Debt-Collection Practices Allowed for Online Lending Apps in the Philippines
(A comprehensive legal primer as of 24 April 2025 – prepared without external web searches)
1. Regulatory Map
| Regulator | Scope vis-à-vis Online Lending Apps (OLAs) | Key Issuances |
|---|---|---|
| Securities and Exchange Commission (SEC) | All “lending companies” and “financing companies” that are not banks or quasi-banks | – Republic Act 9474 (Lending Company Regulation Act, 2007) – MC 18-2019 (Prohibition on Unfair Debt-Collection) – MC 19-2019 (Registration & Disclosure Rules for OLAs) – MC 28-2020 (Enhanced Notification - beneficial ownership & online platforms) – MC 10-2021 & subsequent enforcement directives suspending or revoking abusive OLAs |
| Bangko Sentral ng Pilipinas (BSP) | Banks, NBQBs, electronic-money issuers and their outsourced collection agents | – Circular 1133-2021 (Outsourcing Guidelines; fair-treatment clause) – Circulars 1160-2023 & 1170-2024 (implementing RA 11765 for BSP-supervised FIs) |
| Department of Trade and Industry (DTI) | Consumer complaints & deceptive acts for entities outside SEC/BSP jurisdiction | – Joint DTI-DOJ AO 01-08 (Unfair Sales Acts) |
| National Privacy Commission (NPC) | Data collection, contact list scraping, disclosure of debtor data | – R.A. 10173 (Data Privacy Act, 2012) – NPC Advisories on OLAs (2019-2024) |
| Credit Information Corporation (CIC) | Credit data submission & access by OLAs | – R.A. 9510 & its IRR |
2. Statutory & Regulatory Touchstones on Collection Conduct
R.A. 11765 Financial Products and Services Consumer Protection Act (FPSCPA, 2022)
General clause (Sec. 4-b) forbids “harassing, oppressive, or abusive collection”.
– For SEC entities: Draft IRR (2023) echoes SEC-MC 18 thresholds and adds penalties up to ₱2 million/day plus disgorgement.
– For BSP entities: Circular 1166-2024 requires board-approved Fair Collections Policy and risk-based audits.SEC Memorandum Circular 18-2019 (still the most detailed bright-line test for OLAs)
Allowed:
a) Direct communication only with the borrower (or a court-appointed representative), via:
– Phone call, SMS, e-mail, in-app message, or registered mail
– Weekdays 8 AM-5 PM Philippine time (Saturday/Sunday/holiday contact requires written borrower consent)
b) Use of third-party collection agents registered with the SEC and identified to the borrower in writing.
c) Filing civil actions, barangay conciliation, or small-claims suits.Prohibited:
– Contacting people in the borrower’s phone-book without prior separate consent.
– Threats of arrest, violence, or public shaming (e.g., posting the debt on social media or group chats).
– Profanity, coercion, or repeated calls that “tend to harass or abuse”.
– False representation as a government officer or law-enforcement agent.
– Collection of amounts not expressly authorised in the loan agreement (e.g., “collection processing fee”).Data Privacy Act 2012 (R.A. 10173) & NPC Guidance
– Lawful basis: OLAs may process only data necessary to assess creditworthiness and service the loan.
– Excessive permissioning (blanket access to contacts, photos, SMS) violates the principle of proportionality.
– Unauthorized disclosure of a borrower’s debt to third parties is punishable by up to 5 years’ imprisonment and/or ₱4 million fine (Sec. 31).Consumer Act (R.A. 7394) & Truth-in-Lending (R.A. 3765)
– Lenders must disclose finance charge, APR, penalty rate, and collection fees up front; undisclosed fees are unenforceable.Revised Penal Code & Cybercrime Prevention Act (R.A. 10175)
– Defamation, unjust vexation (Art. 287), grave threats (Art. 282), or cyber-harassment committed in the course of collecting a debt are criminal offences independent of the loan.
3. Permitted Collection Workflow for a Compliant OLA
| Stage | What an Online Lender May Do | Typical Documents |
|---|---|---|
| 1. Pre-collection (1–14 days past due) | – Generate automated in-app reminders and SMS/email to borrower only. – Apply agreed late interest and penalty (if transparently disclosed). |
System logs; timestamped notices |
| 2. Soft collection (15–59 days) | – Live phone calls by trained in-house staff during allowed hours. – Provide borrower with re-payment options or official restructuring offer. |
Call recordings; Restructuring agreement |
| 3. Third-party engagement (≥ 60 days) | – Endorse to an SEC-registered collection agency and email borrower a Notice of Assignment (containing agency name, SEC CA number, and how data will be used). | Endorsement contract; Notice of Assignment |
| 4. Formal demand | – Serve a Notarial Demand Letter or Small Claims Form (for ≤ ₱400,000 under A.M. 08-8-7-SC, as amended 2022). | Proof of mailing or personal service |
| 5. Legal action | – File barangay conciliation (if within same city/municipality and claim ≤ ₱400k). – Escalate to MTC/RTC civil suit or request writ of execution once judgment obtained. |
Court pleadings; Compromise agreement |
| 6. Post-judgment | – Enforce judgment via sheriff levy, garnishment, or by offsetting deposits (for BSP-supervised entities with a set-off clause). | Sheriff’s return; Garnishment order |
Throughout, the OLA must maintain an internal Complaints-Handling Unit and log every attempt at contact for at least five (5) years, per FPSCPA IRR.
4. Contact-Hour Matrix (Quick Reference)
| Day | Call/SMS/E-mail Window Without Special Consent |
|---|---|
| Monday–Friday | 08:00 – 17:00 |
| Saturday/Sunday | Not allowed, unless the loan agreement and a separate opt-in expressly permit it |
| Public Holidays | Not allowed |
| At the workplace | Permissible only if the borrower supplied the workplace number and marked it as an alternate contact |
5. Lawful Content of Debt-Collection Messages
- Identify the caller (company name, SEC Registration & CA number).
- State the exact amount due, itemising principal, interest, and penalties.
- Specify the due date or the date the obligation fell into default.
- Offer remedies, e.g., “You may settle via in-app payment, accredited e-wallet or any LandBank branch.”
- Describe consequences strictly limited to contractual or legal rights (e.g., credit-bureau reporting, small-claims filing).
- Provide a channel for disputes (e-mail/phone of Complaints-Handling Officer).
Anything beyond these—particularly threats of arrest, public humiliation, or contacting relatives—breaches SEC-MC 18 and may trigger Data Privacy and criminal liabilities.
6. Data-Privacy-Compliant Use of the Borrower’s Contact List
| Action | Status under DPA & NPC Advisories |
|---|---|
| Requesting granular consent to access contacts only to auto-fill referee fields | ❏ Allowed (must be opt-in and revocable) |
| Uploading whole contact list to cloud for “skip-tracing” | ✗ Prohibited – excessive data collection |
| Sending payment reminders to listed “co-makers” recorded in the loan contract | ❏ Allowed (they are parties) |
| Mass-texting or calling all contacts | ✗ Prohibited – no lawful basis, violates Sec. 25 DPA |
| Posting borrower’s photo/debt on Facebook group chats | ✗ Prohibited – unauthorised disclosure + potential cyber-libel |
7. Penalties for Non-Compliant OLAs
| Regulator | Range of Sanctions |
|---|---|
| SEC | Suspension or revocation of Certificate of Authority, up to ₱1 million per offence, and monetary penalties equal to actual damages + disgorgement of profits. |
| NPC | Cease-and-desist order, ₱500 k–₱5 million per act + imprisonment of responsible officers. |
| BSP | Monetary penalties (tiered up to ₱30 million for a major bank), restitution to borrowers, public reprimand of directors. |
| Courts | Actual, moral and exemplary damages; attorney’s fees; imprisonment for criminal cyber-libel/harassment. |
8. Borrower Defences & Remedies
- File a written complaint with the SEC Corporate Governance and Finance Department (cgfd@sec.gov.ph), attaching screen-shots and call recordings.
- Elevate to the NPC if the issue concerns data privacy.
- Seek barangay conciliation for loan amounts within the Katarungang Pambarangay jurisdiction (≤ ₱400k).
- Small-Claims action to dispute unauthorised charges or abusive fees (no lawyers required).
- Criminal complaint (Art. 355 or Art. 287 RPC, or Sec. 4(c)(4) R.A. 10175) at the city prosecutor’s office.
- Report to the BSP-Consumer Assistance Mechanism if the collector is a bank/NBQB.
Note: Nothing prevents a borrower from paying a legitimate debt; these defences target only collection misconduct.
9. Best-Practice Checklist for OLA Compliance Teams (2025 Edition)
| # | Control | Implementation Tip |
|---|---|---|
| 1 | Fair Collections Policy | Board-approved, incorporates SEC-MC 18 & RA 11765, reviewed annually |
| 2 | Contact-Hours Dialer Logic | Auto-blocks dial outs beyond 17:00 or on PH holidays |
| 3 | Consent Vault | Machine-readable records of data-subject consents & revocations |
| 4 | Script Library | Pre-approved call/SMS scripts; profanity filter embedded |
| 5 | Third-Party On-boarding | Vendor due diligence checklist, SEC CA verification, NPC Registration |
| 6 | Complaints MI | Monthly dashboard to senior management; threshold for escalation to SEC |
| 7 | Secure Data Handling | End-to-end encryption, role-based access; contacts never stored in plain text |
| 8 | Training & Certification | Collectors pass annual test on DPA & anti-harassment laws |
| 9 | Audit Trails | Immutable logs kept ≥ 5 years, accessible to regulators within 72 hours |
| 10 | Consumer-Friendly UI | In-app “Repayment” and “Help” buttons prominently displayed |
10. Concluding Insights
The Philippine regime has moved from light-touch (pre-2019) to rule-bound consumer protection (2019-2025). SEC Memorandum Circular 18-2019 remains the backbone, but R.A. 11765 widens the net—any entity offering financial products or services digitally now faces unified standards.
For an online lending app, permitted collection boils down to three principles: consent-based communication, proportional data use, and truthful, civil interactions. Any deviation—especially the once-common “contact-all-your-friends” tactic—now invites swift multi-agency enforcement.
Borrowers, for their part, must remember: liability to pay a valid debt endures, but they are never obliged to endure harassment or privacy intrusions. Legitimate courts, not the court of social media, remain the final arbiter of unpaid loans.
Prepared 24 April 2025, Manila. This article is for general information only and does not constitute legal advice.