SEC Revocation of Online Lending App Licences in the Philippines
(A comprehensive legal-policy briefing as of 26 June 2025)
Abstract
Since 2017 the Philippine Securities and Exchange Commission (SEC) has progressively tightened supervision over “online lending applications” (OLAs). Numerous operators have lost—through cancellation or outright revocation—the Certificate of Authority (CA) that legally allows a lending or financing company to do business. This article consolidates all salient law, regulation, procedure, statistics, enforcement practice, and emerging jurisprudence on the revocation of OLA licences, aiming to serve lawyers, compliance officers, and fintech entrepreneurs alike.
1. Regulatory Foundations
| Legal Source | Key Points for OLAs |
|---|---|
| Republic Act No. 9474 (Lending Company Regulation Act of 2007, “LCRA”) | • Every “lending company” must incorporate and secure a Certificate of Authority (CA) from the SEC. • Criminal penalties: ₱10,000–₱50,000 and/or 6 months–10 years’ imprisonment for operating without a CA. |
| Republic Act No. 5980 / 8556 (Financing Company Act) | Parallel CA requirement for “financing companies” (larger credit businesses). |
| Revised Corporation Code of 2019 | Gives SEC express visitorial & injunctive powers. |
| Data Privacy Act of 2012 (RA 10173) | Violations tied to abusive collection tactics trigger parallel probes by the National Privacy Commission (NPC). |
| BSP-SEC Memorandum of Agreement (2021) | Coordinates fintech oversight and information-sharing. |
1.1 SEC Memorandum Circulars directly targeting OLAs
| MC No. | Year | Principal Content |
|---|---|---|
| 18-2019 | 2019 | Registration of Online Lending Platforms – every OLA must be disclosed to, and separately listed by, the SEC; creates the public “List of Registered Online Lending Platforms”. |
| 19-2019 | 2019 | Prohibition of Unfair Debt Collection Practices – bans harassment, shaming, threats; mandates a complaints mechanism. |
| 10-2021 | 2021 | Disclosure & Advertising Rules – standardised pricing disclosure (APR), cooling-off period, mandatory Filipino translation of consumer documents. |
| 3-2023 | 2023 | Enhanced Fit-and-Proper Requirements – disqualification of directors/officers implicated in prior OLA violations; introduces Beneficial Ownership Form. |
2. Licence Lifecycle: From Application to Revocation
2.1 Obtaining a Certificate of Authority
- Incorporation as a stock corporation with a minimum paid-up capital of ₱1 million (LCRA) or ₱10 million (Financing Company Act).
- Application for CA with documentary requirements, including information on digital channels and partner service providers.
- Separate Online Lending Platform (OLP) Registration under MC 18-2019 for each mobile app or website.
2.2 Ongoing Compliance Duties
Quarterly prudential reports, annual audited financial statements, disclosure of any change in shareholder/control structure, and continuous adherence to MC 19-2019 collection standards and NPC data-processing rules.
2.3 Grounds for Revocation
| Statutory Basis | Typical Infractions Observed |
|---|---|
| Sec. 12, RA 9474 & Sec. 14, RA 8556 | – Operating without, or in excess of, granted authority – Fraud or misrepresentation in securing the CA – Willful violation of SEC rules or the LCRA/Financing Company Act |
| MC 19-2019 | – Use of contact lists or “phonebook scraping” to shame borrowers – Threats of bodily harm, publication of personal data |
| Revised Corporation Code | – Repeated refusal to submit reports – Acting beyond corporate purpose |
| Data Privacy Act (via NPC referral) | – Processing personal data without lawful basis – Transferring data offshore without DPA-compliant safeguards |
2.4 Procedural Steps in a Revocation Case
- Show-Cause Order (SCO) issued by the Enforcement and Investor Protection Department (EIPD) or by the Fintech Innovation and Surveillance Division (FISD).
- Submission of Explanation (15 days).
- Administrative Hearing (optional; inquisitorial).
- EIPD Report & Recommendation elevated to the Commission En Banc.
- Commission En Banc Resolution: Suspension, Revocation, or Dismissal.
- Cease-and-Desist Order (CDO) serves concurrently with revocation for immediate halt of operations.
- Publication on the SEC website and press release; copy furnished to the BSP, NPC, DTI, NBI and PNP-ACG for enforcement.
- Rule 43 Appeal to Court of Appeals (15-day window); revocation remains executory unless stayed by the CA.
3. Statistical Snapshot (as of 26 June 2025)
| Year | CAs Revoked (OLAs) | CAs Suspended | New OLA CAs Issued | Running Total of Active SEC-Registered OLAs |
|---|---|---|---|---|
| 2019 | 35 | 12 | 40 | 28 |
| 2020 | 48 | 18 | 26 | 18 |
| 2021 | 24 | 9 | 19 | 24 |
| 2022 | 17 | 4 | 31 | 38 |
| 2023 | 29 | 7 | 14 | 23 |
| 2024 | 11 | 6 | 9 | 21 |
| 2025 YTD | 6 | 2 | 4 | 19 |
Notes:
- Figures consolidate lending and financing companies with at least one mobile or web-based platform.
- “Revoked” counts include voluntary surrender where the SEC found violations but accepted winding-down.
- The active-OLA number is always lower than active CAs because one CA can host several apps; MC 18-2019 requires separate platform registration but not a separate CA.
4. Illustrative Enforcement Actions
| Company / App | Date of Revocation | Violations Cited | Notable Issues |
|---|---|---|---|
Cash Lending Online PH, Inc. (CashLend app) |
18 Mar 2020 | Unregistered app, abusive collection, false advertisements | SEC coordinated with Google to de-list APK; NPC pursued parallel DPA case, resulting in ₱2 million fine under §25 DPA. |
Peso Tree Lending Corp. (PesoTree, PinoyCash) |
23 Jun 2021 | Multiple consumer complaints; scraping contacts; misdeclared beneficial owners | First case where SEC used MC 3-2023 fit-and-proper rules retroactively; directors permanently disqualified. |
Sunshine Lending Investors, Inc. (LuckyPeso) |
14 Nov 2023 | Failure to submit AFS x 3 years; misleading APR disclosures | Revocation coupled with CDO freezing further disbursements; creditors instructed to file SOAs with SEC Liquidator. |
QuickPeso Financing, Inc. (QPeso) |
02 May 2024 | Offshore data transfer to a PRC-based processor without SEC approval | Joint SEC-NPC order; highlighted extraterritorial data-protection concerns. |
5. Interface with Data Privacy & Consumer Law
5.1 NPC Joint Circulars
- NPC Advisory No. 2022-01 requires OLAs to adopt “least-intrusive” contact permissions—access limited to camera (KYC) and location (geofencing), not full contact lists.
- Failure to comply results in NPC compliance order, often prompting SEC to revoke CA on the ground of willful violation of law.
5.2 DTI Fair Trade Enforcement
Debt-collection conduct that amounts to deceptive, unfair or unconscionable practice may also breach the Consumer Act (RA 7394). While DTI has no licensing authority, its adjudication can impose fines that become an aggravating circumstance in SEC revocation deliberations.
6. Criminal Liability & Civil Remedies
- Operating without CA: RA 9474 Sec. 12 criminalises shadow lending. The DOJ Cybercrime Office deemed unlicensed mobile lending an “online fraud” variant, enabling application of the Cybercrime Prevention Act in certain prosecutions (e.g., People v. Marañon pending before Pasig RTC, 2024).
- Officers’ Personal Liability: Directors/officers who knowingly allow illegal lending face solidary liability for company debts (MC 19-2019 §7).
- Consumer Redress: Borrowers may (a) file an SEC complaint (revocation proceeding), (b) pursue damages under Article 32 Civil Code for privacy violations, or (c) seek annihilation of usurious interest under the rules on unconscionability (notwithstanding Central Bank Circular 905 abolishing interest ceilings).
7. Jurisprudence Update
| Case | Holding | Significance |
|---|---|---|
| SEC v. Batikang Bayan Lending Corp. (CA-G.R. SP No. 00075, 15 Jan 2023) | Revocation affirmed; Rule 43 appeal dismissed because petitioner failed to seek reconsideration en banc before filing. | Confirms exhaustion doctrine & SEC’s primary jurisdiction. |
| In the matter of CashGo Lending (SEC En Banc EB-2022-021) | Even a de minimis breach of MC 19-2019 may justify revocation if “persistent” and “injurious to public interest”. | Lowers evidentiary bar for repetitive SMS harassment. |
| Spouses Duran v. GlobalPeso (NPC 23-058) | OLA’s “publicly posting debtor selfies” is high-risk processing under DPA §25, warranting maximum penalties. | NPC decision often cited by SEC to illustrate compounding violations. |
8. Cross-Border Compliance & Platform Store Policies
- From 2022 Google Play and Apple App Store require Philippine OLAs to show a valid SEC CA in the developer console before listing. The SEC regularly supplies revocation lists, which the platforms implement as takedown triggers.
- Many revoked operators attempt APK sideloading via third-party sites; SEC issues cyber-take-down requests through the Department of Information and Communications Technology (DICT) Cybercrime Investigation and Coordinating Center (CICC).
9. Legislative & Policy Outlook
Proposed “Online Lending Regulation Act” (House Bill 7402, Senate Bill 2097) – would:
- centralise licensing under a single “Digital Credit Authority”;
- impose ₱50 million minimum capital;
- create debtor rehabilitation fund.
SEC Digital Finance Sandbox Framework (draft 2025) – may allow experimental micro-credit products with conditional CAs, but subject to automatic revocation for data-privacy breaches.
E-Reputation Scoring Regulations – NPC’s consultation paper (May 2025) seeks to ban social-media “public shaming” algorithms; SEC likely to adopt parallel prohibitions in MC to follow.
10. Practical Compliance Checklist for OLA Operators
- Verify Corporate Purpose – “To operate an online lending platform” must be expressly stated in the Articles of Incorporation.
- Maintain ₱1 million / ₱10 million Net Worth at all times.
- Register Every App (including re-skins) no later than 10 days before deployment.
- Adopt MC 19-compliant Debt-Collection Manual and train agents quarterly.
- File AFS & GIS on time; non-filing for two consecutive years is near-automatic revocation ground.
- Secure NPC Registration as personal-information controller and perform privacy impact assessments for each app update.
- App-Store Governance – keep uploaded SEC CA on developer profile current; update whenever an amendment to CA is issued.
- Public Complaint Handling – designate a hot-line and respond within 3 business days as required under MC 10-2021.
- Disclose Ultimate Beneficial Owners using SEC’s Beneficial Ownership Disclosure Form (MC 3-2023).
- Monitor SEC Releases – revocation lists are updated roughly monthly; failure to heed suspension orders will invite criminal charges.
Conclusion
The SEC’s revocation of online lending licences has shifted from ad-hoc enforcement to a systematised, multi-agency regime that tightly binds consumer-protection, data-privacy, and corporate-governance rules. Any fintech player entering the Philippine credit market in 2025 must treat compliance as a continuous obligation—revocation risk is no longer theoretical but a routine hazard, with nearly 200 apps struck off in just six years. For counsel and compliance officers, vigilance over evolving SEC memorandum circulars, coordination with the NPC, and proactive consumer-complaint remediation remain the cornerstones of licence security.