The rise of Financial Technology (FinTech) has made credit more accessible, but it has also opened the door to predatory practices. Many Filipinos find themselves victims of "debt-shaming," exorbitant interest rates, and data privacy violations by unscrupulous Online Lending Apps (OLAs).

If you are facing harassment or unfair treatment, the Philippine legal system provides several avenues for redress.

1. Identifying Violations

Before filing a complaint, identify which laws or regulations the OLA has violated. Common infractions include:

Harassment and Unfair Collection Practices: Under SEC Memorandum Circular No. 18 (Series of 2019), lenders are prohibited from using threats, profanity, or "debt-shaming" (contacting people in your phone directory who are not co-makers).
Violations of the Data Privacy Act (RA 10173): Accessing your contacts, gallery, or social media accounts without informed consent, or using that data to harass you.
Truth in Lending Act Violations (RA 3765): Failure to clearly disclose the total cost of the loan, including interest, processing fees, and penalties before the transaction.
Usurious Interest Rates: While there is no longer a formal "Usury Law," the Supreme Court often strikes down "unconscionable" interest rates (usually those exceeding 3-4% per month).

2. Where to File: The Key Agencies

Depending on the nature of the violation, you should approach one or more of the following regulatory bodies:

A. Securities and Exchange Commission (SEC)

The SEC is the primary regulator of lending and financing companies.

Best for: Unregistered OLAs, harassment, and violations of disclosure requirements.
How to file: You can submit a formal complaint through the SEC Corporate Governance and Finance Department or via their online portal (e-CIRS).
Requirement: Ensure you check if the OLA is on the SEC’s "List of Recorded/Registered Lending Companies." If they aren't registered, they are operating illegally.

B. National Privacy Commission (NPC)

Best for: "Contact tracing" harassment, unauthorized access to your phone, and public shaming on social media.
Process: You must first send a Letter of Discovery/Request to the OLA's Data Protection Officer (DPO). If they do not act within 15 days, you file a formal complaint with the NPC.

C. Bangko Sentral ng Pilipinas (BSP)

Best for: If the OLA is operated by a bank or an electronic money issuer (like those integrated into major e-wallets).
Process: Use the BSP Online Buddy (BOB) chatbot on their website or Facebook page.

D. PNP Anti-Cybercrime Group (PNP-ACG) or NBI Cybercrime Division

Best for: Criminal acts such as Grave Threats, Cyber Libel, or Online Extortion.
Action: You can visit their offices personally to swear an affidavit of complaint.

3. Step-by-Step Filing Process

Gather Evidence: Take screenshots of harassing text messages, call logs, social media posts, and the loan agreement/disclosure statement.
Verify Registration: Check the SEC website to see if the OLA has a Certificate of Authority (CA) to operate as a lending/financing company.
Send a Formal Demand: (Optional but recommended) Send a formal email or letter to the OLA demanding they cease the illegal activity. This serves as proof of their bad faith if they continue.
Submit the Complaint: * Draft a Complaint Affidavit (a sworn statement detailing the facts).

Attach your evidence as "Annexes."
Submit to the relevant agency (SEC for licensing, NPC for data privacy).

4. Important Legal Protections

Pro-Tip: Under SEC rules, lenders are strictly prohibited from contacting people in your contact list unless they were named as guarantors or co-makers. Any form of "social shaming" is a ground for the revocation of their license.

If an OLA is unregistered, they have no legal standing to sue you for collection in a Philippine court, though the principal debt remains a civil obligation. However, their lack of registration makes them criminally liable under the Lending Company Regulation Act of 2007.

Would you like me to draft a template for a formal complaint letter to the SEC or a demand letter to the OLA's Data Protection Officer?