How to Verify Legit Online Lending Apps in the Philippines (SEC Registration and “Whitelist”)

This guide explains, in Philippine legal context, how to vet online lending apps (OLAs/OLPs) for legitimacy, what the Securities and Exchange Commission (SEC) requires, how the “whitelist” concept works, what documents and disclosures you should look for, and what red flags and remedies apply.

1) Who regulates what?

Securities and Exchange Commission (SEC) – Regulates lending companies and financing companies and their online lending platforms (OLPs) under the Lending Company Regulation Act (R.A. 9474), the Financing Company Act (R.A. 8556), the Securities Regulation Code, and SEC Memorandum Circulars (MCs) on OLPs and debt-collection practices.
Bangko Sentral ng Pilipinas (BSP) – Regulates banks and BSP-supervised institutions (not ordinary lending/financing companies).
National Privacy Commission (NPC) – Enforces the Data Privacy Act (R.A. 10173) as to personal data collected by apps and their service providers (e.g., contact scraping, coercive data use).
Department of Trade and Industry (DTI) – Consumer protection for deceptive or unfair trade practices.
PNP Anti-Cybercrime Group / NBI – For criminal complaints (e.g., harassment, doxxing, threats), alongside SEC/NPC actions.

Practical upshot: For non-bank lending apps, the SEC is the primary gatekeeper; the NPC polices data practices; DTI and law enforcement handle consumer and criminal aspects.

2) The two SEC approvals you must see

Legitimate non-bank lending apps sit on top of a corporate entity that has two layers of SEC authority:

Primary registration (juridical existence)
- Certificate of Incorporation (or License to Do Business for a foreign corp).
- This alone is not enough to lend.
Secondary license to operate as a lender/financier
- Certificate of Authority (CA) to operate as a Lending Company (R.A. 9474) or as a Financing Company (R.A. 8556).
- The CA is the key license. Without it, lending to the public is unlawful.

Online Lending Platform/“Whitelist” angle: SEC requires that each OLP/app be connected to a company that holds a valid CA and that the OLP itself be properly notified/registered with the SEC under that same company. The SEC publishes a current list of allowed/registered OLPs (often informally called a “whitelist”) and also maintains advisories/blacklists against unlawful or abusive operators.

Brand names vs. corporate names: App store names often differ from the SEC-registered corporate name. What matters is that the app’s publisher/owner (disclosed in the app listing, privacy policy, and website) exactly matches the SEC-licensed entity (or an authorized affiliate) and that the app itself appears on the SEC’s list of allowed OLPs for that entity.

3) How to verify an online lending app (step-by-step)

Get the exact corporate identity behind the app.
- From the app store page and the in-app privacy policy, note the legal name, principal office address, SEC CA number (if shown), and email/phone.
- Beware when only a brand is given and there’s no corporate name.
Confirm the company has an SEC Certificate of Authority (CA).
- Check the company’s exact name (spelling, punctuation) against SEC’s published list/database of lending/financing companies with active CAs.
- CA details typically include CA number, status (active/revoked), and issue date.
Confirm the app is on the SEC’s allowed OLP list for that company.
- The SEC list identifies each approved app/OLP and the company it belongs to.
- If the app brand is not listed, treat it as suspect even if the company itself has a CA.
Cross-check disclosures inside the app.
- Look for corporate name (not just brand), SEC CA number, APR/rate and fee breakdown, tenor, repayment channels, complaints contact.
- Verify that repayments go to an account in the company’s name, not to a personal e-wallet or personal bank.
Review data-privacy compliance.
- There must be a clear Privacy Notice, lawful basis for processing (consent/contract/legitimate interest), named Data Protection Officer, and channels for data subject rights (access, correction, deletion, complaint).
- Excessive permissions (e.g., contact list scraping, SMS/call logs, photo gallery) without necessity are red flags under the Data Privacy Act.
Check for prior SEC/NPC advisories.
- Look up SEC advisories against the brand or its operator and NPC public statements on abusive apps.
- Apps subject to cease-and-desist or revocation should be avoided even if they still appear in app stores.
App store conformity.
- Official app stores require proof of local authorization for lending apps and may remove violators. Lack of proper disclosures on the store page is a warning sign.

4) What a compliant lender/app must show you

Exact corporate name (matching SEC records) and principal office address in the Philippines.
SEC Certificate of Authority number and type (Lending or Financing company).
The app’s inclusion in the SEC’s allowed OLP list under that same company.
Transparent cost of credit: APR or effective interest rate, itemized fees (convenience, processing, late charges), repayment schedule, and sample computations.
Fair collection practices notice consistent with SEC rules (no threats, no shaming, no profanity, no contact-list harassment).
Privacy Notice compliant with the Data Privacy Act; named DPO and contact channel.
Complaints channel (email/phone) and reference to SEC and NPC avenues.

5) Red flags that typically indicate an illegitimate or non-compliant app

No SEC CA for the operator; or app not on the SEC OLP list.
Mismatch between app brand/publisher and SEC-licensed corporate name.
Demands for contact list access or threatens to message your contacts if you’re late.
Harassment/shaming via texts, group chats, social media, workplace contacts.
No physical office or only foreign addresses with no Philippine presence.
Repayments to personal accounts or random e-wallets, or frequent account changes.
Hidden fees that reduce the disbursed amount dramatically vs. the “approved” principal.
Unrealistic tenors (e.g., “90-day loan” that demands full payment in 7–14 days).
No Privacy Notice / no DPO / refuses to honor data-subject rights.
Clone apps mimicking known brands with small spelling changes.

6) Debt-collection rules you can expect a legit app to follow

SEC rules on unfair collection practices (applicable to financing/lending companies and their OLPs) generally prohibit:

Profanity, threats, intimidation, or violence;
Shaming (posting your debt on social media, messaging your contacts, workplace, or family);
False representations (e.g., pretending to be a lawyer, officer, or court representative);
Contacting persons other than you about your debt, except for limited location/skip-trace information under strict safeguards;
Contacting you at clearly inconvenient times or in a harassing manner.

Breaches can lead to SEC administrative sanctions (fines, suspension/revocation of CA, cease-and-desist) and, depending on conduct, criminal liability under other laws (e.g., anti-cybercrime, grave threats, unjust vexation), plus data-privacy penalties if personal data is misused.

7) Interest rates and fees: what the law expects

For non-bank lenders, there is no across-the-board statutory usury cap (traditional usury ceilings were suspended decades ago).
Nevertheless, lenders must ensure clear disclosure, no misrepresentation, and no unconscionable or grossly unfair charges under general consumer-protection principles.
Some sectors (e.g., credit cards or special programs) have regulatory caps—but these do not automatically apply to all online lending companies. Always review the APR and total cost of credit disclosed by the app.

8) Record-keeping and contractual must-haves

A legitimate OLP should furnish or make accessible:

Pre-contract information (APR, fees, total repayment);
Loan agreement (identifying the licensed lender as your counterparty);
Promissory note, disclosure statement (Truth-in-Lending-style details), and payment schedule;
Receipts/acknowledgments for disbursements and payments;
Mechanics for grace periods, late fees, refunds, and dispute resolution;
Privacy Notice and Consent records consistent with the DPA.

9) Practical verification checklist (copy-paste friendly)

☐ App’s publisher and brand → note exact spellings.
☐ Identify the corporate operator (complete legal name).
☐ Confirm SEC CA (lending or financing company) → active.
☐ Confirm the app appears on SEC’s allowed OLP/“whitelist” for that operator.
☐ Disclosures: APR, fees, tenor, repayment schedule are visible and consistent.
☐ Repayment account is in the company’s name.
☐ Privacy Notice: DPO named, lawful basis, data-subject rights process.
☐ No excessive permissions (contacts, photos, SMS) demanded to proceed.
☐ Collection policy aligns with SEC prohibitions (no shaming/harassment).
☐ No adverse SEC/NPC advisories against the brand/operator.
☐ Keep screenshots/records of the app listing, disclosures, and communications.

10) If things go wrong: remedies and where to complain

SEC (Enforcement & Investor Protection): For unregistered lending, OLP violations, or unfair collection by an SEC-licensed lender. Provide screenshots, app name, company name, contact numbers, and payment proofs.
NPC: For privacy abuses—contact scraping, unauthorized disclosure of your debt, data breaches, or failure to honor your data rights.
DTI: For false, deceptive, or unfair business practices.
PNP-ACG / NBI: For harassment, threats, doxxing, extortion, and other crimes.
App stores: Report misleading or non-compliant lending apps for policy violations.

11) Special notes for businesses and developers

White-label/aggregator arrangements: Even if tech is outsourced, the SEC-licensed entity remains fully responsible for OLP compliance and debt-collection conduct of agents.
Data processing: If you use third-party analytics or collection agencies, execute DPA-compliant data-processing agreements, maintain records of processing activities, and implement security measures consistent with NPC guidance.
Marketing: Avoid implied bank affiliation, guaranteed approvals, or bait-and-switch pricing. Ensure consistency between ads, app disclosures, and loan contracts.

12) Frequently asked questions

Q: The company has a CA, but the app brand isn’t on the SEC OLP list. Is that okay? A: No. The app itself must be recognized by the SEC under the licensed company. A valid CA does not automatically “cover” any random app/brand.

Q: The app says it’s “partnered with” a licensed company. A: Verify the actual lender named in the contract and the app’s presence on the SEC OLP list tied to that licensed company. “Powered by” tech vendors aren’t lenders.

Q: The app wants my contacts to ‘assess risk.’ A: That’s high-risk under the Data Privacy Act and widely treated as abusive. You can refuse, and you may report the practice to the NPC and SEC.

Q: The app is still downloadable but has an SEC advisory. A: Treat as unsafe. File a report and avoid transacting—even if the store listing remains live.

13) Bottom line

A legit Philippine online lending app must (a) operate under a company with an active SEC Certificate of Authority, (b) appear on the SEC’s allowed OLP/“whitelist” for that company, and (c) comply with fair collection and data-privacy rules. If any of those three pillars are missing or murky, walk away and report the app.

Disclaimer: This article is general information for the Philippine setting and not a substitute for tailored legal advice on a specific app or transaction.