A lending company may look professional on Facebook, TikTok, Google Play, or through text messages, but that does not automatically mean it is legal to lend money in the Philippines. A legitimate lending company should be a registered corporation and should have a valid Certificate of Authority to Operate from the Securities and Exchange Commission (SEC). If it operates through a mobile app or website, the online lending platform should also be properly recorded or recognized under current SEC rules. This guide explains how to check a lender’s legitimacy, what documents and numbers to look for, which red flags matter, and what to do if you already borrowed from a suspicious or abusive lender.

What Makes a Lending Company Legitimate in the Philippines?

In the Philippines, lending is a regulated business. A company cannot simply create an app, advertise “instant cash,” collect IDs, and start lending to the public.

Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company is a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than nineteen persons. It does not include banks, financing companies, pawnshops, cooperatives, insurance companies, and other credit institutions already regulated by other laws.

The most important rule is simple: a lending company must be a corporation and must have authority from the SEC before it can operate as a lending company.

This means there are two levels to check:

What to Check	Why It Matters
SEC Certificate of Incorporation	Shows the company exists as a corporation.
SEC Certificate of Authority to Operate as a Lending Company	Shows the company is allowed to conduct lending business.

A company may have SEC registration but still be unauthorized to lend. This is one of the most common misunderstandings borrowers face.

SEC Registration Alone Is Not Enough

Many suspicious lenders show borrowers an SEC registration number and say, “Registered kami sa SEC.” That may sound reassuring, but it is not enough.

A regular SEC registration only gives a corporation legal personality. It does not automatically authorize the corporation to engage in regulated activities such as lending, financing, investment-taking, securities selling, or operating an online lending platform.

For lending companies, look for the Certificate of Authority, often shortened as CA. The CA is the document that specifically allows the corporation to operate as a lending company.

The usual documents a legitimate lending company should be able to show

A legitimate lender should be able to provide, or at least clearly identify:

Complete registered corporate name;
SEC Registration Number;
Certificate of Authority Number;
Registered office address;
Official contact details;
Business name or trade name used, if different from the corporate name;
For online lending, the name of the mobile app, website, or online lending platform connected to the licensed corporation.

If the lender refuses to give its complete corporate name or only gives an app name such as “Fast Cash,” “Peso Loan,” or “Quick Pera,” treat that as a serious warning sign.

Legal Basis: Philippine Laws and SEC Rules on Lending Companies

Several Philippine laws and issuances protect borrowers and regulate lending companies.

Republic Act No. 9474: Lending Company Regulation Act of 2007

RA 9474 is the main law governing lending companies. It provides that:

A lending company must be organized as a corporation.
It cannot conduct business without an authority to operate from the SEC.
The minimum paid-in capital for lending companies established after the law took effect is generally ₱1,000,000, subject to SEC rules.
At least a majority of the voting capital stock must be owned by Filipino citizens.
The SEC has authority to supervise lending companies, require reports, conduct examinations, and impose administrative sanctions such as fines, suspension, or revocation of authority.
Engaging in lending business without a valid SEC authority can lead to fines, imprisonment, or both.

RA 9474 also recognizes the borrower’s right to disclosure under the Truth in Lending Act, Republic Act No. 3765.

Republic Act No. 8556: Financing Company Act of 1998

Some loan providers are not lending companies but financing companies. Financing companies are governed by Republic Act No. 8556, which amended the older Financing Company Act.

A financing company may provide credit facilities through direct lending, discounting, factoring receivables, buying and selling contracts or chattel mortgages, or financial leasing. Like lending companies, financing companies are regulated by the SEC and need proper authority to operate.

For ordinary borrowers, the practical point is this: whether the provider calls itself a lending company, financing company, loan app, salary loan provider, or cash loan platform, you should verify its SEC authority and not rely only on advertising.

Republic Act No. 11765: Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, strengthened consumer protection for financial products and services.

For borrowers, the key rights include:

Right to fair and equitable treatment;
Right to disclosure and transparency;
Right to protection against fraud and misuse;
Right to data privacy and data protection;
Right to timely handling and redress of complaints.

This law is important because abusive lending is not only a private loan problem. It may also involve unfair financial consumer practices, deceptive disclosures, excessive fees, harassment, or misuse of personal data.

SEC Memorandum Circular No. 18, Series of 2019: Unfair Debt Collection Practices

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and their third-party collection agents.

Prohibited practices include, among others:

Threats of violence or harm;
Use of obscene, insulting, or abusive language;
False representations or deceptive collection methods;
Public shaming;
Disclosure or publication of borrower information to third parties;
Contacting people who are not legally connected to the loan just to pressure the borrower.

A lender may collect a legitimate debt, but it must do so through lawful, reasonable, and fair methods.

Data Privacy Act and NPC Rules on Loan-Related Transactions

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information. The National Privacy Commission (NPC) has also issued rules on loan-related personal data processing, including NPC Circular No. 20-01 and its 2022 amendments.

For online lending apps, this is crucial. A loan app should not harvest your contacts, gallery, messages, or other unnecessary personal data. In general, lenders may not contact people in your phonebook for collection unless those persons are proper guarantors who gave separate consent.

Step-by-Step Guide: How to Verify If a Lending Company Is Legitimate

1. Get the lender’s complete legal name

Start by asking for the lender’s registered corporate name, not just the brand, app, page name, or collector’s name.

For example:

What They Give You	What You Still Need
“Quick Peso App”	Corporate name of the company operating the app
“ABC Cash Loan”	SEC-registered corporation name
“Juan Dela Cruz Lending”	Whether this is actually a corporation with SEC authority
“Collection Department”	Name of the lending or financing company that owns the debt

If the lender cannot provide its full corporate name, you cannot properly verify it.

2. Check the SEC list of lending and financing companies

The SEC maintains official pages for lending and financing companies, including lists of companies with Certificates of Authority and recorded online lending platforms. The SEC website may change its page structure from time to time, so the safest approach is to start from the official SEC Philippines website and look for the section on Lending Companies and Financing Companies.

You may also use the SEC’s public assistance channels, including the SEC iMessage system, for verification or complaints.

When checking the SEC list, compare the details carefully:

Exact corporate name;
SEC Registration Number;
Certificate of Authority Number;
App or platform name, if online;
Status of the company;
Any SEC advisories, suspension orders, revocation orders, or cease-and-desist orders.

Do not rely on screenshots sent by the lender. Check through official SEC sources.

3. Verify the Certificate of Authority, not just the SEC registration number

Ask for the company’s CA number. A legitimate lending company should not be vague about this.

Be careful with these common excuses:

“Our SEC registration is enough.”
“The CA is confidential.”
“We are under our partner company.”
“Our app is new, but our license is processing.”
“We are registered abroad, so Philippine SEC approval is not needed.”

For lending to the public in the Philippines, especially through a Philippine-facing app, website, office, or agent network, SEC authority is a central issue.

4. Check whether the online lending app is recorded or connected to a licensed company

For online lending platforms, do not stop at the app name. Verify the company behind the app.

A legitimate online lending platform should clearly disclose:

The corporate name of the lending or financing company;
SEC Registration Number;
Certificate of Authority Number;
Privacy policy;
Loan terms and fees;
Complaint channels;
Data permissions requested by the app.

If an app has no company name, no physical address, no CA number, and asks for intrusive phone permissions, it is high-risk.

5. Compare the loan terms with the disclosure statement

Under the Truth in Lending Act, borrowers should be informed of the true cost of credit. For ordinary borrowers, this means you should receive a clear disclosure of:

Principal loan amount;
Interest rate;
Effective interest rate, when applicable;
Processing fees;
Service fees;
Notarial fees, if any;
Disbursement or transfer charges;
Penalties for late payment;
Due dates and payment schedule;
Total amount payable.

For certain short-term, small-value loans covered by BSP Circular No. 1133, Series of 2021 and SEC implementing rules, interest and fee ceilings apply to unsecured, general-purpose loans not exceeding ₱10,000 with a loan tenor of up to four months. The ceilings include:

Item	Ceiling for Covered Loans
Nominal interest rate	6% per month
Effective interest rate, including applicable fees except late penalties	15% per month
Late payment or non-payment penalty	5% per month on outstanding scheduled amount due
Total cost cap	100% of total amount borrowed

These caps do not mean all high charges are automatically legal outside those exact covered loans. Philippine courts may still strike down excessive, iniquitous, unconscionable, and exorbitant interest rates. In Medel v. Court of Appeals, the Supreme Court held that a 5.5% monthly interest rate was unconscionable even though usury ceilings had been lifted. More recently, the Supreme Court has reiterated that courts may nullify unconscionable interest and penalty charges.

6. Search for SEC advisories, revocation orders, or cease-and-desist orders

A lender may have existed before but later lost authority. Always check whether there are:

SEC advisories against the company;
Cease-and-desist orders;
Revocation of primary registration;
Revocation or suspension of Certificate of Authority;
Complaints involving unauthorized online lending;
Warnings about similarly named apps.

Scammers often use names that are close to legitimate companies. Check spelling, punctuation, corporate suffix, and app name.

7. Check whether the lender’s behavior matches a legitimate business

Legitimacy is not only about paperwork. Conduct matters.

A legitimate lender should not:

Demand your online banking password, e-wallet PIN, OTP, or SIM card access;
Require access to your full contact list as a condition for the loan;
Threaten to post your face, ID, or debt on social media;
Call your employer, relatives, or friends to shame you;
Pretend to be from the NBI, police, barangay, court, or prosecutor’s office;
Threaten immediate arrest for non-payment of a civil debt;
Refuse to provide a written loan agreement or disclosure statement.

Non-payment of debt is generally a civil matter. A borrower may be sued for collection if the debt is valid, but a private lender cannot simply have a borrower arrested for being unable to pay.

Quick Verification Checklist Before You Borrow

Before accepting money from a lender, check the following:

Question	Safe Answer
Do they give the complete corporate name?	Yes, not just an app or Facebook page name
Do they have SEC registration?	Yes
Do they have a Certificate of Authority to Operate as a lending or financing company?	Yes
Is the app or platform connected to that licensed company?	Yes, and the connection is clear
Are fees and interest disclosed before release?	Yes
Do they provide a written contract or disclosure statement?	Yes
Do they ask for unnecessary phone permissions?	No
Do they threaten public shaming or contact blasting?	No
Do official SEC sources confirm the company’s status?	Yes

If you cannot answer these questions confidently, pause before giving your ID, selfie, bank details, or e-wallet information.

Red Flags That a Lending Company May Be Illegal or Abusive

No Certificate of Authority

The biggest red flag is a lender that has no CA from the SEC but lends money to the public as a business.

A sole proprietor, informal lender, app operator, or foreign company cannot simply lend to the Philippine public without complying with Philippine rules.

“SEC registered” but no lending authority

Some companies are registered for general business purposes but are not authorized to lend. Always ask: registered as what?

A corporation registered for marketing, consulting, IT services, or trading is not automatically authorized to operate a lending business.

App name does not match the corporate name

Many online lending complaints involve apps whose public names do not clearly match the registered corporation. The app may show one name, the privacy policy another name, the collection message another name, and the bank account another name.

This makes complaints harder, but not impossible. Save screenshots showing all names used.

No clear address or only a social media page

A legitimate lending company should have a registered office address. Be cautious if the lender only uses:

Facebook Messenger;
Viber;
Telegram;
WhatsApp;
Random Gmail or Yahoo addresses;
Personal GCash or Maya accounts;
No physical address;
No official corporate email.

Upfront fees before loan release

Be very careful if the lender asks you to pay “processing,” “unlocking,” “insurance,” “tax,” or “verification” fees before releasing the loan, especially if payment is to a personal e-wallet account.

Some legitimate loans may have fees, but they should be properly disclosed and usually deducted or charged in a transparent way under the loan documents. Repeated demands for advance payments before release are a common scam pattern.

Threats, fake legal notices, and fake warrants

Collectors sometimes send messages saying:

“May warrant of arrest ka na.”
“Ipapa-barangay ka namin today.”
“NBI cybercrime case filed.”
“Estafa case approved.”
“We will post your ID online.”
“We will call all your contacts.”

A lender may pursue lawful remedies, but it cannot fabricate criminal cases, impersonate authorities, or use threats to collect.

What Documents Should You Ask From a Lending Company?

Before borrowing, ask for these documents or information:

Document or Information	What It Proves
SEC Certificate of Incorporation	The company exists as a corporation
SEC Certificate of Authority	The company is authorized to operate as a lending or financing company
General Information Sheet or company profile	Officers, address, and corporate details
Business name or trade name registration, if any	Whether the public-facing brand is connected to the corporation
Loan agreement	Contractual terms
Disclosure statement	True cost of credit
Privacy notice	How your personal data will be used
Collection policy or customer support channel	How disputes and payments are handled

You do not always need certified copies before a small loan, but the company should at least provide enough details for you to verify it through official channels.

How to Check If an Online Lending App Is Legitimate

Online lending apps require extra caution because they can collect personal data quickly and disappear just as fast.

Check the app store page carefully

Look at:

Developer name;
Company name;
Privacy policy link;
Website;
Contact email;
App permissions;
Reviews mentioning harassment or contact blasting;
Date of release and update history.

A high rating is not enough. Some apps use fake reviews or incentivized reviews.

Compare the privacy policy with SEC details

The privacy policy should identify the company processing your data. If the app says one company name but the SEC CA belongs to another company, check whether there is a clear legal relationship.

Be cautious with app permissions

For a loan app, some data may be needed to verify identity and assess credit risk. But excessive permissions are suspicious.

Be careful if the app asks for:

Full contact list;
SMS access;
Photo gallery access;
Microphone access;
Location access beyond what is necessary;
Social media login access;
Accessibility permissions;
Permission to read or modify files.

The 2026 public advisory of the DICT, NPC, and SEC on online lending platforms reminded the public that unnecessary and excessive processing of personal data for loan-related transactions is prohibited, especially access to contact lists used for harassment or debt collection outside of proper guarantors.

What If the Lender Is Foreign?

Foreigners and overseas Filipinos often encounter loan providers that claim to be based in Singapore, Hong Kong, China, the United States, or another country but lend to people in the Philippines.

A foreign registration does not automatically authorize lending operations in the Philippines. If the lender is targeting Philippine borrowers, using Philippine payment channels, advertising to the Philippine public, or operating through local agents or apps, Philippine regulatory issues may arise.

Also remember that RA 9474 has Filipino ownership requirements for lending companies. Foreign participation in a Philippine lending company is regulated. If the lender claims to be “100% foreign and no SEC license needed,” be cautious.

For foreign documents used in Philippine proceedings, authentication may be needed. Depending on the country, this may involve an apostille under the Apostille Convention or consular authentication if the country is not part of the convention. This matters if you later need to submit foreign corporate documents, communications, or evidence in a Philippine complaint or court case.

What to Do If You Already Borrowed From a Suspicious Lending Company

If you already received money, do not panic. Take organized steps.

1. Save all evidence immediately

Keep copies of:

Loan agreement;
Disclosure statement;
Screenshots of the app;
Screenshots of app permissions;
Payment receipts;
Bank or e-wallet transaction history;
Collector messages;
Threats or abusive calls;
Names and numbers used by collectors;
Proof that they contacted your relatives, employer, or friends;
SEC details shown by the lender;
Any fake legal notice, fake subpoena, or fake warrant.

Do not delete the app until you have documented the relevant screens, but consider revoking permissions through your phone settings.

2. Verify the lender with the SEC

Use the official SEC website, SEC public assistance channels, or the SEC iMessage portal. Provide the corporate name, app name, website, phone numbers, email addresses, and screenshots.

The SEC may be able to confirm whether the company has a Certificate of Authority, whether the app is recorded, or whether there are existing advisories.

3. Continue separating the debt issue from the harassment issue

If you received money, there may still be a civil obligation to pay the lawful amount due. But even if you owe money, the lender cannot harass you, shame you, threaten you, misuse your data, or contact unrelated third parties.

In other words:

A valid debt does not legalize abusive collection.
An abusive collector does not automatically erase a legitimate debt.
Excessive or unlawful charges may be disputed.
Unauthorized lending may expose the lender to regulatory sanctions.

4. File complaints with the proper agency

The proper office depends on the issue.

Problem	Where to Report
Unauthorized lending company or abusive collection by lending/financing company	SEC
Misuse of personal data, contact blasting, privacy violations	National Privacy Commission
Threats, extortion, identity misuse, fake online accounts, cyber harassment	NBI Cybercrime Division or PNP Anti-Cybercrime Group
Fraud involving e-wallets or bank accounts	Your bank/e-wallet provider, BSP-supervised institution, and law enforcement
Fake court papers or impersonation of officials	Court, police, NBI, or relevant agency
Barangay-level harassment by identifiable persons in your area	Barangay, if covered by barangay conciliation rules

For SEC matters, start with the SEC iMessage portal and attach clear evidence. For privacy complaints, use the National Privacy Commission complaint channels.

5. Protect your personal data and accounts

If the app accessed your phone or you gave sensitive information:

Change passwords for email, banking, e-wallet, and social media accounts;
Enable two-factor authentication;
Revoke app permissions;
Uninstall suspicious apps after saving evidence;
Inform close contacts not to respond to collectors;
Report fake social media posts or accounts;
Monitor e-wallet and bank activity;
Replace compromised IDs if needed.

If you shared OTPs, passwords, or account credentials, contact your bank or e-wallet provider immediately.

Can an Illegal Lending Company Still Collect From You?

This is a practical question many borrowers ask.

If you actually received money, the lender may argue that you must return what you borrowed. However, an unauthorized lender may face SEC sanctions, and unlawful fees, penalties, interest, or abusive collection practices may be challenged.

A court may also reduce or nullify unconscionable interest and penalties. Under Civil Code principles, contracts and stipulations contrary to law, morals, good customs, public order, or public policy may be void. The Supreme Court has repeatedly held that courts may strike down excessive and unconscionable interest rates.

So the better way to frame the issue is not simply “Do I still pay?” but:

Was the lender authorized?
Was there a valid loan?
How much was actually released?
Were fees and interest properly disclosed?
Are charges within applicable ceilings?
Are the interest and penalties unconscionable?
Were collection practices lawful?
Was personal data processed legally?

Common Scenarios and What They Usually Mean

“The lender sent me an SEC certificate but no CA.”

Ask for the Certificate of Authority. If they cannot provide it, verify directly with the SEC. SEC incorporation alone does not prove authority to lend.

“The app is on Google Play. Does that mean it is legal?”

No. App store availability is not the same as Philippine regulatory approval. You still need to check the SEC status of the company and the app.

“They said they will file estafa if I do not pay.”

Non-payment of a loan is usually a civil matter. Estafa under the Revised Penal Code requires specific elements such as deceit or abuse of confidence. A collector cannot automatically convert unpaid debt into a criminal case by saying “estafa.”

However, avoid issuing checks without funds, using fake IDs, or making fraudulent representations, because those may create separate legal issues.

“They contacted my relatives and officemates.”

That may raise issues under SEC debt collection rules and data privacy rules, especially if those people are not guarantors and did not consent to be contacted for collection. Save screenshots and call logs.

“They deducted huge fees, so I received much less than the approved loan.”

This is a common online lending problem. Compare the amount approved, amount actually released, fees deducted, interest, due date, and total repayment. Covered short-term small-value loans have regulatory caps. Even outside those caps, hidden or excessive charges may be challenged.

“The lender uses a personal GCash account for payment.”

That is a red flag. Some legitimate small businesses may use digital payment channels, but a regulated lending company should provide official payment instructions connected to the company, not random personal accounts with changing names.

Practical Timeline for Verification and Complaints

Action	Typical Timeframe	Practical Notes
Basic online SEC search	Same day	Depends on whether the SEC page or list is accessible and updated
Requesting clarification from lender	Same day to a few days	Ask in writing so you have proof
SEC iMessage inquiry or complaint	Varies	Attach complete screenshots and details to avoid back-and-forth
NPC complaint preparation	A few days to several weeks	Strong evidence matters: screenshots, call logs, app permissions, contact blasting proof
Bank/e-wallet dispute	Often time-sensitive	Report immediately if fraud or unauthorized transfer is involved
Law enforcement report for threats or cyber harassment	As soon as possible	Preserve original messages, numbers, URLs, and account links

Government processing times vary. In practice, delays often happen because the complainant submits only an app name without the company name, phone number, screenshots, transaction records, or copies of messages. The more organized your evidence, the easier it is for the agency to assess the complaint.

Frequently Asked Questions

How do I know if a lending company is registered in the Philippines?

Check the official SEC sources for the company’s exact corporate name, SEC Registration Number, and Certificate of Authority Number. Do not rely only on the lender’s screenshot or statement that it is “SEC registered.”

Is an SEC registration number enough for a lending company?

No. SEC registration means the corporation exists. A lending company also needs a Certificate of Authority from the SEC to operate as a lending company.

How can I check if an online lending app is legit?

Identify the company behind the app, then verify that company’s SEC registration, Certificate of Authority, and online lending platform status through official SEC sources. Also check whether the app clearly discloses its loan terms, privacy policy, and complaint channels.

Are online lending apps allowed to access my contacts?

They should not process personal data unnecessarily or excessively. Contacting people in your phonebook for debt collection, especially if they are not guarantors who gave separate consent, may violate data privacy and debt collection rules.

Can a lending company threaten to post my photo or ID online?

No. Public shaming, threats, and disclosure of borrower information to pressure payment may violate SEC rules on unfair debt collection and data privacy laws.

Can I be arrested for not paying an online loan?

Mere non-payment of debt is generally a civil matter. A lender may file a collection case if it has a valid claim, but it cannot simply have you arrested for inability to pay. Be careful, however, with separate acts such as fraud, fake documents, or bouncing checks, which may create different legal issues.

What should I do if the lender has no SEC Certificate of Authority?

Save evidence and report the lender to the SEC. If there is harassment, threats, or misuse of personal data, you may also report to the National Privacy Commission, NBI Cybercrime Division, or PNP Anti-Cybercrime Group, depending on the facts.

Are high interest rates automatically illegal in the Philippines?

Not always automatically, because general usury ceilings have been lifted. However, specific caps apply to certain short-term, small-value loans, and courts may nullify or reduce interest rates and penalties that are excessive, iniquitous, unconscionable, or exorbitant.

What if I borrowed from an illegal lender but already received the money?

You may still need to address the lawful amount actually borrowed, but unauthorized lending, hidden charges, excessive interest, harassment, and privacy violations can be reported and disputed. Keep records of the amount released, payments made, and all collection conduct.

Where can I report abusive online lending apps in the Philippines?

For lending and financing company violations, report to the SEC through its official channels such as the SEC iMessage portal. For privacy violations, report to the National Privacy Commission. For threats, extortion, cyber harassment, or identity misuse, report to the NBI Cybercrime Division or PNP Anti-Cybercrime Group.

Key Takeaways

A legitimate lending company in the Philippines must be a corporation and must have a valid SEC Certificate of Authority to operate as a lending company.
SEC registration alone is not enough. Always verify the Certificate of Authority.
For loan apps, check the company behind the app and whether the online lending platform is properly recorded or recognized by the SEC.
Legitimate lenders should disclose the true cost of credit, including interest, fees, penalties, due dates, and total amount payable.
Abusive collection practices such as threats, public shaming, fake legal notices, and contact blasting are not allowed.
Excessive interest and penalties may be challenged, especially when they are unconscionable or covered by regulatory caps.
Save screenshots, contracts, receipts, call logs, app details, and messages before filing a complaint.
Report unauthorized lending to the SEC, privacy violations to the National Privacy Commission, and cyber threats or fraud to law enforcement.