Registration, Authority, and Compliance (Philippine Context)

1) What counts as “online lending” in Philippine regulation

An online lending operation is typically a lending or financing business that markets, originates, approves, disburses, services, and/or collects loans using electronic channels (mobile app, website, social media, messaging platforms, APIs). In practice, regulators focus less on the technology and more on what you do and how you hold yourself out to the public.

Common models:

Balance-sheet lender (direct lender): The company lends its own funds to borrowers and earns interest/fees.
Financing company activities: Broader “financing” may include leasing, receivables financing, discounting, factoring, and similar arrangements.
Marketplace/P2P matching: The platform matches lenders/investors with borrowers and may earn commissions.
Embedded lending: Lending offered through another app/platform (e-commerce, ride-hailing, wallet, payroll platform), often via partnerships.

Your regulatory path depends on whether you are:

A lending company under the Lending Company Regulation Act of 2007 (Republic Act No. 9474);
A financing company under the Financing Company Act (Republic Act No. 8556, as amended); or
Potentially a bank/quasi-bank/other BSP-supervised financial institution if you take deposits or engage in quasi-banking activities.

2) Core rule: you generally need SEC authority to lend to the public as a “lending company” or “financing company”

In the Philippines, the primary licensing/registration regime for non-bank lenders is handled by the Securities and Exchange Commission (SEC).

2.1 Lending company vs. financing company (high-level distinction)

Lending company (RA 9474): A corporation primarily organized to grant loans from its own capital (often short-term consumer and SME loans).
Financing company (RA 8556): A corporation engaged in broader financing activities (including leasing and other structured financing) and typically subject to more extensive requirements.

Why it matters: Your permitted activities, capitalization expectations, reporting, and naming/marketing constraints can differ. If your product set goes beyond straightforward cash loans (e.g., leasing, factoring, receivables financing), you may fall into financing company territory.

2.2 The “certificate of authority” requirement

As a rule, a corporation that will operate as a lending company or financing company must obtain SEC authority to operate (commonly referred to as a certificate of authority/secondary license). Operating or advertising lending services without the appropriate SEC authority is a major enforcement trigger, especially for mobile-app lenders.

3) Incorporation and basic business registrations (the “entity stack”)

Before you can lawfully operate at scale, you generally complete the “stack” below:

3.1 SEC incorporation (primary registration)

Incorporate as a domestic corporation with lending/financing as a primary purpose (online channel may be stated as part of business description).
Align corporate name rules with sector restrictions (avoid implying you are a bank, government entity, or otherwise regulated entity you are not).

3.2 SEC authority to operate (secondary license)

Apply for authority as a lending company (RA 9474) or financing company (RA 8556).
Expect requirements around:
- Minimum paid-up capital (often set by SEC policy and may vary by type/scale)
- Corporate governance documents
- Compliance undertakings (including fair collection and consumer protection)
- Operational forms/disclosures and other SEC-mandated submissions

3.3 Local and tax registrations

Even if your “financial” license is SEC-based, you still need standard Philippine business registrations:

BIR registration (invoicing/receipts, books of accounts, taxes)
LGU permits (may include Mayor’s Permit, barangay clearance, business tax)
Data privacy compliance registration steps (see Section 6)

4) Online lending platform (OLP) and mobile app registration expectations

The SEC has treated online lending—especially via mobile apps—as an area requiring specific transparency and accountability, commonly focusing on:

Disclosure of the operator’s true corporate identity
Registration/notification of the online platform and/or mobile application
Clear presentation of the SEC certificate/authority details
Restrictions on unfair collection and abusive conduct
Prohibitions against using deceptive identities, fake SEC credentials, or “front” operators

In practical compliance terms, online lenders should ensure that:

The legal entity name and SEC registration details are prominently displayed in-app and on the website.
The app store listing and marketing pages match the licensed entity (no “brand-only” anonymity).
Any third-party service providers (collections, call centers, verification vendors) are contractually bound to comply with Philippine law and SEC/NPC standards.

5) Product and contract compliance: what your loan documents and app flows must get right

5.1 Truth in Lending and cost disclosure (RA 3765)

The Truth in Lending Act (Republic Act No. 3765) requires lenders to provide clear, written disclosures of credit terms so borrowers can understand the true cost of credit.

For online lending, best practice is to present a pre-acceptance disclosure statement that clearly states:

Principal amount (net proceeds vs. face amount if you deduct fees)
Interest rate (and whether daily/weekly/monthly; nominal vs effective)
Finance charges, service fees, processing fees, late charges, penalty interest
Repayment schedule and total amount payable
Conditions triggering default and collection actions

Key point for app UX: Disclosures should not be buried; they should be shown before the borrower clicks accept/confirm, and should be downloadable/savable (PDF/email/in-app record).

5.2 Interest rates: no usury ceiling, but unconscionable terms are vulnerable

The Philippines has long operated under a regime where statutory usury ceilings are effectively suspended, but interest and penalty terms can still be struck down or reduced by courts if deemed unconscionable, iniquitous, or shocking. This matters for:

Extremely high daily rates
Excessive penalty stacking (interest-on-interest, compounding penalties, multiple late fees)
Fees structured to disguise interest

5.3 E-contracting and electronic signatures (RA 8792)

Under the E-Commerce Act (Republic Act No. 8792) and its rules, electronic data messages and electronic signatures can be legally recognized if integrity and authenticity requirements are met.

Operational essentials:

Maintain audit logs: time, device, IP (with privacy safeguards), consent screens, versioned terms.
Preserve the exact contract version accepted by the borrower.
Ensure the borrower can access the final terms after acceptance.

5.4 Collection terms and “authorization” clauses

Clauses that purport to authorize:

Access to a borrower’s entire contact list,
Messaging of the borrower’s friends/family/employer,
Public posting/shaming,
Threats of criminal action for ordinary nonpayment, are high-risk and often conflict with data privacy principles, unfair collection standards, and other laws.

6) Data privacy, cybersecurity, and consumer-permission compliance (critical for OLPs)

Online lending is intensely data-driven, so the Data Privacy Act of 2012 (Republic Act No. 10173) is a central compliance pillar, enforced by the National Privacy Commission (NPC).

6.1 Lawful basis and consent

You must identify and document a lawful basis for each processing purpose:

Application evaluation (identity verification, credit scoring)
Fraud prevention
Loan servicing and collections
Regulatory reporting
Marketing (often requires a clearer consent framework)

Consent must be specific, informed, and freely given—and cannot be bundled into take-it-or-leave-it permissions that are not necessary to deliver the service.

6.2 Data minimization: collect only what you need

Regulators have scrutinized OLPs that:

Harvest entire contact lists, photos, SMS, call logs, or social media data unrelated to credit assessment;
Request excessive device permissions as a condition of lending.

A defensible approach:

Collect identity and repayment-relevant data only.
Use privacy-by-design: default off for nonessential permissions.
Provide a granular permissions screen and meaningful alternatives when feasible.

6.3 Transparency: privacy notice and borrower rights

Your privacy notice (in-app and on the website) should clearly state:

What data you collect
Why you collect it
How long you retain it
Who you share it with (categories and key vendors)
How borrowers can exercise rights (access, correction, objection, etc.)

6.4 Security measures and breach response

You need appropriate organizational, physical, and technical measures:

Access controls, encryption in transit/at rest (as appropriate)
Vendor risk management
Incident response and breach notification procedures
Secure deletion and retention schedules

6.5 Data sharing with third parties (vendors, collectors, analytics)

If you use:

Collection agencies,
Call centers,
KYC/ID verification providers,
Cloud hosting,
Credit scoring vendors, you need robust data processing agreements and controls over onward transfers.

7) Fair collection and conduct standards: what you must not do

Online lenders are frequently sanctioned due to collection abuses. High-risk prohibited practices commonly include:

Harassment, profanity, threats, repeated calls at unreasonable hours
Contacting third parties (friends, family, workplace) to shame or pressure the borrower
Public disclosure of debt
Impersonating government authorities, police, courts, or lawyers
Threatening criminal prosecution for ordinary civil debt (nonpayment is generally not a crime absent fraud-related facts)
Using fake accounts, doxxing, or social media blasting
Misrepresenting the amount due or hiding fees

These behaviors may trigger:

SEC enforcement actions (license revocation/suspension, fines)
Data Privacy Act exposure (unlawful processing/disclosure)
Criminal and civil liabilities under various laws (e.g., threats, coercion, cyber-related offenses depending on the act)

8) AML/CFT considerations (when lending becomes an AML compliance issue)

The Philippine AML framework is anchored on the Anti-Money Laundering Act (RA 9160, as amended) and implemented through the Anti-Money Laundering Council (AMLC). Whether a specific online lending business is treated as a “covered person” can depend on classification and applicable AMLC rules.

Operationally, online lenders should still treat these as baseline controls (and many are required if you are classified as covered):

Customer identification / KYC appropriate to risk
Sanctions and watchlist screening (risk-based)
Suspicious transaction detection and escalation
Recordkeeping and compliance governance
Controls against mule accounts and identity fraud

Because online lending can be used to move funds quickly through wallets/bank accounts, robust fraud and transaction monitoring is both a regulatory and business necessity.

9) Payments, disbursement, and e-wallet partnerships: when BSP involvement appears

The Bangko Sentral ng Pilipinas (BSP) regulates banks, EMI/e-money issuers, operators of payment systems, and other supervised financial institutions.

Many online lenders avoid direct BSP licensing by:

Disbursing via bank transfers, remittance partners, or e-wallet partners,
Collecting via payment gateways, OTC channels, or partner wallets.

However, BSP issues can arise if you:

Operate your own e-money/wallet product,
Run a payment system or settlement function that needs BSP authorization,
Engage in deposit-like or quasi-banking activities,
Partner in a way that effectively makes you part of a regulated payment flow (contractually you’ll still be required to meet partner compliance standards).

Practical takeaway: even without a BSP license, expect bank and wallet partners to impose stringent KYC, fraud, and data security requirements via contract.

10) Credit reporting and the Credit Information System (CIC)

The Credit Information System Act (RA 9510) established the Credit Information Corporation (CIC) and a framework for sharing credit data. Lenders often need to consider:

Whether they must submit borrower credit data (mandatory submission rules can apply depending on covered entities and implementing regulations)
Compliance with borrower notice and data accuracy obligations
Secure handling of credit data and dispute resolution processes

Participation in formal credit reporting can strengthen underwriting defensibility, but must be executed with strict privacy and accuracy controls.

11) Advertising, marketing, and sales conduct rules

Online lending marketing is heavily scrutinized because of:

“Zero interest” claims that hide fees
Misleading “instant approval” promises
Non-disclosure of total cost
Deceptive countdowns, dark patterns, coercive UX

Relevant legal anchors include:

Consumer protection principles under Philippine law (including deceptive/unfair sales practices concepts)
Truth-in-lending disclosure requirements
SEC expectations on fair dealing and proper identification
Data privacy rules for marketing consent and opt-out

Best practices:

Disclose representative pricing (APR/effective cost) and typical fees
Avoid implying government endorsement
Avoid false urgency or hidden charges
Ensure ads identify the licensed entity behind the brand

12) Tax considerations specific to lending

Online lenders must align tax and documentation with Philippine tax rules, commonly including:

Income tax on interest and fee income
Withholding tax rules in relevant cases
Documentary stamp tax (DST) implications on loan documents or debt instruments (structure-dependent)
VAT/percentage tax implications depending on classification and thresholds

Tax treatment can hinge on product structure (cash loan vs. financing vs. assignment of receivables) and documentation design.

13) Corporate governance and recurring regulatory filings

Once licensed/authorized, you typically must maintain:

Regular SEC corporate filings (e.g., GIS, audited financial statements)
Lending/financing sector-specific reports and disclosures required by SEC policy
Board and officer qualifications and updated records
Branch/extension approvals where applicable
Prompt reporting of material changes (ownership, officers, address, brand/app identity)

Online lenders must also manage:

Vendor governance (collections, KYC vendors, cloud vendors)
Complaint handling and dispute resolution
Internal controls and compliance monitoring

14) Special case: marketplace/P2P and “investment” features (securities risk)

If your platform:

Pools investor money to fund loans,
Offers “investment notes,” “fixed returns,” or participations,
Markets lending as an investment product, you may trigger the Securities Regulation Code (RA 8799) and need additional licensing/registration. Some structures can be treated as:
Securities offerings,
Investment contracts,
Crowdfunding-like activities, or can be flagged as unauthorized solicitation.

If you are not carefully structured, “P2P lending” can become a securities compliance problem even if the borrower side looks like ordinary lending.

15) Enforcement, penalties, and practical risk map

15.1 What regulators typically penalize first

Operating without SEC authority / misrepresenting registration
Abusive collection practices
Data privacy violations (excessive permissions, unlawful disclosures)
Deceptive pricing and hidden charges
Fake identities, shadow operators, or “borrower shaming” practices

15.2 Liability surface (multi-agency)

A single misconduct pattern (e.g., shaming borrowers using contact lists) can create exposure across:

SEC (license sanctions)
NPC (data privacy enforcement)
AMLC (if AML obligations apply and are breached)
Courts (civil claims, damages, injunctions)
Potential criminal liability depending on the acts and evidence

16) Compliance blueprint for a defensible online lending operation

A robust Philippine online lending compliance program typically includes:

Governance & licensing

Correct corporate purpose and SEC licensing classification
Clear brand-to-entity mapping (no anonymity)
Board-level oversight of compliance and risk

Product & disclosures

Truth-in-lending disclosure pack integrated into app flow
Transparent fee table and amortization schedules
Fair, reviewable pricing and penalty design

Data privacy & security

Data mapping and lawful-basis documentation
Permission minimization and privacy-by-design UX
Strong vendor contracts and access controls
Incident response and breach management

Collections

Written collections code of conduct
Script controls and QA monitoring
Prohibition on third-party harassment/shaming
Complaint handling, remediation, and audit trails

Fraud & AML alignment

KYC proportional to risk
Transaction/fraud monitoring (especially for rapid disburse/repay loops)
Recordkeeping and escalation procedures

Operational hygiene

Versioned terms and e-sign audit logs
Regulatory and corporate filings calendar
Training and enforcement for staff and vendors

17) Summary: the legal “non-negotiables”

To lawfully operate online lending in the Philippines at scale, the essentials are:

Operate through the properly registered corporation and obtain the appropriate SEC authority as a lending or financing company.
Ensure app/platform transparency—the licensed entity must be clearly identifiable to the public and regulators.
Comply with Truth in Lending by presenting clear, pre-acceptance disclosures of all costs and repayment terms.
Treat data privacy as core infrastructure: minimize permissions, justify processing, protect data, and control vendors.
Enforce fair collection: no harassment, no shaming, no third-party pressure tactics, no deceptive threats.
Manage AML/fraud and payments risks, especially when partnering with banks, wallets, and payment gateways.
Maintain ongoing filings, governance, and audit trails fit for regulatory review and dispute resolution.