How to Check if an Online Lending App Is Legitimate in the Philippines
(A comprehensive legal guide for borrowers, compliance officers, and fintech founders)
1. Why Legitimacy Matters
Online cash‑loan applications (“apps”) exploded in the Philippines after 2018, giving unbanked Filipinos fast access to credit. Unfortunately, the same speed that delights borrowers also enables fraudsters, data‑privacy abusers, and abusive collectors. Verifying that a platform is properly licensed and compliant protects you from:
- Exorbitant interest and hidden charges
- Harassment and “doxxing” tactics (contact‑scraping, public shaming, threats)
- Identity theft or sale of your personal data
- Void or unenforceable loan contracts (creating enforcement headaches for lenders as well)
2. The Legal & Regulatory Framework
| Instrument | Scope | Key Take‑aways for Online Lending |
|---|---|---|
| Republic Act No. 9474 (Lending Company Regulation Act of 2007) & Implementing Rules | Governs lending companies (corporations) that extend loans from their own funds | Requires SEC registration and a separate Certificate of Authority (CA) to operate |
| RA 8556 (Financing Company Act of 1998) | Governs financing companies (usually larger, asset‑based lenders) | Same CA requirement; higher minimum paid‑up capital |
| SEC Memorandum Circular (MC) No. 18‑2019 | First set of rules for Online Lending Platforms (OLPs) | Forces each lending company to register every app/website it uses |
| SEC MC No. 19‑2019 | Prohibits unfair debt‑collection (threats, profanity, public shaming, contact‑scraping) | Allows SEC to suspend or revoke a CA for abusive practices |
| SEC MC No. 10‑2021 | Strengthens disclosure: legal entity name must appear on the download page and splash screen; requires customer‑service channels | Non‑compliance = grounds for takedown from app stores |
| SEC MC No. 03‑2022 (rate caps) | Caps small‑value, short‑term loans (≤ ₱10,000, tenor ≤ 4 months) at 6 % nominal / 15 % effective interest per month; penalties limited to 5 %/month | Violators commit unfair and abusive acts under RA 9474 and may face CA revocation |
| RA 11765 (Financial Products and Services Consumer Protection Act, 2022) & Joint IRR | Elevates consumer protection across all regulators (SEC, BSP, IC, CDA) | Gives borrowers a statutory right to redress; hefty fines for abusive acts |
| RA 10173 (Data Privacy Act) + NPC Advisories | Protects “contact list”, photos, location, etc. | Apps must request purpose‑specific, freely given, informed consent; scraping contacts for collection is illegal |
| BSP Circular No. 1105 (digital banks) & BSP Circular No. 1033 (digital lending guidelines) | Only if the lender is a bank/e‑money issuer or partners with one | Dual licensing may apply (BSP + SEC) |
| E‑Commerce Act (RA 8792) & Cybercrime Prevention Act (RA 10175) | Digital signatures, electronic evidence, cyber‑libel | Screenshots/text threats admissible evidence |
3. Key Regulators & Where to Verify
| Regulator | What to Check | Where |
|---|---|---|
| Securities and Exchange Commission (SEC) | 1. Company Registration Number (CRN) 2. Certificate of Authority for Lending/Financing 3. Inclusion in the “List of Registered Online Lending Platforms” 4. Absence from SEC Advisories / Cease‑and‑Desist Orders | • www.sec.gov.ph → Data → Lending Companies • SEC Facebook page (advisories) • Walk‑in: Company Registration and Monitoring Department, Mandaluyong |
| Bangko Sentral ng Pilipinas (BSP) | E‑money issuer & digital bank licenses (if the app disburses via its own e‑wallet) | www.bsp.gov.ph → Lists & Registries |
| National Privacy Commission (NPC) | Registration of the company as a Personal Information Controller; pending complaints vs. the app | www.privacy.gov.ph |
| National Telecommunications Commission (NTC) | Blocking orders for SMS/voice harassment | Public advisories |
| Philippine National Police ‑ Anti‑Cybercrime Group (PNP‑ACG) | Cyber‑libel or extortion cases filed | Hotline + social‑media updates |
4. Legal Requirements Every Legitimate Online Lending App Must Meet
Corporate Form & Paid‑Up Capital
- Must be a stock corporation (sole proprietorships are never allowed to lend).
- Minimum paid‑up capital: ₱1 million for lending companies; ₱10 million (or more, depending on assets) for financing companies.
Certificate of Authority (CA)
- Separate from the SEC Certificate of Incorporation.
- Must be posted conspicuously at the principal office and inside the mobile app or website.
Registration of the Online Lending Platform
- Each unique app name, APK file hash, and website URL must be filed with SEC (MC 18‑2019, MC 10‑2021).
- Updates (re‑branding, app‑store publisher change) must be reported 10 days in advance.
Mandatory Disclosures to Borrowers (pre‑loan screen & contract)
- Exact annualized interest rate and effective interest rate (EIR)
- Service/processing fees, penalties, and late charges (in pesos and %)
- Borrower’s right to rescind within 7 calendar days if no funds were released
- Data‑privacy notice & consent form compliant with NPC rules
Debt‑Collection Code of Conduct
- No profanity, humiliating language, or threats of criminal prosecution (which is civil in nature)
- Contacts outside the borrower’s co‑makers or guarantors prohibited
- Calls allowed only 8 AM‑9 PM, maximum 3 times per week
Interest & Fee Caps (SEC MC 03‑2022)
Loans ≤ ₱10k & ≤ 120 days:
- Nominal rate: ≤ 6 % per month
- Effective rate: ≤ 15 % per month
- Penalties/charges: ≤ 5 % per month of outstanding balance
5. Step‑by‑Step Guide to Verifying an App’s Legitimacy
Identify the Legal Entity Behind the App
- Scroll to the app‑store “Developer contact”.
- A legitimate lender will show: ABC Lending, Inc., SEC CN2020‑12345, CA No. 123.
Cross‑check with SEC Registers
- SEC Lending Companies List → search “ABC Lending, Inc.”
- Verify that the CA status is “Active” and note expiry date.
Confirm the App/Website Registration
- SEC publishes a PDF list of approved Online Lending Platforms.
- The exact app name (e.g., “PeraQuick – Fast Cash Loan”) must appear.
Look for SEC Advisories & CDOs
- Search within Investors’ Protection Advisories.
- If the entity appears, it may have been ordered to shut down—do not borrow.
Examine the App’s Privacy Permissions
- Android ≥ 13 displays requested data categories (contacts, SMS, call logs).
- Legitimate apps now request only: camera (ID capture), storage (file upload), and location (optional). Access to contacts or SMS is a red flag unless clearly explained.
Check BSP Registration (if e‑wallet functions are embedded)
- E‑money disbursement (instant wallet creation) requires the lender to be an EMI or partner with one.
- The EMI’s name (e.g., “XYZ Payments, Inc.”) must be disclosed.
Validate Interest & Fee Schedule
- Compute the monthly rate and compare with the 6 % nominal cap (for small loans) or market norms for larger loans.
- Hidden “service fees” that push the EIR above caps are illegal.
Contact Customer Support
- Legitimate lenders have hotlines, e‑mail, and a physical office address.
- A Viber/Telegram number alone is insufficient.
6. Common Red Flags of Illegitimate or Rogue Apps
| Red Flag | Why It Matters |
|---|---|
| Developer is an individual or unregistered trade name | Lending requires a corporation + CA |
| No SEC CA number on app page | Mandatory under MC 10‑2021 |
| Permissions for contacts, calendar, SMS | Often used for “shaming” borrowers |
| Interest stated only as “₱50 per day” | Hides true EIR; violates disclosure rules |
| Threatening SMS after 1‑day delay | Violates MC 19‑2019, FCPA |
| CA status “Revoked” or app not on SEC OLP list | Operating illegally |
| Collects upfront “processing fee” before loan release | Classic scam; fees must be netted from proceeds or billed post‑disbursement |
| Uses foreign payment channels only (crypto, remittance abroad) | Hard to trace, suggests no local license |
7. Borrower Rights & What to Do if Things Go Wrong
File a Complaint with SEC‑EIPD
- E‑mail: epd@sec.gov.ph or visit the Mandaluyong office.
- Attach screenshots, contracts, SMS logs.
Report Privacy Violations to NPC
- Online complaint form: https://privacy.gov.ph/complaint-referral
- NPC may issue a Cease‑and‑Desist Order and levy fines up to ₱5 million per infraction.
Invoke the Financial Products & Services Consumer Protection Act (RA 11765)
- File with SEC’s Consumer Assistance Mechanism – resolution within 30 days is mandatory.
Seek Civil or Criminal Relief
- Small Claims Court (≤ ₱1 million) to contest unlawful charges.
- Cyber‑libel or grave threats: lodge with PNP‑ACG or NBI‑CCD.
Request SMS Blocking via NTC
- Forward harassing numbers to NTC hotline for blocking.
8. Compliance Checklist for Fintech Founders
- ☐ Incorporate (stock corporation) and achieve minimum paid‑up capital
- ☐ Secure SEC Certificate of Authority
- ☐ Register every new OLP (app/URL) and update changes within 10 days
- ☐ Draft plain‑language disclosure screens (interest, fees, privacy)
- ☐ Implement in‑app Know‑Your‑Customer (KYC) aligned with BSP AML rules
- ☐ Limit data collection to what is necessary; no contacts/SMS scraping
- ☐ Adopt a written Fair Debt Collection Policy and train agents
- ☐ Ensure interest & penalties respect SEC MC 03‑2022 caps
- ☐ Maintain a functional customer‑assistance desk (phone & e‑mail)
- ☐ Perform quarterly internal compliance audits and retain logs for 5 years
9. Frequently Asked Questions
| Question | Short Answer |
|---|---|
| Does SEC provide a public API to verify CAs? | Not yet; rely on the PDF lists or e‑mail SEC Monitoring. |
| Can a sole proprietor lend online under DTI registration? | No. Lending needs a corporation + CA; sole proprietorships are illegal lenders. |
| Is a post‑dated check required? | Not by law. The Bouncing Checks Law risk rests on the borrower, but lenders can’t coerce issuance. |
| Are interest caps absolute? | The 6 %/15 % caps apply only to small, short‑term loans. Larger loans are un‑capped but must remain “reasonable” under FCPA. |
| Can unpaid loans lead to criminal charges? | Simple non‑payment is civil. Only fraud (e.g., falsified documents) can trigger criminal liability. |
10. Conclusion
Verifying an online lender’s legitimacy is straightforward once you know where to look: the SEC’s corporate and OLP registers, rate‑cap rules, and privacy requirements. A few minutes of due diligence shields you from abusive practices and ensures that your loan contract is enforceable, transparent, and protected by Philippine consumer‑finance law.
Disclaimer: This article is for general information and does not constitute legal advice. Regulations may change; consult the SEC or a qualified Philippine lawyer for advice on your specific situation.