SEC Registration & Verification for Online Loan Apps in the Philippines
(A Practitioner-Oriented Legal Article, updated to April 30 2025)
1. Why Registration Matters
Under Philippine law, no person or entity may engage in the business of lending money to the public without (1) registration as a corporation with the Securities and Exchange Commission (SEC) and (2) a separate Certificate of Authority (CA) to operate as a Lending or Financing Company.
For online-only lenders, the two requirements are the same; the delivery channel (a mobile or web-based “online lending platform” or “OLA”) does not remove the need for a CA.
Failure to secure either document exposes promoters, officers and agents to administrative closure, massive fines up to ₱1 million per violation (plus ₱2,000/day of continuing violation), and criminal liability of up to six (6) months imprisonment under Republic Act 9474 and RA 8556.
2. Statutory & Regulatory Framework
| Tier | Instrument | Key Provisions for Online Lenders |
|---|---|---|
| Primary statutes | RA 9474 (Lending Company Regulation Act of 2007); RA 8556 (Financing Company Act); RA 11765 (Financial Products and Services Consumer Protection Act of 2022) | Corporate registration, minimum paid-up capital (₱1 million for lending cos.; ₱10 million for financing cos.), CA requirement, interest disclosure, consumer-protection powers of SEC & BSP |
| Complementary statutes | RA 11232 (Revised Corporation Code), RA 10173 (Data Privacy Act), RA 10644 (Go Negosyo Act) | Corporate governance, privacy, MSME incentives |
| Bangko Sentral (BSP) | BSP Circ. 1133 - 2021 & 1156 - 2023 | Caps effective interest + penalties for unsecured loans ≤ ₱10 k (max 6 %/month interest + 5 %/month penalties) |
| SEC Memorandum Circulars (MC) | MC 19 - 2019: additional rules for Online Lending Platforms (OLPs); MC 10 - 2021: 60-day moratorium on collection harassment; MC 3 - 2022: mandatory beneficial-ownership disclosure; MC 16 - 2023: e-SPARC online company registration system | Required disclosures in-app and in advertising; limits on data harvested; 3rd-party collection rules; registration workflow fully online via e-SPARC |
| Inter-agency rules | NPC-SEC Joint Advisory 20-01; DTI Fair Trade advisories | Digital consent, prohibited “contact scraping,” unfair collection practices |
3. Definitions
| Term | Regulatory Meaning (Philippines) |
|---|---|
| Lending Company | Corporation “engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons.” (RA 9474) |
| Financing Company | Corporation “organized for extending credit facilities to consumers or enterprises, by directly or indirectly engaging in discounting, factoring, or general financing.” (RA 8556) |
| Online Lending Platform / Online Loan App (OLA) | Any website, software or mobile application that markets, offers or processes loans. MC 19-2019 makes it an “extension office” of the lending entity. |
| Certificate of Authority (CA) | A separate license issued by the SEC Corporate Governance & Finance Department (CGFD) after corporate registration but before commencing lending operations. |
4. Registration Workflow for a New Online Lender (2025 edition)
- Name Reservation & Articles of Incorporation via SEC e-SPARC
- Minimum paid-up: ₱1 million (lending) / ₱10 million (financing).
- Primary purpose must expressly mention lending or financing.
- Upload Additional OLA-Specific Annexes (MC 19-2019):
- Business model & flowchart showing the app as only a channel, not a separate entity.
- Information Technology (IT) & cybersecurity plan.
- Data privacy / NPC registration proof.
- Secure CA – pay ₱15,260 filing + legal research fees; CGFD issues CA valid until revoked (no expiries, but subject to periodic renewal of documentary requirements).
- Post-registration Compliance
- Register beneficial owners (MC 3-2022).
- Enlist independent auditor within 30 days.
- File quarterly and annual reports (FS + General Information Sheet).
- Before launching the app:
- Submit final APK/iOS build to SEC for review of in-app disclosures.
- Post ₱1 million surety bond (RA 9474 §6).
- Within 30 days of “go-live”: file OLA Launch Notice (MC 19-2019 §6).
- Annual Requirements
- GIS, Audited FS, AML/KYC training certificates.
- NPC Breach reporting, if any.
5. How the Public Can Verify an Online Lending App’s Legitimacy
| Step | Where & How |
|---|---|
| 1. Check SEC “List of Registered Lending/Financing Companies with CA” | Downloadable PDF updated monthly on sec.gov.ph > Advisories > Lending Companies. |
| 2. Cross-check Corporate Name | Use the Free Name Search tab in e-SPARC or request a Company Profile via SEC Express Reg (paid). |
| 3. Verify CA details | Every legitimate app must display its SEC Registration No. and CA No. - both 13-digit alphanumerics – on the app’s splash screen, Play Store/App Store description, website and advertisements (MC 19-2019 §7). |
| 4. Look for SEC Advisories & Cease-and-Desist Orders (CDOs) | Browse SEC “Media & Advisories” page for company or app name; revoked entities are posted here. |
| 5. Confirm Inclusion in BSP “Interest-Cap-Compliant Lenders” | BSP posts quarterly lists after onsite verification. |
| 6. Report Suspicious Apps | File Investor Complaint Form (ICF) with SEC CGFD; attach screenshots; SEC may summarily block the app store listing within 24 hrs under MC 10-2021. |
Red Flag: Apps that publish only a DTI business-name number (BN #) or sole-proprietorship permit are automatically illegal for extending credit to the public.
6. Ongoing Obligations Specific to Online Platforms
- In-App Disclosures (MC 19-2019 §8)
- Total Loan Amount, APR, all fees + penalties, repayment schedule – displayed prior to acceptance.
- Cooling-off period of at least 24 hours for loans > ₱7,000.
- Data Privacy
- Access limited to camera, location and basic device info only during KYC; contact-list scraping is prohibited.
- Debt Collection Rules
- No threatening messages, no public shaming, no contacting persons other than the borrower except guarantors.
- Violations enforceable under RA 11765 (administrative fines) and Revised Penal Code (grave coercion).
- Interest & Penalty Limits
- Unsecured, salary-deduction or short-term credit ≤ ₱10 k: max 6 %/month interest + 5 %/month penalty (BSP Circ. 1156-2023).
- Advertising Standards
- All marketing must clearly show SEC & CA numbers; no misleading “0 % interest” claims unless truly zero cost.
- Cybersecurity & Business Continuity
- Annual penetration-test certificate; mandatory incident-response plan; report breaches to SEC within 72 hours.
7. Enforcement Landscape (2019-2025 Snapshot)
| Year | Notable Action | Basis | Outcome |
|---|---|---|---|
| 2019 | SEC MC 19 issued | First comprehensive OLA rules | Required all existing OLAs to re-file CA annexes |
| 2020 | Pandemic surge of 200+ rogue apps | RA 9474 + CDOs | 63 apps blocked in Play Store within six months |
| 2022 | RA 11765 enacted | Creation of SEC “FCPD” super-division | Broader subpoena & refund powers |
| 2023 | First ₱21 million fine vs. 88Finance Lending Corp. | MC 19 + RA 11765 | CA revoked; officers indicted |
| 2024-Q3 | Inter-agency sweep (#ProjectPiso) with NBI Cybercrime | Unlicensed Chinese-owned apps | 14 arrests; ₱190 m of receivables frozen |
8. Practical Tips for Lawyers & Compliance Officers
- Build the CA application bundle early—IT architecture diagrams and privacy-impact-assessment (PIA) cause most delays.
- For group or foreign-funded structures, keep ultimate parent shareholding below 40 % foreign equity if you plan to avail of MSME incentives.
- Train collection staff on NPC Advisory 2017-01 to avoid data-privacy complaints.
- Monitor Google Play Console for impostor apps using your corporate name; report to SEC & Google concurrently.
- Renew surety bonds annually even though the CA itself has no expiry; insurers typically cancel bonds for chronic consumer complaints, which in turn violates CA conditions.
9. Forthcoming Developments (as of April 30 2025)
- Proposed SEC MC “Digital Assets & Fintech Lending” (exposure draft January 2025) – will consolidate OLA rules with crypto-secured lending provisions and raise minimum paid-up capital to ₱25 million.
- NPC draft “Guidelines on Automated Credit Scoring” – expected to require explainability and opt-out for AI-driven loan decisions.
- House Bill 10277 – seeks to criminalize “debt-shaming” as a stand-alone offense (penalty up to 3 yrs).
10. Conclusion
Verifying the legality of an online loan app in the Philippines is straightforward yet essential: look for a valid SEC Registration Number and Certificate of Authority, both of which can be cross-checked on the SEC website. The Commission has sharpened its teeth through new consumer-protection laws, capped interest rates, fast-track app-store takedowns, and escalating fines. For fintech entrepreneurs, strict compliance is no longer optional but a prerequisite to market entry. For counsel, mastery of the intertwined rules—corporate, lending, consumer-protection, data privacy, and cybersecurity—has become a core specialty in the Philippine legal landscape.
This article is for informational purposes only and does not constitute legal advice. For specific situations consult Philippine counsel or the SEC Corporate Governance & Finance Department.