A practitioner’s guide to forums, venues, procedures, and asset-protection tactics—criminal, administrative, and civil

I. First, is it a “pyramid scam” or a legitimate direct-selling/MLM?

A scheme is typically pyramiding when compensation substantially comes from recruiting people or buy-in fees (starter kits, positions, tokens), not from real consumer sales of goods/services at fair value. Red flags:

Income promises tied to headcount or entry fees, not retail sales;
Inventory loading; forced/automatic monthly purchases with no real resale;
Pay plans paying multiple “levels” for enrolments, with token or overpriced products;
No refund or sham “buy-back” policy;
Solicitation of “investments” or passive returns without a secondary license.

When “investments” or passive returns are pitched, it crosses into securities territory—an SEC matter—with possible criminal estafa overlays.

II. The three main tracks (use them in parallel)

A. Administrative / Regulatory (to stop the scheme fast)

Securities and Exchange Commission (SEC) – primary regulator for investment/pyramiding schemes
- What to file: Complaint or information report with Enforcement and Investor Protection units (investment solicitation, unregistered securities/salesmen, illegal pyramiding).
- Why here: SEC can issue Advisories and Cease-and-Desist Orders (CDOs), require records, refer for criminal prosecution, and coordinate bank freezes with other agencies.
- Who files: Any victim/whistleblower; corporate victims may file through authorized officers.
Department of Trade and Industry (DTI) – deceptive sales/consumer-protection issues for product-based pyramiding
- What to file: Complaint for unfair or deceptive acts under the Consumer Act; useful where the entity claims to be “direct selling/MLM” but compensates recruitment.
- Why here: DTI can penalize false/misleading advertising, order refunds, and coordinate with LGUs for permit action.
Other helpful regulators (supplemental):
- BSP/banks/e-money issuers – report accounts used to collect fees; request account flags/holds and return of erroneous transfers.
- AMLC – tipline for suspicious transactions; can seek freeze orders via the Court of Appeals in proper cases.
- NPC (Data Privacy) – if the scheme doxxes, spams, or misuses IDs/contacts.

B. Criminal (to punish and deter; also helps leverage recovery)

PNP-CIDG/PNP-ACG or NBI (Anti-Fraud / Cybercrime Divisions)
- What to file: Criminal complaint-affidavits for estafa (Art. 315 RPC), syndicated/large-scale estafa (P.D. 1689), violations of the Securities Regulation Code (unregistered sale of securities, fraudulent transactions), Cybercrime overlays if online.
- Why here: Law enforcement can investigate, subpoena records, seize devices, and assist in asset tracing.
Office of the City/Provincial Prosecutor (DOJ–NPS)
- What to file: Sworn complaint with annexes for preliminary investigation.
- Venue: Where any essential element occurred—place of solicitation, payment, issuance of receipts, or victim’s residence (if online acts caused damage there).
- Outcome: Prosecutor’s Resolution → filing of Information in court; you can also press the civil aspect within the criminal case.

C. Civil (to recover money and freeze assets)

Regional Trial Court (RTC) – Damages, Rescission/Annulment, Unjust Enrichment
- What to file: Complaint for sum of money/damages/rescission with urgent provisional remedies.
- Provisional remedies:
  - Preliminary attachment (Rule 57) to secure assets;
  - Preliminary injunction/TRO to stop ongoing solicitations;
  - Receivership in extreme cases.
Small Claims – for limited amounts, quick recovery (no lawyers required).

Strategy tip: File SEC (CDO) + NBI/PNP + civil with attachment together. Stopping cashflow early dramatically improves recovery odds.

III. Where exactly to file (by scenario)

Scenario	Primary Forum(s)	Notes
You paid “investment”/entry fees; returns promised	SEC (unregistered securities/pyramiding) + NBI/PNP (estafa/SRC crimes)	Attach proof of solicitation, payment, and promised returns.
Product-based “MLM” that pays for recruits	SEC (pyramiding) + DTI (deceptive selling) + LGU BPLO	DTI for misrepresentation/refunds; SEC for investment/pyramiding violations.
Purely online recruitment (FB/Telegram/Apps)	NBI Cybercrime / PNP-ACG + SEC	Ask for data preservation letters to platforms; include URLs, handles.
Many victims, big amounts	DOJ Tasking via Prosecutor, SEC	Consider syndicated/large-scale estafa angle; coordinate affidavits to avoid fragmented cases.
You need money back fast	RTC Civil (attachment/injunction)	File civil with ex parte attachment if grounds exist; proceed in parallel with criminal/SEC.
Wallet/bank account identified	BSP-supervised institution complaint desk + bank’s fraud team	Ask to flag beneficiary accounts; submit police report/SEC complaint ref.

IV. Venue and jurisdiction quick rules

Criminal: Any place where an element occurred (solicitation, payment, deceit, damage, online posting with effects). Large-scale or syndicated estafa goes to RTC.
Civil: Generally where plaintiff or defendant resides, or where the cause of action arose; injunction where the act is being committed.
Administrative: SEC/DTI accept complaints nationally; you may file by email/online or at their Enforcement/Field Offices (formats vary).
Barangay conciliation: Not required for criminal cases and usually inapplicable to SEC matters; often bypassed when immediate court relief (attachment/injunction) is sought.

V. Evidence you should prepare (the “scam kit”)

Affidavit narrating how you were recruited, promises made, and payments sent;
Proof of payment: bank/e-wallet transfers, deposit slips, receipts;
Screenshots/recordings of pitches, compensation plans, dashboards, group chats, “uplines” messages;
Marketing materials: decks, PDFs, ads;
Victim list with contact details and amounts;
Identity trail of perpetrators: names, phone numbers, wallet/bank accounts, pages/handles, corporate registrations (if any);
Loss computation (principal, “fees,” promised returns);
Timeline (dates of solicitations, payments, demands).
For online evidence, preserve metadata (URLs, timestamps) and keep original files.

VI. What each forum can give you

SEC: Cease-and-Desist Orders, public Advisories, asset/account tracing via inter-agency work, and criminal referral to prosecutors; administrative fines/penalties.
NBI/PNP: Investigation, subpoenas, search/seizure with warrants, arrest (upon warrants), forensics.
Prosecutor/Criminal Court: Conviction (deterrence), restitution via the civil aspect of the criminal case.
RTC Civil: Money judgment, attachment, injunctions, receivership; better for fast asset security than waiting on criminal finality.
DTI: Administrative sanctions, refund orders, penalties for deceptive sales.
BSP/AMLC/Banks: Account flags/holds, freeze orders (AMLC via CA), incident records helpful to courts/regulators.

VII. Legal theories to plead (mix and match)

Estafa (deceit + damage), Syndicated/Large-Scale Estafa (if elements met);
Securities Regulation Code violations (unregistered sale of securities; fraudulent transactions);
Cybercrime (if committed through computer systems);
Consumer Act (false, deceptive, or misleading sales acts);
Civil Code (rescission/annulment for fraud, damages under Arts. 19/20/21);
Unjust enrichment for recovery of net proceeds;
Conspiracy among uplines, promoters, and corporate shells.

VIII. Filing sequence that works (playbook)

Evidence preservation (screens, exports, ledger of payments).
SEC complaint (ask for CDO; attach victim matrix).
NBI/PNP report (request preservation letters to platforms/e-wallets; include SEC ref no.).
Civil suit with attachment in RTC (move ex parte if grounds exist; target known accounts/vehicles/real property).
Prosecutor complaint (bundle multiple victims if possible; well-indexed annexes).
Bank/BSP/AMLC notifications (reference police/SEC filings).
DTI complaint (if MLM façade/ads used).
Platform takedowns (FB/YouTube/TikTok/app stores) using the SEC advisory/complaint as support.

IX. Special situations

Cross-border / offshore promoters: Still file SEC + NBI/PNP; agencies will use MLAT/INTERPOL routes. In civil court, sue local agents and attach local assets.
Crypto/forex “investment” fronts: Treat as securities solicitation; include cybercrime angles. Capture wallet addresses and on-chain explorers as annexes.
Company says it’s “registered with SEC”: SEC registration to operate as a corporation ≠ license to sell securities/MLM. Ask SEC to confirm status of secondary license and product approvals.
Religious/charitable veneer (“blessing circles”): Still pyramiding if pay-ins fund payouts; file same way.
Whistleblower/employee complainants: Ask SEC/NBI about anonymity/whistleblower handling; protect evidence chain.

X. Timelines and expectations

SEC CDO/Advisory: can be rapid with solid evidence; use to warn the public.
Law-enforcement investigation: weeks to months; your organized annexes speed things up.
Civil attachment/injunction: can be days to weeks if grounds are met and bond posted.
Criminal prosecution: multi-month preliminary investigation; trial can take longer—hence the importance of asset freezes/attachments early.

XI. Victim coordination and cost sharing

Create a victim consortium: shared notary and evidence repository, aligned affidavits, and lead counsel for consistency.
Use a standardized damages matrix; nominate bellwether witnesses for the first wave of filings.
Pool funds for filing fees/attachment bonds where feasible; consider IBP/legal-aid channels for indigent victims.

XII. Practical checklists

Complaint pack (common to SEC/NBI/Prosecutor/RTC):

Affidavit (detailed chronology)
Proof of payments (receipts, transfers, wallet txids)
Marketing/comp plan materials (PDFs, vids, posts)
Chat/email screenshots (with timestamps/URLs)
List of perpetrators and roles (uplines, officers)
Victim matrix (names, amounts, dates)
Demand/cease-and-desist letters (if any)

Civil with attachment (add):

Verified complaint + causes of action
Attachment affidavit stating grounds (e.g., fraud, intent to abscond)
Bond (coordinate with surety)
Property list (bank accounts, plates, titles, wallets) with identifiers

XIII. Bottom line

File everywhere it counts: SEC to shut it down, NBI/PNP + Prosecutor to prosecute, and RTC civil to lock and recover assets—plus DTI if there’s an MLM/disclosure angle. Move fast, file in parallel, and lead with well-organized evidence and provisional remedies. The earlier you stop the money flow, the better your shot at getting your money—and your neighbors’—back.