Reporting Illegal Lending Businesses in the Philippines

A practical legal guide for consumers, employees, and local officials

1) Snapshot: what counts as “illegal lending”?

An operation is illegal if it is any of the following:

Unregistered lender – operating without registration with the Securities and Exchange Commission (SEC) as a lending or financing company, or operating as a bank/pawnshop/money service business without Bangko Sentral ng Pilipinas (BSP) authority.
Registered company, but no secondary authority – e.g., a corporation registered with SEC whose Articles don’t authorize lending, or one that never obtained the specific license/authority applicable to its activity (typical with online lending apps).
Use of prohibited collection practices – threats, public shaming, contacting a borrower’s phone contacts, profane or demeaning language, false representations, or harassment at work/home.
Deceptive disclosure – failure to provide clear information on total cost of credit (principal, interest, fees, penalties) prior to consummation.
Privacy violations – harvesting a borrower’s contacts/media, excessive data collection, or disclosure of debt to third parties without lawful basis or consent.
Criminal acts – robbery/extortion, grave threats/coercion, cyber-harassment, libel/slander, or identity theft.
Usury and “unconscionable” rates – while statutory usury ceilings were suspended decades ago, Philippine courts may strike down unconscionable interest/charges and reduce them equitably.

2) Legal framework (core statutes & principles)

Lending Company Regulation Act (LCRA) – governs lending companies; penalizes unlicensed lending and mandates disclosures and compliance.
Financing Company Act – governs financing companies (broader asset-based credit and installment financing).
Financial Consumer Protection Act (FCPA, 2022) – sets out the rights of financial consumers, prohibits abusive collection and mis-selling, and empowers regulators (BSP/SEC/IC/CDA) to investigate, issue cease-and-desist orders, impose admin sanctions, and order restitution.
Truth in Lending Act – requires meaningful disclosure of finance charges before a loan is granted.
Data Privacy Act (DPA) – prohibits unauthorized processing of personal data, requires proportionality and transparency; harassment via doxxing or contact-scraping is actionable.
Civil Code – unconscionable stipulations (interest, penalties, fees) may be void or reduced; damages may be awarded for abuse of rights or torts.
Revised Penal Code / Cybercrime Act – grave threats/coercion, libel/cyber-libel, unjust vexation, extortion, and related offenses.
Local Government Code / Barangay Justice – nuisance/harassment incidents can be mediated; LGUs may act on business-permit violations.

Tip: “Lending” vs. “Financing.” Lending companies primarily extend unsecured loans to the public; financing companies commonly do financing/discounting/credit for acquisition of goods or services. Both fall under the SEC. Banks/pawnshops/MSBs fall under BSP.

3) Who regulates what?

SEC – lending and financing companies, including online lending platforms (OLPs). Investigates unregistered lenders and abusive collectors; can suspend/revoke licenses, issue cease-and-desist orders, impose administrative fines, coordinate app takedowns, and file criminal actions.
BSP – banks, pawnshops, remittance/money service businesses, e-money issuers. Handles collection-practice complaints against entities it supervises.
National Privacy Commission (NPC) – privacy breaches by any lender/app (scraping contacts, doxxing, public shaming, excessive data). Can order stop-processing, delete unlawfully obtained data, and impose fines.
PNP Anti-Cybercrime Group / NBI – criminal harassment, threats, extortion, cyber-libel, identity theft.
City/Municipal LGU & Business Permits Office – absence of local permits; may issue closure orders for unpermitted physical outlets.
Department of Justice (DOJ)/Prosecutors – preliminary investigation for criminal complaints.
Courts – civil actions to nullify unconscionable terms, claim damages, or seek injunctions; criminal trials.

4) How to verify legitimacy before reporting

Check registration
- For non-banks: search the SEC’s public lists for lending or financing companies, and check if revoked/blacklisted.
- For banks/pawnshops/MSBs: check BSP’s public directories.
Match business name – compare the app/storefront name to the corporate name; many violators use aliases.
Check required disclosures – clear loan amount, term, interest rate, fees, and penalties before you proceed. If these are hidden, that’s a red flag.
Read permissions – an app demanding access to contacts/photos/location for a simple cash loan is likely over-collecting data (a DPA issue).

5) Where and how to report (step-by-step)

A. Report to the SEC (for lending/financing entities and OLPs)

When: unregistered operations; abusive collection; deceptive terms; violations of the LCRA/Financing Co. Act/FCPA. What to submit:

Complaint/Affidavit (see template below).
Proof of the entity’s activity: screenshots of app pages, loan offers, chat/email/SMS, payment receipts, contracts/“promissory notes,” screenshots of abusive messages or “contact blasting,” call recordings (if lawfully recorded), photos of offices/IDs, and your valid ID.
Details that help: app name and developer/publisher, website and social profiles, exact phone numbers used, GCash/bank accounts where payments were demanded, and dates/times.

What the SEC can do: investigate; direct removal of illegal apps/ads; issue cease-and-desist orders; impose administrative penalties; endorse criminal prosecution; publish advisories/blacklists; order restitution under the FCPA.

B. Report to the NPC (privacy/data abuses)

When: the lender accesses your contacts/media; sends messages to your colleagues/family; threatens to post your images; processes data without consent or beyond necessity. What to submit:

Sworn complaint stating facts;
Evidence of data misuse (screenshots of “contact blasting,” app permissions, privacy policy, call/SMS/email logs). Possible outcomes: Stop-processing orders, deletion of unlawfully obtained data, compliance orders, and administrative fines.

C. Report to PNP-ACG or NBI (criminal aspects)

When: grave threats, coercion, extortion, slander/libel (including cyber-libel), identity theft, robbery/intimidation. What to submit:

Sinumpaang Salaysay (sworn statement) with dates, places, and identities if known;
Abusive messages/voicemails; caller IDs; payment demands; any witness statements. Next step: case may be filed with the City/Provincial Prosecutor for preliminary investigation.

D. Inform your LGU (Business Permits/Mayor’s Office)

When: a physical office operates without permits or violates local ordinances (e.g., signage without permit, nuisance operations). Possible outcome: inspection, fines, and closure orders.

E. If the entity is a bank/pawnshop/MSB

File with the BSP consumer protection channel (not the SEC). Provide the same set of evidence and ID.

6) Building your case: evidence checklist

Copies of the loan agreement or in-app “Terms & Conditions” (export/print to PDF).
Disclosure screen showing principal, interest rate, fees, penalties, term.
Payment history: receipts, bank/GCash transfers, reference numbers.
Harassment proof: screenshots of messages to you and to your contacts; call recordings (include time/date); social posts.
Privacy proof: app permission prompts; phone OS logs of permissions granted; privacy policy copies.
Identity of actors: phone numbers, email addresses, GCash/bank account names and numbers, office addresses, agent names/IDs, app store listing.
Harm suffered: lost wages (if you missed work due to harassment), emotional distress, reputational damage (e.g., messages sent to employer).
Your ID and authority (if reporting for a company or as a parent/guardian).

Keep original files and share copies. Preserve metadata (dates/times). Do not delete the app or chats until you’ve exported what you need.

7) Remedies you may pursue (can be simultaneous)

Administrative (SEC/NPC/BSP) – sanctions, cease-and-desist, app takedown, restitution/refund, compliance orders.
Criminal – for threats, coercion, extortion, libel/cyber-libel, privacy crimes, and violations of special laws.
Civil – suit for damages; annulment or reformation of unconscionable loan terms; injunction against abusive collection; attorney’s fees and costs.
Employment remedies – if you’re an employee being harassed at work, coordinate with HR; employers may take action for workplace harassment and protect data of other employees.

8) Special topics

Online Lending Apps (OLPs)

Must be tied to a duly registered lending/financing company with SEC authority.
Prohibited practices include: (i) contacting persons in your phonebook; (ii) public shaming posts; (iii) misrepresenting they’re law enforcement; (iv) threats of arrest without a court order; (v) charging undisclosed fees.
SEC has previously imposed moratoria and special rules on OLPs and has ordered app store takedowns against violators.

Interest, fees, and “usury”

No fixed statutory ceiling applies across the board, but courts reduce or strike oppressive interest, penalties, and “processing fees.”
Hidden fees can be treated as finance charges subject to disclosure requirements; non-disclosure is actionable.
Roll-over loans that trap borrowers into repeated renewals with mounting “penalty/processing” charges are scrutinized as unconscionable.

Data privacy

Lenders may collect only what is proportionate and necessary to extend and service a loan.
Accessing contacts or broadcasting debt to third parties usually lacks lawful basis.
You may demand access, correction, and deletion; you may withdraw consent and complain to the NPC.

Collection conduct

Collectors must identify themselves, call only within reasonable hours, speak respectfully, and may not disclose your debt to others.
Employers are not obligated to honor demands sent to HR/colleagues unless served with a lawful court order or garnishment following judgment.

9) Practical step-by-step (borrower’s playbook)

Secure your evidence (export chats, screenshots, recordings).
Back up your phone before uninstalling any app; capture permission screens.
Freeze communications to one channel (email/SMS) to keep a clean record; avoid heated replies.
Run identity-protection basics: change passwords, enable 2FA, lock SIM, and alert your contacts not to respond to any messages about you.
File with SEC (if non-bank lender) and NPC (for privacy issues).
File with PNP-ACG/NBI if there are threats, extortion, or doxxing.
Consider a civil lawyer for injunction/damages, especially if your employer/clients were contacted.
Monitor for retaliation; document any new incidents and submit supplements to your pending complaints.

10) For employees and insiders (whistleblowing)

Keep copies of internal directives, scripts, and spreadsheets showing targeting or abusive collection.
Do not take data unlawfully—focus on documents that show policies and practices.
You may coordinate with SEC/NPC for secure submission.
If you face threats, inquire about remedies under the Witness Protection, Security and Benefit Act and seek counsel.

11) Model complaint templates

A. SEC Complaint (administrative)

Complainant: [Full Name, Address, Contact] Respondent: [Full Corporate Name / App Name / Aliases, Addresses, Contact Nos.] Subject: Illegal lending operations / Abusive collection practices

Allegations:

Respondent operates a lending/financing business [online/physical] without the required SEC authority or despite violations of the LCRA/FCPA.

On [dates], Respondent offered/granted me a loan of ₱[amount] at [stated rate/fees], without proper disclosure.

Beginning [date], Respondent/agents engaged in abusive collection, including [threats/contacting my employer/contact blasting/public shaming].

Respondent processed my personal data beyond necessity and without lawful basis, in violation of the DPA.

Relief Sought: Investigation; cease-and-desist; administrative fines; referral for prosecution; restitution; public advisory/blacklisting; and other reliefs just and equitable.

Evidence: (Annex A – screenshots; Annex B – loan agreement; Annex C – payment receipts; Annex D – call logs/recordings; Annex E – app permissions; Annex F – ID)

Verification/Jurat: Sworn and subscribed before a notary (or any officer authorized to administer oaths).

B. NPC Privacy Complaint

Complainant: [Name/Contact] Respondent: [Corporate/App name] Acts complained of: Unauthorized access to contacts; disclosure of my debt to third parties; harassment; lack of privacy notice; refusal to delete data. Relief: Order to stop processing, delete unlawfully processed data, impose penalties, and require compliance reporting. Annexes: Screenshots, permission logs, privacy policy, list of third parties contacted, timeline.

C. Criminal Complaint (PNP-ACG/NBI → Prosecutor)

Offenses: Grave threats/coercion; extortion; cyber-libel; violation of special laws. Narration of facts: Chronological details of calls/messages, exact words used, amounts demanded, and harm suffered. Supporting evidence: Excerpts of chats/calls, sender numbers/emails, payment instructions, witness statements. Prayer: Issuance of subpoena, filing of Information in court, and protection orders as warranted.

12) Defenses & borrower rights to anticipate

Right to demand disclosure of all finance charges; if undisclosed, you may question the validity of the charges.
Right to privacy and to restrict processing; you can require deletion of contacts harvested without basis.
Right to respectful collections; you can insist on written communications and business-hour contact.
Right to contest unconscionable terms; courts may reduce interest/penalties and void hidden fees.
No arrest without court process for simple non-payment of debt (it’s not a criminal offense by itself).

13) Frequently asked questions

Q1: I borrowed money from a “5-6” lender. Can I be jailed if I stop paying? Non-payment of a civil debt is not a crime. You can, however, be sued civilly. Criminal liability arises from separate acts (e.g., issuing bouncing checks, fraud, etc.).

Q2: The collector contacted my boss and clients. What can I do now? Notify them that disclosure of your debt to third parties is unlawful; include this in your SEC/NPC complaints and consider a civil action for damages and an injunction.

Q3: Can I force the app to delete my data? Yes, under the DPA you may request deletion when processing is unlawful or no longer necessary. Refusal strengthens your NPC case.

Q4: The interest is outrageous. Is that automatically illegal? Not automatically; but courts can strike down/reduce unconscionable rates and hidden charges, especially with evidence of deception or unequal bargaining power.

Q5: Should I keep paying while my complaint is pending? This is strategic. Stopping payment may escalate collection, but paying under protest preserves peace while you challenge illegal charges. Get case-specific legal advice.

14) Practical drafting & filing tips

Use dated filenames for annexes (e.g., 2025-03-02_abusive-texts.pdf).
Put timestamps on screenshots; export full conversation threads.
If you record calls, announce that you are recording.
Prefer email submissions so you retain an electronic trail.
Keep a logbook (date/time, caller number, summary, action taken).
When you receive a regulator’s docket number/reference, cite it in all follow-ups.

15) When to get a lawyer

When you need an injunction to stop harassment or takedown defamatory posts.
When facing sizable claims or wage garnishment threats.
When an employer or professional license is implicated.
To negotiate structured settlements or debt restructuring with lawful lenders.

16) Ethical note

Borrow responsibly. Illegal lenders prey on urgency and opacity; legitimate lenders provide clear disclosures, reasonable collection practices, and respect for your data rights.

One-page checklist (tear-off)

Identify regulator (SEC vs BSP)
Export loan terms & disclosures
Capture harassment & privacy violations
Prepare sworn complaint (SEC/NPC)
File criminal complaint (PNP-ACG/NBI) if threats/extortion
Notify LGU for unpermitted physical offices
Consider civil action for injunction/damages
Keep a timeline & docket references

This article is for general information only and is not a substitute for legal advice tailored to your situation.