Overview

Online lending in the Philippines is tightly regulated. Only Financing Companies (FCs) and Lending Companies (LCs) that (1) are duly incorporated with the Securities and Exchange Commission (SEC) and (2) hold a Certificate of Authority (CA) to operate may legally offer consumer loans. If they conduct lending through a website or mobile app, each distinct Online Lending Platform (OLP) they operate must also be registered with the SEC under the operator-company’s CA.

This article explains the legal framework, the exact places and documents you should check, how to verify a platform or app end-to-end, how to interpret common edge cases (rebrands, reskinned apps, white-label operators), and what to do if a platform is not on the SEC’s list.

Key idea: A legal OLP has two layers of authorization—(A) the company’s CA to operate as an LC/FC, and (B) SEC recognition of the specific app/website it uses for lending.

Governing Laws & Rules (Philippine Context)

Republic Act No. 8556 (Financing Company Act of 1998) and its IRR
Republic Act No. 9474 (Lending Company Regulation Act of 2007) and its IRR
SEC rules on OLPs (registration/disclosure, reporting of launches/closures, advertising and transparency)
Truth in Lending Act (R.A. 3765) – requires clear disclosure of finance charges and total loan cost
Data Privacy Act (R.A. 10173) – prohibits unauthorized contact scraping, “debt shaming,” and excessive data processing
SEC rate caps for unsecured consumer loans issued by LCs/FCs (caps on nominal/EIR and processing fees; verify current figures before relying on them in contracts or pleadings)

Practical note: Rate-cap numbers and specific OLP procedural circulars can change. Treat the SEC website, advisories, and memoranda as the controlling source when you check.

What Counts as an “Online Lending Platform”?

An OLP is the technology front end (app or site) through which an SEC-authorized LC/FC markets, evaluates, approves, disburses, and/or collects consumer loans. Registration is app/website-specific. If an operator runs several apps or domains, each must be registered.

Clues you’re looking at an OLP:

The app/website allows loan application or repayment;
Terms mention an LC/FC with a CA;
The privacy policy collects personal and device data;
The brand may differ from the legal corporate name (common with white-label providers).

The Official Sources You Must Check

There are three authoritative SEC artifacts you should consult—in this order:

List of LCs/FCs with a valid Certificate of Authority
- Confirms that the company is legally allowed to operate a lending/financing business.
List of SEC-registered Online Lending Platforms (OLPs)
- Confirms that the specific app/website (by brand name and, typically, package/URL) is registered under a particular LC/FC’s CA.
SEC Advisories / Orders (suspension, revocation, cease-and-desist, prohibited apps)
- Captures apps and operators subject to enforcement actions, including debt-shaming and unlicensed lending cases.

Tip: The SEC usually publishes the OLP list and updates as PDFs or table pages and posts advisories naming app titles and operator companies. Always note the publication/update date on the document you rely on.

Step-by-Step: How to Verify an OLP

A. Collect identifiers from the platform

App store page: exact app title, publisher/developer name, and package ID (Android) or bundle ID (iOS).
Website: full domain (and subdomain), company name in the Terms/Privacy pages.
In-app/legal pages: claimed corporate name, SEC Company Registration No., and CA number.

If the app/website refuses to disclose the legal operator and CA details, treat that as a red flag.

B. Verify the company’s CA

Search the SEC’s LC/FC CA list for the exact corporate name.
Confirm: (1) active CA status, (2) company address, (3) date of issuance/expiry (if shown), and (4) whether any suspension/revocation notes appear.

C. Verify the OLP itself

Open the SEC’s OLP list and look for:
- Exact app title and/or package/bundle ID (for mobile apps) or URL (for websites);
- The LC/FC under which the OLP is registered;
- Any status notations (e.g., active, discontinued, suspended).

Names are often stylized (e.g., “CashGo-PH” vs “CashGo PH”). Match character-for-character and cross-check the developer/publisher shown in the app store. If the brand changed, look for the old name in the list and check for a noted rebrand.

D. Screen for enforcement actions

Check SEC Advisories/Orders for:
- The app name (current and former) and the operator;
- Cease-and-desist, revocation, or prohibition lists.

E. Record your verification

For compliance or dispute purposes, take screenshots/PDF copies of the lists/advisories showing:

Document title, URL, and publication/update date;
The matched line(s) in the table for the company and OLP;
The app store page showing publisher and package ID.

How to Read the Listing (Common Pitfalls)

Brand vs. Legal Name
- The SEC list will show the legal LC/FC; the app brand may differ. That is legal so long as the OLP entry maps back to the CA-holding operator.
Group Structures and White-Labeling
- Some tech providers build apps for multiple LCs/FCs. Confirm which LC/FC owns your OLP entry.
Rebranded/Reskinned Apps
- If a brand changes but package ID/domain is the same, the SEC may reflect a new name in a later update. Until then, rely on unique technical identifiers.
Cloned or Look-Alike Apps
- Fraudsters mimic names but publish under different package IDs or non-listed publishers. The official OLP list won’t include clones—treat as unregistered.

If You Don’t Find the App on the Official OLP List

Stop: Treat the app as unregistered (even if the operator has a valid CA).
Check variants: Search for prior brand names and the package/bundle ID.
Escalate:
- File a complaint with the SEC (Enforcement and Investor Protection Department / Corporate Governance and Finance Department),
- Report privacy abuses (contact scraping/debt shaming) to the National Privacy Commission,
- Report harassment or threats to PNP Anti-Cybercrime Group,
- For mobile apps, report to Google/Apple to request removal for policy and legal violations.

Keep evidence: screenshots of chats/collection threats, call logs, in-app pages, and your SEC/NP C reference numbers.

Consumer Protections You Can Invoke

Rate/fee caps for unsecured consumer loans by LCs/FCs (verify the current SEC circular before citing numbers in a complaint).
Truth in Lending Act: demand pre-loan disclosure of APR/EIR, fees, and total cost.
Data Privacy Act: you can complain about excessive permissions, contact scraping, or debt shaming (public shaming messages to friends/contacts).
Unfair Debt Collection: harassment, threats, or obscenity may trigger administrative and criminal liability under various laws (including the Revised Penal Code and special laws).

Due Diligence Checklist (Use Before You Borrow or Partner)

□ LC/FC appears on SEC CA list (active)
□ App/website appears on SEC OLP list under the same LC/FC
□ No SEC advisory/order against the company or the app
□ App store publisher matches the listed operator or disclosed affiliate
□ Terms/Privacy disclose the legal operator, address, and contact
□ Pricing is transparently stated (APR/EIR and fees)
□ Permissions are limited to what the service needs (no contacts/gallery scraping)
□ Collection practices comply with fair-collection standards

Frequently Asked Questions

Is a Certificate of Incorporation enough? No. The operator must hold a Certificate of Authority as an LC/FC. Without a CA, lending is illegal even if the entity is incorporated.

If the company has a CA but the app isn’t on the OLP list, is that okay? No. Each OLP must be registered. Lending via an unregistered app/site exposes the operator to SEC enforcement and renders the platform illegal.

What if the app says it “partners with” a listed LC/FC? Partnership language is not authorization. The specific app must still appear on the SEC OLP list under that LC/FC.

The app’s name changed. How do I check? Match the package/bundle ID and publisher; then look for the previous brand on the SEC list and check for updated entries in later versions.

Where do I complain about debt shaming? File with the SEC (illegal lending/collection), the National Privacy Commission (unlawful processing), and the PNP-ACG (harassment/cybercrime). Keep your evidence.

Practical Templates

Short internal memo after verification

On [date], we verified that [App/Website] (package/bundle ID [ID]) is [listed/not listed] on the SEC Online Lending Platforms list, operated by [LC/FC name] with CA No. [number]. We also checked the SEC CA list (status: [active/suspended/revoked]) and advisories ([none / advisory dated ___ re: ___]). Evidence: screenshots saved at [location].

Consumer-facing advisory

Before using [App], confirm that the company has an SEC Certificate of Authority and the app/website is on the SEC OLP list. If either check fails, do not proceed and consider reporting to the SEC.

Bottom Line

To legally operate an online lending app or site in the Philippines, an operator must (1) be a duly registered LC/FC with an active SEC CA, and (2) list each app/website as an authorized OLP with the SEC. Your verification is only complete when both layers check out and there are no enforcement advisories against the operator or the platform.

When in doubt, don’t borrow—and document everything.