Lending App Terms & Complaints in the Philippines: A Practical Legal Guide

Updated for general principles and enduring rules. This is not legal advice.

1) Who regulates lending apps?

Jurisdiction depends on the entity behind the app:

Banks, e-money issuers, and their apps → supervised by the Bangko Sentral ng Pilipinas (BSP) (e.g., disclosure standards, fair collection, complaint handling).
Financing and lending companies (non-banks) → incorporated under the Corporation Code and licensed by the Securities and Exchange Commission (SEC) under:
- Lending Company Regulation Act (LCRA) (R.A. 9474) for lending companies; and
- Financing Company Act (R.A. 8556) for financing companies.
- SEC also polices online lending platforms and abusive collection practices.
Data protection in all cases → National Privacy Commission (NPC) under the Data Privacy Act of 2012 (DPA, R.A. 10173).
Consumer protection overlaps with the Consumer Act (R.A. 7394) and sectoral rules.
Cybercrime (e.g., doxxing, threats) → Cybercrime Prevention Act (R.A. 10175); criminal law applies to harassment.
Anti-Money Laundering compliance (KYC/CDD) for covered persons → AMLA (R.A. 9160, as amended).

2) Core contract law backdrop

Freedom of contract (Civil Code) allows parties to agree on terms so long as they are not contrary to law, morals, good customs, public order, or public policy.
Interest rate ceilings under the old Usury Law were suspended decades ago, but courts may strike down or reduce “unconscionable” interest, penalties, or charges under equity and Civil Code doctrines (e.g., abuse of rights; unconscionability; reduction of liquidated damages).
Electronic contracts and signatures are generally valid under the E-Commerce Act (R.A. 8792) and the Electronic Signatures in Global and E-Commerce Act principles, provided integrity and attribution are shown.

3) Key terms you’ll see in lending apps—and how the law treats them

A. Disclosure & pricing

Truth-in-lending principles require a clear, conspicuous disclosure of:
- total loan amount (principal),
- all finance charges (interest, service fees, processing fees),
- effective interest rate (EIR/APR equivalent),
- amortization schedule and due dates,
- penalties for late or missed payments.
Hidden fees, undisclosed “convenience fees,” or automatic add-ons can be challenged as unfair or deceptive; regulators expect upfront, plain-language breakdowns before you tap “Accept.”

B. Interest, penalties, and roll-overs

High interest isn’t automatically illegal, but stacked charges (e.g., daily interest + compounding + high late fees + “collection fees”) can become unconscionable in aggregate.
Roll-over/extend features must disclose new costs and impacts on the effective rate.

C. Repayment authorization & wage deductions

Clauses authorizing automatic debits (auto-debit from e-wallet/bank) are allowed with informed consent and a way to revoke subject to contract and network rules.
Payroll deductions require lawful basis (employer consent, legal compliance); unilateral wage seizures invite labor and data privacy issues.

D. Data access and privacy

Permissions to access contacts, photos, SMS, call logs, device info must satisfy the DPA’s requirements:
- Specific, freely-given, informed consent for each purpose;
- Data minimization (only what’s necessary);
- Purpose limitation (no repurposing without a new lawful basis);
- Security measures and retention limits.
Harvesting contacts to blast messages or dox borrowers/guarantors is unlawful; NPC has sanctioned such practices. Borrowers have rights to access, rectification, erasure, and to withdraw consent (subject to legal/contractual limits).

E. Collection and communication clauses

Contracts may authorize reminders via SMS, email, calls, and in-app notices. However:
- Harassment, threats, profanity, obscene language, or shaming (including contacting employers, coworkers, or family without lawful basis) may violate data privacy, anti-harassment, and consumer protection rules.
- Repeated calls at odd hours, social media shaming, or excessive frequency can be actionable.

F. Dispute resolution, venue, and choice-of-law

Venue clauses: If they unreasonably force consumers to litigate far from their residence or where the obligation is incurred, they may be challenged.
Arbitration: Valid if clearly consented to; look for seat, rules, costs, and small-claims carve-outs.
Governing law: Consumer credit tied to Philippine borrowers and operations typically remains subject to Philippine law despite boilerplate foreign law choices.

G. Assignment and third parties

Lenders can assign receivables to collection partners/servicers, but data sharing still needs a lawful basis, DPAs (data processing agreements), and privacy notices to borrowers.

4) Abusive practices to watch for (and why they’re problematic)

Contact scraping and sending mass messages to your contacts → violates DPA and fair collection norms.
Shaming tactics (group chats, social posts, employer calls) → potential privacy, cybercrime, and civil liability exposure.
Confusing pricing (low teaser “per day” rates but high “processing”/“convenience” fees) → unfair/deceptive practice; EIR must be shown.
Auto-debit traps (withdrawals before payday or repeated failed charges with fees) → challengeable as unfair if not properly disclosed or if revocation is ignored.
Impossible timelines (same-day loan with same-day full repayment unless rolled over with heavy add-ons) → red flag for cost opacity.
Over-collection of data (e.g., GPS, photos, contact list without necessity) → data minimization breach.
Retention beyond necessity without anonymization → DPA violation.

5) Borrower rights checklist

Pre-contract: Clear disclosure of EIR, all fees, total obligation, schedule, and penalties.
During the loan:
- Access to account statements and computation breakdowns upon request;
- Ability to revoke marketing consent and manage data permissions consistent with service needs;
- Protection against abusive collection (time, frequency, tone, and audience of contacts).
Privacy rights: access, correction, erasure (where applicable), portability, and complaint to the NPC.
Overcharging/unconscionability: Courts/regulators may reduce unconscionable interest/penalties.
Security breach notification: You should be notified of personal data breaches that pose risk.

6) Lender compliance essentials (for internal policy and audits)

Licensing: Correct SEC/BSP authorization, including online lending permissions where applicable; publish corporate name, principal office, certificate numbers, and contact details in-app and on the website.
KYC/AML: Verified identities, sanctions screening, ongoing monitoring; secure handling of ID images and selfies.
Product governance: Approved pricing grid, fee catalogue, EIR computation, marketing scripts, and sales scripts with compliance sign-off.
Privacy governance:
- Privacy Notice and Consents mapped to each data flow;
- Data Sharing Agreements with processors/collectors;
- Privacy Impact Assessments (PIA) for high-risk processing (e.g., contact permissions);
- Breach Response Plan (containment, forensics, notification).
Collections: Written code of conduct (hours, frequency limits, prohibited language), call recording controls, complaint logging, and remediation playbooks.
Vendor management: DPA-compliant contracts, audits, and security controls for BPOs and tech partners.
Recordkeeping: Retention schedule aligned with law and business need; secure disposal or anonymization.

7) How to read a lending-app contract (consumer due diligence)

Front page/summary box: Confirm the EIR/APR-equivalent and total cost.
Fees table: Identify processing, convenience, disbursement, collection, roll-over, and early repayment fees.
Penalties: Late fees per day/month, caps, and whether interest compounds on penalties.
Permissions: What device data the app collects, why, who gets it, how long it’s kept.
Communications: Hours and channels; does it authorize contact of third parties? (This is a red flag.)
Auto-debit: Your control to cancel or change debit timing; error resolution.
Dispute clause: Venue, arbitration, fees; check for small-claims carve-out.
Early payoff: Right to prepay and how interest/fees are recomputed.
Assignment: Whether debts may be sold/assigned and your notice rights.

8) Complaint and enforcement pathways (step-by-step)

A. Start with the lender

Use the app’s in-app help or official email/phone. Keep screenshots, call logs, transaction IDs, and computation requests. Ask for a final response letter.

B. Regulator escalation (choose the right venue)

BSP Consumer Assistance: for banks/e-money issuers. File with account details, screenshots, and the lender’s final response.
SEC (for lending/financing companies and online lending platforms):
- Complaints on unlicensed activity, excessive/undisclosed fees, abusive collection, false advertising.
- Include loan contract, receipts, app screenshots, caller IDs/recordings (if lawfully obtained), and computation of charges.
NPC (privacy and harassment tied to misuse of data):
- File a complaint or incident report for contact scraping, non-consensual disclosure, overcollection, or breach.
- Attach privacy notice, consent screens, and evidence of third-party contact.
Law enforcement (PNP/DOJ) for threats, extortion, or cyber harassment.

C. Courts and ADR

Small Claims (no lawyers required): sue for sum of money up to the prevailing limit (currently high enough for typical consumer loans). Attach computations and proof.
Barangay conciliation: generally not required if a juridical person (corporation) is a party; check local rules.
Arbitration/mediation: follow contract clause where valid; ensure fees are not prohibitive.

9) Evidence kit for complaints

Loan application screens and final loan summary (before acceptance).
Contract, schedule, fee table, EIR computation.
Payment history and bank/e-wallet statements.
Communications: SMS, emails, call logs/recordings (observe recording laws), social posts.
Screenshots of app permissions and privacy notices.
Computation worksheet showing interest, penalties, and effective rates.
Written demands or final response from the lender.

10) Practical defenses and strategies for borrowers

Request a payoff computation; insist on itemized charges.
Dispute unconscionable fees in writing; cite truth-in-lending principles and unconscionability.
Revoke non-essential data consents; demand cessation of third-party contacts.
Document harassment; notify lender that future communications must comply with fair-collection standards.
Propose structured repayment; lenders often accept waiver/reduction of penalties against a realistic plan.
Escalate promptly if the lender ignores reasonable requests or continues harassment.

11) Compliance red flags (for lenders and platforms)

Operating an app without proper SEC/BSP authority.
No EIR or a “per-day” teaser with undisclosed fees.
Contact list upload is mandatory to proceed with a loan.
Shaming scripts or templates that target contacts/employers.
Data retention with no schedule; no DPIA for high-risk processing.
No in-app complaint channel or no final response procedure.
Collectors paid per recovery without controls → incentives for harassment.

12) Template: borrower letter for abusive collection & privacy misuse

Subject: Demand to Cease Abusive Collection and Unlawful Processing of Personal Data Dear [Lender/Collector], I reference Loan No. [___]. Your representatives have [describe conduct] including contacting [third parties]. This violates Philippine data privacy and fair collection standards. I demand that you: (1) cease contacting third parties; (2) restrict communications to my number/email between 8:00 a.m.–9:00 p.m.; (3) provide an itemized statement (principal, interest, fees, penalties) and effective interest rate; and (4) delete personal data not necessary for account servicing, consistent with your privacy notice and the Data Privacy Act. Please acknowledge within 5 business days. Failure to comply will lead to escalation before the SEC/NPC and other authorities. Sincerely, [Name] / [Contact] / [Date]

13) For startups: designing a compliant lending app

Consent architecture: granular toggles; deny path must not block the core service unless strictly necessary.
Transparent pricing UI: “Total to receive today / Total to repay / EIR / Next due” on one screen.
Collection guardrails: dialer throttles, call-time windows, audit of scripts, no third-party contact without lawful basis.
Privacy by design: default to off for contact/SMS access; conduct PIA; encrypt data at rest/in transit; role-based access.
Incident response: 72-hour internal triage, regulator notification thresholds, and consumer messaging templates.
Dispute workflow: in-app ticketing, 15-day final response target, settlement authority to waive penalties.

14) FAQs

Can a lender charge 1–2% per day if I consented? Consent alone won’t save a grossly unconscionable rate; regulators/courts may reduce unenforceable charges.

Can a lender text my boss or family? Generally no, absent a lawful basis. This risks privacy and harassment violations.

I repaid but the app won’t delete my data. They may retain what’s necessary (e.g., AML recordkeeping) for a limited time, but not everything indefinitely or for new purposes without basis.

Is a screenshot enough to prove harassment? Often yes, especially with timestamps, caller IDs, and multiple instances. Preserve original files.

15) Bottom line

For borrowers, demand clarity, document everything, and escalate smartly. For lenders, price transparently, collect fairly, and minimize data. The fastest way to regulatory trouble is abusive collection and opaque pricing—and the fastest way out is a clear EIR, clean consents, and a humane collections playbook.