How to Check the Legitimacy of an Online Lending Corporation in the Philippines

An in-depth legal guide for consumers, entrepreneurs, and compliance professionals (updated 2025)

1. Overview

Online lending has boomed in the Philippines, driven by smartphone penetration and the need for fast, small-ticket loans. Unfortunately, so have scams and predatory lenders. Philippine law treats lending as a highly regulated finance activity—failure to comply can lead to criminal liability and penalties up to ₱2 million per offense, plus imprisonment for responsible officers.

This article covers:

Section	Key Take-aways
2. Governing Laws & Agencies	SEC is the primary regulator; BSP and NPC also have jurisdiction
3. Minimum Licenses & Filings	Every lender must have both SEC company registration and a separate Certificate of Authority (CA)
4. Step-by-Step Due Diligence	How to verify status through public databases, official apps, and document inspection
5. Warning Signs & Common Schemes	Collection harassment, illegal data scraping, hidden fees, fake BSP “approvals”
6. Remedies & Where to Report	SEC citizen complaints, BSP consumer assistance, NPC privacy violation reports, private civil suits
7. Practical Checklist	One-page cheat sheet you can print or share internally

2. Governing Laws, Rules & Regulators

Legal Authority	Scope of Power	Highlights
Republic Act 9474 (“Lending Company Regulation Act of 2007”)	Core statute on all lending companies	Requires a Certificate of Authority (CA) before starting operations; prescribes penalties
SEC Memorandum Circular (MC) 18-2019	Online Lending Platforms (OLPs)	Caps contact-scraping, harassment; sets transparency rules
SEC MC 19-2019	Registration of OLPs	App stores must host only SEC-registered OLPs; borrowers must see CA number
RA 11765 (Financial Products & Services Consumer Protection Act, 2022)	Cross-sector conduct standards	Allows SEC and BSP to issue restitution, disgorgement, and cease-and-desist orders (CDOs)
RA 3765 (Truth in Lending Act) + BSP Circular 1036-2019	Disclosure of finance charges	Mandates Total Annual Percentage Rate (APR) disclosure
Data Privacy Act of 2012 (RA 10173) + NPC Circular 16-01	Personal data processing	Borrower consents, data retention limits, required Privacy Impact Assessment
BSP (if lender offers e-wallets, deposits, or performs credit scoring for banks)	EMI license, credit bureau registration	EMI-Others vs. EMI-Banks classifications

3. Minimum Legal Requirements for Legitimate Lenders

SEC Company Registration
- Regular corporations file Articles of Incorporation and By-laws.
- Business name must include the word “Lending” or “Credit” (SEC MC 9-1997).
Certificate of Authority (CA)
- Separate from SEC “Company Reg. Number.”
- Must be displayed on app, website, branch, and every loan contract.
- Valid for perpetual use but revocable upon violation.
Online Lending Platform (OLP) Registration
- Each mobile app or website needs a distinct OLP registration number under MC 19-2019—even if the same lender group.
Beneficial Ownership Disclosure
- SEC MC 1-2021: 25 % beneficial owners must be identified to combat money-laundering.
BSP Licenses (if applicable)
- EMI (Electronic Money Issuer) if the platform stores monetary value.
- Credit Bureau Accreditation if it shares borrower data.
National Privacy Commission (NPC) Registration
- Mandatory if processing >1,000 individuals’ data annually.

4. How to Verify a Philippine Online Lending Corporation

Step	What to Do	Where	Tip
1	Search the SEC Company Registration System (CRS)	https://crs.sec.gov.ph → Search	Name, Reg. No., Incorporation Date
2	Download SEC list “Registered Lending Companies with Certificate of Authority” (CSV updated weekly)	SEC official website → Lending Advisories	Cross-check CA number & date
3	Check SEC list of “Online Lending Platforms with Authority to Operate”	Same page, separate PDF	Each app must appear individually
4	Inspect the mobile app	Google Play → Developer info	CA & OLP number must be in description
5	Verify BSP EMI (if funds are stored)	https://www.bsp.gov.ph → e-Money Issuers list	“Other EMI” vs. “Bank EMI” tables
6	Confirm Privacy Policy & NPC Registration Number	In-app or website footer	Should mention NPC Case Registration No.
7	Review loan agreement	Provided before drawdown	Must show: APR, fees, amortization schedule, cooling-off period
8	Search SEC Advisories & CDOs	SEC site → Enforcement & Investor Protection Department (EIPD)	Unlicensed entities are named
9	Look up court / NLRC / small claims cases (optional deep dive)	e-Courts Portal; e-SCRA; DOLE dockets	Check for harassment suits
10	Ask for copy of official receipt (OR)	BIR-registered OR required for every payment	OR series & TIN printed

5. Red Flags & Common Illicit Practices

“Advance processing fee” or “membership fee” before loan approval
APR > 36 % per annum for small consumer loans (violates SEC interest guidance)
Contact Scraping: App demands access to entire phonebook—banned under SEC MC 18-2019
Harassment & Threats via SMS/Facebook to borrower contacts
Fake BSP Seal or “BSP Accredited” claims (BSP does not accredit lenders)
No physical office or only virtual address without Mayor’s Permit
Constant name changes in Play Store to evade takedowns
Use of “coop” or “micro-finance” labels without CDA or cooperative registration

If you spot ≥ one red flag, stop transactions immediately and report (see next section).

6. Remedies, Sanctions & Where to Report

Violation	Primary Agency	Possible Outcome
Operating without CA	SEC EIPD (complaints@sec.gov.ph)	CDO, asset freeze, ₱2 M fine, 1-10 yrs imprisonment
Excessive interest / hidden charges	SEC; may file civil action	Refund, damages under Art. 1390 Civil Code
Data Privacy abuse	National Privacy Commission	Compliance order, ₱5 M per act, criminal prosecution
EMI without BSP license	Bangko Sentral	₱100 K per day fine, CDO, criminal referral
Abusive collection	SEC; DOJ for grave threats; NLRC if employee misconduct	Suspension/revocation of CA; criminal charges
Consumer deception	DTI (for unfair trade)	Administrative fines up to ₱300 K per trans.
Cyber fraud	PNP-ACG; NBI-CCD	Arrest, cyber-libel, estafa

Always gather screenshots, receipts, chat logs, and official ID before filing a complaint.

7. One-Page Due-Diligence Checklist

☐ SEC Reg. No. verified
☐ Certificate of Authority (CA) valid & matches company name
☐ App/Website listed in SEC OLP Registry
☐ Privacy Policy & NPC Registration visible
☐ BSP EMI license (if wallet/advance repayment required)
☐ Loan contract shows APR, all fees, cooling-off clause
☐ No upfront “processing fee” before release
☐ App does not require phonebook/SMS access
☐ Receipt issued with BIR authority
☐ No pending SEC advisory or CDO

Print, paste, or share this list inside your compliance or risk department.

8. Frequently Asked Questions (FAQ)

Question	Short Answer
Is a DTI permit enough?	No. DTI Business Name Registration does not authorize lending.
Are cooperatives exempt?	Only if the entity is CDA-Registered and lends exclusively to members.
Can a foreign corporation lend online here?	Yes, but it must set up a Philippine branch registered with SEC and obtain a CA.
What if the lender says “We’re just a marketing agent”?	SEC treats any entity that facilitates loans and collects payments as a lender or OLP—still needs registration.

9. Final Practical Tips

Always pay through traceable channels (bank transfer, e-wallet QR labeled with lender’s name).
Keep digital and printed records: contracts, payment confirmations, SMS/email notices.
Update credit reports: under RA 9510 (Credit Information System Act), you may request your credit file to ensure accurate loan status.
Consult counsel early: complex cases (e.g., identity theft, cross-border apps) often require coordinated action with PNP-ACG and Interpol.

Disclaimer: This article is for general informational and compliance guidance. Laws and regulations evolve; consult a Philippine lawyer or the relevant government agency for specific legal advice.