This guide explains, in practical legal terms, how a borrower or business can verify whether a “lending company” is legitimate in the Philippines, how to read the regulatory landscape, and what red flags and remedies to know before you sign anything.

1) Why “verification” matters

Unregistered lenders expose you to abusive collection tactics, hidden charges, unenforceable or void contract terms, data-privacy risks, and difficulty asserting rights if disputes arise. Under Philippine law, lending and financing companies must be authorized by the Securities and Exchange Commission (SEC) before they can legally operate. Lending is a regulated activity; having a mayor’s permit or a DTI/SEC registration alone is not enough.

2) The legal framework—what the law requires

Lending Company Regulation Act of 2007 (R.A. 9474). Requires lending companies to be organized (usually as a corporation) and to secure a Certificate of Authority (CA) from the SEC before operating. Sets governance, capitalization, disclosure, and reporting expectations.
Financing Company Act of 1998 (R.A. 8556), as amended. Similar SEC regime for financing companies (often engaged in installment financing, leasing, or longer-tenor credit). Many verification steps are the same; just make sure you’re looking at the right license type.
Truth in Lending Act (R.A. 3765). Lenders must give a Disclosure Statement showing the finance charge, total amount to be financed, schedule, and the effective interest rate, before you are bound.
Data Privacy Act of 2012 (R.A. 10173). Lenders (especially online lending apps) must process personal data lawfully and proportionately, have a clear privacy notice, and secure your data. You can complain to the NPC for privacy abuses.
Financial Consumer Protection Act of 2022 (R.A. 11765). Elevates consumer rights (right to disclosure, protection against abusive collection, fair treatment) and empowers regulators like the SEC to enforce.
Usury Law & interest ceilings. While statutory ceilings were effectively suspended by Central Bank Circular No. 905 (1982), courts strike down unconscionable interest and penalty rates. Disclosed does not always mean enforceable if the rate is shockingly excessive.

3) “Lending” vs “Financing” vs everything else

Entity	Regulator	Can take deposits?	Typical license paper	Where you check
Lending Company	SEC	No	SEC Certificate of Authority (CA)	SEC list of licensed Lending Companies
Financing Company	SEC	No	SEC Certificate of Authority (CA)	SEC list of licensed Financing Companies
Banks/Thrift/Rural	BSP	Yes	BSP banking license	BSP directories (not the SEC list)
Pawnshops/Money Service	BSP	No	BSP registration	BSP directories
Sole prop “lenders”	—	—	DTI name reg only	Not enough to lend legally

4) The SEC’s lists and what to look for

The SEC maintains official lists of companies that (a) are registered and (b) hold a current Certificate of Authority to Operate as a Lending or Financing Company. These lists are periodically updated and typically show:

Exact corporate name (must match your contract/receipt).
Company/CA status (active/suspended/revoked).
Principal office address.
Sometimes trade/brand names or online app names (but don’t rely on brand alone—always match to the corporate entity).

Key rule: the brand/app name you see in ads or in the app store must tie back to a specific SEC-licensed corporation. If the contract and receipt use a different (or vague) name, treat it as a red flag.

5) Step-by-step: Verify a lender like a lawyer would

Identify the legal entity. Get the corporate name that will appear on the loan agreement and receipts. Don’t proceed on a brand name alone.
Check the SEC for a Certificate of Authority (CA). Confirm the company is on the SEC’s list of Lending/Financing Companies and that the CA is active. Screenshots or printed pages help your records.
Cross-check corporate documents. Ask for (and inspect):
- SEC Certificate of Incorporation/Registration;
- Certificate of Authority to operate as a lending/financing company;
- Latest General Information Sheet (GIS) or at least a document showing authorized officers.
Match the names everywhere. The corporate name should match loan agreement, disclosure statement, OR/acknowledgment receipt, official website/app imprint, and collection letters. Mismatches suggest a pass-through or shadow operator.
Confirm business permits and BIR registration. A Mayor’s Permit and BIR Certificate of Registration (Form 2303) should be current. While these don’t legalize an unlicensed lender, their absence is a strong red flag.
Demand pre-contract disclosures (R.A. 3765). Insist on a Disclosure Statement with:
- Total amount financed and term;
- Nominal and effective interest rate;
- All fees/charges, including late penalties, collection fees, and any “processing” fee;
- Amortization schedule (dates/amounts). Don’t sign if numbers are missing or “to follow.”
Review the privacy notice (R.A. 10173). Check what data is collected (e.g., contacts, photos, GPS). Access to your contact list is rarely necessary for a loan and is a major red flag.
Check the collection policy. The company should have a written policy forbidding harassment, threats, public shaming, doxxing, or contacting your employer/relatives without basis. Any “waiver” of your privacy or consent to be shamed is invalid/unenforceable.
Inspect repayment channels. Payments should go to the company’s bank account or official payment partners and be receipted in the corporate name. Personal accounts = red flag.
Keep evidence. Save copies of IDs you gave, contracts, disclosures, receipts, screenshots of the app listing, and your verification steps.

6) Red flags that usually mean “walk away”

No SEC Certificate of Authority (or “pending/for processing”).
Corporate name ≠ brand/app name, or “d/b/a” with no evidence of use authorization.
Upfront fees before approval or cash release.
Guaranteed approval and no income/ID verification.
Requires access to your phone contacts, photos, SMS, or threatens to message them.
No Disclosure Statement or refuses to show an effective interest rate.
Interest/penalty structure that looks like loan-sharking (e.g., very high daily rates, rolling fees).
Receipts under a different entity or cash collection by individuals without proper IDs/authority.
Harassment scripts in the contract (threats, shaming, seizure of personal items like ATM cards/IDs).
Uses cryptic QR codes or personal e-wallets for repayments.

7) Special notes on Online Lending Platforms (apps)

App store presence is not proof of legality. Some platforms require proof of SEC authorization to list lending apps, but you must still match the app to a specific SEC-licensed corporation and confirm the CA is active.
Over-collection of data (contacts/camera/gallery) is a privacy red flag. You can refuse permissions that are not necessary for credit evaluation or KYC.
In-app disclosures must mirror the written Disclosure Statement. If the numbers differ, rely on the signed disclosure—and consider that discrepancy a risk signal.

8) Interest, fees, and what courts will strike down

No fixed ceilings, but courts routinely reduce or nullify interest and penalty rates deemed unconscionable (e.g., excessive compounding, “snowballing” penalties, hidden fees).
Charges must be disclosed up front. Surprise add-ons (e.g., “system fee,” “fast-track fee,” “insurance you didn’t want”) are contestable if not clearly explained and consented to.
Penalty vs interest. Penalties for late payment are separate from interest. If the total cost of credit balloons beyond reason, you may challenge the enforceability.

9) Your rights if things go wrong

Against abusive collection You can document calls, texts, emails, and social posts and complain to the SEC (for regulatory breaches) and the National Privacy Commission (for data mishandling, doxxing, unauthorized disclosure).
For privacy/data abuse Submit an NPC complaint with screenshots and logs. You can demand erasure or restriction of processing in certain cases.
Contract challenges in court If sued, you can raise defenses such as lack of SEC authority, unconscionable interest/penalties, or invalid consent to privacy-violating practices.
Criminal/administrative exposure for illegal lenders Operating without an SEC CA can lead to administrative sanctions and criminal liability under R.A. 9474 and related rules.

10) Due-diligence checklist (printable)

Entity & License

Exact corporate name (not just the brand/app)
SEC Certificate of Authority (active, correct entity)
SEC registration (corporation) + officers/authorized signatory

Permits & Tax

Mayor’s Permit (current)
BIR Certificate of Registration (2303) and proper ORs

Disclosure & Terms

Disclosure Statement (R.A. 3765) received before signing
Effective rate/APR and full fee list shown
Amortization schedule with dates/amounts
No blank fields in the contract

Privacy & Collection

Privacy Notice consistent with R.A. 10173
No unnecessary phone permissions (contacts/photos/SMS)
Collection policy bans harassment/shaming/third-party contacts

Payment Controls

Payee name = corporate name
Traceable bank/e-wallet under the corporate name
Official receipts issued correctly

Evidence

Copies/screenshots of SEC list entry and the CA
All communications and payment proofs saved

11) Frequently asked practical questions

Q: The company shows only a DTI Business Name Certificate. Is that enough? A: No. For lending, the operator must be a corporation with an SEC Certificate of Authority. A sole proprietorship with only DTI registration cannot lawfully operate as a lending company.

Q: The agent says they’re “covered” by a partner that has a license. A: The entity contracting with you must itself be authorized, or must be clearly acting as agent of the licensed entity—with contracts and receipts in the name of the licensed principal. Otherwise, treat it as unlicensed.

Q: The app’s developer name doesn’t match the lender. A: That’s common; developers can be third parties. What matters is whether the lender named in your contract and receipts holds an active SEC CA.

Q: They refused to give the Disclosure Statement until after I sign. A: That violates R.A. 3765 principles. Walk away.

Q: The interest seems high but I signed. Can I still contest it? A: Yes, courts may reduce unconscionable interest/penalties even if disclosed. Keep all documents; seek counsel.

12) How to escalate complaints (quick map)

SEC – Enforcement/Corporate Governance/FinTech desks: Unlicensed operations, abusive collection, misrepresentations, violations of lending/financing regulations.
National Privacy Commission (NPC): Unlawful data collection, doxxing/shaming, over-broad consents, data breaches.
BSP (if a bank or BSP-regulated entity): Misconduct by banks, e-money issuers, pawnshops, etc.
Local authorities/police/NBI: Harassment, threats, extortion.
Courts/CIAC/ADR: Contract disputes; ask counsel about proper forum.

13) Model borrower questions to ask a lender

“What is your corporate name and SEC Certificate of Authority number? May I have a copy?”
“Please provide the Disclosure Statement (R.A. 3765) before I decide.”
“What is the effective interest rate and all fees in pesos?”
“What data will you collect and why? Do you access my contacts?”
“If I’m late, what penalties apply? Do you engage third-party collectors?”
“Where do I pay, and will the receipt show your corporate name?”

14) Bottom line

To verify a Philippine lending company is legit, you need both (1) proof of SEC authorization (Certificate of Authority) that matches the exact corporate name on your contract and receipts, and (2) proper pre-contract disclosures and lawful data/collection practices. If any link in that chain is missing or fuzzy, don’t sign—and consider reporting it.

This article provides general legal information, not formal legal advice. For specific cases, consult a Philippine lawyer and check the most recent SEC issuances and lists.