Compliance & Regulation

RBI Digital Lending Guidelines: What a Lending App Must Do

Key fact statements, direct fund flows, cooling-off, app permissions, data storage, multi-lender disclosure and app reporting. RBI's digital lending rules as product requirements.

Purushottam Kumar Suman
Purushottam Kumar Suman
Founder & CEO, Drema AI
9 min read
Financial paperwork and calculator

RBI first issued digital lending guidelines in September 2022 and replaced them with the Reserve Bank of India (Digital Lending) Directions in May 2025. In late 2025 RBI reorganised its rulebook into consolidated directions by type of regulated entity, so paragraph numbers have moved, but the requirements below carry through. They apply to banks and NBFCs, and through them to every loan service provider and lending app.

01

Who is who

The rules use three terms that decide who is responsible for what.

Regulated entity (RE)The bank or NBFC that lends. It carries responsibility for everything done in its name
Loan service provider (LSP)An agent of the RE that helps with sourcing, underwriting support, servicing or recovery
Digital lending app (DLA)The mobile or web app, owned by the RE or by an LSP, through which loans are offered
02

Disclosure before the loan

The borrower must see the full cost before accepting, and must know who the lender is.

Key fact statementIn the standard format, with the annual percentage rate including all charges, shown before the borrower accepts
Lender identityThe RE's name displayed prominently in the app
Digitally signed documentsKFS, sanction letter, terms and privacy policy sent to the borrower's verified email or SMS on execution
No hidden chargesAnything not in the KFS cannot be charged
Credit limit increasesOnly with the borrower's explicit consent
03

Money flows

Loans must be disbursed directly into the borrower's bank account, and repayments must go directly into the RE's account. Funds cannot pass through an LSP's account or a pool account. Fees to the LSP are paid by the RE, not charged to the borrower. Limited exceptions exist, such as disbursals covered by specific statutory or regulatory mandates, co-lending flows and loans for a specified end use where money goes to the end beneficiary.

If the money touches the LSP's account on the way, the product design is wrong.

04

Cooling-off period

Borrowers get a cooling-off period to exit the loan by repaying principal and the proportionate annual percentage rate, with no penalty. The period is set by the lender's board, cannot be less than one day and has to be disclosed in the key fact statement. A reasonable one-time processing fee may be retained if disclosed. In the app this needs a visible exit option and a calculation of the amount due.

05

Data and app permissions

Data collection has to be need-based, with explicit consent and an audit trail.

Blocked accessNo access to files and media, contact lists, call logs or telephony functions
One-time accessCamera, microphone and location only for onboarding or KYC, with explicit consent
Consent choicesThe borrower can deny consent for specific data, restrict sharing with third parties, withdraw consent and ask for deletion
Storage in IndiaData stored on servers in India; data processed abroad is deleted there and brought back within 24 hours
Minimal storage by LSPsOnly basic details needed to service the loan; no biometric data stored by the app
Privacy policyPublic, and listing third parties who may receive data
06

Multi-lender platforms

Where an LSP works with several lenders, the app must show the borrower a digital view of all the loan offers matching the request from the lenders it has arrangements with, including each lender's name, amount, tenor, annual percentage rate, repayment terms and a link to the key fact statement. It must also name the lenders whose offers did not match. The display has to be unbiased: no dark patterns that push one lender.

07

Reporting, grievances and guarantees

Three further requirements affect operations.

App reportingREs report every DLA they use on RBI's CIMS portal; RBI publishes a public directory so borrowers can check whether an app is linked to a regulated lender
Grievance redressalA nodal grievance officer for the RE and each LSP dealing with borrowers, shown in the app; unresolved complaints after 30 days can go to RBI's ombudsman
Credit bureau reportingAll loans through DLAs reported to credit information companies, including short-tenor and pay-later products
Default loss guaranteeCapped at five per cent of the loan portfolio, in permitted forms, with disclosure
KFS first
Before the borrower accepts
1 day
Minimum cooling-off period
5%
Cap on default loss guarantee
Sources · last reviewed October 1, 2026

This article explains what to build, not legal advice. Rules change; confirm against the current official text before relying on it.

Purushottam Kumar Suman
Written by
Purushottam Kumar Suman
Founder & CEO, Drema AI

Founder and CEO of Drema AI. Builds AI systems, SaaS platforms and industry software — and writes about what actually survives production.

CTA Background

Got a problem like this one?

Bring it to a call with a founder.You will get a straight answer, including when the answer is no.

View Our Work
AI-First Engineering
Secure & Scalable
Built to Deliver Impact