SEC Registration Requirements for Online Lending Platforms in the Philippines A comprehensive legal-practitioner’s guide (updated to May 2025)
1. Legal and Regulatory Framework
| Instrument | Key points for online lending platforms (OLPs) |
|---|---|
| Republic Act (RA) 9474 – Lending Company Regulation Act of 2007 | Requires a Certificate of Authority (CA) from the Securities and Exchange Commission (SEC) before a corporation may “engage in or hold itself out as engaging in the business of granting loans from its own capital funds.” |
| RA 5980 (as amended by RA 8556) – Financing Company Act | Similar CA requirement; larger minimum capitalization; foreign equity may reach 100 %. |
| Securities Regulation Code (SRC) | Grants the SEC rule-making power; anti-fraud provisions apply when loan receivables are packaged as securities. |
| SEC Memorandum Circular (MC) No. 18, Series of 2019 | First dedicated rules for OLPs; no lending or financing company may launch an online or mobile lending facility without prior platform approval from the SEC. |
| SEC MC No. 19, Series of 2019 | Outlaws “unfair or abusive collection practices” (threats, public shaming, contact-list harassment, etc.). |
| SEC MC Nos. 10-2021 & 10-2022 | Tightened application checklist; declared a moratorium (Nov 2021–present) on new OLP applications while the rules are being overhauled—only previously registered entities may update or replace an approved platform. |
| Financial Products and Services Consumer Protection Act (RA 11765, 2022) | Elevates many SEC consumer-protection issuances to statutory level; authorizes restitution, disgorgement, and hefty administrative fines (up to ₱ 2 million per violation plus ₱ 100,000/day of continuing breach). |
| Anti-Money Laundering Act (RA 9160, as amended) | Lending and financing companies are “covered persons”; mandatory AML program, KYC and transaction reporting. |
| Data Privacy Act (RA 10173) | Prohibits scraping borrowers’ phone contacts; requires Privacy Impact Assessment, Privacy Manual, & NPC registration of Data Protection Officer. |
| BSP Memorandum M-2020-042 & MB Resolution 1711-2020 | Rate caps for consumer loans granted by lending/financing companies & their OLPs: (i) 6 % nominal monthly interest, (ii) 15 %-per-month effective interest (EIR), (iii) processing fees ≤ 5 % of principal, (iv) penalty interest ≤ 1 % per month. |
Practice point The BSP caps override any contractual stipulation once the loan is ≤ ₱ 10,000 and the term ≤ 4 months.
2. When Is SEC Approval Required?
| Scenario | Needs SEC CA? | Needs separate SEC “OLP Approval”? |
|---|---|---|
| Brick-and-mortar lending company, no online or app component | Yes | No |
| Lending company that merely advertises online but issues loans physically | Yes | No, but advertising rules apply |
| Existing lending/financing company launching a website or mobile app to originate, approve, disburse or collect loans | Yes (already holds) | Yes – file OLP application |
| Foreign-incorporated fintech serving Philippine residents | Must incorporate a PH subsidiary and secure CA | Yes |
3. Incorporation and Minimum Capital
| Item | Lending Company | Financing Company |
|---|---|---|
| Corporate form | Stock corporation only (one-person corps allowed since 2020, but SEC usually insists on at least three incorporators for CAs) | |
| Paid-up capital | ₱ 1 million minimum (may be increased by SEC order) | ₱ 10 million minimum |
| Foreign ownership ceiling | 49 % of outstanding capital stock | None (100 % foreign-owned is allowed) |
| Directors/officers fit-and-proper | Integrity, solvency, competence; no final conviction for moral-turpitude crimes; no SEC-revoked certificates within 5 years. Majority of the board must be residents. |
4. Two-Stage Licensing Workflow
Stage A – Certificate of Authority (CA) Submit the CA application after Articles of Incorporation are approved but before commencing operations. Key documentary requirements:
- Treasurer’s Affidavit & bank certificate covering paid-up capital.
- Personal Information Sheets (SEC Form 12-IS) + NBI/Police clearances for each director/EO.
- Business plan and five-year financial projections.
- AMLA and consumer-protection manuals (draft).
- Surety bond (₱ 1 million) or escrow agreement equal to 50 % of paid-up capital, at SEC’s discretion.
Stage B – Online Lending Platform (OLP) Approval File within the same company; no separate juridical entity is needed. Core submissions under MC 18-2019:
Requirement Practical notes Sworn Application for OLP (SEC Form OLP-1) Signed by President & Corporate Secretary Detailed business model & process flow Should illustrate origination, credit-scoring, disbursement, collection, complaint-handling, and loan sale (if any). Platform prototype (wireframes/screenshots) SEC now asks for a recorded walk-through video link (≤ 15 min). List of server/IP addresses & data center location Data must reside in the Philippines or in a jurisdiction with adequate data-privacy safeguards (SEC generally requires on-shore). Third-party contracts (app developer, payment gateway, cloud host, collection partner) Include source-code escrow clause or droit de suite ensuring SEC access during investigations. IT Governance & Cyber-security Self-Assessment Mapped to DICT Circular 2020-02 (National Cybersecurity Plan) or ISO 27001. NPC Registration Certificate For the company and the app itself (as “automated decision-making system”). The SEC’s Fintech & Innovation Division reviews the documents and, if satisfied, issues a “Confirmation of OLP Registration/Approval”. The platform must go live within 90 days or the approval lapses.
5. Conduct-of-Business Rules (Always-On Compliance)
| Domain | Core obligations | Penalty for breach |
|---|---|---|
| Disclosure & advertising | Always include SEC Registration No. and CA No. in app store listing, website, push notifications, SMS blasts and printed marketing. | Up to ₱ 2 M + ₱ 100 k/day (RA 11765) |
| Data privacy | Written, granular borrower consent; no bulk contact scraping; no posting of debt status on social media. | NPC may fine ₱ 5 M + criminal |
| Interest & fees | Observe BSP cap; display APR/EIR prominently before loan acceptance. | SEC cease-and-desist, refund or disgorgement |
| Collection | Strictly follow MC 19-2019; no threats, profanity, deception, public humiliation; calls allowed only to numbers supplied by borrower. | CA revocation; directors/officers may be prosecuted |
| AML/CFT | Register with AMLC; file CTRs & STRs; appoint Compliance Officer and Alternate. | AMLC penalty up to ₱ 5 00,000 per violation |
| Regulatory reporting | • General Information Sheet (GIS) – within 30 days of annual stockholders’ meeting | |
| • Audited Financial Statements (AFS) – within 120 days after FY-end | ||
| • Quarterly OLP Performance Report – within 15 days of quarter-end | ||
| • Monthly upload to Credit Information Corporation (CIC) | Late filing fine: ₱ 1,000/day/document | |
| Consumer complaint handling | Designate Complaints Officer; resolve within 15 BD; maintain a logbook for SEC inspection. | SEC may order restitution |
6. Technology & Cyber-security Benchmarks
- Application-layer security – OWASP Top 10 controls.
- Infrastructure – Redundant servers located in PH; daily incremental & weekly full backups retained ≥ 2 yrs.
- Penetration testing – External and internal, at least once a year; submit executive summary to SEC within 30 days.
- Incident reporting – Significant data breach or service-down event affecting ≥ 500 users must be reported to SEC, NPC & DICT within 48 hours.
7. Common SEC Roadblocks (and How to Avoid Them)
| Issue cited by SEC | How to pre-empt |
|---|---|
| Ownership exceeds 49 % foreign for a lending company | Use a financing company structure or restructure shares (e.g., redeemable pref. + voting trust) |
| “Generic” privacy consent language | Break down consent into granular check-boxes: credit-scoring, data share with CIC, marketing, collections. |
| No source-code escrow | Add a clause in software-development agreement granting SEC view-only repository access upon written notice. |
| No board member with consumer-finance track record | Recruit an independent director with at least 3 yrs lending or banking experience. |
8. Enforcement Trends (2019 – May 2025 snapshot)
- 145 lending/financing companies have had their CA revoked for operating unregistered apps.
- 1,600 + lending apps ordered taken down from Google Play / Apple App Store at SEC request.
- Notable test case – SEC v. Fynamics Lending, Inc. (2023): Individual directors fined and permanently disqualified for systematic contact-list harassment despite claiming that the conduct was outsourced. The decision affirmed that board members are vicariously liable for the acts of third-party collectors.
9. Step-by-Step Timeline (Realistic)
| Day | Action |
|---|---|
| 0–5 | Name reservation, draft Articles |
| 6–25 | SEC corporate registration (online OneSEC portal) |
| 26–40 | Prepare CA package; notarize affidavits |
| 41–80 | SEC CA evaluation (may include clarificatory meetings) |
| 81–90 | Receive CA; immediately file OLP application |
| 91–135 | OLP evaluation & platform demo |
| 136 | Issuance of OLP Approval |
| 137–180 | Soft launch; obtain BSP “SSL” Certificate for QR Ph disbursement (optional) |
| ≈ 6 months total | Full commercial roll-out (subject to moratorium status) |
SEC presently refuses to accept brand-new OLP applications while the moratorium is in force. Prospective entrants may incorporate and obtain a CA now, then queue for OLP approval once the window re-opens.
10. Practical Compliance Tips
- Treat your app store listing like a miniature disclosure statement. Borrowers often download without visiting your website; all mandatory disclosures must appear there.
- Embed a consent matrix—the app should not advance to the next screen unless each consent item is separately ticked.
- Outsource responsibly. Debt-collection partners are agents; any abusive script is attributed to you. Include audit rights and a termination-for-cause clause.
- Automate your CIC and AMLC reporting to avoid per-day penalties.
- Build an appeals process for borrowers flagged as defaulters due to stolen-identity loans—both SEC and NPC now focus on dispute-resolution mechanics.
11. Penalties and Remedies at a Glance
| Violation | Administrative fine | Criminal exposure |
|---|---|---|
| Operating without CA | ₱ 10,000–₱ 50,000 + ₱ 1000/day; cease-and-desist | 6 mos–10 yrs imprisonment (RA 9474) |
| Operating CA-holding company but without OLP approval | ₱ 50,000–₱ 2 M + ₱ 100,000/day (RA 11765) | Possible estafa if fraud proven |
| Unfair collection (MC 19-2019) | CA suspension or revocation | Anti-photo-and-video voyeurism, cyber-libel, etc. |
| Rate-cap breach | Disgorgement of excess interest + fines | U.N.L. |
| AML program failure | up to ₱ 5 00,000 per breach | AML facilitated money-laundering prosecution |
12. Outlook for 2025–2026
- The SEC’s draft “Digital Financing and Lending Rules” (circulated privately in January 2025) propose: • raising minimum paid-up capital to ₱ 25 million for OLPs; • requiring at least one resident Chief Technology Officer; • mandatory application-programming-interface (API) connection to the PhilSys e-KYC gateway.
- Moratorium is expected to lift after the final rules take effect, tentatively Q4 2025.
- Integration with the Digital Payments Transformation Roadmap (BSP) will push OLPs toward QR Ph loan disbursements and InstaPay collections, reducing cash-handling risk.
13. Conclusion
Launching an online lending platform in the Philippines is no longer a “light-touch” venture. The SEC now views OLPs as systemically important retail-finance utilities and imposes layered licensing, granular disclosures, strict data-privacy safeguards, and consumer-centric controls on pricing and collections. A successful applicant must therefore:
- Engineer compliance into the platform—not tack it on later.
- Budget six months (or more) for regulatory processing.
- Prepare for continuing supervision that is, in practice, as intrusive as that applied to banks.
By treating regulation as a design pillar, fintech lenders can tap the Philippine consumer-credit gap while avoiding the costly revocations and reputational damage that have plagued many first-generation apps.
This article is for general informational purposes only and does not constitute legal advice. Specific projects should be vetted with Philippine counsel and, where applicable, coordinated directly with the SEC’s Financing & Lending Companies Division (FLCD) and Fintech & Innovation Division (FID).