RA 11765) standards (fair treatment, transparency, complaint handling).
Beware of apps that:
- Force access to contacts/photos/files unrelated to credit scoring.
- Use mass-message “shaming” tactics.
- Advertise unrealistic rates (“0% interest, guaranteed”) but load fees elsewhere.

5) Pricing rules and what to watch for

Truth in Lending (RA 3765) requires disclosure of the finance charge and an effective interest rate so borrowers can compare offers.
The SEC has set caps for certain small, short-term, unsecured consumer loans by lending/financing companies (e.g., nominal monthly interest and penalty/fee caps were introduced by SEC circulars beginning 2022).
- Action for consumers: Ask the lender to state in writing the nominal rate, effective rate (APR), all fees/penalties, and the circular they rely on. If the figures look inflated or unclear, treat as a red flag.
Usury law ceilings remain effectively suspended, but abusive or unconscionable pricing can still draw regulatory enforcement under consumer-protection standards.

6) Collection conduct—what’s legal, what isn’t

Generally prohibited for lending/financing companies and their collectors:

Harassment, threats, violence, or obscenities.
Public shaming, doxxing, or posting your personal data on social media.
Contacting your employer, relatives, or contacts who are not parties to the loan (beyond lawful references/guarantors and for legitimate tracing consistent with privacy law).
Repeated calls at odd hours or misrepresenting the amount owed, legal status, or consequences.

Required good practices:

Identify the creditor and collector; state the exact amount due, due date, and how to pay.
Keep communications professional and during reasonable hours.
Honor cease-and-desist requests sent through proper channels for harassment or privacy violations.

If violated, you can complain to SEC (for lending/financing company conduct) and NPC (for privacy abuses), and, where applicable, law enforcement.

7) Due-diligence playbook (for consumers & MSMEs)

Gather identifiers: full corporate name, business style/brand, office address, phone, email, website/app store link.
Request copies: Certificate of Incorporation, CA to Operate, latest Mayor’s Permit, BIR Cert., Privacy Notice, Sample Loan Agreement.
Match names: company name on CA must match the name on the contract and receipts.
Read the contract: map all fees; compute total cost of credit and APR; compare offers.
Test support: call the hotline/email to see if they respond professionally.
Check complaints footprint: look for patterns (harassment, hidden fees, “ghost” offices).
Walk away if any of these are present: no CA; mismatched names; extreme permissions in the app; refusal to provide cost breakdown; or insistence on blank documents.

8) Special notes for employers and HR

If a staff member lists your company phone/email as a contact or if collectors call your office:

You are not obliged to disclose employee information to private collectors.
Direct them to the employee’s personal channels; log the call.
If harassment occurs (mass emails, calls to reception, social-media tagging of your company), help the employee document and consider reporting to regulators.

9) Common misconceptions

“They have a DTI certificate, so they’re legit.” Not for lending. Lending companies must be SEC-incorporated corporations with a CA.
“They said the SEC registration is ‘in process.’” They cannot lend until the CA is issued. “In process” is not authority.
“High interest is automatically illegal.” Usury ceilings are suspended, but SEC caps apply to certain small, short-term loans, and unfair or deceptive practices are sanctionable.
“Collections can call anyone to pressure payment.” No—SEC and privacy rules prohibit harassment and contacting unrelated third parties beyond what the law allows.

10) If you need to file a complaint

Prepare the following:

Your ID, loan agreement, payment receipts, screenshots/recordings of messages or calls, and copies of the lender’s SEC documents (or the refusal to provide them).
A timeline of events (application, disbursement, due dates, communications).
Specify what you want: account correction, stop harassment, refund of unlawful charges, or closure with clearance.

Depending on the issue, complaints may involve: SEC (licensing and lending conduct), National Privacy Commission (NPC) (privacy abuses), DTI (for unfair trade practices by non-lenders), BSP (if a bank is involved), AMLC (for suspicious activities), or law enforcement for threats/coercion.

11) For startups and operators (compliance capsule)

Choose the right vehicle: incorporate as a lending or financing company (not a sole proprietorship/partnership for lending under RA 9474).
Capitalization: meet the statutory minimum paid-in capital (historically at least ₱1,000,000 for lending companies under RA 9474; check latest SEC rules for updates and regional office requirements).
Licensing: obtain the SEC CA before operations; register DBAs/brands; file GIS and audited FS timely.
Consumer protection: align with RA 11765, RA 3765, SEC circulars on interest caps and debt collection, and NPC requirements (appoint a DPO, maintain a privacy management program).
KYC/AMLA: if within scope (e.g., asset thresholds), enroll as a covered person, implement KYC, CDD, STR/CTR filings.
Third parties: paper your relationships with collection agencies, credit scoring vendors, and payment channels; monitor their compliance.
App governance: permission minimization, in-app disclosures, and audit trails for consent.

12) Practical tools

Document-check template (what to record):
- Corporate name (exact):
- Brand/business style (if any):
- SEC Registration No.:
- SEC CA No.:
- CA Issue Date / Status:
- Registered address / website:
- Contact channels tested (date/time/outcome):
- Key pricing (rate, fees, APR, penalty):
- Privacy/DPO details:
- Notes on collection policies:
Effective cost calculator (manual method):
- Start from net cash you actually receive (after all deductions).
- Compute total payable (principal + interest + fees).
- Convert to APR by comparing total finance charge against net proceeds over tenor. If APR is opaque or extreme, pause.

13) Bottom line

A legit Philippine lending company will prove it with a valid SEC Certificate of Authority, robust disclosures, lawful pricing, privacy-respecting data practices, and professional collections. If any piece is missing—especially the CA—treat it as a hard stop.

One-page rule of thumb: No CA, no loan.