The digital financial landscape in the Philippines has seen a surge in Online Lending Applications (OLAs). While many provide legitimate credit access, a significant number operate outside the law, employing predatory interest rates and "shaming" tactics. Under Philippine law, two primary regulatory bodies oversee these entities: the Securities and Exchange Commission (SEC) and the National Privacy Commission (NPC).

Identifying an Illegal OLA

Before filing a complaint, it is crucial to determine the nature of the violation. A lending company is considered illegal or non-compliant if it fails to meet these two fundamental requirements:

Certificate of Incorporation: Proof that the entity is a registered corporation.
Certificate of Authority (CA): A specific license issued by the SEC to operate as a lending or financing company.

Note: Being registered as a corporation does not automatically mean a company is authorized to lend money. Without a CA, the lending activity is a criminal violation of the Lending Company Regulation Act of 2007 (R.A. No. 9474).

I. Reporting to the Securities and Exchange Commission (SEC)

The SEC regulates the business operations of lenders. You should file a complaint with the SEC if the OLA is unlicensed or is violating debt collection standards.

Grounds for SEC Complaints

Operating without a CA: The most common violation for "fly-by-night" apps.
Violation of SEC Memorandum Circular No. 18 (Series of 2019): This circular prohibits unfair debt collection practices, such as:
Using threats of violence or other criminal means to harm a person or their reputation.
Using profane or abusive language.
Disclosing the borrower's name as a "deadbeat" or "scammer" on social media.
Contacting people in the borrower’s contact list without consent (other than the listed guarantors).

How to File

Verify Status: Check the SEC website for the "List of Lending Companies with Certificate of Authority."
Prepare a Formal Letter/Form: Use the SEC's pro-forma complaint form for OLAs.
Submit Evidence: Attach screenshots of the loan agreement, transaction history, and proof of harassment (messages, call logs).
Send to the CGFD: Direct complaints to the Corporate Governance and Finance Department (CGFD) via email at cgfd_enforcement@sec.gov.ph.

II. Reporting to the National Privacy Commission (NPC)

The NPC takes jurisdiction when the OLA violates the Data Privacy Act of 2012 (R.A. No. 10173). This usually involves "contact tracing" or "contact-list grabbing."

Grounds for NPC Complaints

Unauthorized Processing: Accessing your phone’s contacts, gallery, or social media accounts without explicit and informed consent.
Harassment via Personal Data: Contacting people in your phone book to shame you or demand payment.
Failure to Provide a Privacy Notice: If the app does not clearly explain how your data will be used.

The Formal Process

Unlike the SEC, the NPC often requires a Formal Complaint that complies with the NPC Rules of Procedure.

Complainant's Affidavit: A sworn statement detailing the privacy violation.
Supporting Evidence: Digital evidence must be preserved (e.g., screenshots showing the app demanding permissions to "Contacts").
Filing: Submit through the NPC’s "Complaints and Investigation Division" or their online portal.

Summary of Jurisdiction

Issue	Primary Agency	Relevant Law
No License/Unregistered	SEC	R.A. 9474
Harassment/Threats	SEC	SEC MC No. 18
Contact List Grabbing	NPC	R.A. 10173
Online Shaming/Libel	NPC / PNP-ACG	Cybercrime Prevention Act

Evidence Checklist

To ensure a successful investigation, victims should compile the following:

App Details: Full name of the app, developer name, and the "Privacy Policy" (if available).
Digital Paper Trail: Screenshots of the loan terms, interest rates, and all payments made (e-wallet receipts or bank transfers).
Harassment Logs: Screenshots of SMS, Viber, or Facebook messages including the mobile numbers or profiles used by the collectors.
Affidavit of Loss/Damage: If the harassment resulted in job loss or severe emotional distress.

Additional Recourse: PNP-ACG

For cases involving Grave Threats, Extortion, or Cyber-Libel, victims are encouraged to report simultaneously to the Philippine National Police - Anti-Cybercrime Group (PNP-ACG). This is particularly effective if the collectors are using "death threats" or "pornographic shaming" as a tactic.