SEC Lifts the Online Lending Platform Moratorium: What Changes Under MC 20-2026

On August 1, 2026, the SEC reopens registration for online lending platforms (OLPs) for the first time in almost five years. SEC Memorandum Circular No. 20, Series of 2026 (MC 20-2026), signed July 7, replaces the moratorium the Commission imposed under MC No. 10, Series of 2021, with a new SEC online lending rules framework: tiered paid-up capital requirements, a single Certificate of Authority, stricter disclosure standards, and firmer market-conduct rules for financing companies (FCs) and lending companies (LCs) that operate OLPs.

If your business already runs an OLP, plans to launch one, or borrows from one, this changes what needs to be in place, and by when.

What Changed Under MC 20-2026

MC 20-2026 ties paid-up capital directly to how many platforms a company operates. No FC or LC may own, operate, or control more than five OLPs. Alongside the capital tiers, MC 20-2026 introduces:

• A single Certificate of Authority per entity, covering the principal office, all branches, and all platforms, replacing the practice of securing separate approvals per app or branch.
• A requirement that loan proceeds cannot be released, whether automated or system-initiated, without the borrower’s explicit and informed confirmation of the final loan terms. Auto-disbursement and auto-renewal without that confirmation are no longer allowed.
• A restriction on contact-list use in collection. A borrower’s phone contacts cannot be treated as guarantors or pursued for payment unless those specific individuals gave written consent to that role.
• A requirement for every registered OLP’s website, mobile app, domain, and platform link to be disclosed and recorded with the SEC, closing a gap that let unregistered apps operate under the radar.

Existing FCs and LCs are not required to adjust their capital immediately if they keep their current platform count. If they plan to expand, they have one year from MC 20-2026’s effectivity to meet the new tiers, or they need to reduce their platforms to match their existing capital.

Why the SEC Tightened Online Lending Rules Instead of Just Reopening the Market

The moratorium under MC No. 10, Series of 2021, was a response to years of harassment and contact-list abuse by early online lenders. Lifting it without a stronger framework would have reopened the same risk. SEC Chairperson Francis Lim framed the new circular as a trade-off: the Commission welcomes and promotes financial innovation but will not tolerate the proliferation of predatory and unfair lending practices.

That framing shows up directly in the rules. The contact-list restriction builds on protections already in place under the SEC’s existing unfair debt collection rules and the Data Privacy Act of 2012 (RA 10173), and the five-platform cap targets a specific evasion pattern: companies running dozens of near-identical apps to dodge bad reviews or SEC scrutiny on any single one. The capital tiers make platform expansion a genuine balance-sheet decision rather than a matter of spinning up another app.

What This Means for Your Business

This announcement lands differently depending on which side of the loan a business sits on. It is worth being specific about both.

For OLP Operators and Fintech Lenders

The capital tiers are no longer a formality; they are a funding decision. A lending company running two platforms and planning a third needs ₱30 million in paid-up capital before it can add that platform, not after. That number belongs in the next fundraising conversation, not in a compliance checklist reviewed the week before launch. A financing company scaling from one OLP to five needs to plan for ₱100 million in paid-up capital, a five-times jump that changes how founders should be pitching runway to investors.

Single Certificate of Authority consolidation is not optional bookkeeping. Any FC or LC still holding separate approvals per branch or app needs those consolidated into one CA, and any platform not formally disclosed to the SEC under that CA is now at risk of delisting, not just a late paperwork flag.

The consent and collection rules carry the sharpest immediate exposure. A platform with an automated, instant-approval disbursement flow is non-compliant on day one unless it adds an explicit borrower confirmation step before funds move.

This is a common pattern with growth-stage lending platforms built to optimize approval speed, and it now needs to be rebuilt as a compliance requirement, not treated as a UX preference. The same applies to collection: any script or process that still pulls from a borrower’s full contact list, rather than named guarantors or co-makers with signed consent, is now a direct violation, not a gray area.

For SME Borrowers Using Online Credit

The protections run the other way for businesses that borrow through OLPs rather than operate one. A lender cannot release loan proceeds, whether the disbursement is manual or automated, without the borrower’s explicit confirmation of the final terms. A business that finds funds released without that confirmation step has a legitimate compliance complaint, not just a customer service issue.

The contact-list protection is enforceable, not aspirational. If a lender contacts an SME owner’s staff, suppliers, or personal contacts to collect on a loan, and those individuals never signed written consent to act as guarantors, that is a violation the business can raise directly with the SEC’s Financing and Lending Companies Department. Businesses that have felt cornered by aggressive collection tactics from an OLP now have a specific rule to point to, not a general appeal to fairness.

What to Do Before August 1 (For OLP Operators and Lenders)

1. Count live OLPs against the capital table above, and confirm paid-up capital already meets, or is on track to meet, the tier for the current or planned platform count.
2. Confirm a single Certificate of Authority is held or applied for. Platforms still operating under separate approvals need to be consolidated.
3. Audit the loan disbursement flow for auto-release or auto-renewal steps that skip explicit borrower confirmation of final terms.
4. Review collection scripts and contact-list use. Anyone treated as a guarantor without signed, written consent is a violation under the new rules.
5. Confirm every OLP’s website, app, and domain is disclosed and recorded with the SEC under the Certificate of Authority.

What to Check as a Borrower

1. Confirm the lender showed the complete loan terms, principal, interest, fees, penalties, and repayment schedule, before releasing funds, and that active confirmation was required before any money moved.
2. Confirm no listed contact, staff, family, or suppliers, is being pursued as a guarantor unless that specific person signed written consent to take on that role.
3. If a lender is already contacting people who never agreed to that role, that is a specific, reportable violation under MC 20-2026, not something to tolerate as normal collection practice. It can be raised directly with the SEC’s Financing and Lending Companies Department.

Getting This Right Before the Deadline

A capital shortfall, an undisclosed platform, or a collection process still built around the old rules is the kind of gap that surfaces during SEC review, not before. With MC 20-2026 taking effect August 1, the businesses that come out ahead are the ones treating this as a compliance project now rather than a scramble once applications open.

CloudCFO works with growth-stage fintech and lending clients on exactly this kind of regulatory transition, from mapping capital requirements against platform plans to tightening the financial reporting that sits behind a Certificate of Authority application. If a business operates or is planning an OLP and wants a second set of eyes on where it stands against MC 20-2026 before August 1, get in touch with CloudCFO today.