Background

The Reserve Bank of India (RBI) has issued the Digital Lending Directions under the recommendations of the “Working Group on Digital Lending”. Digital lending refers to the process of disbursing loans digitally, replacing the traditional system of approaching banks in person. While the majority of the directions are being enforced immediately, the directions relating to multiple lenders shall come into effect from 1 November 2025, and the reporting of Digital lending applications to the RBI shall come into effect from 15 June 2025.

The directions primarily regulate the Regulated Entities (RE), including Commercial Banks, Co-operative Banks, Non-Banking Financial Companies (NBFCs), and All India Financial Institutions. Important terms of Digital Lending, Digital Lending Apps/Platforms (DLAs), and Lending Service Provider (LSP) are defined in the newer directions.

Key Provisions of the Directions

1. RE-LSP Arrangements

   1. Due Diligence: REs must execute contractual agreements with LSPs, conduct enhanced due diligence (technical capabilities, data privacy, compliance), and periodically review LSP conduct.
   2. Multiple Lenders: LSPs working with multiple REs must display all matching loan offers on DLAs, including RE names, loan details, APR, and Key Facts Statement (KFS) links, ensuring unbiased presentation without deceptive patterns.
   3. RE Responsibility: REs remain fully liable for LSP actions, adhering to outsourcing guidelines.

2. Assessing Creditworthiness and Disclosure to Borrowers

   1. RE shall obtain information relating to the economic profile of the borrower to assess the borrower’s creditworthiness before extending the loan, and RE shall ensure that no automatic increase in credit limit occurs unless, any request for the same is received.
   2. RE shall ensure that Key Fact Statements, summary of loan product, penal charges, terms, and conditions shall automatically flow to the borrower on the registered and verified email/SMS upon execution of the loan contract.

3. Cooling-Off Period

   Borrowers can exit a digital loan by paying the principal and proportionate Annual Percentage Rate (APR) without any penalty during an initial cooling-off period.

4. Mode of Disbursal/Repayment

   Loans must be disbursed to borrowers’ bank accounts, with repayments directly to the RE accounts. Any third-party involvement shall be excluded. Any fees to be paid to the LSP’s shall be paid by the RE’s and not by the borrowers.

5. Grievance Redressal

   Both the RE and LSP shall designate nodal grievance redressal officers to deal with complaints/issues raised by the borrower.

6. Technology and Data Requirements

   1. Data Collection: DLAs require explicit borrower consent for need-based data collection, prohibiting access to mobile resources (e.g., contacts, media) except for one-time KYC needs. Borrowers can deny, revoke, or request data deletion.
   2. Data Storage: LSPs store minimal borrower data; REs are responsible for privacy. Data must be stored in India, with offshore-processed data returned within 24 hours. Biometric data storage is prohibited unless legally permitted.
   3. Privacy Policy: REs and LSPs must maintain and publicly disclose comprehensive privacy policies compliant with laws and RBI guidelines.
   4. Technology Standards: Compliance with RBI and other agencies’ cybersecurity standards is mandatory.

7. Reporting Requirements

   1. Credit Information Companies (CICs): REs must report all digital lending transactions, including short-term or deferred payment products, to CICs.
   2. DLA Reporting: REs must report all DLAs (own or LSP-operated) on RBI’s CIMS portal by 15 June 2025, with updates for changes. Chief Compliance Officers certify compliance, and data is published on RBI’s website without verification. Reporting does not imply RBI endorsement.

8. Default Loss Guarantee (DLG) Providers

   RE may enter into DLG arrangements only with a LSP/other RE engaged as an LSP and shall comply with the relevant Due Diligence requirements.