Introduction

In the Philippines, complaints against lenders are often misdirected because borrowers assume there is only one government regulator for all loan-related problems. There is not. The proper agency depends on what kind of entity the lender is, what the lender did, and what right was violated.

A complaint about a lending company’s license or abusive collection practices may involve the Securities and Exchange Commission (SEC). A complaint about a bank, digital bank, quasi-bank, or BSP-supervised financial institution may fall under the Bangko Sentral ng Pilipinas (BSP). A complaint about harassment involving misuse of personal data, unauthorized contact of third parties, unlawful processing of phone contacts, photos, or IDs may belong with the National Privacy Commission (NPC). A complaint involving estafa, threats, coercion, cybercrime, identity misuse, or other criminal conduct may require going to the Department of Justice (DOJ) or the prosecutor’s office, often with the police or NBI involved.

The key point is simple: the same lending dispute can involve multiple agencies at once. For example, an online lending app may be:

unregistered with the SEC,
unlawfully accessing a borrower’s contact list,
sending humiliating collection messages,
and making criminal threats.

That single case can trigger SEC, NPC, and criminal complaints separately.

This article explains, in Philippine legal context, which agency regulates what, when each agency has jurisdiction, where borrowers should file, what evidence matters, and how to avoid common mistakes.

I. The First Question: What Kind of Lender Are You Dealing With?

Before deciding where to complain, identify the lender.

In practice, Philippine lenders usually fall into one of these groups:

1. Lending companies and financing companies

These are commonly private corporations engaged in lending or financing and are generally registered with the SEC. Many non-bank online lenders fall in this category.

2. Banks and BSP-supervised institutions

These include:

universal banks
commercial banks
thrift banks
rural banks
cooperative banks
digital banks
quasi-banks
other BSP-supervised financial institutions

These are under the BSP, not the SEC, for prudential and consumer-protection supervision.

3. Credit cooperatives

These may be regulated differently, commonly through the cooperative regulatory framework rather than the SEC or BSP structure applicable to corporations and banks.

4. Informal or illegal lenders

These may include unlicensed online lenders, “5-6” operators, fake collection agents, or persons using apps and social media without lawful authority. Depending on the conduct, they may fall under SEC enforcement, NPC action, and criminal prosecution.

This classification matters because the SEC does not regulate banks as banks, and the BSP does not regulate ordinary SEC-registered lending companies the same way it regulates banks.

II. SEC Jurisdiction: When the Securities and Exchange Commission Is the Proper Agency

A. What the SEC regulates

In the Philippine setting, the SEC is the primary regulator for lending companies and financing companies organized as corporations and operating under the applicable laws and SEC rules.

As a practical rule, the SEC is the proper agency when the complaint involves:

whether the lender is duly registered
whether it has the proper Certificate of Authority to Operate
whether it is violating SEC rules on lending and financing companies
whether it engages in unfair debt collection practices
whether it uses oppressive, harassing, false, or deceptive collection tactics
whether an online lending platform appears to be operating without proper authority

The SEC has also taken a visible role in the Philippines regarding online lending apps and abusive collection conduct.

B. Laws commonly associated with SEC-regulated lenders

The legal framework usually discussed in this area includes:

the Lending Company Regulation Act of 2007
the Financing Company Act of 1998
the Revised Corporation Code
SEC circulars and memoranda, especially those dealing with registration, disclosure, online lending platforms, and prohibited collection acts

A borrower does not need to cite every law perfectly before filing. What matters is identifying that the lender is a lending or financing company and that the complaint concerns a matter the SEC supervises.

C. Complaints commonly filed with the SEC

A borrower may complain to the SEC if the lender:

Operates without SEC registration or authority
Refuses to disclose corporate identity
Uses fake company names or unclear legal identity
Charges questionable fees or makes misleading disclosures
Commits unfair collection practices
Publicly shames debtors
Threatens arrest for mere nonpayment of debt
Pretends to be a law firm, court, or government office when it is not
Contacts unrelated third persons to pressure payment
Uses insulting, obscene, or degrading language

D. Unfair debt collection and SEC relevance

One of the most common misconceptions is that all collection abuse is purely a criminal matter. Not always. The SEC can act administratively against a lending or financing company for prohibited collection conduct even when the same facts may also support privacy or criminal complaints.

Typical acts that may trigger SEC action include:

repeated harassment by call or text
threats of imprisonment solely for nonpayment
use of profanity or humiliating language
contacting a borrower’s employer, relatives, or friends merely to shame the borrower
false representations that a case has already been filed when none has
coercive pressure tactics disproportionate to the debt

The SEC’s role here is administrative and regulatory. It can investigate regulated entities and impose sanctions within its authority. It is not the court that will decide a civil collection suit, and it is not the prosecutor that will determine criminal liability. But it is a major regulator for abusive practices by SEC-supervised lenders.

E. What the SEC generally does not resolve

The SEC is generally not the venue to litigate the entire private debt dispute in the sense of adjudicating all money claims between borrower and lender like an ordinary court case. It may discipline the regulated company, but it does not replace:

the courts for civil actions,
the prosecutor for crimes,
or the NPC for data privacy violations.

So if the borrower’s main issue is, “I deny the debt entirely and I want damages,” a judicial or quasi-judicial route may still be necessary depending on the facts. The SEC complaint can proceed separately on the regulatory aspect.

III. BSP Jurisdiction: When Bangko Sentral ng Pilipinas Is the Proper Agency

A. What the BSP regulates

The BSP regulates banks and other BSP-supervised financial institutions. If the lender is a bank, digital bank, rural bank, thrift bank, quasi-bank, pawnshop under relevant supervision, or other BSP-covered institution, complaints should usually be directed to the BSP’s consumer assistance mechanisms rather than the SEC.

A common mistake is filing against a bank with the SEC just because the bank is also a corporation. That is usually the wrong regulator for lending complaints about banking operations.

B. Complaints appropriate for the BSP

The BSP is commonly the right agency when the complaint involves:

loan disclosures by a bank
billing or statement disputes involving bank credit products
unauthorized charges tied to banking products
bank collection practices
violations of financial consumer protection rules
digital banking app problems
loan restructuring complaints involving BSP-supervised institutions
conduct of bank staff or accredited agents in relation to BSP-supervised products

C. Why BSP complaints are different from SEC complaints

The BSP’s concern is broader in the banking context: prudential regulation, sound banking practice, consumer protection, and compliance by supervised institutions. So even if the borrower experiences something similar—say, harassing collection calls—the correct regulator may still be the BSP if the lender is a bank or BSP-supervised entity.

D. What the BSP does not usually replace

Like the SEC, the BSP is not a substitute for:

civil courts deciding contractual liability,
the NPC on privacy breaches,
or the prosecutor on crimes.

A bank-related complaint may therefore also branch into:

BSP for regulatory violations,
NPC if personal data was unlawfully processed,
DOJ/prosecutor if crimes were committed.

IV. NPC Jurisdiction: When the National Privacy Commission Is the Proper Agency

A. Why data privacy is central to lending complaints

In the Philippines, many of the most serious complaints against online lenders involve privacy violations, not just loan terms. Borrowers often discover that a lender or collection agent:

accessed their phone contacts,
copied photos or IDs,
used their information beyond the agreed purpose,
contacted relatives or co-workers,
disclosed the debt to third parties,
or posted/shamed them online.

These issues fall squarely into the realm of the Data Privacy Act of 2012 and the jurisdiction of the National Privacy Commission.

B. When to complain to the NPC

The NPC is generally the proper agency if the lender or collector:

Collected personal data without valid lawful basis
Processed contact lists, photos, messages, or files beyond what was necessary
Disclosed your debt to other people without authority
Used your personal data for shaming, harassment, or intimidation
Retained or shared your IDs or personal records improperly
Failed to protect your personal information from unauthorized access
Required app permissions grossly unrelated to legitimate lending purposes
Used your data in a way incompatible with the privacy notice or consent terms

C. Contact-list harassment and the NPC

One recurring Philippine problem is the online lending app that harvests the borrower’s contact list and sends messages to unrelated persons saying the borrower is a scammer, a delinquent, or a fugitive. That can raise serious privacy issues because the lender may have:

unlawfully accessed personal data,
processed personal data excessively,
disclosed personal data without a valid basis,
violated data minimization,
and used the information for an unlawful or disproportionate purpose.

Even when the borrower granted app permissions, that does not automatically legalize everything. Consent in privacy law is not a blank check for humiliation, broad disclosure, or disproportionate collection tactics.

D. NPC versus SEC

The SEC may sanction the lending company for unfair collection practices. The NPC may separately act on unlawful data processing. The same act—such as messaging all contacts in the borrower’s phone—can be both:

an unfair debt collection practice, and
a privacy violation.

The agencies are addressing different legal injuries.

E. Evidence that matters in NPC complaints

Useful evidence includes:

screenshots of app permissions requested
screenshots of privacy notices and consent forms
messages sent to relatives, employers, or friends
logs showing access to contacts or media
copies of humiliating texts or chat messages
names and numbers of collection agents
timestamps and dates
witness statements from contacted third parties

V. DOJ and Prosecutor’s Office: When the Matter Becomes Criminal

A. Nonpayment of debt is not automatically a crime

This is one of the most important legal principles in Philippine law: mere failure to pay a debt is generally not, by itself, a criminal offense. A borrower cannot ordinarily be jailed simply because he or she failed to pay a private loan.

That is why threats such as “Pay today or you will be arrested tonight” are often legally baseless when no actual criminal case exists.

B. When criminal liability may arise

While simple nonpayment is not itself a crime, the conduct surrounding the loan may become criminal. Complaints may be brought through the prosecutor’s office under the DOJ, often with assistance from the PNP or NBI, when there are facts suggesting:

grave threats
unjust vexation
coercion
estafa, depending on the facts
libel or cyber libel, depending on publication and content
identity theft or falsification
computer-related offenses or cybercrime
extortion-like behavior
harassment involving fake legal processes
unauthorized use of another person’s identity or documents

In criminal matters, the formal route is often through the Office of the City/Provincial Prosecutor, which belongs to the prosecution service under the DOJ, rather than by writing the DOJ central office first.

C. Examples of lender conduct that may justify criminal referral

Possible examples include:

A collection agent threatens bodily harm.
A lender impersonates a judge, sheriff, police officer, or government official.
A collector sends fabricated warrants or fake subpoenas.
Someone uses a borrower’s photo to create defamatory public posts.
A lender hacks or unlawfully accesses accounts or devices.
A scam loan app steals identity documents for other fraudulent uses.
A collector threatens to circulate intimate images or false accusations unless payment is made.

Whether these acts actually constitute specific crimes depends on the evidence and exact circumstances, but they are beyond ordinary civil collection.

D. DOJ versus police versus NBI

People often ask whether they should go to the DOJ, police, or NBI. In practice:

police or NBI may receive and investigate complaints,
but criminal prosecution is usually determined by the prosecutor’s office,
which is within the DOJ structure.

So when people say “file with the DOJ,” what usually matters operationally is filing a criminal complaint before the proper prosecutor’s office, often with supporting affidavits and evidence.

VI. Civil, Administrative, and Criminal Remedies: They Are Different

A lending dispute can produce three separate tracks at the same time.

A. Administrative complaint

This is filed with a regulator such as the SEC, BSP, or NPC. The goal is to hold the regulated entity accountable under regulatory rules.

B. Civil action

This is filed in court when the dispute concerns damages, injunction, contractual issues, debt enforcement, or other private rights.

C. Criminal complaint

This is filed with the prosecutor’s office when the facts amount to a crime.

These remedies may overlap. Filing one does not automatically bar the others.

Example:

A borrower downloads an online lending app. The lender is SEC-registered. The app copies contacts. The collector messages the borrower’s employer and relatives, calling the borrower a thief, and threatens jail without a real case.

Possible routes:

SEC: unfair and abusive debt collection
NPC: unlawful processing and disclosure of personal data
Prosecutor/DOJ: threats, coercion, cybercrime, or other offenses depending on facts
Civil court: damages or injunction, if warranted

VII. How to Identify the Correct Agency

A practical way to identify the regulator is to ask four questions.

1. Is the lender a bank or a non-bank lending company?

If it is a bank or BSP-supervised institution, go first to the BSP.
If it is a lending company or financing company, the SEC is usually central.

2. Is the problem about licensing, legality of operations, or collection abuse?

That usually points to the SEC for lending/financing companies, or BSP for banks.

3. Is the problem about misuse of personal data?

That points to the NPC.

4. Is the problem about threats, fraud, fake legal notices, hacking, or coercion?

That points to the prosecutor’s office/DOJ, possibly with the police or NBI.

VIII. Common Complaint Scenarios and Where to File

Scenario 1: Online lending app is not clearly registered and keeps harassing the borrower

Likely agencies:

SEC
NPC, if personal data was misused
Prosecutor/DOJ, if threats or criminal acts occurred

Scenario 2: A bank’s collection department is acting abusively

Likely agencies:

BSP
NPC, if privacy was violated
Prosecutor/DOJ, if criminal threats or other crimes occurred

Scenario 3: Collector texted friends and co-workers that borrower is a scammer

Likely agencies:

NPC
SEC if it is a lending company
BSP if it is a bank
possible criminal and civil remedies depending on wording and publication

Scenario 4: Lender threatens imprisonment solely for unpaid debt

Likely agencies:

SEC or BSP, depending on the lender type
Prosecutor/DOJ if the threats cross into criminal conduct

Scenario 5: Fake collection law firm or fake subpoena sent by text or email

Likely agencies:

SEC or BSP for regulatory misconduct
Prosecutor/DOJ for possible criminal falsity, threats, or fraud

Scenario 6: App demanded access to contacts, gallery, and microphone unrelated to loan underwriting

Likely agencies:

NPC
SEC if it is a lending company using an online lending platform

Scenario 7: Lender is charging disputed amounts and refusing transparency

Likely agencies:

SEC for lending companies
BSP for banks
civil remedies may also be necessary if the core dispute is contractual

IX. What Evidence Should a Borrower Preserve?

Borrowers often weaken their own complaints by failing to preserve evidence early. In lending harassment cases, evidence disappears quickly.

Keep:

screenshots of text messages, chats, emails, and app notices
recordings or detailed logs of calls, where legally usable
screenshots of social media posts
app store listing and app name
website screenshots
proof of payments made
screenshots of loan terms, charges, and due dates
privacy policy and consent forms
names, numbers, and email addresses of agents
messages sent to third parties
affidavits of relatives, employers, or friends who were contacted
copies of IDs or forms submitted to the lender
proof of corporate identity, if available
timeline of events

A clear chronology is especially important. State:

when the loan was obtained,
how much was borrowed,
how much was repaid,
what the lender demanded,
what abusive acts occurred,
who was contacted,
and what harm resulted.

X. What a Complaint Should Contain

Whether filing with the SEC, BSP, NPC, or prosecutor, a good complaint usually contains:

1. Identity of the complainant

Full name, address, contact details.

2. Identity of the lender or collector

Company name, app name, website, phone number, email, office address if known.

3. Nature of the transaction

Date of loan, principal amount, disbursement, repayments, balance claimed.

4. Specific wrongful acts

Do not stay vague. Quote actual texts. Identify dates and persons contacted.

5. Legal basis, if known

This helps, but a complaint can still be valid even if not elegantly drafted by a lawyer.

6. Supporting evidence

Attach screenshots, documents, affidavits, and receipts.

7. Relief requested

For example:

investigation,
sanctions,
cease and desist,
data protection action,
criminal investigation,
damages in the proper forum.

XI. Important Philippine Legal Principles Borrowers Should Know

A. Debt collection is allowed, but abuse is not

A lender has the right to collect a valid debt. What the law restricts is the manner of collection. Collection becomes unlawful when it uses harassment, deception, humiliation, unlawful disclosure, or threats.

B. Consent is not unlimited

Borrowers often click “allow” on app permissions. That does not mean the lender may lawfully:

message all contacts,
shame the borrower,
process unrelated data indefinitely,
or disclose debt information to strangers.

C. Corporate registration does not excuse misconduct

A lender may be duly registered and still commit regulatory, privacy, civil, or criminal violations.

D. A collector is not a court

Collectors cannot lawfully create the impression that they can instantly order arrest, garnish wages without process, or issue legal mandates on their own.

E. Lawyers and law firms are not exempt from regulation

Even when a collection notice comes from or claims to come from a law office, the conduct can still be scrutinized. Use of a legal letterhead does not legalize false threats or privacy violations.

XII. Where Borrowers Commonly Go Wrong

1. Filing only with one agency

A borrower might complain only to the SEC, when the strongest part of the case is actually privacy-based before the NPC or criminal before the prosecutor.

2. Complaining about the debt but not the conduct

A complaint saying only “the lender is unfair” is weaker than one documenting exact harassment acts.

3. Deleting the app before preserving proof

Uninstalling the app may remove evidence. Preserve screenshots first.

4. Ignoring the lender’s true identity

Many apps use trade names. Try to identify the legal entity behind the app.

5. Assuming all threats are legally real

Collectors often use frightening language. Separate bluff from actual legal process.

6. Waiting too long

Evidence gets lost. Witnesses forget. Numbers change. Preserve and file promptly.

XIII. Does the SEC, BSP, NPC, or DOJ Order Refunds or Stop Collection?

Not always in the way complainants expect.

SEC

Can regulate and sanction lending/financing companies, and act on violations within its authority. It is not primarily a debt-cancellation court.

BSP

Can address complaints involving BSP-supervised entities and require compliance with consumer protection and supervisory rules. It is not a substitute for all civil adjudication.

NPC

Can address unlawful data processing and privacy violations. Its focus is privacy compliance and accountability, not a general rewrite of the loan contract.

DOJ/Prosecutor

Can pursue criminal liability, but a criminal complaint does not automatically erase a valid civil debt.

This distinction matters. A borrower may win on privacy or collection abuse and still owe a legitimate principal balance, unless the underlying debt itself is legally defective. Likewise, a lender may still have collection rights but lose the right to use unlawful methods.

XIV. Can a Borrower Be Sued Even If the Lender Also Violated the Law?

Yes. These are separate questions.

Question 1: Does the borrower owe money under the loan?
Question 2: Did the lender violate regulations, privacy law, or criminal law in collecting?

A “yes” to the second does not automatically erase the first. But the lender’s misconduct can expose it to sanctions, damages, injunctions, or criminal consequences.

XV. Practical Agency-by-Agency Guide

A. File with the SEC when:

the lender is a lending company or financing company
you suspect no proper authority to operate
the issue is abusive collection
the online lending app appears illegal, deceptive, or noncompliant
the complaint concerns regulatory violations by non-bank lenders

B. File with the BSP when:

the lender is a bank or BSP-supervised financial institution
the issue concerns bank loan practices, bank collections, or consumer protection violations by a bank
the product is clearly within the banking or BSP-supervised system

C. File with the NPC when:

your contacts, photos, IDs, or other personal data were misused
the lender contacted third parties
your debt was disclosed to others
the app gathered or used data excessively or unlawfully
privacy rights under the Data Privacy Act were violated

D. File with the prosecutor’s office/DOJ when:

there are threats, coercion, fraud, fake legal notices, cybercrime, identity misuse, or other criminal acts
the conduct goes beyond rude collection and into punishable offenses

XVI. Special Note on Online Lending Apps

In the Philippine context, online lending apps have generated a large portion of complaints because they combine three things:

Easy digital onboarding
Aggressive short-term collection
Extensive access to personal data

Because of that, complaints against online lending apps are often multi-agency cases.

A single online lending app complaint may involve:

SEC for authority to operate and collection conduct,
NPC for data processing and disclosure,
DOJ/prosecutor for threats or cyber-related wrongdoing,
and courts for civil damages or injunctive relief.

Borrowers should resist the instinct to file only one generic complaint. The stronger strategy is to identify each violation by category.

XVII. Can the Barangay Help?

For some disputes between parties residing in the same city or municipality and where the law requires prior conciliation, the barangay process may become relevant before certain civil or minor cases. But barangay conciliation is not a substitute regulator for lending companies, banks, privacy violations, or criminal prosecution in the sense discussed above.

Barangay proceedings may help in neighborhood-level disputes, but they are not the primary answer to regulatory complaints against lenders.

XVIII. Can a Lawyer Help Even Before Filing?

Yes. Many borrowers wait until a case has escalated. But legal review early on is useful because counsel can separate:

valid debt from illegal charges,
ordinary collection from abusive collection,
privacy breach from simple contact,
and bluff from actionable criminal conduct.

This is especially important where the facts could support simultaneous SEC, NPC, and criminal filings.

XIX. Bottom Line: Which Agency Regulates Lending Companies, and Where Should Complaints Be Filed?

There is no single universal answer because different agencies regulate different aspects of lending activity in the Philippines.

The SEC is the principal regulator of lending companies and financing companies

File there when the issue involves:

registration,
authority to operate,
online lending platform compliance,
and unfair or abusive collection by non-bank lenders.

The BSP regulates banks and BSP-supervised financial institutions

File there when the lender is a bank or BSP-covered entity and the complaint concerns lending operations, bank collections, disclosures, or consumer-protection issues.

The NPC handles data privacy violations

File there when the lender or collector unlawfully accessed, processed, disclosed, or misused personal data, especially contact lists, IDs, photos, and debt information shared with third parties.

The DOJ, through the prosecutor’s office, addresses criminal liability

Go there when the conduct involves threats, coercion, fraud, fake legal notices, identity misuse, cybercrime, or other offenses beyond ordinary debt collection.

In many real Philippine cases, especially involving online lending apps, the correct answer is not one agency but several at the same time.

A useful rule is this:

Who regulates the lender as an entity? SEC or BSP.
Who protects your personal data? NPC.
Who prosecutes crimes? DOJ through the prosecutor’s office.

That is the proper framework for deciding where to file complaints against lenders in the Philippines.