This practical legal guide explains how to verify that a Philippine “lending company” (or a “financing company,” which is regulated under a parallel law) is properly authorized by the Securities and Exchange Commission (SEC) to operate, and how to spot warning signs of non-compliance.

1) Legal framework—in brief

Lending companies are governed primarily by the Lending Company Regulation Act of 2007 (Republic Act No. 9474) and its Implementing Rules and Regulations (IRR).
- Only corporations may engage in lending as a regular business.
- They must secure a Certificate of Authority (CA) from the SEC in addition to their SEC Certificate of Incorporation.
Financing companies are governed by the Financing Company Act of 1998 (RA 8556) (as amended) and must likewise obtain an SEC CA to operate as financing companies.
Online lending platforms (OLPs). The SEC has issued several memoranda to regulate OLPs and their collection practices, data handling, and disclosures. In practice this means:
- The corporation that owns/operates the app or website must itself be a licensed lending/financing company or be properly affiliated with one, and specific online business names/platforms must be registered with the SEC.
- Abusive collection and privacy-violating tactics are punishable under SEC rules and the Data Privacy Act of 2012.
Regulatory boundaries. Lending/financing companies cannot take deposits (deposit-taking is a BSP function for banks). Interest rates are generally deregulated under the suspension of the Usury Law ceiling, but unfair or unconscionable practices can still be sanctioned under consumer protection and SEC rules.

2) What “properly registered” looks like

A compliant lender will be able to show you, on demand:

SEC Certificate of Incorporation (corporation name, SEC Registration No., date).
SEC Certificate of Authority to Operate as a Lending/Financing Company (shows the CA number, company’s exact corporate name, and authority “to operate as a [Lending/Financing] Company”).
Latest General Information Sheet (GIS) (lists directors/officers, principal office address).
Latest Audited Financial Statements (AFS) filed with the SEC (or the current filing status if within the allowable filing window).
Business/mayor’s permit for the city/municipality where the branch operates.
For OLPs: evidence that the online app/website name is registered with the SEC under the licensee company; posted privacy notice and complaints channel.

Practice point: The CA is separate from the Incorporation Certificate. If a company only shows its incorporation document but no CA, it is not authorized to lend to the public.

3) Step-by-step: Verify SEC registration yourself

A. Identify the exact legal name

Get the exact corporate name from any contract, official receipt, or the certificate itself.
Watch for trade names/brands that differ from the corporate name (common in OLPs). You need both: the corporate name and the platform/brand names.

B. Look up the company in the SEC’s public facilities

The SEC maintains online tools to search registered corporations and to request official documents (e.g., Articles, GIS, AFS, and—if available for release—a copy or verification of the CA). Use these to confirm:

Corporate status: Existing/Active/Registered vs Revoked/Expired/Suspended.
Company type: Lending Company or Financing Company (as applicable).
Principal office address and officers (compare with what the lender told you).
Document trail: When the latest GIS/AFS was filed, and whether there are revocation or show-cause orders reflected.

Tip: Requesting certified true copies (CTCs) or official extracts provides an evidentiary trail if you need to prove due diligence later.

C. Confirm the Certificate of Authority

Ask the lender for a copy of the CA and verify that:
- The company name matches exactly.
- The CA number is present and clearly printed.
- There are no alterations.
Cross-check with SEC records or request an official verification/certification from the SEC that the CA is valid and not revoked.

D. Check for advisories and revocations

The SEC regularly issues public advisories naming unregistered entities and those with revoked authority. Search for the company name, trade name, and OLP name(s).
If you see aliases or look-alike names, treat as a red flag until clarified with the SEC.

E. For online lending apps (additional checks)

Verify that the app/website name appears as a registered platform of a particular licensed company.
Check that the privacy policy:
- Identifies the legal entity behind the app;
- States a lawful basis for processing your data;
- Gives a dedicated complaints/contact channel.

4) Documents and data points you should specifically ask for

Use this borrower’s mini-diligence checklist:

□ SEC Certificate of Authority (CA) (clear copy).
□ SEC Certificate of Incorporation (or Amended Certificate if the name changed).
□ Latest GIS (look for current directors/officers).
□ Latest AFS received by the SEC.
□ Mayor’s/business permit for the lending office/branch.
□ Schedule of charges and sample amortization (to spot hidden fees).
□ Privacy Notice (especially for OLPs) and complaints contact.
□ For platforms/brands: proof that Brand/App XYZ is owned/operated by [Corporate Name], CA No. ____.

5) Common red flags (treat as high-risk)

No SEC CA presented, or “pending/for processing” excuses.
Mismatch between the name on the CA and the name on contracts/receipts/website.
Personal bank accounts used for loan releases/repayments (rather than a corporate account).
Harassing or shaming collection practices, mass-messaging your contacts, or threats of public disclosure.
Unclear or changing fee tables, or promises to “fix the paperwork later.”
Revocation/advisory hits when you search the SEC advisories.

6) What to do if things don’t check out

Walk away from the transaction until the company produces a valid CA and you have verified it.
Preserve evidence: screenshots of the app, chat, fee tables, certificates shared, and names of agents.
Complain to the SEC’s enforcement/complaints channels; attach your evidence. For privacy violations, also notify the National Privacy Commission (NPC).
If money changed hands and fraud is suspected, consider filing a criminal complaint and consult a lawyer on estafa or relevant offenses, alongside administrative complaints with the SEC.

7) Special notes on branches, brands, and group structures

Branches don’t get separate CAs. Their authority flows from the corporate CA; the branch address should appear in corporate filings or official notices.
Trade names/brands are common. Ensure the brand is traceable to the licensed corporation that holds the CA.
Group structures/agents. If an “agent” originates loans “for” a licensed lender, insist on written agency/servicing agreements and check that your loan contract names the licensed principal (not just the agent).

8) Borrower protections you can invoke

Transparency: You are entitled to a clear disclosure of principal, interest, fees, penalties, due dates, and the total cost of credit.
Fair collection: Lenders/collectors must not harass, threaten, or shame borrowers; calls must be during reasonable hours and made to the borrower (or declared contacts) only, with lawful basis under the Data Privacy Act.
Data privacy: OLPs must obtain valid consent (or identify another lawful basis), collect only necessary data, and implement safeguards. Unconsented scraping of your contacts/photos is unlawful.
Receipts and statements: Demand official receipts and account statements; keep them.
Dispute pathways: Keep records of your requests and the company’s replies; escalate to SEC and NPC as needed.

9) Practical FAQs

Q: Is an SEC Certificate of Incorporation enough? A: No. The company must also have an SEC Certificate of Authority specifically authorizing it to operate as a lending (or financing) company.

Q: Can a sole proprietor operate a lending business? A: Not as a licensed lending company under RA 9474. The law requires a corporation. (Sole proprietors may use “lending” in a trade name for other purposes, but they cannot engage in the regulated lending-company business to the public without a corporate CA.)

Q: The app shows a brand I’ve never heard of. How do I link it to a licensed company? A: Ask the operator to identify the corporation and provide the CA number. Verify that the brand/app is an officially registered platform of that corporation and that contracts/receipts bear the licensed corporate name.

Q: What if the CA was revoked after I took out a loan? A: Revocation affects the company’s authority to continue operating; it does not automatically void existing, otherwise lawful obligations. Seek legal counsel; you may have defenses or claims if the lender violated the law in granting/collecting the loan.

10) Model request letter/email to a lender (copy/paste)

Subject: Request for SEC Registration and Authority Documents

Dear [Lender],

In line with our due diligence, please provide the following for [Exact Corporate Name]:

SEC Certificate of Incorporation;

SEC Certificate of Authority to Operate as a [Lending/Financing] Company;

Latest GIS and AFS filed with the SEC;

Mayor’s/Business Permit for your [branch/office]; and

For your online platform/app [Brand/App Name], proof of registration with the SEC and your Privacy Notice.

Kindly send clear copies showing the CA number and the exact corporate name. Thank you.

11) Quick borrower’s checklist (printable)

✅ Exact corporate name + all brand/OLP names
✅ CA number seen and verified
✅ Corporate status “Active/Existing”
✅ Latest GIS & AFS on file
✅ Business permit for the branch
✅ Transparent fee schedule & amortization
✅ Privacy notice & proper consent (OLPs)
✅ No harassment, shaming, or privacy abuses
✅ Receipts and statements issued

Final thought

In the Philippines, the single most important proof that a lending or financing company is legally allowed to operate is the SEC Certificate of Authority—not merely the incorporation certificate. Always ask for it, verify it against SEC records, and make sure the name on your loan documents matches the name on the CA. If anything looks off, treat it as a red flag and report the matter to the SEC (and NPC for privacy violations).