A legitimate online lender in the Philippines should be more than a registered corporation with a polished app. It should have authority from the proper regulator, operate the particular lending platform it advertises, disclose the true cost of the loan before you agree, process personal data lawfully, and follow fair collection rules. Checking all five points can protect you from advance-fee scams, cloned company identities, hidden charges, and apps that misuse your contacts.

What Makes an Online Lending Company Legitimate?

For an ordinary lending or financing company, legitimacy has several layers:

The company legally exists.
It has an active Certificate of Authority to operate as a lending or financing company.
The app, website, or online lending platform actually belongs to that company.
Its loan terms comply with disclosure, pricing, privacy, and consumer-protection rules.
Its authority has not been suspended or revoked.

A company’s SEC Certificate of Incorporation is only its primary registration. A lending company must also obtain a secondary license, called a Certificate of Authority or CA, before it may legally engage in the lending business.

Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company must generally be organized as a stock corporation and must secure authority from the Securities and Exchange Commission. Operating without a valid SEC authority is punishable under the law. (Lawphil)

This means that the following do not, by themselves, prove that an online lender is legitimate:

A DTI business-name certificate
A barangay clearance or mayor’s permit
A BIR registration certificate
An SEC Certificate of Incorporation without a lending or financing CA
An app-store listing
Thousands of social-media followers
A photograph of an SEC certificate
A claim that the company is “SEC registered”
A celebrity endorsement or paid advertisement

Philippine Laws Protecting Online Loan Borrowers

Law or regulation	What it means for borrowers
RA 9474, Lending Company Regulation Act of 2007	Lending companies must be properly organized and authorized by the SEC.
RA 8556, Financing Company Act of 1998	Financing companies are also regulated by the SEC, subject to limited areas of BSP authority.
RA 3765, Truth in Lending Act	The lender must disclose the true cost of credit in writing before the loan is completed.
RA 11765, Financial Products and Services Consumer Protection Act of 2022	Financial consumers have rights to fair treatment, transparent information, data protection, fraud safeguards, and proper complaint handling.
RA 10173, Data Privacy Act of 2012	Personal information must be collected and used only for lawful, specific, and proportionate purposes.
SEC Memorandum Circular No. 18, Series of 2019	Lending and financing companies and their collectors may not use threats, insults, public shaming, deception, or other unfair collection methods.
SEC Memorandum Circular No. 19, Series of 2019	Advertisements must contain identifying disclosures, and online lending platforms must be reported to the SEC.
SEC Memorandum Circular No. 3, Series of 2022	Certain small, short-term, unsecured loans are subject to interest, fee, penalty, and total-cost ceilings.
NPC Circular No. 20-01, as amended	Online lending apps face specific restrictions on contact-list access, permissions, character references, guarantors, photos, and borrower data.

The Truth in Lending Act requires a written disclosure before the credit transaction is completed. It must identify the amount financed, itemized charges, finance charge in pesos, and the applicable annual rate. “Finance charge” includes not only interest but also fees and service charges connected with the loan. (Lawphil)

Under RA 11765, financial service providers must maintain a consumer-assistance mechanism and protect borrowers against abusive debt recovery, misuse of personal information, fraud, and unfair treatment. (Bureau of Small and Medium Enterprises)

How to Check an Online Lending Company Step by Step

1. Find the exact legal name of the lender

Do not search only the brand or app name. Look for the legal corporate name in the:

Loan agreement
Disclosure statement
Privacy notice
App-store developer page
Website footer
Terms and conditions
Customer-service page
Payment instructions

For example, an app called “QuickCash” may be operated by “ABC Financing Corporation.” The company you must verify is ABC Financing Corporation, not merely QuickCash.

Be cautious when the legal creditor is missing, written differently across documents, or disclosed only after you upload your IDs.

2. Identify the correct regulator

Most stand-alone lending and financing companies are supervised by the SEC. Banks, digital banks, and many other financial institutions are supervised by the Bangko Sentral ng Pilipinas.

Lender type	Where to verify
Lending company	SEC
Financing company	SEC
Online platform operated by a lending or financing company	SEC
Universal, commercial, thrift, rural, cooperative, or digital bank	BSP
Lending app using a bank as the actual creditor	Verify the bank with BSP and examine the platform’s role
Cooperative lending to members	Cooperative Development Authority, subject to applicable cooperative laws
Pawnshop or remittance provider offering a regulated product	Usually BSP, depending on the product and entity

Banks and digital banks can be checked through the BSP Directory of Banks and Non-Bank Financial Institutions. (Bureau of Small and Medium Enterprises)

3. Search the company on the SEC’s official system

Use the Check with SEC portal or the official SEC Check App. Search using:

The complete corporate name
Variations of the corporate name
The SEC registration number shown in the advertisement
The alleged Certificate of Authority number

Confirm the company’s current status rather than relying on an old screenshot or a PDF list shared on Facebook. Older SEC lists expressly state that they are subject to amendment or updating, so a company appearing on a years-old list may now have a different status. (SEC Appointment System)

4. Verify the Certificate of Authority

The most important question is not simply, “Is this company registered?” It is:

Does this company have a valid and active Certificate of Authority to operate as a lending or financing company?

Record the following:

Exact corporate name
SEC registration number
CA number
Whether the CA is for lending or financing
Current status
Registered business address

When the online result is incomplete or unclear, submit a request through the SEC iMessage system. The SEC’s Financing and Lending Companies Department accepts requests for certification of CA status and complaints involving lending and financing companies. The system issues a ticket that can be tracked. (Securities and Exchange Commission)

For a formal corporate-document request, the SEC Express System allows users to order plain or authenticated SEC documents. Delivery is generally within three to five working days after the documents are released by the SEC, although SEC processing time comes before delivery. (SEC Express System)

5. Confirm that the app or website belongs to the licensed company

A real company’s name and CA number can be copied by scammers. Finding a legitimate corporation in SEC records is therefore not enough.

Match the SEC information against the platform:

Detail	What should match
Corporate name	Loan contract, privacy notice, website, app listing, and SEC record
SEC registration number	Advertisement and official company information
CA number	Advertisement, website, or written confirmation
Business address	SEC information and official contact page
Website domain	Domain used in the company’s official communications
App developer	Company itself or an identifiable authorized technology provider
Payment recipient	Creditor or a clearly disclosed authorized payment partner
Email address	Preferably an official company domain rather than a free personal account

SEC Memorandum Circular No. 19, Series of 2019 covers identifying disclosures in advertisements and the reporting of online lending platforms. Compliant advertisements should conspicuously identify the corporate lender, its SEC registration, and its Certificate of Authority information. (SEC Appointment System)

A mismatch does not always prove fraud. A lender may use a separate brand, technology contractor, collection agency, or payment processor. However, the relationship should be clearly explained through verifiable official channels.

6. Check for SEC advisories, suspension orders, and revocations

Search the company name together with phrases such as:

“SEC advisory”
“revoked Certificate of Authority”
“suspended lending company”
“cease and desist order”
“unauthorized online lending platform”
“SEC Philippines complaint”

Use official SEC pages rather than relying solely on news posts or social media. A company may still have an old Certificate of Incorporation even after its lending authority has been suspended or revoked.

7. Examine the app’s permissions before installing or applying

A legitimate lending app should not treat unrestricted access to your phone as the price of obtaining a loan.

A joint DICT-NPC-SEC advisory dated March 18, 2026 reiterates that unnecessary, excessive, or disproportionate processing of borrower data is prohibited. Contacting people in a borrower’s contact list for collection is prohibited unless the person is a properly consenting guarantor. Camera or gallery access may be used for legitimate identity verification or know-your-customer procedures, but the permission should be turned off after its purpose has been fulfilled. (National Privacy Commission)

Treat these permissions as serious warning signs:

Unrestricted copying of your entire contact list
Access to SMS messages unrelated to identity verification
Continuous access to photographs or videos
Access to call logs without a clear, lawful purpose
Permission to post, message, or call people automatically
Accessibility-service access that lets the app control the phone
Requests to install an APK from a private message
Requests for remote-screen access

A character reference is not automatically a guarantor. A reference may be contacted for identification or verification. A guarantor assumes responsibility for the debt and must separately consent to that obligation. An app should not quietly convert every reference or phone contact into a person who can be harassed about the loan. (National Privacy Commission)

8. Read the disclosure statement before accepting the loan

Do not rely on the amount displayed on the first screen. Before pressing “Accept,” “Confirm,” or “Disburse,” check:

Principal amount
Amount actually released to you
Interest rate
Processing, service, verification, transfer, or handling fees
Documentary or notarial charges
Due date and payment schedule
Late-payment penalty
Collection charges
Total amount payable
Effective interest rate
Renewal or rollover terms
Method of computing the balance after default
Cancellation or cooling-off rights, if offered
Name of the actual creditor

The implementing rules of RA 9474 require disclosure of the principal, interest, processing charges, amortization schedule, penalties, collection fees, notarial fees, other charges, collection procedures, and the method for computing charges after default. (Lawphil)

A lender advertising “0% interest” may still charge substantial processing or service fees. Compare the money you actually receive with the total amount you must repay, not merely the advertised interest percentage.

9. Check whether the loan falls under the special interest-rate caps

SEC Memorandum Circular No. 3, Series of 2022, implementing BSP Circular No. 1133, applies to unsecured, general-purpose loans that:

Do not exceed ₱10,000
Have a term of no more than four months
Are offered by covered lending companies, financing companies, or their online platforms
Were entered into, restructured, or renewed beginning March 3, 2022

For covered loans, the ceilings are:

Charge	Maximum
Nominal interest	6% per month
Effective interest, including most fees	15% per month
Late or nonpayment penalty	5% per month on the outstanding scheduled amount due
Total interest, fees, charges, and penalties	100% of the total amount borrowed

The effective-interest ceiling includes charges such as processing, service, handling, verification, and notarial fees, although late-payment penalties are treated separately. (Law and Policy Reform Program)

These particular ceilings do not automatically apply to every loan. Larger loans, longer-term loans, secured loans, and loans for other purposes may fall outside the circular’s defined coverage. They remain subject to applicable disclosure, contract, consumer-protection, and fair-conduct rules.

10. Verify the payment instructions

Be especially cautious when told to send money to:

A collector’s personal GCash or Maya account
A personal bank account unrelated to the corporate lender
An account whose name changes repeatedly
A cryptocurrency wallet
A remittance recipient identified only by a first name
A payment link sent from an unofficial social-media account

Some legitimate lenders use authorized payment processors or collection partners. Verify the arrangement through contact information independently obtained from the company’s official website or SEC records—not through the same person demanding payment.

Never disclose your:

One-time password or OTP
ATM PIN
E-wallet PIN
Online-banking password
Card verification code
SIM-registration credentials
Recovery code
Screen-sharing or remote-access code

Major Red Flags of an Illegal or Fake Online Lender

Stop the transaction when several of these signs appear together:

The company will not disclose its complete legal name.
It provides an SEC registration number but no Certificate of Authority.
Its CA belongs to a different company.
The app or domain cannot be linked to the licensed corporation.
It guarantees approval regardless of identity, income, or repayment capacity.
It asks for an advance payment to “unlock,” “verify,” “insure,” “cancel,” or “release” the loan.
The advance fee must be sent to a personal account.
It asks for an OTP or banking password.
It disburses money without clear acceptance of final terms.
The total charges appear only after disbursement.
It requires unrestricted contact-list access.
It threatens arrest merely for failure to pay.
It threatens to post the borrower’s photograph or ID.
It contacts an employer, relatives, friends, or unrelated phone contacts to shame the borrower.
It pretends that a collector is a police officer, court sheriff, lawyer, or government employee.
It refuses to provide a written loan agreement or disclosure statement.

SEC Memorandum Circular No. 18 prohibits violence or threats of violence, threats of legally impossible action, insults or profane language, publication of borrower information, false representations, and contact at unreasonable hours. It also treats contacting people in the borrower’s contact list—other than identified guarantors or co-makers—as an unfair collection practice. (Law and Policy Reform Program)

What to Do If You Already Gave the App Your Information or Money

Preserve evidence first

Before deleting the app, save:

Screenshots of the app and app-store page
Website addresses and social-media profiles
Privacy policy and terms
Loan agreement and disclosure statement
Messages, emails, and call logs
Threats or public posts
Payment instructions
Bank or e-wallet receipts and transaction numbers
Names and numbers used by collectors
Permissions requested by the app
Proof of the amount actually received
SEC registration and CA details claimed by the lender

Screen-recording the important pages can help when the app prevents screenshots or changes its content.

Secure your accounts and device

Revoke unnecessary app permissions, change compromised passwords, enable multi-factor authentication, and notify your bank or e-wallet immediately when an OTP, password, SIM, or unauthorized payment may be involved. Uninstalling the app may stop further access, but preserve evidence first.

Complain to the correct agency

Problem	Agency or channel
Unauthorized or abusive lending or collection	SEC iMessage
Contact-list misuse, unauthorized disclosure, or public posting of personal data	National Privacy Commission complaint process
Complaint against a bank or digital bank	BSP consumer-assistance channels
Fraud, impersonation, threats, or cybercrime	DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group
Unauthorized bank or e-wallet transaction	The institution’s official fraud or consumer-assistance channel

The 2026 joint government advisory identifies SEC iMessage for unfair collection complaints and lists the DICT, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for harassment, threats, fraud, and scams. (National Privacy Commission)

For a formal NPC complaint, the current NPC procedure generally requires a notarized Complaints-Assisted Form or verified complaint, supporting evidence, and applicable identification documents. Filing requirements should be checked against the latest form before submission. (National Privacy Commission)

An unauthorized lender’s lack of a license does not necessarily mean that money actually received can simply be ignored. Keep a precise record of the amount disbursed, payments already made, disputed charges, and communications. Do not pay unexplained fees or surrender account credentials merely because a collector applies pressure.

Common Situations That Confuse Borrowers

The app name is different from the company name

This can be legitimate when the app is a registered or reported platform of the licensed corporation. Verify the connection through SEC records, official company communications, and the loan documents.

The company is legitimate, but the person messaging me may be an impostor

Scammers frequently use the names, logos, certificates, and addresses of real companies. Independently contact the lender using details from an official source. Do not use the phone number or link supplied by the suspected scammer.

The app is on Google Play or the Apple App Store

An app-store presence is not equivalent to a Philippine lending license. The 2026 government advisory recommends downloading only from official or verified sources and confirming that the operator is duly registered and licensed. Both checks are necessary. (National Privacy Commission)

The lender says it is “DTI registered”

A DTI business-name registration does not replace the SEC authority required for a lending company. Under RA 9474, a lending company is generally organized as a stock corporation and requires a Certificate of Authority. (Lawphil)

I am a foreigner borrowing while in the Philippines

The same verification process applies. Be particularly careful when an app asks for passport, visa, or ACR I-Card images. Identity documents may be processed for legitimate verification, but access and retention should remain necessary and proportionate. Avoid platforms that cannot identify the Philippine creditor or explain how sensitive identity data will be used and protected. (National Privacy Commission)

Frequently Asked Questions

How do I know whether a lending app is SEC registered?

Find the app’s exact corporate operator, search it through Check with SEC, and verify both its corporate registration and active Certificate of Authority. Then confirm that the particular app or website belongs to that company.

Is an SEC registration number enough?

No. A corporation may legally exist without being authorized to lend. A lending or financing company needs the appropriate Certificate of Authority.

Can a legitimate company operate under a different app name?

Yes, but the brand or app must be traceable to the licensed company. The loan agreement, privacy notice, advertisement, developer information, and official company records should be consistent.

Is it legal for a loan app to access all my contacts?

Unrestricted or excessive contact-list processing is prohibited. Access must be necessary and proportionate, and unrelated contacts cannot be used for collection. Only a person who separately consented as a guarantor may be contacted in relation to the guaranteed obligation. (National Privacy Commission)

Can an online lender post my photo or message my friends?

Using borrower data to harass, shame, or pressure payment may violate SEC collection rules, the Data Privacy Act, NPC regulations, and other laws depending on the conduct. The borrower’s photograph may not be used to harass or embarrass the borrower. (National Privacy Commission)

Are online loan interest rates capped in the Philippines?

Certain unsecured, general-purpose loans of ₱10,000 or less with a term of up to four months are subject to the specific ceilings under SEC Memorandum Circular No. 3, Series of 2022. Other loans require a separate legal and contractual assessment.

Is paying a processing fee before loan release normal?

A disclosed processing fee can form part of a legitimate loan’s finance charge. However, being told to transfer money first to a personal account to “unlock” or “release” a promised loan is a major advance-fee scam warning. Verify the company and payment channel independently.

Can I be arrested simply because I could not pay an online loan?

Mere nonpayment of a civil debt does not by itself justify imprisonment. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt. Fraud, bouncing checks, identity falsification, or other separate criminal conduct can raise different issues, but a collector cannot lawfully threaten automatic arrest merely because an installment is overdue. (Lawphil)

Where can I report an abusive online lending app?

Report lending and collection violations through SEC iMessage. Report personal-data misuse to the National Privacy Commission. Fraud, impersonation, cyber harassment, and threats may also be reported through the DICT, NBI Cybercrime Division, or PNP Anti-Cybercrime Group.

Key Takeaways

A Certificate of Incorporation is not the same as authority to lend.
Verify the exact corporate lender and its active SEC Certificate of Authority.
Confirm that the app, website, developer, contract, and payment channels genuinely belong to that lender.
Do not rely only on app-store availability, social-media popularity, a DTI certificate, or an image of an SEC document.
Read the written disclosure statement and compare the amount received with the total amount payable.
Certain loans of ₱10,000 or less and up to four months are subject to specific interest and cost ceilings.
Unrestricted contact-list access, public shaming, threats, and messaging unrelated contacts are prohibited warning signs.
Never send an advance “release fee” to a personal account or disclose an OTP, PIN, password, or remote-access code.
Preserve screenshots, contracts, payment records, and messages before deleting an abusive or suspicious app.
Direct complaints to the SEC, NPC, BSP, or cybercrime authorities according to the lender and the violation involved.