Online Loan Agreements in the Philippines — A 2025 Comprehensive Legal Guide

This explainer is written for general information. It is not legal advice. Statutes, rules and jurisprudence are cited as of 25 May 2025.

1 | Concept & Typical Workflow

An online loan agreement (OLA) is a credit contract (usually small-ticket, short-term, unsecured) that is marketed, executed, funded and collected through the internet or a mobile app. The whole life-cycle is therefore governed simultaneously by Philippine contract law (Civil Code), sector-specific finance statutes, e-commerce rules on electronic documents and signatures, and the fast-evolving conduct standards imposed by the Securities and Exchange Commission (SEC), the Bangko Sentral ng Pilipinas (BSP) and the National Privacy Commission (NPC). (RESPICIO & CO.)

2 | Core Statutes and “Who Regulates What”

Legal Source	Key Coverage	Primary Regulator
RA 9474 (Lending Company Regulation Act 2007) & RA 8556 (Financing Company Act 1998)	Licensing; ₱1 M (LC) / ₱10 M (FC) paid-up capital; Certificate of Authority; criminal liability for unlicensed lending	SEC
SEC Memos – MC 18-2019 (registration of every Online Lending Platform), MC 19-2019 (unfair debt-collection ban), MC 10-2021 (data-permission limits), MC 3-2022 (business-plan & reporting), plus CDO practice	Conduct, disclosure, tech permissions, sanctions up to ₱1 M fine + license revocation	SEC (RESPICIO & CO.)
RA 11765 (Financial Products & Services Consumer Protection Act 2022)	Cross-agency consumer rights (fair treatment, disclosure, fraud redress, restitution)	BSP, SEC
BSP Circular 1133-2021	Interest- and fee-ceiling for loans ≤ ₱10 000 & ≤ 4 months: ‣ Nominal 6 % / month (0.2 % / day) ‣ Effective 15 % / month (0.5 % / day) incl. all fees ‣ Penalty cap 5 % / month ‣ Absolute “total cost” cap 100 % of principal	BSP, enforced by SEC
RA 3765 (Truth-in-Lending Act) & BSP/SEC IRR	APR and all-in finance-charge disclosure	BSP, SEC
RA 8792 (E-Commerce Act 2000) plus 2020 Interim Rules on Remote Notarization (A.M. No. 20-07-04-SC)	Legal effect of electronic documents & signatures; validity of e-loan contracts; optional remote notarization of paper originals	DICT / SC
RA 10173 (Data Privacy Act 2012) & NPC circulars	Lawful basis for data processing; ban on “contact-list scraping”, “doxx-harass” tactics	NPC
RA 9160 (AMLA) & SEC MC 4-2021	LCs/FCs are covered persons – AMLC registration, CDD/KYC, STR/CTR filing, ML/TF program	AMLC / SEC (UP College of Law)

3 | Incorporation, Licensing & Platform Registration

Set-up a stock corporation at the SEC.
Secure a Certificate of Authority (CA) under RA 9474/RA 8556. The CA expressly limits credit activities to the Philippines and is renewed every three years.
File the Online Lending Platform (OLP) dossier under MC 18-2019 before any app or website goes live; each new build or re-brand needs prior SEC clearance. (RESPICIO & CO.)
NPC Registration as a personal-information controller and submission of a Data-Protection Impact Assessment covering the app’s permissions.
AMLC Registration & ML/TF Program within 60 days of SEC licence (MC 4-2021). (UP College of Law)
BSP Coordination if the lender also operates as an EMI, digital bank or partners with an EMI for disbursement/collection (see BSP Circular 1154 & 1205 on digital banks).

Failing any step exposes promoters and officers to administrative closure, criminal prosecution (up to 10 years’ imprisonment under RA 9474) and permanent disqualification as corporate directors. (Respicio & Co.)

4 | Formation & Validity of the Online Loan Contract

Requirement	Legal Basis	Practical Take-away
Consent, object, cause	Art. 1318 Civil Code	Click-wrap or OTP-based acceptance is valid if unambiguous and borrower may download a copy.
Electronic form & signature	RA 8792 §7–11	Contracts “shall not be denied legal effect… solely because in electronic form.” A simple typed name, tick-box, biometrics or digital certificate will suffice unless a law requires notarization.
Notarization (rare)	2020 RON Rules	If collateral (e.g., chattel mortgage) must be notarized, parties may send the wet-ink original to the notary and appear via video under strict identity-proofing rules.
Disclosure of finance charge	RA 3765 & BSP/SEC IRR	APR, total peso cost, due dates and all fees must appear on the very first screen that shows the loan amount. Hidden “processing fees” deducted upfront violate both RA 3765 and RA 11765.
Privacy consent	RA 10173	Contact-list harvesting, GPS tracking and microphone access are illegal except for the three permissions expressly allowed by MC 10-2021 (camera, microphone, location).

5 | Pricing Rules — Interest, Fees & Penalties

Statutory Ceiling (small-value loans) – BSP Circular 1133-2021 (Sec. 1–2) fixes the nominal and effective monthly rates plus a total-cost “double-the-principal” cap. Breaking the ceiling is an “abusive practice” that grounds SEC cease-and-desist orders and borrower restitution under RA 11765.
Other loans (>₱10 000 or >4 months) – No hard cap, but the Civil Code test of unconscionability and the Usury Law (Act 2655) as revived by BSP may still void a rate if it “shocks the conscience.”

6 | Debt-Collection Conduct Standards

MC 19-2019 lists thirteen “unfair collection practices,” including: public shaming, threats of violence, obscene language, contacting borrowers’ contacts more than once, and false criminal accusations. Fines scale from ₱25 000 → ₱1 M plus licence revocation; repeat violators are now automatically endorsed to the DOJ Cybercrime Office for prosecution under the Anti-Cybercrime Act. (Credit Information Corporation, Respicio & Co.)

The NPC separately prosecutes “doxx-harass” tactics as unauthorised processing (up to 6 years’ imprisonment). Coordinated SEC-NPC raids since 2023 have shuttered 800 + rogue apps. (Respicio & Co.)

7 | Data Privacy & Cybersecurity Obligations

Lawful Basis: processing must be necessary for the performance of a contract or with explicit consent (DPA §12).
Purpose Limitation: permissions beyond camera-microphone-location (e.g., contacts) are prima facie illegal (MC 10-2021).
Security Measures: encryption of data-in-transit, two-factor authentication, breach-notification within 72 h to NPC.
Cross-border Transfer: allowed only if the recipient country has equal or stronger DPA safeguards or with data-subject consent.

8 | Anti-Money Laundering & KYC

Lending and financing companies are “covered persons”; failure to register with the AMLC online reporting portal or to file Suspicious Transaction Reports (STRs) is punishable by up to ₱500 000 per offense plus CDD restrictions on the platform itself. (UP College of Law)

9 | Common Contract Clauses — What Regulators Expect to See

Clause	Compliance Tip
Clear loan‐summary box (amount, tenor, APR, total cost)	Mirror the BSP “Key Fact Statement” template to satisfy RA 3765 & RA 11765.
Grace-period & pre-payment	RA 11765 gives borrowers the right to pre-pay subject only to disclosed reasonable fees.
Borrower identity warranties (selfie, e-KYC)	Align with AML CDD Tier 1; preserve facial-biometric match logs for 5 yrs.
Consent to electronic service of notices	Protects lender if debtor blocks the app or e-mails.
Venue & governing law	PH law and courts only; arbitration is allowed but may not oust SEC jurisdiction on consumer complaints.

10 | Enforcement Snapshot (2019 – 2025)

SEC cease-and-desist orders: > 900 apps closed; 19 entities shut in a single 2024 order. (Credit Information Corporation)
Google Play takedowns: 33 unregistered OLAs de-listed in Feb 2023 after SEC referral. (ABS-CBN)
Licence revocations for harassment: e.g., Populus Lending (2023). (Newsbytes.PH)

11 | Cross-Border & FinTech Issues

Digital-bank partnerships (BSP Circular 1105/1205) let OLAs disburse via e-wallet, but the digital bank remains jointly liable under RA 11765.
Buy-Now-Pay-Later (BNPL): treated as a “deferred payment sale” → still a “loan” if finance charges are imposed; BNPL operators must get a CA or team with one.
Foreign lenders targeting Philippine-resident borrowers fall under “doing business” rules and need an SEC licence or local subsidiary.

12 | Future Outlook (2025–2026)

BSP review of Circular 1133 is due before 3 Jan 2026; the ceiling may tighten or expand to higher loan sizes.
A draft E-Notarization Bill (House Bill 10267) seeks to allow fully digital notarization, removing the courier step under the interim RON Rules.
NPC public consultations on an “Algorithmic Fairness” circular could require disclosure of credit-scoring AI models.

13 | Checklist for Compliance Officers

Confirm CA-LC/FC & OLP approval on file.
Publish hotline, SEC reg. no. & CA no. in-app and on ads. (MC 19-2019)
Embed KFS (loan-summary) on the first loan-offer screen.
Hard-code interest cap logic and total-cost cap into calculation engine.
Limit Android/iOS permissions to camera, mic, location; disable contact scanning.
Run quarterly privacy & AML audits; file STRs within 5 days of red-flag trigger.
Maintain call-log evidence to prove no unfair collection (max 1 text & 1 call per day).
Keep complete borrower file (e-sign logs, disclosure receipts) for 5 years.

14 | Borrower Remedies at a Glance

Complaint	Where to File	Typical Relief
Harassment / doxxing	SEC (EIPD) & NPC	CDO vs. lender; deletion of data; fines; moral damages
Excessive interest	SEC / BSP	Refund of charges above cap; penalties on lender
Unlicensed app	SEC	App de-listing; criminal case vs. officers
Data-privacy breach	NPC	Compliance order; possible jail for “unauthorised processing”
Fraudulent mis-representation	PNP-ACG / DOJ	Cyber-fraud prosecution

Key Take-aways

Licensing is non-negotiable. Operating an online lending platform without both an SEC CA and an OLP registration is a criminal offense.
Pricing is capped. For the small-value consumer loans that dominate the app space, the BSP’s 6 %/15 %/100 % formula is absolute.
Digital signatures are enforceable under RA 8792, but certain collateral documents still need remote notarization.
Collection tactics are now heavily policed. MC 19-2019 and RA 11765 make harassment a fast-track to licence revocation and criminal charges.
Privacy-by-design is mandatory. The combination of the Data Privacy Act and MC 10-2021 makes intrusive phone-permission harvesting illegal.

For lenders, full-spectrum compliance is now a strategic necessity. For borrowers, the legal toolkit to contest abusive OLAs has never been stronger.

Prepared 25 May 2025.