How to Check the Legitimacy of Online Lending Companies in the Philippines

A 2025 practitioner’s guide for borrowers, compliance officers, and counsel

1. Why legitimacy matters

Unregistered or non-compliant apps have been linked to privacy breaches, harassment, and hidden fees. Between 2019 and 2024 the Securities and Exchange Commission (SEC) revoked more than 2,000 lending-company registrations, took 33 apps off Google Play, and filed criminal cases against erring operators. (SEC removes 33 online lending apps in Google Play Store | Philstar.com)

2. The regulatory map

Regulator	Key legal bases	What it polices
SEC	• Lending Company Regulation Act (RA 9474) • Financing Company Act (RA 8556) • SEC Memos: MC 18-2019 (unfair collection), MC 19-2019 (OLP registration & disclosure), MC 10-2021 (moratorium on new OLPs), MC 3-2022 (interest-cap rules)	Corporate registration, Certificates of Authority (CA), online-lending platforms
Bangko Sentral ng Pilipinas (BSP)	BSP Circular 1133-2021 (6 %-per-month nominal & 15 % EIR cap on loans ≤ ₱10k ≤ 4 months)	Caps on rates/fees and enforcement (through SEC MC 3-2022)
National Privacy Commission (NPC)	Data Privacy Act (RA 10173); NPC Circular 20-01-2020 & 2022-02 on loan-data processing	Data-collection limits, consent, contact-list scraping, breach reporting
Other statutes	Truth in Lending Act (RA 3765) – mandatory cost disclosure; Financial Products & Services Consumer Protection Act (RA 11765) – broad consumer remedies; Consumer Act (RA 7394); Anti-Money Laundering Act (RA 9160)	Advertising, disclosure, AML registration, dispute resolution

(2019MCNo19 PDF | PDF, [PHILSTAR] SEC issues memorandum on unfair debt collection practices | Credit Information Corporation, SEC halts registration of online lending platforms - The Manila Times, SEC implements cap on lending, financing firms’ interest rates | Philippine News Agency, [PDF] BANGKO SENTRAL NG PILI PINAS, Republic Act No. 3765, R.A. 11765 – Financial Products and Services Consumer Protection Act - ACCRALAW)

3. Eight-step legitimacy check (2025 edition)

Search the SEC database
Go to SEC website > “Lending & Financing Companies” > “List of Lending Companies / List of Recorded OLPs.” Confirm that:
- The corporate name exactly matches the one on the app/website;
- A valid SEC Registration No. and Certificate of Authority (CA) No. are shown. (About Lending Companies and Financing Companies - Securities and Exchange Commission)
Confirm the online-lending platform (OLP) itself is recorded
Under MC 19-2019 every app or web portal must be reported to the SEC and registered as a separate business name. Absence from the “Recorded OLP” list or launch after the November 2 2021 moratorium (MC 10-2021) is a red flag. (2019MCNo19 PDF | PDF, SEC halts registration of online lending platforms - The Manila Times)
Check for SEC advisories, cease-and-desist orders (CDOs), or revoked licences
The same SEC menu hosts a “List of Revoked and Suspended Lending Companies” and real-time advisories.
Look at Google Play / iOS App Store developer info
Google now removes personal-loan apps without a declared SEC licence. Mismatch between the developer name and the SEC-registered entity, or sideload-only APKs, strongly suggests illegitimacy. (SEC removes 33 online lending apps in Google Play Store | Philstar.com)
Verify AMLC enrolment (for anti-money-laundering compliance)
Cross-check the public list of “SEC-supervised entities” registered with the Anti-Money Laundering Council. ([PDF] List of AMLC registered SEC Supervised Entities as of 27 March 2024)
Run the numbers
For loans ≤ ₱10,000 and tenor ≤ 4 months, the lawful limits are:
- Nominal interest ≤ 6 % / month (≈ 0.2 % / day)
- Effective interest ≤ 15 % / month (all-in)
- Penalties ≤ 5 % / month; total cost ≤ 100 % of principal. (SEC implements cap on lending, financing firms’ interest rates | Philippine News Agency)
  Anything higher—or undisclosed—violates BSP Circular 1133, SEC MC 3-2022, and RA 3765.
Scrutinise the privacy notice and app permissions
Under NPC Circular 20-01 an app may request only data that is “adequate, relevant, suitable, necessary, and not excessive.” Demanding full contact-list or photo-gallery access without a lawful basis breaches the Data Privacy Act and carries up to six years’ imprisonment and ₱4 million fines per count.
Evaluate collection practices
MC 18-2019 outlaws calls before 6 a.m./after 10 p.m., threats, doxxing, foul language, and disclosing debt to third parties. First-offence fines start at ₱25k (lending companies) and escalate to revocation. ([PHILSTAR] SEC issues memorandum on unfair debt collection practices | Credit Information Corporation)

4. Red-flag checklist

No CA number or “SEC Reg. Pending” claim
App launched after 02 Nov 2021 but not on the SEC’s recorded-OLP list
Interest or fees exceed BSP/SEC caps, or are hidden until checkout
App requests SMS, contacts, camera, or location with no obvious need
Debt collectors threaten arrest, publish your name, or spam your contacts
Developer email uses free webmail rather than a corporate domain

5. Remedies if you are victimised

Problem	Where to complain	Legal footing
Unregistered or fake lender	SEC Enforcement & Investor Protection Dept.	RA 9474 §12; MC 19-2019
Harassment / unfair collection	SEC CGFD; PNP Anti-Cybercrime	MC 18-2019; Art. 287 RPC
Privacy breach / contact-list scraping	National Privacy Commission	NPC Circular 20-01
Excessive or hidden charges	SEC, BSP Financial Consumer Assistance Mechanism	RA 3765; BSP Circular 1169 (RA 11765 IRR)

6. Penalties lenders face

Operating without a CA – fine ₱10k–₱50k and/or 6 months–10 years’ imprisonment (RA 9474 §12) (Basics of the Lending Company Regulation Act of 2007 (RA 9474) | Philippine e-Legal Forum)
Violating interest-rate ceilings – up to ₱1 million, 60-day suspension, or CA revocation (SEC MC 3-2022) (SEC implements cap on lending, financing firms’ interest rates | Philippine News Agency)
Unfair debt collection – up to ₱1 million plus licence revocation (MC 18-2019) ([PHILSTAR] SEC issues memorandum on unfair debt collection practices | Credit Information Corporation)
Privacy violations – ₱500k–₱4 million per act and up to 6 years’ jail (DPA §33, NPC Circular 20-01)

7. Recent enforcement snapshots

2023: SEC and Google removed 33 rogue loan apps; total revoked lenders now > 2,000. (SEC removes 33 online lending apps in Google Play Store | Philstar.com)
2022: First full year of the 6 %/15 % interest-cap regime (BSP Circular 1133 + SEC MC 3). (SEC implements cap on lending, financing firms’ interest rates | Philippine News Agency)
2024-2025: NPC’s amended Circular 2022-02 tightened rules on borrower profiling and guarantor data.

8. Quick borrower checklist (print or save)

Search SEC list → company & CA number match?
Look for the app on the recorded-OLP list; check launch date.
Read the disclosure statement – APR, fees, penalties visible?
Compute cost – is it within the 6 % / 15 % / 100 % caps?
Review permissions – deny contacts/location if unnecessary.
Record all communications – screenshots help in a complaint.

9. Take-away

In 2025, legitimacy is no longer guesswork. A lawful Philippine online lender will leave a digital paper-trail across SEC lists, Google Play declarations, AMLC enrolment, transparent cost disclosures, a minimalist privacy policy, and civil collection tactics. Anything less is a signal to walk away—or to report. Using the eight-step test above puts the law squarely on the borrower’s side.