In recent years, the proliferation of mobile lending applications in the Philippines has been accompanied by widespread complaints of aggressive debt-collection practices. Borrowers who default on short-term, high-interest loans often face relentless harassment through text messages, phone calls at unreasonable hours, public shaming on social media, unauthorized contact with family members or employers, and even the dissemination of personal photographs or loan details. These tactics not only cause severe emotional distress but also violate multiple Philippine statutes. Two key government agencies—the Securities and Exchange Commission (SEC) and the National Privacy Commission (NPC)—possess distinct yet complementary mandates to address such misconduct. This article provides a complete exposition of the legal bases, procedural requirements, evidentiary standards, and post-filing remedies available when reporting online lending app harassment to the SEC and the NPC.

I. Legal Framework Governing Online Lending and Harassment

A. Regulation of Lending Activities by the SEC

The SEC derives its authority from Republic Act No. 8799 (Securities Regulation Code), Presidential Decree No. 902-A (as amended), and Republic Act No. 9474 (Lending Company Regulation Act of 2007). Under these laws, any entity engaged in the business of lending money, whether traditional or digital, must be registered with the SEC as a lending company or financing company. Most online lending apps operate as corporations or partnerships and are required to secure a Certificate of Authority to Operate. Unlicensed operation constitutes a serious violation punishable by fines, cease-and-desist orders, and criminal prosecution under Section 8 of R.A. 9474.

Harassment itself is not directly regulated by the SEC, but the Commission treats abusive collection practices as evidence of “unfair, fraudulent, or deceptive” conduct under its consumer-protection mandate. When an app employs such tactics, the SEC may revoke its license, impose administrative penalties ranging from ₱100,000 to ₱1,000,000 per violation, and refer the case to the Department of Justice for criminal prosecution. Additionally, the SEC’s Fintech Supervisory Framework and its Memorandum Circulars on Digital Lending Platforms explicitly prohibit collection methods that violate public policy or human dignity.

B. Data Privacy Violations Cognizable by the NPC

Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations (IRR) govern the processing of personal information. Online lending apps are classified as “personal information controllers” (PICs) or “personal information processors” (PIPs). When they collect borrower data—phone numbers, addresses, employment details, photos, or social-media accounts—they must obtain informed consent, ensure proportionality, and implement security measures.

Harassment tactics frequently breach the following principles:

Purpose limitation and proportionality (Section 11, R.A. 10173) – using data solely for debt collection beyond what is necessary;
Unauthorized disclosure (Section 13) – sharing information with third parties (family, friends, employers) without consent;
Inaccuracy and integrity – publishing false or exaggerated debt information;
Security and confidentiality – failure to protect data from public exposure.

Violations are punishable by administrative fines of up to ₱5,000,000 per offense, imprisonment of one to six years, and civil liability for damages. The NPC also has the power to issue cease-and-desist orders, require data deletion, and impose mandatory privacy-impact assessments on erring apps.

C. Overlapping Criminal and Civil Liabilities

While SEC and NPC proceedings are administrative, the same acts may constitute crimes under:

Revised Penal Code (unjust vexation, Article 287; grave coercion, Article 286; libel or slander, Articles 353-359);
Republic Act No. 10175 (Cybercrime Prevention Act) – online libel, cyberstalking, or unauthorized access to personal data;
Republic Act No. 11462 (Anti-Online Sexual Abuse or Exploitation of Children, if minors are involved).

Victims may therefore pursue parallel remedies: administrative complaints before SEC/NPC, criminal complaints before the prosecutor’s office or National Bureau of Investigation (NBI), and civil suits for damages in regular courts.

II. Preparing Evidence for a Strong Complaint

A successful report hinges on documentary evidence. Victims should compile, in chronological order:

Screenshots of all threatening messages, including timestamps and sender details;
Call logs showing dates, times, and frequency (especially calls after 8:00 p.m. or before 8:00 a.m., prohibited under SEC guidelines);
Loan agreements or app terms of service (to prove exorbitant interest rates exceeding the 36% per annum cap under the Usury Law as revived by BSP Circulars);
Proof of unauthorized third-party contacts (e.g., screenshots of messages sent to relatives or employers);
Public shaming posts on Facebook, Viber groups, or other platforms;
Affidavits from witnesses (family members or colleagues who received the calls);
Bank statements or e-wallet records showing payments made under duress;
Medical certificates if harassment caused anxiety, depression, or hospitalization.

All evidence must be preserved in its original digital form; tampering may weaken the case.

III. Step-by-Step Procedure to Report to the SEC

Verify the Lender’s Registration Status
Visit the SEC’s official website (www.sec.gov.ph) and search the Company Registration and Monitoring System (CRMS) or the “Online Lending Platforms” list. Note whether the app is licensed or listed as “advised against” or “illegal.”
File the Complaint Electronically
The SEC accepts complaints through its online portal at complaints.sec.gov.ph or via the “eComplaint” system. Select “Lending Companies” or “Fintech/Online Lending” as the category. The form requires:
- Personal details of the complainant;
- Name and exact app name (including company name if known);
- Detailed narration of facts;
- Upload of all supporting evidence (PDF or JPEG, maximum 10 MB per file).
Alternative: Physical Filing
Complaints may be filed in person at the SEC Main Office (EDSA, Mandaluyong City) or any Regional Extension Office (REO). Bring two copies of the complaint and evidence.
Acknowledgment and Investigation
The SEC issues a reference number within 24–48 hours. The Enforcement and Investor Protection Department (EIPD) conducts an initial evaluation. If meritorious, the Commission issues a Show-Cause Order to the lender, requiring an answer within 15 days. Hearings may be conducted virtually or in person.
Possible SEC Outcomes
- Cease-and-desist order stopping all collection activities;
- License revocation and blacklisting;
- Imposition of fines;
- Referral to the DOJ for criminal charges under R.A. 9474.

The entire administrative process typically lasts 60–120 days, though urgent cases involving public shaming may be expedited.

IV. Step-by-Step Procedure to Report to the NPC

Confirm the Privacy Breach
The NPC website (www.privacy.gov.ph) maintains a public list of registered PICs. Most lending apps are required to be registered; unregistered processing is itself a violation.
Submit the Online Complaint
Use the NPC’s “File a Complaint” portal (npc.gov.ph/complaint). The system is fully electronic and requires:
- Complainant’s full name, contact details, and proof of identity (uploaded ID);
- Name of the lending app and its Data Protection Officer (if known);
- Specific sections of the Data Privacy Act alleged to have been violated;
- Upload of evidence (screenshots, call logs, public posts).
A Data Privacy Complaint Form is generated automatically upon submission.
Physical or Email Filing
Complaints may also be sent by registered mail to the NPC Office (North Avenue, Quezon City) or emailed to complaints@privacy.gov.ph with the subject “Data Privacy Complaint – Online Lending Harassment.”
NPC Proceedings
The NPC assigns a case number and notifies the respondent within seven days. The respondent must answer within 15 days. The NPC may conduct mediation, issue a subpoena for additional evidence, or immediately issue a Privacy Compliance Order. If the breach is serious, the Commission may conduct an on-site investigation or require the app to conduct a privacy impact assessment.
NPC Sanctions
- Administrative fines up to ₱5 million;
- Mandatory data deletion and cease-and-desist on further processing;
- Publication of the violation on the NPC website (naming and shaming the app);
- Referral to the DOJ for criminal prosecution under Sections 25–30 of R.A. 10173.

NPC cases are generally resolved within 90–180 days.

V. Simultaneous Filing and Strategic Considerations

A victim may file with both agencies simultaneously because their jurisdictions are distinct: the SEC focuses on illegal lending and unfair practices, while the NPC addresses data misuse. Filing with one does not preclude the other. However, coordinate the evidence to avoid duplication; reference the SEC complaint number in the NPC filing and vice versa to demonstrate the interconnected nature of the violations.

VI. Additional Parallel Remedies

While awaiting SEC and NPC action, victims should:

Report the harassment to the Philippine National Police (PNP) Anti-Cybercrime Group or the nearest police station for blotter entry;
File a cybercrime complaint with the NBI Cybercrime Division;
Seek a Temporary Protection Order from a Regional Trial Court under the Anti-Violence Against Women and Children Act if the victim is female or a minor;
Demand credit repair from the Credit Information Corporation if false negative information was reported.

VII. Practical Tips for Victims

Immediately change all passwords and enable two-factor authentication;
Block all numbers associated with the app and instruct family members to do the same;
Refuse to pay “collection fees” or “penalty interest” not stipulated in the original contract;
Document every interaction after filing the complaint, as continued harassment may constitute contempt of the SEC/NPC orders;
Seek free legal aid from the Public Attorney’s Office (PAO), Integrated Bar of the Philippines (IBP) chapters, or university legal clinics.

VIII. Expected Outcomes and Enforcement

Successful complaints have resulted in the permanent shutdown of numerous illegal lending apps, deletion of borrowers’ data, refunds of usurious interest, and payment of moral and exemplary damages. SEC and NPC orders are enforceable through contempt proceedings and may be used as evidence in subsequent civil or criminal cases. Victims who suffer quantifiable losses (lost wages, medical expenses) may claim full indemnification.

By understanding the distinct yet synergistic roles of the SEC and the NPC, Filipino borrowers subjected to online lending app harassment possess powerful, accessible, and cost-free administrative remedies. Timely and well-documented reporting not only halts immediate abuse but also contributes to the broader regulatory crackdown on predatory digital lending practices in the Philippines.