Which loan apps in the Philippines are actually SEC-licensed? (2026)
A legit loan app in the Philippines carries two things: an SEC registration and a live Certificate of Authority (CA). The table below tracks 10 online lending platforms we have checked against the SEC registry, with their CA numbers and where each one stood as of 2026-06-20. Licences change — a company can be granted, suspended, or stripped of its CA at any time — so always re-confirm the current status yourself before you apply. Stick to the names tagged Active. When Aprubado matches you, it only ever points you at lenders that sit on that active list.
Lenders currently cleared by the SEC
Listed by Certificate of Authority number, and every one is something you can re-confirm yourself on the SEC public registry at any moment. Notice that we spell out the operating company alongside the brand — that pairing matters, because copycat apps love to wear a trusted brand name while running under a completely different, often unlicensed, corporate shell.
| Brand | Operating company | CA No. | SEC Reg. | Est. | Status | Max | Term | |
|---|---|---|---|---|---|---|---|---|
| Tala | Tala Financing Philippines, Inc. | #1230 | CS201608780 | 2017 | active | ₱15,000 | 21-61 days | |
| Cashalo | Paloo Financing Inc. | #1162 | CS201729117 | 2018 | active | ₱20,000 | 30-180 days | |
| Home Credit | Home Credit Philippines Inc. | #1099 | CS201307832 | 2013 | active | ₱150,000 | 6-36 months | |
| MoneyCat | MoneyCat Financing Inc. | #2762 | CS201822361 | 2019 | active | ₱20,000 | 90-180 days | |
| JuanHand | WeFund Lending Corp. | #1262 | CS201912590 | 2019 | active | ₱15,000 | 90-180 days | |
| Finbro | SOFI Financing, Inc. | #2868 | CS201817128 | 2018 | active | ₱25,000 | 15-365 days | |
| HoneyLoan | Warm Cash Lending Corp. | #3472 | 2021030009095-02 | 2020 | active | ₱20,000 | 90-180 days | |
| BillEase | First Digital Finance Corporation | #1118 | CS201740118 | 2017 | active | ₱40,000 | 30-180 days | |
| Atome | Atome Financial Philippines, Inc. | #3010 | CS201938201 | 2020 | active | ₱25,000 | 30-90 days | |
| Tonik | Tonik Digital Bank, Inc. | #BSP-licensed | CS202001247 | 2020 | active | ₱250,000 | 12-60 months |
Tala
Cashalo
Home Credit
MoneyCat
JuanHand
Finbro
HoneyLoan
BillEase
Atome
TonikBrand names and logos are shown for identification and comparison only. Each is the property of its respective owner. Aprubado is an independent loan-matching service and is not affiliated with, sponsored by, or endorsed by any listed lender. Always confirm a Certificate of Authority on checkwithsec.sec.gov.ph before applying.
Let us line up licensed lenders for you
Every partner Aprubado connects you with holds an active SEC Certificate of Authority and stays within the BSP MC 1133 s.2021 rate ceilings. One short form, one valid ID, and you can weigh the offers you actually qualify for — no collateral, no co-maker, and the matching is free (libre).
See my matches →The one check that outweighs all the others
The rulebook for non-bank lenders here is Republic Act 9474, the Lending Company Regulation Act of 2007. It is brief but it bites: before anyone can extend consumer or small-business credit, they have to incorporate with the SEC and secure a Certificate of Authority that expressly clears them to lend. Lending without that CA is not a paperwork slip — it is a crime, carrying six months to ten years of imprisonment and fines reaching ₱50,000 for every day the operation runs unauthorized.
It reads like red tape, but in day-to-day terms the CA is the wall between a borrower and a predatory clone. After the SEC and BSP sharpened enforcement in the wake of the December 2025 rate-cap sweep, a wave of unlicensed apps that had been posing as trusted brands were delisted or stripped of their CAs. What you see in the active table above is the landscape once that dust settled.
A properly licensed lender puts its CA number where you can find it — inside the app under About or Legal, down in the website footer, and on whatever print or social ads it runs. A clone either flashes a bogus number or shows none, betting that hardly anyone looks. Looking takes about half a minute, and it is the surest way to sidestep the contact-list scraping, the interest that quietly compounds without disclosure, and the abusive collections that have tarnished the whole sector.
Check any loan app yourself in half a minute
- 1
Dig out the registered company name
Scroll to the app or website footer, or open the About / Legal screen, and find the operator behind the brand. That corporate name — not the catchy label on the splash screen — is what you will search. JuanHand, for instance, traces back to WeFund Lending Corp., while HoneyLoan runs under Warm Cash Lending Corp.
- 2
Head to the SEC look-up tool
Open checkwithsec.sec.gov.ph, the SEC’s own public verification site. It costs nothing to use and its records refresh daily.
- 3
Search using that corporate name
Drop the registered company name into the search field. The record that comes back lists the SEC Registration No., the Certificate of Authority No. (for lending firms), and a status label of Active, Suspended, or Delisted.
- 4
Line the CA numbers up
Compare the CA number in the SEC record against the one printed inside the app or on the site. If they do not match, you are either looking at a company borrowing someone else’s CA to look legitimate, or an app pretending to be a firm it is not.
- 5
Insist on an "Active" reading
Only entities marked Active are cleared to lend. Suspended firms cannot take on new borrowers and delisted ones cannot operate at all. If you see anything other than Active, keep your money and your KYC documents to yourself and report it to the SEC EIPD.
- 6
Scan the advisory board
Finish at sec.gov.ph/advisories to check whether the company has been named in a recent public advisory. These notices frequently land before an official suspension, so a mention there is a strong signal to steer clear.
Eight tell-tale signs an app is running illegally
Learning the shape of a shady app is quicker than running a full check on every single one you meet. The moment any of these show up, pause the application and pull up the operating company on the SEC public registry before you go a step further.
You cannot find an SEC or CA number anywhere on the app or site
R.A. 9474 obliges lenders to display both the SEC registration and the Certificate of Authority. Silence here usually means there is nothing to show.
Signup wants access to your contacts, photos, or file storage
That access exists to scrape phone numbers for later shaming and harassment. The NPC outlawed it in 2021 — a compliant app only needs your camera for ID and SMS for verification.
A GCash "processing fee" is required before the money lands
Legitimate fees come out of the loan proceeds, never as a separate payment you send in advance.
The APR stays hidden until after you agree
SEC MC 19 s.2019 requires the effective interest rate to be disclosed to you before you put your name to anything.
Collection messages carry threats, cursing, or drag in your relatives
SEC MC 18 s.2019 forbids abusive collection outright. Keep the evidence and report it to both the SEC and the NPC.
The brand looks identical to a known lender but the operator company is different
Impersonating a licensed name is a favourite clone tactic. Always match the operator, not the logo, against the SEC record.
An unsolicited "you're pre-approved — tap this link now" arrives by SMS or Facebook DM
Marketing over SMS and social is normal for licensed lenders. What is not normal is a guaranteed-approval promise to someone who never applied, pushed through a shortened link with urgency. The pressure and the link are the tell, not the channel — and this pattern has been a common scam funnel through 2025 and 2026.
Someone asks for your OTP or password "to confirm your account"
A real lender never needs an OTP outside its own app. Hand one over and you have opened the door to SIM-swap fraud and account takeover.
The price ceilings under BSP MC 1133, in plain terms
Borrowing costs swing widely even inside the licensed pool. Bangko Sentral ng Pilipinas Memorandum Circular 1133 s.2021 — first issued in November 2021 and tightened again in 2025 — draws the legal ceiling for small, short-term, unsecured loans:
- Nominal interest: no higher than 6% a month
- Effective interest rate (EIR), fees included: no higher than 15% a month
- Total cost of credit (TCC): capped at 100% of the principal over the entire loan
- Late-payment penalty: no more than 5% a month on whatever is overdue
Those limits cover loans up to ₱10,000 running no longer than a year. Go bigger or longer and SEC MC 3 s.2022 kicks in, which still forces the lender to lay out the APR before you sign — meaning you are always entitled to ask for the figure and to walk if it is withheld.
Charge above these ceilings and an app is either flouting the law or betting you will never complain — often both. Complaining is not complicated: use epd@sec.gov.ph for SEC matters, and complaints@privacy.gov.ph for Data Privacy Act breaches like contact-list scraping.
Being hounded by a collector? Here is your move
The unfair-collection rule, SEC MC 18 s.2019, bars collectors from cursing at you, threatening violence, roping in your relatives or workmates, or reaching out beyond lawful hours of 8am to 9pm. So many of the ugliest online-lending horror stories in the Philippines trace back to collectors who trample these limits while working through a contact list that was scraped the moment you signed up.
If a collector comes after you — or anyone in your phonebook — using those tactics, work through three steps in order:
- Capture everything. Screenshot each message and call log with its timestamp, and hang on to any voicemails.
- Put a stop request in writing. Reply just once, on the same channel: "Please limit contact to me, on this number only, between 8am and 9pm, in line with SEC MC 18 s.2019."
- Take it up the chain. Report to epd@sec.gov.ph for the SEC and complaints@privacy.gov.ph for the NPC. Attach the company name, your loan reference, and all the evidence you gathered.
Questions borrowers keep asking
When people say a loan app is "SEC-registered," what are they really describing?+
There are two documents, and both have to exist. Republic Act 9474 — the Lending Company Regulation Act of 2007 — says any business that lends money in the Philippines has to first be incorporated with the Securities and Exchange Commission, and then separately earn a Certificate of Authority (CA) that specifically permits it to run as a lending company. Think of the incorporation as being allowed to exist and the CA as being allowed to lend. A company can be a registered corporation and still have no legal right to hand out loans, because the CA is the piece that unlocks that. So "SEC-registered" without a live CA number is only half the story.
Where do I actually look up a Certificate of Authority?+
Two official sources: the SEC public look-up at checkwithsec.sec.gov.ph, and the published lending-and-financing roster at sec.gov.ph/lending-companies-and-financing-companies-2/. The trick is to search using the registered corporate name, not the brand splashed across the app store listing — they are frequently different. Once you find the record, line up the CA number with the one the app shows and make sure the entry reads "Active." Anything tagged suspended or delisted has no legal footing to collect from you, and if such a company is chasing you for payment, take it straight to the SEC Enforcement and Investor Protection Department.
How much are licensed apps allowed to charge?+
For small, short-term, unsecured loans — ₱10,000 or below, repaid within a year — Bangko Sentral ng Pilipinas Memorandum Circular 1133 s.2021 draws a hard ceiling: no more than 6% nominal interest a month, no more than a 15% effective monthly interest rate once fees are folded in, and no more than 100% total cost of credit over the whole loan. Anything bigger or longer falls under SEC MC 3 s.2022, which still forces the lender to spell out the APR before you commit. If the number is not shown, ask; if it is refused, walk.
What does a "delisted" tag actually signal?+
It means the SEC pulled the plug — usually because the company blew past the BSP rate ceilings, mishandled personal data under the Data Privacy Act (R.A. 10173), or broke the debt-collection rules in SEC MC 18 s.2019. Being delisted rarely stops the bad actors: many resurface as clone apps or rebranded fronts and keep operating illegally. Treat a delisted name as radioactive — do not pay it, do not send it your ID or documents. If you run into one, flag it to the SEC EIPD or ring (632) 8818-5476.
Are foreign lenders allowed to operate here?+
Not directly. R.A. 9474 requires the lending entity itself to be incorporated under Philippine law. The internationally-known names you see — Tala, Cashalo and the like — run through Philippine-incorporated companies that carry their own CA. If an app pitches itself as "international" yet cannot produce a local SEC registration and a matching CA, that is not a technicality; it is unlicensed lending.
Is being asked to pay a fee before the money arrives normal?+
No — it is one of the loudest warning signs. SEC MC 19 s.2019 requires every charge to be written into the loan agreement and taken out of the amount disbursed, never collected on the side before approval. The classic scam pattern is a "processing" or "release" fee demanded through GCash to a personal account rather than a company one. A real licensed lender nets fees from your proceeds; it does not ask you to pre-pay a stranger.
How current is the roster on this page?+
Every row gets re-checked against the SEC public registry on a monthly cycle, and anything material — a fresh suspension, a delisting, a newly granted CA — is folded in within about a week of the change. The "Last updated" stamp near the top of the page always reflects the latest pass, so you can gauge how recent the data is at a glance.
Does Aprubado hold its own Certificate of Authority?+
No, and it should not need one. Aprubado does not lend money, does not set your interest rate, and does not decide your terms — it is a free service that matches you with partner lenders. Because it is not a lending company under R.A. 9474, a Certificate of Authority does not apply to it. What Aprubado does guarantee is that the partners it introduces you to each carry an active SEC CA, so every offer you are shown traces back to a lender you can independently confirm on the SEC registry.
Sources drawn on: the SEC public lending registry (checkwithsec.sec.gov.ph and sec.gov.ph/lending-companies-and-financing-companies-2/), BSP Memorandum Circulars 1133 s.2021 and 3 s.2022, and NPC Circular 2022-02. Cross-checked by hand by the Aprubado editorial team on 2026-06-20. Treat this page as background information, not legal or financial advice. Only proceed with a lender whose CA you have confirmed for yourself. Questions or corrections? Reach us at general@virixlabs.com.