How to Upgrade a Financing or Lending Company License to an Online Lending Platform (Philippines)

This article explains, in practical legal terms, how an SEC-licensed financing or lending company can lawfully “go online”—i.e., originate and service loans through a website and/or mobile app (an online lending platform or OLP)—under Philippine law. It covers the legal bases, governance, approvals, filings, compliance architecture, and a step-by-step project plan, with pitfalls and enforcement risks.

1) Legal foundations and scope

Core statutes

Financing Company Act of 1998 (Republic Act No. 8556) and Lending Company Regulation Act of 2007 (RA 9474) — require SEC registration and a Certificate of Authority (CA) to operate as a financing or lending company.
Anti-Money Laundering Act (RA 9160, as amended) — financing and lending companies supervised by the SEC are “covered persons” subject to KYC/CDD, sanctions screening, and reporting.
Data Privacy Act (RA 10173) — governs personal data processing, security, breach notification, and cross-border transfers.
Financial Products and Services Consumer Protection Act (RA 11765) — imposes market conduct standards (disclosure, suitability where relevant, fair treatment, complaints handling) on SEC-regulated firms.
Truth in Lending Act (RA 3765) — mandates clear disclosure of finance charges and the true cost of credit.
Credit Information System Act (RA 9510) — requires submission of borrower data to the CIC (through an accredited submitting entity).

Key regulators and touchpoints

Securities and Exchange Commission (SEC) — primary prudential and market-conduct supervisor; issues the CA, receives GIS/AFS, and administers specific OLP rules (reporting/clearances, advertising/collection standards).
National Privacy Commission (NPC) — registration of your DPO and data processing systems; breach handling.
Anti-Money Laundering Council (AMLC) — supervision for AML/CFT reporting and on-site/off-site compliance checks.
Bangko Sentral ng Pilipinas (BSP) — not your corporate supervisor (unless you are a bank/QB), but relevant if you use BSP-supervised e-money issuers (EMIs), payment gateways, or remittance channels for disbursement/collection.

What “upgrading to an OLP” means (legally)

You are not changing your primary license class (you remain a financing or lending company).
You are changing delivery channels and processing flows (digital onboarding, e-KYC, e-signatures, online disbursements/collections).
You trigger additional SEC/NPC/AMLC obligations on disclosures, reporting, privacy/security, and fair collection—plus technical/outsourcing controls.

2) Readiness checklist (corporate, capital, governance)

Corporate purpose & bylaws. Ensure your Articles/bylaws explicitly cover technology-enabled/online lending and use of third-party service providers/cloud. If not, prepare amendments for SEC approval.
Trade names & OLP branding. Register business/operating names, domain(s), and app titles you’ll use in stores; align with your SEC corporate name rules.
Paid-in capital. Confirm you meet minimum paid-in capital for your entity type and business scale. Maintain unimpaired capital consistent with regulatory expectations and your risk appetite.
Board structure. Constitute board-level oversight for risk, compliance, and information security. Approve an OLP Program Charter and policies described below.
Key officers. Designate:
- Compliance Officer (SEC/market conduct),
- AML Compliance Officer (AMLCO) and alternate,
- Data Protection Officer (DPO),
- Information Security Officer (ISO),
- Chief Risk Officer (CRO) (or equivalent function).

3) SEC touchpoints specific to going online

Amendments, if needed. File corporate amendments (purpose/bylaws/secondary purposes) to expressly authorize online origination/servicing and digital channels.
OLP reporting/clearance. Before public rollout, notify and/or report your online lending platforms (websites and mobile apps) to the SEC, including:
- Legal and contact details; CA number;
- Exact URLs, domain ownership evidence;
- App names, developer/publisher account IDs, and store links;
- Screenshots of onboarding, disclosures, consent, repayment, and complaint channels;
- Terms & Conditions, Privacy Notice, Fair Collection Policy;
- Third-party service providers used (KYC tech, cloud/hosting, analytics, collections, payment partners);
- Customer support details and physical principal office.
Update SEC before any change in OLP name, URL, app store listing, or material features.
Advertising & disclosure rules. All online ads and app store pages must show your full corporate name, SEC CA number, principal office, and clear, truthful pricing (no bait rates or hidden fees). Retain ad copies for audit.
Debt collection standards. Adopt and publish a Fair Collection Policy aligned with SEC rules (no harassment, “debt-shaming,” threats, or contacting a borrower’s contacts; call-time windows; agent identification; audio recording standards).
Routine filings continue. AFS, GIS, beneficial ownership disclosures, and special reports as required.

4) NPC (privacy) program for OLPs

Register with the NPC:
- DPO,
- Data Processing Systems (DPS) for your OLP (lending, collections, analytics),
- Outsourcing/third-party processors (KYC vendors, cloud providers, call centers).
Data inventory & minimization. Map personal data you collect (IDs, biometrics/liveness, device data, geolocation, contacts—avoid unless strictly necessary). Do not harvest contact lists or photos unrelated to credit analysis; this is both a privacy and market-conduct risk.
Privacy notices & consent. Layered privacy notice; lawful basis (often contract and legitimate interests). Obtain separate, granular consent where required (e.g., marketing).
Cross-border transfers. Ensure adequate safeguards (DPAs, SCC-style clauses) for data stored/processed overseas; disclose countries and processors.
Security controls. Written ISMS covering encryption in transit/at rest, access controls, logging, vulnerability management, secure SDLC, vendor risk. Maintain PAIAs/PIAs for your OLP and high-risk processes.
Breach management. 72-hour assessment and notification rules; maintain an incident register and playbooks.

5) AML/CFT digital onboarding

Register with AMLC (e.g., goAML), designate AMLCO, and file the money laundering/terrorism financing prevention program (MLPP).
Customer due diligence. Establish risk-based onboarding, including:
- Reliable remote identity verification (government ID OCR, NFC where available, liveness/face match),
- Name screening for sanctions/PEPs/adverse media,
- Beneficial ownership where applicable (non-individuals),
- Ongoing monitoring and event-driven reviews.
Recordkeeping. Retain CDD and transaction records for statutory periods.
Reporting. Timely STRs/CTRs through goAML; documented thresholds and red flags.
Outsourcing. If using a third-party KYC vendor, keep ultimate responsibility, audit rights, and data quality controls.

6) Consumer protection & market conduct (RA 11765)

Key Facts Statement (KFS). Provide a one-page, plain-language summary: principal, term, APR/total cost, fees, due dates, consequences of late payment, and complaint contacts.
Suitability & affordability. Use fair, explainable credit scoring; avoid products clearly unsuitable for the borrower’s financial profile.
Complaints handling. A two-tier complaint process, clear turn-around times, and multiple channels (in-app, email, hotline, physical office). Maintain a complaints log and root-cause program.
Collections. Zero tolerance for harassment, public shaming, or contacting uninvolved third parties. Train staff/agents; monitor calls; enforce escalation/QA.
Vulnerable customers. Special handling for financial hardship and disaster-affected borrowers (payment holidays or restructuring options where appropriate).

7) The technology & outsourcing control stack

Policies and artifacts to prepare:

OLP Program Charter (scope, roles, governance),
Information Security Policy and Acceptable Use,
Secure SDLC and Change Management,
Vendor/Cloud Risk Management (due diligence, DPAs, SLAs, exit plans),
Business Continuity & Disaster Recovery (RTO/RPO),
Cyber Incident Response Plan (with law-enforcement/contact trees),
Model Risk Management for credit scoring (data lineage, fairness testing, back-testing),
Logging & Monitoring (SIEM, fraud analytics, device fingerprinting).

Testing before go-live:

VAPT and code review,
Privacy impact assessment sign-off,
Table-top exercises for fraud and data breach scenarios,
Dry-run of AMLC reporting and complaints workflow.

8) Payments, disbursements, and collections

Disbursement via bank transfer, BSP-supervised EMI, or check. Contractually fix cut-off times, fees, and reversal procedures.
Repayments via PESONet/Instapay, OTC partners, EMIs, or auto-debit. Provide receipts and real-time posting where feasible.
Chargebacks & reversals. Document dispute windows; maintain reconciliation and breakage controls.
Cash handling. Avoid unless strictly necessary; if used, strengthen controls and audit trails.

9) Pricing & disclosures

Publish all fees (processing, late/penalty, convenience, collection, prepayment, renewal) and the effective interest rate/APR.
Present a comparison table in-app before acceptance; allow downloadable KFS and pre-contract information (PCI).
E-signatures (RA 8792) are valid if you keep a robust audit trail (consent capture, IP/device, OTP/2FA, timestamping) and provide post-acceptance copies (contract, KFS, schedule).

10) Credit bureau (CIC) obligations

Onboard with CIC (directly or through an accredited submitting entity).
Submit positive and negative data regularly; retrieve reports (with borrower consent) for underwriting.
Disclose CIC use in your privacy notice and KFS.

11) Tax considerations (high-level)

Documentary Stamp Tax (DST) typically applies to loan instruments; embed DST computation in your contract flows.
Income/Gross receipts taxes and withholding (where applicable) on interest/fees.
E-invoicing/e-receipting compliance if you cross applicable thresholds.

Coordinate early with tax counsel to map system logic to tax rules (DST triggers, timing, and reporting).

12) Step-by-step project plan (90–120 days is common)

Phase 1 — Strategy & governance (Weeks 1–3)

Gap assessment vs. current license and operations.
Board approval of OLP strategy, budget, and OLP Program Charter.
Name/domain/app title reservations; draft corporate amendments (if needed).

Phase 2 — Policy & vendor build (Weeks 2–8)

Draft/approve: MLPP, privacy policy & PIAs, ISMS, fair collection policy, advertising/disclosure standards, complaints policy, outsourcing policy.
Select tech stack: onboarding/KYC, scoring, loan management system (LMS), payment rails, collections suite, cloud.
Prepare AMLC registration package; start DPO/DPS NPC registrations.

Phase 3 — SEC/NPC filings & controlled build (Weeks 5–10)

File corporate amendments (if applicable).
Prepare SEC OLP reporting pack (app/URL details, screenshots, policies).
Integrations, UAT, VAPT; draft customer-facing contracts (T&Cs, KFS, privacy).

Phase 4 — Dry run & go-live (Weeks 9–14)

Pilot with staff/friends-and-family under tight limits.
Validate STR/CTR pipelines, complaint SLAs, collection scripts.
Finalize store listings with required disclosures; submit/update SEC OLP report.
Launch with phased limits and enhanced monitoring.

Phase 5 — Steady state (Post-launch)

Monthly compliance dashboard to the board (volumes, complaints, breaches, STRs, vulnerability backlog).
Material change protocol: notify SEC/NPC before rolling out new data types, analytics, or app names.

13) Contracts and artifacts (what to have on file)

Customer: Loan Agreement, KFS, PCI, Consent & Privacy Notice, E-signature terms, Auto-debit authorization (if used), Hardship/Restructuring terms, Collections policy summary.
Vendors: Master Services Agreement, Data Processing Agreement, InfoSec addendum, AML/KYC responsibility matrix, Sub-processor list, Right-to-audit clause, Exit/portability.
Internal: MLPP, ISMS, Cyber IRP, BCP/DRP, Model documentation, Complaints SOP, Advertising approval SOP.

14) Common pitfalls (and how to avoid them)

Launching the app before SEC OLP reporting → Risk of cease-and-desist and app-store takedowns. Fix: Complete reporting/clearances first and keep them updated.
Excessive data collection (e.g., phone contacts, photos) → Privacy and market-conduct violations. Fix: Strict data minimization; document necessity in PIAs.
Debt-shaming and aggressive collections → Major enforcement and reputational risk. Fix: Scripted, recorded, and QA-reviewed contacts; enforce vendor discipline.
Opaque pricing → Violates TILA/consumer protection rules. Fix: Prominent, consistent APR/total cost; pre-contract disclosures and downloadable KFS.
Weak vendor controls → Breaches and downtime. Fix: Due diligence, DPAs, SLAs, RTO/RPO, penetration testing, exit plans.
AML reporting gaps → Regulatory and criminal exposure. Fix: Automate triggers; test goAML filings; train frontline staff.

15) Practical “go-online” compliance pack (table of contents)

Board-approved OLP Program Charter
Corporate amendments and name/brand registrations
SEC OLP Reporting Dossier (URLs, app IDs, screenshots, policies)
Advertising & Disclosure Standard (with sign-off workflow)
Fair Collection Policy and scripts
MLPP, KYC/CDD SOPs, sanctions screening SOP
Privacy Program: DPO appointment, data map, PIAs, privacy notice, cross-border safeguards
ISMS: access control, encryption, logging, VAPT, incident response
Vendor/Cloud: DD reports, DPAs, SLAs, sub-processor register
Consumer Protection: KFS templates, complaint SOP, hardship SOP
CIC Integration: submission and inquiry SOPs
Tax & DST SOP and system rules
Training Plan (onboarding, privacy, AML, collections)
Launch Runbook and rollback plan
Post-Launch Monitoring dashboard and regulatory notification log

16) Frequently asked implementation questions

Do we need a new SEC primary license? No. You retain your financing/lending CA; you add online channels and comply with OLP reporting/requirements.

Can we outsource e-KYC, cloud hosting, or collections? Yes, but you remain fully responsible. Use DPAs, audit rights, KPIs/SLAs, and ensure compliance with AML, privacy, and collection rules.

Are electronic loan contracts enforceable? Yes, if you follow the E-Commerce Act and maintain robust consent, identity, and integrity evidence (2FA/OTP, device and timestamp logs, immutable storage).

What about interest caps or fee limits? Price transparently and check current regulatory issuances before launch. Your disclosures must reflect total cost of credit and any penalties.

When must we notify SEC/NPC again? Before rolling out new apps/URLs, changing app names, launching materially new data processing (e.g., biometrics), or engaging new critical vendors.

17) Executive summary: the fast path to compliant OLP launch

Align corporate purpose and board governance.
Stand up compliance: AML (AMLC registration), Privacy (NPC DPO/DPS), Consumer Protection (KFS, complaints), Fair Collections.
Engineer the stack with secure SDLC, vendor controls, and proven payment rails.
Complete SEC OLP reporting with full disclosures and artifacts.
Pilot, test, and document (VAPT, PIAs, STR/CTR pipeline, complaints handling).
Launch with monitored limits and a plan for rapid remediation.

Final note

This article provides a comprehensive, practice-oriented roadmap. Specific documentary requirements and formats evolve; align your implementation with the most current SEC/NPC/AMLC circulars and your firm’s risk profile, and have counsel review the filing set, consumer disclosures, and vendor contracts before go-live.