I. Introduction

Lending is a regulated business in the Philippines. A person or entity cannot simply hold itself out to the public as a lending company, offer loans commercially, collect interest, and operate under a lending business name without complying with the legal requirements imposed by Philippine law.

The central regulator for lending companies is the Securities and Exchange Commission, commonly referred to as the SEC. The SEC supervises corporations, partnerships, financing companies, lending companies, and other entities placed under its jurisdiction by law. In the lending sector, SEC registration is not merely a formality. It is a key indicator that a lending company has legal personality, authority to operate, and accountability to a regulator.

However, SEC registration alone does not always mean that a lender’s every act is lawful. A company may be registered as a corporation but still lack authority to operate as a lending company. A lending company may have a Certificate of Authority but still commit violations through unfair collection practices, excessive or undisclosed charges, deceptive advertising, unauthorized online lending practices, or misuse of borrower data. Legitimacy therefore requires looking at both registration status and actual conduct.

This article discusses the legal framework governing lending companies in the Philippines, the importance of SEC registration, the difference between corporate registration and lending authority, the requirements for legitimacy, borrower protections, common violations, enforcement mechanisms, and practical ways to verify whether a lending company is legitimate.

II. Governing Laws and Regulatory Framework

The primary law governing lending companies in the Philippines is the Lending Company Regulation Act of 2007, or Republic Act No. 9474.

This law regulates lending companies and requires them to be organized as corporations. It places lending companies under the supervision of the SEC and requires them to secure a Certificate of Authority to Operate as a Lending Company before commencing lending operations.

Other relevant laws and rules include:

Revised Corporation Code of the Philippines This governs the creation, organization, powers, duties, and dissolution of corporations, including lending companies organized as corporations.
Truth in Lending Act This requires creditors to disclose finance charges, interest rates, and other essential credit terms so borrowers can make informed decisions.
Data Privacy Act of 2012 This applies especially to online lending applications that collect personal data, access phone contacts, request identification documents, process employment details, or store borrower information.
Consumer protection laws and SEC rules These govern abusive, unfair, deceptive, or unconscionable lending and collection practices.
Anti-Money Laundering laws and regulations, where applicable Lending companies may be subject to compliance obligations depending on their activities, structure, and regulatory classification.
Cybercrime Prevention Act and penal laws These may apply when lending companies or their agents use threats, harassment, public shaming, identity misuse, unauthorized access, or online intimidation.
SEC Memorandum Circulars and administrative issuances The SEC has issued several rules governing lending companies, including online lending platforms, disclosure obligations, collection practices, and the suspension or revocation of authority.

III. What Is a Lending Company?

A lending company is generally a corporation engaged in granting loans from its own capital funds or from funds sourced lawfully, usually with interest, charges, or other forms of compensation.

Under Philippine law, lending companies are distinct from banks. Banks are regulated by the Bangko Sentral ng Pilipinas and operate under banking laws. Lending companies, on the other hand, are generally regulated by the SEC and are not allowed to conduct banking activities unless separately authorized by law.

A lending company may offer different kinds of loans, such as:

personal loans;
salary loans;
business loans;
emergency loans;
online or app-based loans;
collateralized or non-collateralized loans;
short-term consumer loans;
micro-lending products; and
installment-based credit products.

The method of delivery may vary. Some lending companies operate through physical offices, agents, websites, mobile applications, or online platforms. Regardless of method, the requirement of SEC authority remains central.

IV. SEC Registration Versus Certificate of Authority

One of the most important distinctions in Philippine lending law is the difference between:

SEC corporate registration, and
SEC Certificate of Authority to operate as a lending company.

These are not the same.

A. SEC Corporate Registration

Corporate registration means that a company has been incorporated with the SEC. It has legal personality as a corporation. It may have a corporate name, articles of incorporation, by-laws, directors, officers, and a registered office.

However, corporate registration alone does not automatically authorize the corporation to engage in lending.

A corporation may be SEC-registered as a general business corporation, but if it wants to operate as a lending company, it must also comply with the requirements under the Lending Company Regulation Act.

B. Certificate of Authority

The Certificate of Authority is the specific authorization from the SEC allowing a corporation to engage in lending business.

A legitimate lending company must generally have both:

a valid SEC Certificate of Incorporation; and
a valid SEC Certificate of Authority to Operate as a Lending Company.

Without the Certificate of Authority, the entity may be incorporated but not legally authorized to conduct lending business.

This distinction matters because some illegal lenders mislead borrowers by saying they are “SEC registered” when they only have corporate registration, not lending authority. Borrowers should therefore ask: registered for what purpose?

V. Why Lending Companies Must Be Corporations

The law requires lending companies to be organized as corporations. This requirement serves several regulatory purposes.

First, corporations are easier to supervise because they have a formal structure. The SEC can identify their incorporators, directors, officers, shareholders, registered office, capital structure, and corporate documents.

Second, the corporate form helps impose accountability. When violations occur, the SEC can proceed against the corporation and, in proper cases, responsible officers, directors, and agents.

Third, capitalization rules help ensure that a lending company has a sufficient financial base. Lending is not supposed to be conducted informally by fly-by-night operators who disappear after collecting fees or after misusing borrower information.

Fourth, corporate records help regulators distinguish legitimate lenders from informal lenders, loan sharks, fake online apps, and entities used for fraud.

VI. Basic Requirements for Legitimacy

A lending company in the Philippines is more likely to be legitimate if it satisfies the following requirements:

It is registered with the SEC as a corporation.
Its primary or secondary purpose authorizes lending activities.
It has secured a Certificate of Authority from the SEC to operate as a lending company.
Its name appears in the SEC’s list of registered lending companies.
It has not been listed as revoked, suspended, delinquent, or unauthorized.
It discloses loan terms clearly before releasing the loan.
It gives borrowers a copy of the loan agreement or disclosure statement.
It charges interest, penalties, and fees that are disclosed and legally defensible.
It follows lawful collection practices.
It protects borrower data under data privacy rules.
It does not use threats, humiliation, false criminal accusations, or public shaming.
It issues receipts or records of payments.
It has a verifiable office address, contact details, and responsible officers.
It uses online platforms, apps, or agents that are disclosed to or recognized by the SEC where required.
It complies with SEC reporting and regulatory requirements.

Legitimacy is therefore not determined by name, logo, website design, app-store availability, social media presence, or claims of being “licensed.” It is determined by legal authority and compliant conduct.

VII. Capitalization and Organizational Requirements

Lending companies are subject to capitalization requirements. The required paid-up capital may depend on the area of operation and applicable SEC rules. The law and SEC issuances have historically distinguished between lending companies operating in cities, municipalities, and wider geographic areas.

The reason for capitalization requirements is that a lending company must have real financial capacity. It should not rely on misleading representations, advance fees from borrowers, or unauthorized fund-sourcing schemes.

A lending company must also comply with corporate governance requirements, including:

maintaining corporate books and records;
filing required reports with the SEC;
observing by-law provisions;
keeping a registered office;
maintaining responsible officers;
disclosing ownership or control where required;
complying with tax and business permit requirements; and
maintaining proper accounting records.

A company that fails to comply with SEC reportorial obligations may become delinquent, suspended, or subject to revocation proceedings.

VIII. Names and Representations

A lending company’s name matters because the public must not be misled.

A legitimate lending company should use the corporate name registered with the SEC or a properly authorized business name. If it uses a trade name, platform name, mobile app name, or online brand different from its corporate name, borrowers should be able to trace that name back to the SEC-authorized corporation.

Misleading names may create problems. For example, an entity should not falsely imply that it is:

a bank;
a government agency;
affiliated with the SEC;
affiliated with the Bangko Sentral ng Pilipinas;
a public welfare program;
a foreign financial institution;
a charity; or
a government-approved emergency aid program.

The use of words like “cash,” “loan,” “credit,” “finance,” “lending,” “peso,” or “microfinance” does not by itself prove legitimacy.

IX. Online Lending Companies

Online lending has become one of the most controversial areas of Philippine lending regulation.

An online lending company may operate through:

a website;
mobile application;
social media page;
messaging app;
digital marketplace;
online loan aggregator;
electronic know-your-customer system;
digital wallet integration; or
other internet-based platform.

Online lending companies must still comply with the same basic requirements as traditional lending companies. They must be SEC-registered and must have authority to operate as lending companies.

In addition, online lenders face heightened scrutiny because of recurring abuses such as:

unauthorized access to phone contacts;
public shaming of borrowers;
sending messages to relatives, employers, or co-workers;
threatening criminal prosecution for ordinary loan default;
using fake legal notices;
using fake barangay, police, court, or prosecutor documents;
misrepresenting penalties;
imposing undisclosed fees;
automatically renewing loans without clear consent;
collecting excessive personal data;
using abusive language;
harassing borrowers through repeated calls or messages;
disclosing borrower information to third parties; and
operating under multiple app names to hide the real corporate entity.

The SEC has taken action against many online lending operators for abusive practices, lack of authority, or violations of lending rules.

X. The Role of the SEC

The SEC’s role is central. It has authority to:

register lending companies as corporations;
issue Certificates of Authority;
monitor compliance;
require reports;
investigate complaints;
issue advisories;
suspend or revoke certificates;
impose penalties;
direct companies to stop unlawful operations;
identify unauthorized lenders;
regulate online lending platforms;
require disclosure of lending apps and platforms;
coordinate with other agencies; and
refer possible criminal violations to proper authorities.

The SEC may also act against companies that misuse corporate registration. A corporation cannot use SEC registration as a shield if its actual business violates the law.

XI. The Role of Local Government Permits

Aside from SEC registration and authority, a lending company may need local permits, such as a mayor’s permit or business permit from the city or municipality where it operates.

However, a local business permit does not substitute for SEC authority.

A city or municipal permit merely allows a business to operate within a locality for local regulatory and tax purposes. It does not authorize lending if the company lacks the SEC Certificate of Authority.

Thus, a lender cannot defend its operations by saying it has a barangay clearance, mayor’s permit, BIR registration, or DTI registration if the law requires SEC lending authority.

XII. DTI Registration Is Not Enough

For sole proprietorships, the Department of Trade and Industry registers business names. But lending companies must generally be corporations regulated by the SEC.

A DTI certificate only registers a business name. It does not create a corporation and does not authorize a person to operate a lending company.

Therefore, if a supposed lending business claims legitimacy based only on a DTI certificate, that is a warning sign.

XIII. BIR Registration Is Not Enough

Registration with the Bureau of Internal Revenue means that a business is registered for tax purposes. It may have a Tax Identification Number, official receipts, books of accounts, and tax filing obligations.

But BIR registration does not mean the business is authorized to lend money to the public as a lending company.

Tax registration and regulatory authority are different. A business may be registered with the BIR and still be operating unlawfully if it lacks the necessary SEC authority.

XIV. Barangay or Mayor’s Permit Is Not Enough

A barangay clearance or mayor’s permit is also insufficient by itself.

Local permits do not cure the absence of national regulatory authority. A lending company must satisfy the regulatory requirements imposed by the SEC. Local government recognition cannot override the Lending Company Regulation Act.

XV. The Loan Agreement

A legitimate lending transaction should be supported by a written or electronically accessible loan agreement.

The agreement should identify:

the lender;
the borrower;
principal amount;
interest rate;
service fees;
processing fees;
penalties;
repayment schedule;
due date;
consequences of default;
method of payment;
prepayment rules;
collateral, if any;
data privacy consent, if applicable;
dispute mechanism;
governing law; and
contact details of the lender.

For online loans, the borrower should be able to access, download, save, or review the loan terms before accepting the loan. A lender should not hide essential loan terms behind confusing screens, rushed consent buttons, or incomplete disclosures.

XVI. Truth in Lending Requirements

The Truth in Lending principle requires clear disclosure of credit terms. Borrowers must be informed of the true cost of borrowing.

This is important because some lenders advertise a low interest rate but impose high processing fees, service charges, platform fees, insurance charges, penalties, or deductions from the released amount.

For example, if a borrower applies for a ₱10,000 loan but receives only ₱8,000 because ₱2,000 is deducted upfront, the borrower must understand the effective cost of the loan. The lender should disclose the finance charge and the real amount payable.

A legitimate lender should not rely on hidden charges, misleading “zero interest” claims, or confusing loan computations.

XVII. Interest Rates and Charges

Philippine law generally allows parties to agree on interest, but interest and charges may be questioned if they are unconscionable, excessive, hidden, or contrary to law, regulation, or public policy.

Courts may reduce unconscionable interest rates. The validity of charges depends on the circumstances, including disclosure, agreement, proportionality, and fairness.

Lenders should clearly disclose:

nominal interest rate;
effective interest rate;
total finance charge;
penalties for late payment;
collection fees;
service fees;
processing fees;
documentary stamp tax, if applicable;
notarial fees, if any;
insurance charges, if any; and
other deductions or charges.

A lender that advertises “low interest” but imposes hidden deductions may be engaging in deceptive practice.

XVIII. Collateral and Security

Some lending companies offer unsecured loans. Others require collateral or security, such as:

chattel mortgage;
real estate mortgage;
post-dated checks;
promissory notes;
assignment of receivables;
guaranty;
surety agreement;
salary deduction authorization; or
pledge of personal property.

The use of collateral must comply with law. A lender cannot automatically seize property without observing legal requirements. For secured loans, foreclosure, repossession, or enforcement must follow applicable procedures.

A borrower should be cautious when asked to sign blank documents, undated checks, deeds of sale, waivers, or broad authorizations. Blank or incomplete documents are risky because they may later be filled in with terms the borrower did not intend.

XIX. Collection Practices

Debt collection is lawful, but abusive collection is not.

A lending company may remind borrowers of due dates, send demand letters, call or message the borrower, negotiate restructuring, offer settlement, or pursue legal remedies.

However, collection practices become unlawful or abusive when collectors:

threaten violence;
use obscene or insulting language;
shame borrowers publicly;
contact third parties without lawful basis;
post borrower information online;
falsely accuse borrowers of crimes;
pretend to be police officers, prosecutors, sheriffs, or court personnel;
use fake subpoenas or fake warrants;
threaten imprisonment for ordinary debt;
repeatedly call at unreasonable hours;
disclose loan details to employers or relatives;
harass co-workers or family members;
access or misuse phone contacts;
send defamatory messages;
misrepresent the amount due;
refuse to issue payment records; or
continue collecting amounts already paid.

A borrower’s failure to pay a loan is generally a civil matter. It may lead to collection suits, small claims actions, foreclosure, or other civil remedies, depending on the transaction. It does not automatically make the borrower a criminal.

XX. Can a Borrower Be Imprisoned for Nonpayment?

As a rule, a person cannot be imprisoned merely for failure to pay a debt. The Philippine Constitution prohibits imprisonment for debt.

However, certain acts related to borrowing may have criminal implications, such as:

issuing bouncing checks under the Bouncing Checks Law;
using falsified documents;
committing fraud;
identity theft;
using another person’s information;
estafa, in proper cases; or
misrepresentation accompanied by deceit.

But ordinary inability to pay a loan is not automatically a criminal offense. A lender that threatens immediate arrest, imprisonment, or police action for a simple unpaid loan may be misleading or harassing the borrower.

XXI. Small Claims and Court Remedies

Lending companies may file cases to collect unpaid loans. In many cases involving sums of money, the proper remedy may be a civil collection case or a small claims case, depending on the amount and nature of the claim.

Small claims proceedings are designed to be faster and more accessible. Lawyers are generally not allowed to appear for parties during hearings, subject to rules and exceptions. The court may order payment if the claim is proven.

A legitimate lender has legal remedies. Resorting to harassment, threats, or public shaming is not necessary and may expose the lender to regulatory, civil, or criminal liability.

XXII. Data Privacy and Lending Apps

Online lending often involves sensitive personal information. Lending apps may ask for:

name;
address;
phone number;
government ID;
selfie verification;
employment information;
bank account or e-wallet information;
emergency contacts;
phone contacts;
location data;
device information;
photos; and
social media details.

Under data privacy principles, collection and processing of personal data must be lawful, fair, transparent, and limited to legitimate purposes.

A lender should not collect more data than necessary. It should not use borrower data for harassment or public shaming. It should not contact every person in the borrower’s phonebook to pressure payment. It should not disclose loan information to third parties without lawful basis.

Borrowers should be wary of apps requiring excessive permissions, especially access to contacts, photos, messages, microphone, or location when such access is not necessary for loan processing.

XXIII. Unauthorized Online Lending Applications

Some online lending apps operate under names that differ from the SEC-registered company. Some use multiple app names under one corporate entity. Others operate without authority.

A borrower should not assume that an app is legitimate simply because it appears on an app store. App-store availability does not equal SEC approval.

A legitimate lending app should be traceable to an SEC-registered lending company with a valid Certificate of Authority. The corporate name, SEC registration number, Certificate of Authority number, privacy policy, loan terms, and contact details should be available and verifiable.

Red flags include:

no corporate name;
no SEC Certificate of Authority number;
no physical office address;
only a mobile number or messaging app contact;
very short loan terms with high deductions;
threats before due date;
access to contacts;
harassment of third parties;
fake legal notices;
demand for upfront fees before loan release;
refusal to provide written terms;
changing app names;
untraceable payment channels;
pressure to borrow again to pay old loans; and
claims that the lender is “SEC approved” without proof.

XXIV. Advance Fees and Loan Scams

Some entities pretend to be lenders but are actually scammers. They ask borrowers to pay fees before loan release, such as:

processing fee;
insurance fee;
verification fee;
attorney’s fee;
notarial fee;
tax clearance fee;
anti-money laundering fee;
account activation fee;
release fee;
collateral registration fee; or
courier fee.

After payment, the supposed lender disappears or demands additional fees.

A legitimate lender may charge lawful and disclosed fees, but borrowers should be cautious when asked to send money first, especially through personal e-wallet accounts, remittance centers, or bank accounts not under the registered company’s name.

XXV. Verification of Legitimacy

To verify whether a lending company is legitimate, a borrower should check several things.

A. SEC Registration

The borrower should verify whether the company is registered with the SEC as a corporation.

B. Certificate of Authority

The borrower should verify whether the company has a Certificate of Authority to operate as a lending company.

C. SEC Lists and Advisories

The borrower should check whether the company appears in SEC lists of registered lending companies or in advisories concerning unauthorized, suspended, revoked, or abusive lenders.

D. Corporate Name Versus App Name

The borrower should compare the app name, brand name, website name, and corporate name. If they do not match, the borrower should determine whether the app is operated by or registered under the authorized corporation.

E. Physical Address

A legitimate lender should have a verifiable office address. A purely anonymous online lender is risky.

F. Loan Documents

The borrower should review the loan agreement, disclosure statement, repayment schedule, charges, penalties, and privacy policy.

G. Payment Channels

Payments should generally be made to accounts traceable to the company, not to random individuals.

H. Complaints and Conduct

Even if a company is registered, repeated complaints of harassment, privacy violations, hidden charges, or deception may indicate regulatory risk.

XXVI. SEC Advisories

The SEC issues advisories warning the public against entities that may be operating without authority or engaging in suspicious lending or investment activities.

An SEC advisory is important because it may indicate that the entity:

is not registered;
has no authority to lend;
is soliciting investments illegally;
is operating an unauthorized online lending app;
is using abusive collection practices;
is misrepresenting its authority;
is under investigation; or
has had its authority suspended or revoked.

However, the absence of an advisory does not automatically mean a company is legitimate. It may simply mean the SEC has not yet issued an advisory, or the company has not yet been reported.

XXVII. Revocation and Suspension

A lending company’s authority may be suspended or revoked for violations. Grounds may include:

operating without proper authority;
failure to comply with reportorial requirements;
misrepresentation;
abusive collection practices;
data privacy violations;
undisclosed online lending platforms;
violation of SEC rules;
engaging in prohibited acts;
failure to maintain qualifications;
using unregistered business names or apps;
repeated complaints;
refusal to comply with SEC directives; or
other acts contrary to law or regulation.

A company whose Certificate of Authority has been revoked or suspended should not continue lending operations as if it remains fully authorized.

XXVIII. Criminal, Civil, and Administrative Liability

Violations in lending operations may lead to different kinds of liability.

A. Administrative Liability

The SEC may impose penalties, suspend authority, revoke authority, or issue cease-and-desist directives.

B. Civil Liability

Borrowers may raise defenses in collection cases, seek damages for abusive practices, question unconscionable interest, or dispute unauthorized charges.

C. Criminal Liability

Criminal liability may arise from threats, coercion, unjust vexation, grave threats, slander, libel, cyberlibel, identity theft, falsification, fraud, unauthorized access, or other penal offenses, depending on the facts.

D. Data Privacy Liability

Unauthorized processing, disclosure, misuse, or excessive collection of personal data may expose a lender to liability under data privacy laws and rules.

XXIX. The Legitimacy Test

A practical test for legitimacy may be summarized as follows:

1. Legal Personality

Is the lender a corporation registered with the SEC?

2. Regulatory Authority

Does it have a valid Certificate of Authority to operate as a lending company?

3. Public Traceability

Can the borrower verify the company’s registered name, office address, officers, platform, and contact details?

4. Transparent Loan Terms

Are the interest, fees, penalties, deductions, and due dates clearly disclosed before acceptance?

5. Lawful Collection

Does the company collect debts without threats, harassment, public shaming, or deception?

6. Data Protection

Does the company collect only necessary information and protect borrower data?

7. Compliance Record

Is the company free from SEC revocation, suspension, or serious regulatory warnings?

A company that fails one or more of these tests may not be fully legitimate even if it claims to be “registered.”

XXX. Common Misconceptions

Misconception 1: “SEC registered” means fully legitimate.

Not always. The company must have the proper authority to operate as a lending company.

Misconception 2: A mobile app on an app store is automatically legal.

No. App-store listing is not the same as SEC authorization.

Misconception 3: A borrower can be jailed for any unpaid loan.

No. Nonpayment of debt is generally civil, not criminal, although fraud or bouncing checks may create separate legal issues.

Misconception 4: A collector may contact family members to force payment.

Generally, collection should be directed to the borrower or authorized parties. Unauthorized disclosure to third parties may violate privacy and collection rules.

Misconception 5: BIR or DTI registration is enough.

No. Lending companies generally require SEC registration and SEC lending authority.

Misconception 6: Online lenders do not need physical offices.

A legitimate lending company should still be traceable to a registered corporation with a registered office and responsible officers.

Misconception 7: High interest is always illegal.

Not automatically, but excessive, unconscionable, hidden, or unfair charges may be challenged.

XXXI. Borrower Rights

Borrowers have rights, including the right to:

know the true cost of the loan;
receive clear disclosure of interest, fees, and penalties;
receive a copy of the agreement or loan terms;
be treated fairly during collection;
be free from threats and harassment;
have personal data protected;
dispute incorrect amounts;
receive receipts or proof of payment;
complain to regulators;
question unconscionable terms; and
seek legal remedies when harmed.

Borrowers should keep screenshots, messages, loan agreements, payment receipts, call logs, collection letters, app screenshots, and proof of harassment. Documentation is important when filing complaints.

XXXII. Duties of Lending Companies

Lending companies have corresponding duties:

secure and maintain SEC authority;
comply with corporate and reportorial requirements;
disclose loan terms clearly;
refrain from false advertising;
issue proper documents;
protect borrower data;
use lawful collection methods;
train agents and collectors;
supervise third-party collection agencies;
maintain records;
avoid misleading legal threats;
respond to borrower concerns;
comply with SEC orders; and
observe fairness and good faith.

A lending company cannot avoid responsibility by outsourcing collection to agents. If collectors act for the company, their conduct may expose the company to liability.

XXXIII. Collection Agencies and Agents

Some lending companies use third-party collection agencies. This is not inherently illegal, but the lender remains responsible for ensuring lawful collection practices.

A collection agency should not:

misrepresent itself as a court or government office;
threaten arrest without basis;
disclose debt to unrelated persons;
use abusive language;
send fake demand letters;
inflate balances;
demand payment without authority;
collect after settlement; or
refuse to identify the creditor.

Borrowers may ask collectors to identify the lending company, the basis of the debt, the amount due, and the authority to collect.

XXXIV. Fake Legal Notices

Abusive lenders sometimes send fake documents labeled as:

subpoena;
warrant of arrest;
hold departure order;
barangay complaint;
police blotter;
prosecutor notice;
court summons;
cybercrime notice;
estafa complaint;
final arrest warning; or
public posting notice.

Real legal documents come from proper authorities and follow official procedures. A private lender cannot issue a warrant, subpoena, court order, or criminal charge by itself.

Threatening borrowers with fake legal documents may expose the sender to liability.

XXXV. The Role of the National Privacy Commission

The National Privacy Commission may become involved when a lending company misuses personal data. This is especially relevant when lending apps access contacts, disclose debts, send messages to third parties, or publicly shame borrowers.

Possible privacy violations include:

collecting unnecessary data;
failing to obtain valid consent;
using data beyond the stated purpose;
disclosing borrower information to contacts;
storing data insecurely;
refusing to delete or correct data when required;
using borrower photos for shaming; and
processing data through undisclosed third parties.

Borrowers may consider filing privacy-related complaints when collection conduct involves misuse of personal information.

XXXVI. The Role of the Bangko Sentral ng Pilipinas

The Bangko Sentral ng Pilipinas regulates banks, quasi-banks, certain financial institutions, payment systems, e-money issuers, and other entities under its jurisdiction.

Most lending companies are under SEC supervision, not BSP supervision. However, if the lending product involves banks, e-wallets, payment systems, or financial institutions regulated by the BSP, there may be overlapping issues.

Borrowers should distinguish between:

banks;
financing companies;
lending companies;
pawnshops;
cooperatives;
microfinance NGOs;
credit card issuers;
payment platforms; and
informal lenders.

Different entities may have different regulators.

XXXVII. Lending Companies Versus Financing Companies

Lending companies and financing companies are related but distinct.

A lending company typically grants loans from its own funds.

A financing company may engage in broader financing activities, such as extending credit facilities, leasing, factoring, discounting commercial papers, and other forms of financing allowed by law.

Both may be regulated by the SEC, but they are subject to different statutory frameworks and licensing requirements. A company authorized as one type of entity should not automatically assume it may perform all activities of the other without proper authority.

XXXVIII. Lending Companies Versus Cooperatives

Cooperatives may provide credit to members under cooperative laws and are generally regulated by the Cooperative Development Authority.

A cooperative lending to its members is different from a lending company offering loans to the general public. If an entity claims to be a cooperative but lends broadly to non-members like a commercial lender, its legal status should be examined carefully.

XXXIX. Lending Companies Versus Informal Lenders

Informal lenders, sometimes called “5-6” lenders or loan sharks, may operate without SEC authority. They may lend based on personal arrangements, daily collection, or verbal agreements.

Some informal lending may occur privately, but when lending becomes a business offered to the public, regulatory requirements may apply. Operating a lending business without authority exposes the lender to regulatory and legal consequences.

XL. Advertising and Marketing

Lending companies must advertise responsibly. Misleading advertising may include:

claiming “guaranteed approval” without conditions;
hiding fees;
advertising “0% interest” while imposing large charges;
claiming government affiliation;
using fake testimonials;
misrepresenting SEC approval;
using another company’s registration details;
advertising an unregistered app;
promising loan release after advance payment;
failing to disclose the true lender; and
using deceptive urgency tactics.

Marketing materials should be consistent with actual loan terms.

XLI. Use of Social Media

Many lenders advertise through Facebook, TikTok, Instagram, messaging apps, and online groups. Social media lending is risky when the lender is not traceable.

Borrowers should be cautious when a supposed lender:

communicates only through personal accounts;
has no registered corporate name;
asks for ID photos through chat;
requires upfront fees;
uses copied logos;
refuses video or office verification;
gives inconsistent company details;
uses fake SEC certificates;
pressures immediate payment;
offers unusually large loans with no verification; or
asks for online banking credentials.

Legitimate lenders do not need a borrower’s online banking password, one-time password, or full wallet login credentials.

XLII. Fake SEC Certificates

Some scammers use fake or altered SEC documents. A borrower should know that a screenshot of an SEC certificate is not enough.

A fake certificate may contain:

mismatched company name;
wrong registration number;
edited date;
incorrect spelling;
old corporate registration but no Certificate of Authority;
certificate belonging to another company;
expired or revoked authority;
unrelated business purpose; or
fabricated QR codes.

Verification should be done through official SEC records or direct confirmation with the SEC where necessary.

XLIII. Borrower Complaints

Borrowers may file complaints depending on the issue.

Possible venues include:

SEC, for unauthorized lending, lack of Certificate of Authority, abusive lending practices, or violations by lending companies;
National Privacy Commission, for misuse of personal data;
Philippine National Police Anti-Cybercrime Group or National Bureau of Investigation Cybercrime Division, for cyber harassment, identity theft, threats, cyberlibel, or online scams;
barangay, for certain disputes subject to barangay conciliation, depending on residence and nature of dispute;
courts, for civil claims or damages;
prosecutor’s office, for criminal complaints;
BSP, if the entity is a BSP-regulated financial institution; and
local government offices, for business permit violations.

The appropriate forum depends on the facts.

XLIV. Evidence to Preserve

A borrower dealing with an abusive or suspicious lender should preserve evidence such as:

screenshots of app details;
screenshots of loan offers;
loan agreement;
disclosure statement;
repayment schedule;
proof of amount actually received;
proof of deductions;
payment receipts;
bank or e-wallet transfer records;
collection messages;
call logs;
voice recordings, where lawfully obtained;
names and numbers of collectors;
social media posts;
fake legal notices;
messages sent to third parties;
privacy policy;
app permissions;
SEC documents shown by lender; and
correspondence with the company.

Good documentation strengthens complaints and defenses.

XLV. Employer and Family Contact

Many lending apps ask for character references or emergency contacts. Providing a reference does not automatically authorize the lender to disclose private loan information to that person.

Contacting references may be allowed for legitimate verification or location purposes if properly disclosed and consented to, but using references to shame, threaten, or pressure the borrower may be unlawful.

Employers should not be harassed over an employee’s personal debt. A lender that sends messages to an employer accusing the employee of fraud or threatening workplace exposure may commit privacy or defamation-related violations.

XLVI. Public Shaming

Public shaming is one of the most serious abusive practices in lending. It may involve:

posting borrower photos online;
labeling borrowers as scammers;
sending group messages to contacts;
creating social media posts;
editing images;
sending defamatory messages to employers;
threatening to expose the borrower;
publishing loan details; or
contacting unrelated third parties.

Public shaming may violate privacy rights, collection rules, and criminal laws depending on content and method.

Debt collection must not become humiliation.

XLVII. Restructuring and Settlement

Borrowers unable to pay may negotiate restructuring or settlement. A settlement should be documented.

A borrower should ask for:

written confirmation of outstanding balance;
breakdown of principal, interest, penalties, and charges;
settlement amount;
deadline;
payment channel;
waiver of remaining balance, if applicable;
confirmation that collection will stop after payment;
official receipt or acknowledgment; and
certificate of full payment, if fully settled.

Borrowers should avoid paying settlement amounts to personal accounts without written confirmation from the lending company.

XLVIII. Full Payment and Release

After full payment, a borrower should request proof of payment or a certificate of full settlement.

If collateral was provided, the lender should release or cancel the security documents in accordance with law. If post-dated checks were issued, the borrower should request their return or proper cancellation. If a chattel mortgage or real estate mortgage was registered, proper cancellation may be required.

XLIX. Credit Reporting

Some lending companies may report borrower information to credit bureaus or credit information systems where legally allowed and properly disclosed.

Credit reporting must comply with applicable laws, accuracy requirements, and data privacy rules.

A lender should not threaten fake “blacklisting” by government agencies or claim that the borrower will be automatically banned from all employment, travel, or government benefits due to ordinary loan default.

L. Foreign-Owned or Foreign-Linked Lending Companies

Foreign participation in Philippine lending companies may be subject to constitutional, statutory, and regulatory restrictions depending on the nature of the business and applicable foreign investment rules.

A company with foreign shareholders must still be incorporated and authorized in the Philippines if it operates a lending business in the country. Foreign registration alone does not authorize Philippine lending operations.

Online platforms operating from abroad but lending to Philippine residents may raise jurisdictional and enforcement issues. Borrowers should be cautious when the lender has no Philippine-registered entity, office, or SEC authority.

LI. Penalties for Illegal Lending Operations

Operating a lending company without authority may expose the persons involved to penalties under the Lending Company Regulation Act and related laws.

Possible consequences include:

administrative fines;
cease-and-desist orders;
suspension;
revocation;
disqualification of officers;
criminal prosecution, where applicable;
civil liability;
data privacy sanctions;
cybercrime liability; and
reputational consequences.

The exact liability depends on the violation, evidence, and applicable rules.

LII. Corporate Officers’ Responsibility

Directors, officers, managers, compliance officers, beneficial owners, and agents may face responsibility if they participate in or allow unlawful operations.

Corporate personality does not always shield individuals from liability, especially where there is fraud, bad faith, gross negligence, or direct participation in unlawful acts.

Responsible officers should ensure that the company’s lending, advertising, data processing, and collection practices comply with law.

LIII. Due Diligence for Borrowers

Before borrowing, a borrower should ask:

What is the exact corporate name of the lender?
Is it registered with the SEC?
Does it have a Certificate of Authority as a lending company?
Is the app or platform disclosed as part of the company’s operations?
What is the principal amount?
How much will actually be released?
What are the interest and fees?
What is the repayment date?
What is the penalty for late payment?
What personal data will be collected?
Will contacts be accessed?
Who may be contacted in case of default?
What are the payment channels?
Is there a written agreement?
Is the lender’s address verifiable?

Borrowing from an unverified lender can lead to financial loss, harassment, identity misuse, and privacy violations.

LIV. Due Diligence for Investors and Business Partners

Investors, advertisers, payment processors, app developers, and collection agencies should also perform due diligence before working with lending companies.

They should verify:

SEC registration;
Certificate of Authority;
ownership structure;
regulatory status;
compliance record;
privacy practices;
collection policies;
app permissions;
consumer complaint history;
anti-fraud controls;
loan documentation; and
authority to use trade names or apps.

Third parties that knowingly assist illegal lending operations may face legal and reputational risks.

LV. Practical Red Flags

A supposed lender may be suspicious if it:

lacks SEC authority;
claims only DTI or BIR registration;
refuses to disclose corporate name;
uses personal bank accounts;
asks for advance fees;
guarantees approval without verification;
requires access to contacts;
has no written contract;
hides interest and fees;
gives only a social media page as identity;
uses fake legal threats;
threatens arrest;
harasses references;
imposes unexplained penalties;
changes app names frequently;
has no office address;
uses another company’s SEC details;
demands passwords or OTPs;
refuses to issue receipts; or
pressures immediate borrowing.

One red flag may justify caution. Several red flags may indicate illegal or abusive operations.

LVI. Practical Signs of a Legitimate Lending Company

A lending company is more credible if it:

has SEC corporate registration;
has a valid SEC Certificate of Authority;
appears in SEC lists of registered lending companies;
discloses its corporate name and office address;
provides clear loan documents;
explains interest, fees, and penalties;
respects data privacy;
does not access unnecessary phone data;
uses official payment channels;
issues receipts;
uses professional collection methods;
has customer support;
responds to disputes;
follows fair advertising standards; and
complies with regulatory reporting.

Still, borrowers should verify rather than rely on appearances.

LVII. Effect of Illegality on Loan Obligations

A borrower should not automatically assume that a loan disappears simply because the lender has regulatory problems. The legal effect may depend on the circumstances.

If a lender lacks authority, regulators may penalize the lender. But whether the borrower must return the principal, pay interest, or pay charges may require legal analysis. Courts may distinguish between repayment of money actually received and enforcement of unlawful or unconscionable terms.

Borrowers facing collection from an unauthorized lender should seek legal advice, especially if sued.

LVIII. Ethical Lending

Beyond technical compliance, lending companies should observe ethical standards.

Ethical lending means:

borrowers understand what they are signing;
charges are fair and disclosed;
products are suitable for borrowers;
repayment terms are realistic;
data is protected;
collection is humane;
vulnerable borrowers are not exploited;
advertising is honest;
complaints are handled properly; and
profit is not pursued through deception or humiliation.

The legitimacy of lending is not measured only by paperwork. It is also measured by fairness.

LIX. Conclusion

In the Philippines, the legitimacy of a lending company depends primarily on compliance with SEC requirements and lawful conduct. A lending company must generally be incorporated with the SEC and must have a Certificate of Authority to operate as a lending company. Corporate registration alone is not enough.

Borrowers should be alert to misleading claims of being “SEC registered,” especially where the company cannot show lending authority, clear loan terms, a verifiable corporate identity, and lawful collection practices. Online lending apps require particular caution because many abuses involve data privacy violations, harassment, hidden charges, and unauthorized operations.

A legitimate lending company is transparent, traceable, authorized, compliant, and fair. It discloses the true cost of credit, protects borrower data, collects debts lawfully, and remains accountable to regulators.

In a regulated financial system, lending is not merely a private business. It affects consumers, families, employees, small businesses, and public trust. SEC registration and regulatory authority exist to ensure that lending companies operate not as hidden loan sharks or digital harassment platforms, but as lawful financial service providers subject to oversight, accountability, and the rule of law.