An online lending app is not legal simply because it appears on Google Play or the Apple App Store, displays an “SEC registered” badge, or has thousands of positive reviews. To verify it properly, you must identify the company behind the app, confirm that the company has authority from the Securities and Exchange Commission (SEC) to operate as a lending or financing company, and check that the particular app or online platform is genuinely connected to that company.

The Three Checks That Matter Most

A legitimate online lender normally passes all three layers of verification:

What to check	What you should find	Why it matters
Corporate registration	An existing Philippine corporation registered with the SEC	Confirms that the company legally exists
Lending authority	A valid SEC Certificate of Authority to operate as a lending or financing company	Ordinary SEC registration alone does not authorize lending
Online platform connection	The app, website, or brand is actually operated by or reported under that licensed company	Prevents you from dealing with clone apps, impersonators, or unreported platforms

Under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, a company engaged in the lending business must be organized as a stock corporation and must secure authority from the SEC. Some lenders operate as financing companies under the Financing Company Act of 1998, or Republic Act No. 8556, but they likewise need the appropriate SEC authority. (Lawphil)

What “Legal Online Lending App” Actually Means

There are three separate questions that borrowers often combine:

Does the company exist?
Is the company authorized to lend?
Is the company following lending, privacy, disclosure, and collection laws?

A company may be registered with the SEC but have no authority to offer loans. Another company may have a Certificate of Authority but use collection methods that violate SEC or data privacy rules.

This means that “licensed” does not automatically mean that:

Every interest rate or fee is lawful.
Every app permission is necessary.
Every collection message is acceptable.
The lender may contact everyone in your phone.
Every term in the loan agreement is enforceable.

Conversely, discovering a regulatory violation does not automatically erase the money you actually received. The principal obligation, interest stipulation, penalties, and collection conduct may have to be evaluated separately.

Philippine Laws That Apply to Online Lending Apps

Several laws and regulations work together:

Law or regulation	What it covers
RA 9474	Registration, licensing, operation, and regulation of lending companies
RA 8556	Regulation of financing companies
RA 3765, Truth in Lending Act	Disclosure of the true cost of credit before the loan is finalized
RA 11765, Financial Products and Services Consumer Protection Act of 2022	Fair treatment, disclosure, complaint handling, data protection, and responsible collection
RA 10173, Data Privacy Act of 2012	Lawful, necessary, proportionate, and secure processing of personal data
SEC Memorandum Circular No. 18, Series of 2019	Prohibited unfair and abusive debt collection practices
SEC Memorandum Circular No. 19, Series of 2019	Advertising disclosures and reporting of online lending platforms
BSP Circular No. 1133, Series of 2021	Interest, fee, penalty, and total-cost caps for certain small, short-term loans

The SEC is generally the regulator for lending and financing companies. Banks, digital banks, and certain non-bank financial institutions are supervised by the Bangko Sentral ng Pilipinas. Cooperatives are regulated by the Cooperative Development Authority. The regulator therefore depends on the legal identity of the actual lender, not merely on how the app describes itself.

How to Check If an Online Lending App Is Legal

1. Find the exact corporate name behind the app

Do not search only for the app’s brand name. An app called “Quick Peso,” for example, may be operated by a corporation with a completely different legal name.

Look for the corporate operator in the:

Google Play or Apple App Store developer information
App privacy policy
Terms and conditions
Loan agreement
Truth in Lending disclosure statement
Customer support email
Official website footer
Text or email confirming loan approval
Disbursement and repayment instructions

Record the company’s:

Complete corporate name
SEC registration number
Certificate of Authority number
Registered business address
Customer service contact details
Website domain
Name of the app developer

A legal operator should not make it difficult to identify the creditor. Be cautious when an app shows only a brand, a first name, a social media account, or a mobile number.

2. Check whether the company exists in SEC records

Search the exact corporate name through the SEC’s official verification facilities, including the SEC Check App.

Confirm that:

The spelling of the name matches exactly.
The corporation is active or registered.
Its stated business is consistent with lending or financing.
The information was not taken from an unrelated company with a similar name.

A screenshot of an SEC certificate sent by the lender is not enough. Certificates and registration numbers can be copied, edited, or taken from legitimate companies.

3. Confirm the company’s Certificate of Authority

A Certificate of Incorporation proves only that a corporation was formed. It does not, by itself, authorize the company to operate a lending business.

The company should have a valid Certificate of Authority, sometimes called a secondary license, to operate as either:

A lending company; or
A financing company.

When checking with the SEC, ask specifically whether the company has a current Certificate of Authority—not merely whether it is SEC registered.

DTI business-name registration, a BIR Certificate of Registration, a barangay clearance, or a mayor’s permit does not replace the SEC Certificate of Authority required for a lending or financing company.

4. Match the app to the licensed company

Scammers sometimes copy the name, SEC registration number, or Certificate of Authority of a legitimate lender. The company may be real, but the app may still be fake.

Compare the following:

Item	What should match
App developer	The licensed company or an identifiable authorized service provider
Privacy policy	The same corporate operator and legitimate website domain
Loan agreement	The licensed lender’s complete corporate name
Disclosure statement	The same lender, loan amount, fees, and repayment terms
Payment account	A corporate or officially designated account, not an unrelated individual
Customer service	Contact details traceable to the licensed company
Website and email	A consistent official domain rather than random free email accounts

Under SEC Memorandum Circular No. 19, online lending platforms used by lending and financing companies are subject to reporting requirements. Verify that the particular app or website is genuinely associated with the licensed operator, rather than relying on the company’s existence alone. (SEC Appointment System)

5. Check for SEC warnings, suspensions, or revocations

Review the SEC’s lending and financing company pages for:

Advisories against unauthorized lenders
Cease-and-desist orders
Suspended or revoked secondary licenses
Revoked corporate registrations
Enforcement actions involving the company or app

Static lists may not always reflect the most recent change in status. A company may have changed its corporate name, surrendered an authority, obtained a lifting order, or become subject to a new SEC action.

When the records are unclear, submit a verification request through the SEC iMessage system. Include the app name, corporate name, developer, website, SEC number, Certificate of Authority number, and screenshots.

6. Verify the lender before uploading your ID

Complete the SEC checks before giving the app access to your:

Government ID
Facial image or selfie
Bank or e-wallet information
Contact list
Camera
Photo gallery
Location
Employment records

Identity documents can be misused for unauthorized accounts, fraudulent loans, phishing, or impersonation. App-store availability is not proof that your information is safe.

7. Read the disclosure statement before accepting the loan

The Truth in Lending Act requires the creditor to disclose the true cost of credit before the transaction is completed. The borrower should receive a written or electronic disclosure showing the material loan terms.

At minimum, check for:

Amount applied for
Amount actually released
Interest rate
Finance charge
Processing or service fees
Documentary or notarial charges
Payment schedule
Total amount payable
Due dates
Late-payment penalties
Collection charges
Method used to compute the balance after default
Consequences of missed payments
Creditor’s identity and contact details

Never rely only on an advertisement saying “0% interest,” “low interest,” or “₱5 per day.” Fees can substantially increase the real cost.

For example, suppose an app advertises 5% interest on a ₱5,000 one-month loan:

Item	Amount
Stated loan principal	₱5,000
Amount deducted before release	₱750
Cash actually received	₱4,250
Amount due after one month	₱5,250
Effective cost to the borrower	₱1,000

Although the advertised interest is only ₱250, the borrower pays ₱1,000 to use ₱4,250 for one month. That is the type of hidden cost the disclosure rules are meant to reveal.

Do not accept the loan until you can save or download the disclosure statement and loan agreement.

Legal Interest and Fee Limits for Small Online Loans

BSP Circular No. 1133 imposes specific caps on a covered loan that is:

Unsecured;
For general purposes;
Not more than ₱10,000; and
Payable within four months or less.

For a loan meeting all these conditions, the caps are generally:

Charge	Maximum
Nominal interest	6% per month
Effective interest, including applicable fees and charges other than late-payment penalties	15% per month
Late or nonpayment penalty	5% per month on the outstanding scheduled amount due
Total cost, including interest, fees, charges, and penalties	100% of the total amount borrowed

This means that if the covered borrower received a ₱5,000 loan, the total interest, charges, fees, and penalties should not exceed another ₱5,000, regardless of how long the loan remains unpaid. The total amount collectible under the circular’s cost cap would generally not exceed ₱10,000.

These numerical caps do not cover every type of loan. A loan outside the amount, purpose, security, or term requirements must still comply with disclosure rules, consumer-protection laws, the written-interest requirement under Article 1956 of the Civil Code, and the prohibition against unlawful or unconscionable contractual terms.

Privacy Permissions That Should Concern You

A legitimate lender may process information needed to verify identity, assess creditworthiness, prevent fraud, release funds, and collect a lawful debt. However, the processing must be transparent, necessary, proportionate, and connected to a legitimate purpose.

The National Privacy Commission’s Circular No. 2020-01, as amended by NPC Circular No. 2022-02, specifically regulates personal data processing in loan-related transactions.

An app should not demand unlimited access merely because you want to view available loan products. Be cautious when it:

Requires access to your entire contact list before showing loan terms.
Continuously accesses the camera or photo gallery after identity verification.
Copies contacts without allowing you to select a specific reference or guarantor.
Collects unrelated text messages, files, call records, or social media information.
Uses pre-checked consent boxes or confusing screens to obtain permissions.
Refuses to explain why a permission is necessary.
Prevents you from withdrawing an unnecessary permission.
Threatens to publish your ID, selfie, debt, or personal information.

The March 18, 2026 joint advisory of the DICT, NPC, and SEC emphasized that unbridled processing of contact lists is prohibited. Contact access must be limited and purpose-specific. For collection purposes, people in the borrower’s contact list should not be contacted merely because their numbers appear on the phone; the advisory distinguishes guarantors, who must expressly consent, from ordinary character references.

Debt Collection Practices That Are Not Allowed

A lender may send lawful payment reminders, demand payment, negotiate a restructuring, endorse an account to an authorized collection agency, or file an appropriate civil case. It may not use humiliation, threats, or deceptive tactics.

SEC Memorandum Circular No. 18 prohibits practices such as:

Threatening violence or criminal harm
Using obscene, insulting, or profane language
Falsely representing that the collector is a police officer, lawyer, court employee, or government official
Threatening an action that cannot legally be taken
Publicly disclosing the borrower’s name or personal information
Posting fabricated “wanted” notices or humiliating social media content
Contacting people merely to shame or pressure the borrower
Communicating at unreasonable hours, subject to limited exceptions
Using false documents or misleading legal claims

(SEC Appointment System)

Missing a payment on an ordinary loan is generally a civil matter. A collector cannot truthfully claim that the borrower will be arrested automatically because of an unpaid balance. Separate criminal allegations, such as fraud or issuing a bouncing check, require their own facts, legal elements, complaint, and proper proceedings.

Warning Signs of an Illegal or Fake Lending App

Treat the app as high risk when several of these signs appear:

No complete corporate name is disclosed.
The app gives an SEC registration number but no Certificate of Authority.
The corporate name does not match SEC records.
The app uses another company’s Certificate of Authority.
The developer, privacy-policy operator, creditor, and payment recipient are different entities with no explanation.
The lender refuses to provide a disclosure statement before acceptance.
Fees appear only after the loan is released.
The app releases money without clear consent and immediately demands repayment.
It asks for an “unlock fee,” “release fee,” “insurance fee,” or “tax” to be paid to a personal e-wallet before disbursement.
Repayment must be sent to changing personal GCash or Maya accounts.
It asks for your one-time password, e-wallet PIN, bank password, or ATM card.
It requires unrestricted access to contacts, messages, photos, or files.
Collectors threaten arrest, deportation, job termination, or public humiliation.
The company has no verifiable office, official domain, or customer-service channel.
It pressures you to act before you can read or save the agreement.

A legitimate lender may deduct properly disclosed fees from the loan proceeds, subject to applicable limits. The red flag is an undisclosed fee, an unexplained payment to an individual, or a demand for money before any verifiable loan is released.

What to Do If You Already Borrowed From a Suspicious App

1. Preserve evidence before deleting anything

Save:

Screenshots of the app-store listing
Developer information
Privacy policy and terms
SEC and Certificate of Authority claims
Loan agreement
Disclosure statement
Application screens and consent prompts
Amount received
Payment history and transaction references
Collection texts, emails, chats, and call logs
Messages sent to your relatives, employer, or contacts
Social media posts containing your personal information
Names, numbers, and account details used by collectors

Screen-recording the app can be useful because an app may later disappear or change its terms.

2. Secure your accounts and device

After preserving evidence:

Revoke unnecessary app permissions.
Change compromised passwords.
Enable two-factor authentication.
Never share an OTP or PIN.
Notify your bank or e-wallet provider about suspicious transactions.
Check whether your email or mobile number is being used for password resets.
Uninstall the app if continued installation creates a security risk.

Revoking permissions does not cancel a genuine debt, but it can reduce further unauthorized access.

3. Request an itemized account statement

Write to the lender and ask for:

Complete corporate identity
SEC registration and Certificate of Authority details
Principal amount
Net proceeds released
Interest computation
Itemized fees
Penalties
Payment credits
Current balance
Official repayment channel

Pay only through a verified channel belonging to or officially designated by the creditor. Obtain an electronic or written receipt for every payment.

4. File a complaint with the SEC

Use the SEC iMessage portal for complaints involving:

Operating without authority
Misleading advertisements
Undisclosed charges
Unfair collection
Unauthorized or unreported online lending operations
Possible misuse of another company’s registration
Violations by a lending or financing company

Attach the relevant evidence rather than submitting only a general statement that the app is “illegal.” A useful complaint identifies the company, app, dates, loan amount, amounts paid, collector numbers, specific conduct, and desired regulatory action.

The SEC can investigate and impose regulatory sanctions. It does not ordinarily act as a court that cancels a private debt, rewrites the loan agreement, or determines damages in every individual dispute. (SEC Appointment System)

5. File a privacy complaint with the NPC

A privacy complaint may be appropriate when the app:

Harvested contacts without a lawful basis
Disclosed your debt to other people
Publicized your ID or photograph
Continued accessing data after the purpose ended
Used personal information for harassment
Failed to respond to a request concerning your personal data

The NPC’s complaint-filing mechanics generally require a filled-out and notarized complaint-assisted form or a verified complaint, together with supporting evidence and, when applicable, witnesses’ affidavits. Follow the current NPC instructions because filing channels and documentary requirements may change. (National Privacy Commission)

Screenshots usually do not need to be separately notarized. For a formal case, they may be identified and explained in a verified complaint or notarized affidavit.

6. Report threats, extortion, or identity theft

Threats of violence, extortion, impersonation, account takeover, and other cyber-enabled offenses may be reported to the:

Philippine National Police Anti-Cybercrime Group
National Bureau of Investigation Cybercrime Division
Local police station, especially when there is an immediate safety threat

Online conduct may also fall under the Cybercrime Prevention Act of 2012, or RA 10175, when a crime penalized by Philippine law is committed through an information and communications system.

Documents and Evidence to Prepare

Category	Examples
Identity	Government ID or passport
Loan documents	Loan agreement, promissory note, disclosure statement, amortization schedule
Financial records	Disbursement record, bank or e-wallet history, receipts, payment references
App information	Screenshots, app-store page, developer details, permissions, privacy policy
Communications	Texts, emails, chats, call logs, demand letters
Privacy evidence	Messages sent to contacts, public posts, copied photos or IDs
Company information	Corporate name, SEC number, Certificate of Authority number, office address
Witness evidence	Statements from relatives, coworkers, employers, or contacts who were approached

An initial online inquiry may take only a few minutes, but a regulatory complaint can take weeks or months depending on the evidence, the respondent’s answer, and whether a formal investigation is required. Preserve evidence immediately rather than waiting for the app or collector to stop contacting you.

Filipinos abroad and foreign borrowers may also submit complaints concerning Philippine-regulated lenders. When a verified affidavit is signed outside the Philippines for use in a formal proceeding, the receiving agency may require execution before a Philippine consular officer or notarization abroad followed by an apostille. Confirm the agency’s requirements before arranging authentication.

A foreign license or overseas company registration does not automatically authorize an app to conduct a lending business in the Philippines.

Common Verification Mistakes

Relying on the app store

Google Play and Apple review apps under their own platform rules. Publication in an app store is not equivalent to a Philippine lending license.

Searching only the app name

The legal lender may use a different corporate name. Always identify the creditor named in the loan agreement and disclosure statement.

Accepting “SEC registered” as the final answer

A corporation may exist without a Certificate of Authority to lend. Verify both primary registration and secondary authority.

Trusting a photograph of a certificate

A certificate may be outdated, altered, or borrowed from another company. Confirm it directly through official SEC channels.

Assuming an illegal lender means the loan disappears

Unauthorized operation and enforceability of the borrower’s obligation are distinct issues. Do not simply ignore the account. Request a computation, dispute unlawful charges in writing, preserve evidence, and pay only through a verified channel.

Deleting the app too early

Collectors may later deny the permissions requested, terms shown, or amount released. Capture the evidence first, then secure the device.

Frequently Asked Questions

Is every SEC-registered online loan app legal?

No. SEC registration proves that a corporation exists. A lending or financing company must also possess the appropriate Certificate of Authority, and the particular app must be genuinely connected to that company.

How can I check an online lending app’s SEC registration?

Find the exact corporate name in the app’s privacy policy, loan agreement, disclosure statement, or developer page. Search that name through the SEC’s official verification tools and confirm its Certificate of Authority. Use SEC iMessage when the records are unclear.

Is an app legal because it is on Google Play or the Apple App Store?

No. App-store publication does not prove SEC authority. Fake, cloned, unauthorized, or noncompliant apps may still appear in an app marketplace.

Can a loan app access my contacts?

Access cannot be unrestricted or unrelated to a legitimate lending purpose. The app must explain why access is needed and limit processing to what is necessary and proportionate. Unbridled harvesting of contact lists and contacting ordinary phone contacts for collection are prohibited.

Can an online lender contact my family or employer?

A lender cannot disclose your debt to unrelated people merely to embarrass or pressure you. Current government guidance distinguishes a guarantor who expressly agreed to guarantee the loan from an ordinary character reference or person appearing in your contact list.

What is the maximum legal interest rate for an online loan?

For a covered unsecured, general-purpose loan of ₱10,000 or less with a term of four months or less, BSP Circular No. 1133 generally caps nominal interest at 6% per month and effective interest at 15% per month. Different loans may fall outside these numerical caps but remain subject to disclosure, fairness, written-stipulation, and other legal requirements.

Can I be arrested for failing to pay an online loan?

Failure to pay an ordinary debt is generally a civil matter. A collector cannot order your arrest or truthfully guarantee that you will be jailed simply because payment is late. A separate criminal case would require independent facts, legal elements, and proper proceedings.

Do I still have to pay if the app is not licensed?

Lack of authority can expose the operator to sanctions, but it does not necessarily mean you may keep money you actually received. The principal, interest, fees, and penalties may have different legal consequences. Request a complete statement and dispute questionable charges through proper channels.

Where should I complain about harassment by a loan app?

Report lending and collection violations to the SEC. Report unauthorized personal-data use or disclosure to the NPC. Report threats, extortion, identity theft, or other possible crimes to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the local police.

Key Takeaways

Verify the corporate operator, not just the app’s brand name.
SEC incorporation alone is insufficient; look for a valid Certificate of Authority to operate as a lending or financing company.
Match the app, developer, privacy policy, loan documents, and payment channels to the licensed company.
Read and save the complete Truth in Lending disclosure before accepting any loan.
For covered small, short-term loans, BSP rules cap interest, fees, penalties, and total borrowing cost.
A lender may collect a lawful debt but may not threaten, shame, deceive, or indiscriminately contact people in your phone.
Preserve screenshots, agreements, payment records, and collection messages before revoking permissions or deleting the app.
Use SEC iMessage for regulatory complaints, the NPC process for privacy violations, and cybercrime authorities for threats or fraud.