SEC Unfair Debt Collection Practices: What Financing and Lending Companies Must Know (2026 Update)

A lending company’s in-house collector sends a text to a delinquent borrower’s uncle, asking him to “help remind” his nephew about an overdue loan. No threats, no insults, nothing that looks like harassment. Under SEC rules, it’s still a violation, and one that regularly costs financing and lending companies real money.

This is one of the most common ways SEC Memorandum Circular No. 18, Series of 2019 (MC 18-2019) gets triggered, and it’s rarely intentional. Since then, the rules around it have layered further: a 2023 circular now pairs with MC 18-2019 in almost every enforcement case, and a 2026 update tightens the standard even more for companies operating online lending platforms.

What’s Actually Happening

MC 18-2019, issued in August 2019, prohibits financing companies (FCs), lending companies (LCs), and their third-party service providers from using unfair, deceptive, or abusive means to collect debts, whether the company collects directly or through an outsourced agency. The circular lists specific prohibited acts:

• Using or threatening violence or other criminal means to harm a person, their reputation, or property
• Threatening illegal action
• Using obscene, insulting, or profane language that amounts to abuse or a criminal offense
• Publicly disclosing a borrower’s name or personal information over an unpaid debt, subject to narrow exceptions
• Communicating false or misleading information about a loan
• Using deception or false representation to collect a debt or obtain a borrower’s information
• Contacting a borrower outside reasonable hours, before 6am or after 10pm, unless the debt is more than 15 days overdue or the borrower gave written, electronic, or recorded consent
• Contacting anyone in a borrower’s contact list other than those named as guarantors or co-makers

Since 2023, a second layer applies on top of MC 18-2019. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act (FCPA), took effect that year, and the SEC issued its implementing rules under SEC Memorandum Circular No. 5, Series of 2023 (MC 5-2023). SEC enforcement orders now routinely cite both circulars for the same conduct: MC 18-2019 for the unfair debt collection practice itself, and MC 5-2023 for the same act as an “abusive debt recovery practice” under the FCPA.

If the FC or LC operates an online lending platform (OLP), a third layer applies. SEC Memorandum Circular No. 20, Series of 2026 (MC 20-2026), effective August 1, 2026, goes further than MC 18-2019’s blanket rule against contacting non-guarantor contacts. It requires that anyone treated as a guarantor for collection purposes, even someone the borrower listed, must have given specific written consent to that role.

What People Get Wrong

• Assuming the borrower’s consent covers it. In a 2021 case against Familyhan Credit Corp., the SEC made clear that contacting a borrower’s phone contacts who weren’t named as guarantors or co-makers is a violation regardless of the borrower’s consent. Consent from the borrower does not extend to third parties who never agreed to be involved.
• Assuming outsourcing shifts the liability. MC 18-2019 does not prohibit hiring a third-party collection agency, but any agency engaged is treated as an agent of the FC or LC. Ultimate responsibility for compliance stays with the company, not the agency.
• Treating a first violation as minor. Recent orders show first-offense fines of ₱50,000 for financing companies, alongside mandatory reviews of collection policy and compliance reporting, not just a fine to absorb and move on from.
• Assuming this is only a debt collection issue. SEC has combined MC 18-2019 findings with other violations in the same case, including Truth in Lending Act (RA 3765) disclosure failures, which can escalate a fine into a revoked Certificate of Authority.

Confidentiality Rules Still Apply

MC 18-2019 requires FCs and LCs to keep borrower information confidential, with a narrow set of exceptions. Information can be disclosed where:

• The borrower has given written or recorded consent
• It’s shared with other financial institutions, credit information bureaus, lenders, or their agents
• It’s required by a court order or a government agency authorized by law
• It’s disclosed to an agent of the FC or LC to enforce rights against the borrower
• It’s disclosed to a third-party service provider assisting the FC or LC’s financing or lending operations
• It’s disclosed to an insurer for the purpose of insuring against the borrower’s default or fraud

Outside these exceptions, borrower information stays confidential, in-house and with any third-party provider.

Practical Breakdown by Scenario

Traditional financing and lending companies without an OLP: MC 18-2019 and MC 5-2023 apply directly. Every collection script, whether used in-house or by a third-party provider, needs to be checked against the prohibited-acts list and the FCPA’s abusive-practice standard, since a single incident can trigger findings under both circulars at once.

Companies operating an online lending platform: The same base rules apply, plus MC 20-2026’s written-consent requirement for anyone contacted as a guarantor, and its rule that loan proceeds cannot be released without the borrower’s explicit confirmation of final terms. A collection process built years ago around MC 18-2019 alone is very likely no longer sufficient on its own.

Companies using third-party collection agencies: The contract with the agency should confirm, in writing, that the FC or LC retains ultimate responsibility, and that the agency’s staff are held to the same disclosure and confidentiality standards. Collectors must disclose their full name and true identity to the borrower, whether in-house or third-party.

What to Actually Do

1. Audit every current collection script against MC 18-2019’s prohibited-acts list and MC 5-2023’s abusive-practice standard, not just the older circular alone.
2. Confirm no collection process treats a borrower’s consent as sufficient grounds for contacting non-guarantor, non-co-maker contacts. It isn’t.
3. Review third-party collection agency contracts to confirm liability and compliance obligations are documented, since the agency’s conduct is still attributed to the company.
4. If operating an OLP, layer in MC 20-2026’s written-consent standard for any contact treated as guarantor, and confirm the loan disbursement process requires explicit borrower confirmation before funds move.
5. Confirm the required sworn certification, signed by the President or CEO and the Compliance Officer, is current and reflects actual practices, not a template filed once at registration.
6. Maintain a functioning customer service function to handle borrower complaints, as required under MC 18-2019.

Getting the Full Picture Before It Costs You

A single contact-list slip can now trigger findings under two circulars at once, and a third if the company also operates an OLP. Fines start at ₱25,000 to ₱50,000 for a first offense, rise to ₱50,000 to ₱100,000 for a second, and on a third violation the SEC can impose a fine of up to ₱1,000,000, suspend operations for up to 60 days, or revoke the Certificate of Authority entirely.

CloudCFO works with financing and lending company clients on aligning collection policy, third-party agency contracts, and compliance certifications with the SEC’s current rules, not just the ones in place when a company first registered. If a business wants a compliance review against MC 18-2019, MC 5-2023, and, where relevant, MC 20-2026, get in touch with CloudCFO today.