SEC License Requirements for Online Lending Companies in the Philippines
A practitioner‑oriented legal guide (updated April 2025)
I. Why the SEC Matters
Any entity that “lends money from its own capital ‑‑ for profit and on a regular basis” falls under Philippine securities regulation. While banks obtain authority from the Bangko Sentral ng Pilipinas (BSP), non‑bank lenders must first secure a Certificate of Authority (CA) from the Securities and Exchange Commission (SEC) in addition to their corporate registration. Operating without a CA is both an administrative offense (₱10 000‑₱50 000 fine plus ₱1 000 per day of continuance) and a criminal act punishable by up to 20 years’ imprisonment under Republic Act (RA) 9474.
With the explosive growth of smartphone‑based lending, the SEC has issued special circulars that layer technology‑specific controls on top of the classic licensing rules. This article consolidates both the “old‑school” corporate‐law requirements and the fintech add‑ons so you have everything in one place.
II. Core Statutes and Rules
| Instrument | Key Provisions for Online Lending |
|---|---|
| RA 9474 — Lending Company Regulation Act of 2007 | Requires a CA; minimum paid‑up capital ₱1 000 000; foreign equity capped at 49 % of voting stock. |
| RA 8556 — Financing Company Act of 1998 | Alternative framework for companies that buy receivables or grant longer‑term credit; higher capitalization (₱10 M inside NCR / ₱5 M elsewhere); no foreign‑equity cap. |
| SEC Memorandum Circular (MC) No. 19‑2019 | Defines “Online Lending Platform (OLP)” and “Online Lending Application (OLA)”; compels pre‑launch registration of every app or website. |
| SEC MC No. 10‑2021 | Limits data collected through an OLA to (i) camera, (ii) microphone, (iii) location — any other phone permissions are illegal. |
| SEC Revised IRR of RA 9474 (2022) | Updates forms; imposes AML/CTF compliance certificate as a condition precedent to CA renewal. |
| BSP Circular No. 1133‑2021 | Caps effective interest, default and service fees for loans ≤ ₱10 000 at 0.8 % per day (15 % per month) and 5 % penalty of outstanding balance. |
| Data Privacy Act of 2012 (RA 10173) & NPC Circulars | Requires privacy manual, NPC registration and breach‑notification within 72 hours. |
| Anti‑Money Laundering Act (RA 9160, as amended) | Treats SEC‑supervised lending and financing companies as “covered persons”; must register with AMLC, adopt KYC program and submit CTR/STR reports. |
| Credit Information System Act (RA 9510) | Mandatory membership in the Credit Information Corporation (CIC) for data sharing. |
III. Two‑Step SEC Licensing Workflow
Incorporate the Entity
- Name reservation. Must contain the words “Lending Company” (or “Financing Company” if choosing that route).
- Articles of Incorporation & By‑Laws. At least 5 incorporators (3 must be residents); term may be perpetual under the Revised Corporation Code.
- Capital.
- Lending Co. — paid‑up ≥ ₱1 000 000
- Financing Co. — paid‑up ≥ ₱10 000 000 (NCR) / ₱5 000 000 (outside NCR)
- Treasurer‑In‑Trust Affidavit, Proof of deposit or bank certificate.
- Filing fees: 0.2 % of authorized capital stock + legal research fee (₱10 per ₱1 000) + documentary stamps.
Secure the Certificate of Authority (CA)
- Primary requirements (filed with SEC Financing and Lending Division, Head Office):
- Notarized Application Form (SEC Form F‑107)
- Certified true copy of SEC Certificate of Incorporation
- Information Sheet on directors/officers with NBI or police clearances
- Proof of minimum capitalization (bank certification)
- AML compliance documents (board‑approved MLPP, AMLA registration proof)
- Business plan covering credit‑scoring model, target market and collection strategy
- Technology‑specific annexes (for online lenders):
- Systems Description of the OLP/OLA, including architecture diagram, data flows and APIs;
- Copy of APK or TestFlight file, URL of web app, screenshots of onboarding and consent screens;
- Certification from a third‑party information‑security auditor that the app meets ISO 27001 or equivalent;
- NPC‑stamped Privacy Manual and Privacy Impact Assessment;
- Board resolution authorizing launch of the OLP/OLA.
- Fees: ₱10 000 CA fee + ₱2 000 per additional branch; OLP/OLA registration ₱10 000 per application.
- Primary requirements (filed with SEC Financing and Lending Division, Head Office):
Average processing time is 30 calendar days if all papers are complete; the SEC may require clarifications, effectively pausing the clock.
IV. Obligations After Licensing
| Area | Ongoing Duties | Frequency |
|---|---|---|
| Regulatory Filings | Audited FS (e‑FS portal) with General Information Sheet | Annually, within 120 days of FYE |
| OLP/OLA Updates | File Prior‑Notice of new features, UI overhaul or migration of hosting provider | ≥ 10 days before release |
| Interest & Fee Compliance | Ensure effective rates stay within BSP Circular 1133 caps for small‑ticket loans | Continuous |
| AML/CTF | CTR and STR submission via AMLC portal; independent AML audit | Within 5 BD; audit every 2 years |
| Data Privacy | NPC annual registration renewal; breach notices within 72 hours | Annual / As needed |
| CIC Reporting | Positive and negative credit data feed to CIC in prescribed XML format | Monthly |
| Consumer Protection | Provide loan agreement in Filipino and English; give full amortization schedule and cool‑off period of at least 24 hours; maintain complaints logbook | Continuous |
V. Prohibited Collection and Data Practices
- No Contact Scraping. An OLA may view but not export or transfer the borrower’s phone contacts, photos, or social‑media list.
- No Public Shaming. Sending messages or making calls to third parties who are not guarantors is deemed harassment under SEC MC 18‑2019.
- No Misleading Ads. All marketing must disclose total cost of credit, not just daily interest.
- Call‑Center Location. Collection staff must operate from a site disclosed to SEC; sub‑contractors are allowed but the principal remains liable.
Violations trigger fines up to ₱1 000 000 and “kill‑switch” delisting of the offending app from the Google Play Store and Apple App Store.
VI. Foreign Ownership, Tax and Other Cross‑Cutting Issues
| Topic | Lending Co. | Financing Co. |
|---|---|---|
| Foreign equity ceiling | 49 % voting shares (RA 9474) | None (but constitutional 40 % limit if land ownership or mass media involved) |
| Withholding Taxes | 20 % final tax on interest paid to individuals; 30 % to non‑resident corps (treaty rates may apply) | Same |
| Gross Receipts Tax | 5 % on interest, commissions and discounts in lieu of VAT | 5 % (credit companies are VAT‑exempt) |
| Branching | Prior SEC approval; submit projected financials and proof of paid‑up increase if aggregate loans exceed 10× capital | Same, plus BSP concurrence if quasi‑bank authority sought |
VII. Penalties and Enforcement Trends
- Unlicensed Operation. SEC routinely issues Cease‑and‑Desist Orders and forwards cases to the DOJ for prosecution.
- Data‑Privacy Breaches. NPC now fine up to ₱5 Million per infraction under the 2023 Fintech Privacy Guidelines.
- Interest‑Cap Violations. BSP may require restitution to borrowers and recommend CA suspension.
- Revocation Stats. From 2020‑2024 the SEC revoked 67 online lenders’ CAs and caused ~ 600 mobile apps to be pulled from app stores (FLD data, Jan 2025).
VIII. Step‑by‑Step Compliance Checklist
- Corporate Setup – Reserve name → draft AOI/BL → file with SEC CRMD.
- Capital Deposit – Open escrow account; secure bank certificate.
- Prepare AML & Privacy Manuals – Board approval.
- Build Tech Stack – Embed KYC, consent and rate calculators.
- Third‑Party Audit – InfoSec review; penetration test.
- CA Application Packet – Collate, notarize, and pay fees.
- SEC Evaluation & Clarifications – Respond within 15 days to memos.
- Publish Notice of CA Grant – One‑time in two newspapers of general circulation.
- Enroll with AMLC & CIC – Within 30 days of CA issuance.
- Launch OLP/OLA – Only after SEC issues acknowledgment letter for the specific app.
IX. Practical Tips from the Field
- Start with a Financing Company shell if you foresee raising foreign VC money—no 49 % cap.
- Automate reporting early. Design your database so it exports CIC XML and AMLC batch files in one click.
- Budget for BSP interest caps. High‑risk borrowers may now be loss‑making under the 0.8 %/day ceiling; recalibrate scoring models.
- Keep call recordings. SEC inspections increasingly ask for proof of non‑harassment during collections.
- Do sandbox pilots. The SEC’s PhiliFintech Innovation Office will entertain sandbox applications that soften certain requirements (e.g., reduced capital) for six months.
X. Conclusion
The SEC’s licensing regime for online lenders rests on the familiar corporate‑plus‑permit structure of RA 9474, but digital delivery has added layers of consumer protection, data‑privacy, and fintech risk controls. Treat the Certificate of Authority not as a one‑time hurdle but as a continuing covenant: every feature push, marketing campaign and collection script must be tested against the latest circulars.
Keeping a living compliance calendar and assigning a dedicated Chief Risk & Compliance Officer pay dividends—both in smoother fund‑raising and in staying off the SEC’s weekly “name‑and‑shame” list. Follow the roadmap above and you will operate legally, competitively and, most importantly, sustainably in the Philippine online‑lending space.