A lending company can look professional, have a mobile app, display an “SEC registration number,” and still lack legal authority to offer loans in the Philippines. The safest approach is to verify three separate things: the company’s exact legal identity, its current Certificate of Authority to Operate as a Lending Company, and—when borrowing through an app or website—whether that specific online lending platform is recorded with the Securities and Exchange Commission. You should also examine the loan terms, payment instructions, privacy practices, and collection methods because SEC registration alone does not guarantee that every transaction or practice is lawful.

What “SEC-Registered Lending Company” Really Means

People often use “SEC-registered” to describe any corporation appearing in the SEC database. For lending businesses, that is incomplete.

Under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, a lending company must generally:

Be organized as a stock corporation;
Be registered with the SEC; and
Obtain a separate authority from the SEC before conducting lending operations.

The important document is commonly called a Certificate of Authority, or CA, to operate as a lending company. A Certificate of Incorporation merely shows that the corporation was formed. It does not, by itself, authorize the corporation to lend money to the public as a business. RA 9474 prohibits a lending company from operating without a valid SEC authority and imposes penalties on persons who conduct or represent themselves as conducting an unauthorized lending business. (Supreme Court E-Library)

The three checks for an online lender

For a loan app or website, verify all three layers:

What to verify	What it proves	Where to check
Corporate registration and current status	The legal entity exists as a Philippine corporation	CheckWithSEC
Certificate of Authority	The corporation is authorized to operate as a lending or financing company	SEC list of companies with Certificates of Authority
Recorded online lending platform	The identified company reported the particular app or website to the SEC	SEC list of recorded online lending platforms

An app-store listing, DTI certificate, BIR registration, mayor’s permit, Facebook page, or SEC Certificate of Incorporation does not replace these checks.

Why the Company Name Matters More Than the App Name

Loan apps often use a brand name that is different from the corporation’s registered name. For example, an app called “QuickCash PH” might claim to be operated by “ABC Lending Corporation.”

The SEC lists normally identify the corporation, while the recorded online lending platform list connects particular apps, websites, or platform names to their operators. This distinction is important because scammers may:

Copy the brand of a legitimate lender;
Use a name that differs by only one word or letter;
Display another company’s SEC registration number;
Claim to be an “affiliate” or “loan processor” without proof;
Use the name of a legitimate corporation but direct payments to an unrelated personal account; or
Operate an app that is not among the online platforms reported by the corporation.

SEC Memorandum Circular No. 19, Series of 2019 established disclosure requirements for lending and financing advertisements and reporting requirements for online lending platforms. The SEC also maintains a separate list of recorded platforms precisely because checking the corporation alone may not establish that a particular app or website is connected to it. (SEC Appointment System)

How to Check if a Lending Company Is Legitimate

1. Find the lender’s exact legal name

Before searching any database, collect the lender’s complete corporate identity.

Look for it in:

The loan agreement;
Disclosure statement;
Privacy notice;
Terms and conditions;
App-store developer information;
Website footer;
Payment instructions;
Official receipts;
Text messages or emails; and
The lender’s office signage.

The name should ordinarily include a corporate ending such as Corporation, Corp., or Inc.

Do not search only the app’s marketing name. Write down:

Exact corporate name;
SEC registration number, if provided;
Certificate of Authority number, if provided;
Registered or business address;
Official website and email domain;
Telephone numbers;
Name of the app or online platform; and
Name shown on the bank or e-wallet account where payment is requested.

A legitimate lender should not refuse to disclose the legal entity that will be your creditor.

2. Search the official SEC Certificate of Authority list

Go to the SEC list of lending and financing companies with Certificates of Authority.

Search the lender’s exact corporate name. Try reasonable variations, including:

Full name with “Inc.” or “Corporation”;
Name without punctuation;
Former name, if the lender claims it recently changed names; and
SEC registration or CA number, when the page allows it.

Check whether the name, SEC number, CA number, and address are consistent with the lender’s documents.

The SEC identifies this list as the official resource for checking lending and financing companies authorized to operate. It also directs the public to its complaints page and online platform list for additional verification. (www.foi.gov.ph)

Treat these results carefully:

Exact match found: Continue with the remaining checks. This is not yet proof that the app, representative, payment account, and loan terms are legitimate.
Similar name only: Do not assume it is the same company.
Corporation found elsewhere but absent from the CA list: Do not proceed merely because it has SEC incorporation records.
No result: Ask the SEC for written confirmation before borrowing or sending money.

3. Check whether the loan app or website is recorded with the SEC

For an online loan, search the SEC list of recorded online lending platforms.

Confirm that:

The exact app or platform appears on the list;
The named operator matches the corporation with the Certificate of Authority;
The official website or app details are consistent; and
The app you downloaded is not a copy using a similar name, logo, or icon.

A corporation may have a valid lending CA while a particular app claiming to represent it is unrecorded, fake, or operated by another person. When the company appears in the CA list but the app does not appear in the recorded-platform list, pause the transaction and seek confirmation from the SEC.

4. Confirm the corporation’s basic status through CheckWithSEC

Use the official CheckWithSEC portal to verify the corporation’s registered name and available status information.

This check helps detect:

Invented companies;
Misspelled or misleading corporate names;
Businesses presenting only a trade name;
Companies using another corporation’s SEC number; and
Material inconsistencies between the lender’s documents and SEC records.

CheckWithSEC is useful for corporate verification, but it should not replace the Certificate of Authority check. A corporation may legally exist while lacking authority to operate a lending business. The SEC has identified CheckWithSEC and the SEC Check App as official verification channels for corporate information. (Facebook)

5. Match the lender’s documents and payment channels

Do not stop after finding the company’s name on an SEC list. Compare the verified information with the actual transaction.

Check whether:

The loan agreement names the same corporation;
The privacy notice identifies the same operator;
The office address is consistent;
Emails come from a company-controlled domain rather than an unrelated free account;
The loan proceeds come from the company or an identifiable authorized payment processor;
Repayments go to an account officially identified by the lender; and
Receipts or payment confirmations name the correct creditor.

Be especially cautious when a supposed lender asks you to send a “release fee,” “verification deposit,” “insurance fee,” or “account activation fee” to a personal GCash, Maya, or bank account before releasing the loan.

A legitimate lender may charge properly disclosed fees, but an advance payment to an unrelated individual—especially under pressure—is a common scam pattern. Never disclose your one-time password, e-wallet PIN, online banking password, or card security code.

6. Read the disclosure statement before accepting the loan

The Truth in Lending Act, or Republic Act No. 3765, requires creditors to disclose the real cost of credit. RA 9474 also expressly requires lending companies to comply with the Truth in Lending Act and the Consumer Act of the Philippines. (Supreme Court E-Library)

Before the loan is finalized, the lender should provide a written disclosure showing important information such as:

Principal loan amount;
Deductions made before release;
Net proceeds you will actually receive;
Interest rate;
Effective interest rate;
Processing or service fees;
Payment dates and installment amounts;
Late-payment penalties;
Collection charges;
Notarial fees, when applicable; and
Total amount payable.

The effective interest rate is especially important because it reflects the cost of the loan after considering charges and the amount actually received. A lender may advertise a low “monthly interest” while deducting substantial fees from the proceeds.

For example, a borrower might sign for ₱10,000 but receive only ₱8,500 after deductions and then be required to repay ₱12,000. The true cost should be evaluated against the ₱8,500 actually received—not merely against the headline loan amount.

Do not accept a loan when the lender refuses to provide the agreement and disclosure statement before disbursement, leaves important charges blank, or says the final repayment amount will be revealed only after the money is released.

7. Check whether the interest and charges fall under the applicable caps

BSP Circular No. 1133, Series of 2021 imposes specific caps on certain small, short-term loans offered by lending companies, financing companies, and their online lending platforms.

The caps apply to an unsecured, general-purpose loan that is:

₱10,000 or less; and
Payable within four months or less.

For a covered loan, the principal limits include:

Charge	Maximum for a covered loan
Nominal interest	6% per month, approximately 0.2% per day
Effective interest, including most fees	15% per month, approximately 0.5% per day
Late-payment penalty	5% per month on the outstanding scheduled amount due
Total cost of credit	Not more than 100% of the amount borrowed

The 100% total-cost cap generally means that all interest, fees, penalties, and other charges combined should not exceed the principal amount borrowed for a covered loan. These caps do not automatically apply to every consumer, business, secured, or longer-term loan, so the loan amount, term, purpose, and security must be considered. (Bangko Sentral ng Pilipinas)

Even when a loan falls outside Circular No. 1133, the lender must still make proper disclosures, avoid deceptive conduct, and comply with applicable laws and regulations.

8. Ask the SEC for written confirmation when the result is unclear

When the lender’s status cannot be confirmed from the public lists, submit an inquiry through SEC iMessage, the SEC’s official ticketing system.

Select the category relating to the Financing and Lending Companies Department and provide:

Exact corporate name;
SEC registration number;
Claimed Certificate of Authority number;
App or website name;
Screenshots of the offer;
Website or app-store link;
Copy of the loan agreement, if available;
Payment instructions; and
A clear request to confirm the status of the company’s Certificate of Authority and online lending platform.

The SEC’s iMessage system includes services for requesting certification of the status of a lending or financing company’s Certificate of Authority and for filing complaints. The ticket can be used to monitor the inquiry’s status. (Securities and Exchange Commission)

Public-list checks are generally free and immediate. A formal SEC inquiry or certification may take longer depending on the request and agency workload. For corporate documents, the public may also use SEC eSEARCH or SEC Express. SEC Express indicates that delivery ordinarily takes approximately three to five working days after the requested document is released, although processing and delivery periods may vary. (eSEARCH)

A Practical Pass, Pause, or Reject Test

Result	Practical response
Exact corporation is active, has a current CA, app is recorded, documents match, and terms are fully disclosed	Pass the registration check, but still evaluate affordability and contract terms
Company has a CA, but the app, website, address, representative, or payment account does not match	Pause and obtain written confirmation
Corporation appears in CheckWithSEC but is absent from the CA list	Do not treat it as an authorized lending company
App is absent from the recorded online lending platform list	Pause or reject unless the SEC confirms its authority
Lender refuses to disclose its corporate name or CA number	Reject
Upfront payment is demanded through a personal account before loan release	Reject and preserve evidence
Lender asks for an OTP, PIN, password, or remote access to your phone	Reject immediately
Charges are hidden or repayment amount is unclear	Do not accept the loan

Registration Does Not Automatically Mean the Lender’s Conduct Is Lawful

A valid Certificate of Authority proves that the corporation has authority to operate. It does not excuse unlawful advertising, hidden charges, privacy violations, threats, public shaming, or abusive debt collection.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, recognizes financial consumers’ rights to:

Fair and equitable treatment;
Disclosure and transparency;
Protection against fraud and misuse;
Protection of personal data;
Timely handling of complaints; and
Appropriate redress. (Supreme Court E-Library)

SEC Memorandum Circular No. 18, Series of 2019 also prohibits unfair debt-collection practices by financing and lending companies. Registration therefore answers only one question: whether the entity is authorized. Legitimacy must also be judged by how it advertises, contracts, processes personal data, collects payments, and handles delinquent accounts. (SEC Appointment System)

Loan App Permissions and Contact-List Harassment

The March 18, 2026 joint advisory of the Department of Information and Communications Technology, National Privacy Commission, and SEC emphasizes that online lending platforms must not demand unnecessary or disproportionate access to a borrower’s device and personal data.

Among the important safeguards are:

Excessive access to a borrower’s contact list is prohibited;
Persons in the borrower’s contacts should not be contacted unless they were properly identified as guarantors;
Character references and guarantors should be handled separately;
A guarantor’s consent must be obtained separately;
Camera or gallery access should be limited to a specified, legitimate purpose such as identity verification;
Permissions should be capable of being withdrawn or turned off after their purpose is completed; and
Borrowers should download apps only from official or verified sources and confirm that the operator is registered and licensed.

A lender does not gain the right to message your relatives, co-workers, Facebook contacts, or phone contacts merely because you granted broad app permissions. Consent must be informed, specific, and connected to a lawful purpose.

Common Red Flags of a Fake or Illegal Lender

Watch for several warning signs appearing together:

The lender refuses to provide its exact corporate name;
Only a DTI business name or barangay permit is shown;
The company claims that an SEC registration number is the same as lending authority;
The SEC number belongs to another corporation;
The app name is missing from the SEC’s recorded online lending platform list;
The company uses a recently created social-media account with no verifiable office;
The representative communicates only through private messages;
The lender guarantees approval regardless of identity or repayment capacity;
A fee must be paid before release;
The lender demands an OTP, PIN, password, card details, or screen-sharing access;
Payment is directed to changing personal accounts;
The agreement is unavailable, incomplete, or contains a different creditor;
The advertised interest differs from the disclosure statement;
The lender threatens arrest merely for nonpayment of an ordinary debt;
The app accesses contacts, photos, messages, or files without a clear need; or
The lender threatens to publish your photograph or debt information.

No single red flag always proves fraud, but several inconsistencies are a strong reason to stop the transaction.

What to Do if You Already Sent Money or Shared Information

If you paid an advance fee but received no loan

Stop sending additional money, even if the lender claims another payment is needed to “unlock” or “refund” the first payment.
Save screenshots, chat messages, phone numbers, receipts, account names, app links, advertisements, and agreements.
Contact the bank or e-wallet provider immediately and report the transaction as suspected fraud.
Change compromised passwords and secure your email, banking, and e-wallet accounts.
Report the lender or platform through SEC iMessage.
Report suspected fraud, threats, identity theft, or cybercrime to the appropriate law-enforcement or cybersecurity authority.

If the lender accessed or misused your personal data

Document:

The permissions requested by the app;
Messages sent to third parties;
Names and numbers contacted;
Public posts or threats;
Screenshots of the app’s privacy notice;
Your request to stop the processing; and
The lender’s response.

A privacy complaint may be filed with the National Privacy Commission using its prescribed process. The NPC’s official complaint instructions explain the required complaint form, supporting evidence, verification or notarization requirements, and available submission methods. (National Privacy Commission)

If the lender is threatening or humiliating you

Preserve the evidence before blocking the sender. Include dates, numbers, usernames, voice recordings lawfully obtained, screenshots, and the identities of third parties contacted.

Unfair collection may be reported to the SEC. Threats, fraud, impersonation, unauthorized account access, or other potentially criminal acts may also be reported to the Philippine National Police, National Bureau of Investigation, or other appropriate agencies identified in the joint government advisory.

Does an Unregistered Lender Mean the Debt Automatically Disappears?

Do not assume that discovering an unregistered lender automatically erases every obligation.

The company’s unauthorized operation may expose it and its responsible officers to SEC sanctions or criminal liability under RA 9474. However, separate legal questions may arise concerning:

Whether money was actually received;
Whether the principal must be returned;
Whether interest and fees were properly agreed upon;
Whether charges were disclosed;
Whether particular provisions are void, excessive, or unconscionable;
Whether payments should be credited differently; and
Whether the lender committed separate regulatory, privacy, or criminal violations.

A borrower should request a complete statement of account and use only a verified payment channel. Do not send payment to an unknown personal account merely because a collector is threatening immediate arrest or public exposure.

Ordinary failure to pay a private loan is generally a civil matter. Fraud, issuance of a worthless check under applicable circumstances, or other separate acts may create different legal issues, but a collector cannot lawfully invent a criminal case merely to frighten a borrower into paying.

Special Considerations for OFWs and Foreigners

An OFW or foreign borrower can perform the same SEC checks from outside the Philippines. No notarization or apostille is needed merely to search the SEC lists, CheckWithSEC, or iMessage.

Pay particular attention when:

A representative claims the lender is Philippine-registered but sends documents from another jurisdiction;
The contract identifies a foreign company while the app markets itself as a Philippine lender;
Payments are requested through overseas remittance channels or cryptocurrency;
The lender claims that Philippine consumer protections do not apply;
The legal entity in the privacy notice differs from the creditor in the loan agreement; or
The app is unavailable in official stores but is distributed through a direct installation file.

For a substantial transaction, certified SEC corporate documents may provide stronger evidence than screenshots. If Philippine documents will later be submitted to a foreign authority, that authority may separately require authentication or an apostille.

Frequently Asked Questions

How do I check whether an online loan app is SEC-registered?

Identify the corporation operating the app, verify that corporation in CheckWithSEC, confirm that it has a Certificate of Authority in the SEC lending-company list, and confirm that the exact app appears in the SEC list of recorded online lending platforms.

Is an SEC registration number enough?

No. It may establish only that a corporation was registered. A lending company must also have SEC authority to operate under RA 9474.

What if the company appears in CheckWithSEC but not in the Certificate of Authority list?

Do not treat it as an authorized lending company. Ask the SEC through iMessage to confirm whether the company has a current CA before borrowing or sending money.

What if the company has a CA but the loan app is not on the SEC platform list?

Pause the transaction. The app may be new, unreported, unauthorized, or unrelated to the company. Request written confirmation from the SEC and the corporation through independently verified contact details.

Is a DTI-registered lending business legitimate?

DTI business-name registration alone is not sufficient authority to operate a lending company. RA 9474 generally requires the lending company to be organized as a corporation and authorized by the SEC.

Can a legitimate loan app contact everyone in my phone?

No. A lender’s registration does not authorize indiscriminate access to or use of your contact list. Current government guidance prohibits excessive contact-list access and contacting people other than properly identified guarantors.

What is the maximum legal interest rate for online loans?

For unsecured, general-purpose loans of ₱10,000 or less with terms of four months or less, BSP Circular No. 1133 imposes specific monthly and total-cost caps. Different loans may fall outside those particular caps, but disclosure, consumer-protection, and other legal requirements still apply.

Can a lender require payment before releasing the loan?

A properly disclosed fee may be part of a legitimate credit transaction, but a demand to transfer an advance “release,” “insurance,” or “verification” fee to a personal account is a serious warning sign. Confirm the lender and payment channel before sending anything.

Where can I complain about an illegal lending company?

File a complaint or inquiry through SEC iMessage. For misuse of personal data, follow the National Privacy Commission complaint process. Fraud, threats, identity theft, or cybercrime may also be reported to the appropriate law-enforcement authorities.

Do I still have to pay if the lender is not SEC-authorized?

Do not assume the principal automatically disappears. Unauthorized lending operations and the borrower’s obligation to account for money actually received can involve separate legal questions. Challenge unauthorized interest, hidden charges, harassment, or illegal practices through the proper channels, and pay only through a verified account with documented crediting.

Key Takeaways

A Certificate of Incorporation is not the same as a Certificate of Authority to operate as a lending company.
Verify the exact corporation in the SEC’s CA list, not just in a general corporate search.
For a loan app or website, confirm that the specific platform is recorded under the same authorized company.
Match the corporate name, address, agreement, privacy notice, app developer, and payment account.
Review the net proceeds, effective interest rate, fees, penalties, schedule, and total repayment before accepting the loan.
Registration does not legalize hidden charges, abusive collection, threats, or privacy violations.
Never send advance fees to an unrelated personal account or disclose an OTP, PIN, or password.
When records are unclear, obtain confirmation through SEC iMessage before borrowing or paying.