Research and Articles

Introduction

On May 8, 2025, the Reserve Bank of India (“RBI”) introduced the Digital Lending Directions, 2025 (“DL Directions”), thus consolidating the regulatory landscape for digital lending in India. These Directions supersede the following prior frameworks:

• Loans Sourced by Banks and NBFCs over Digital Lending Platforms: Adherence to Fair Practices Code and Outsourcing Guidelines, 2020;

• Guidelines on Digital Lending, 2022 (“DL Guidelines 2022”); and

• Guidelines on Default Loss Guarantee in Digital Lending, 2023 (“DLG Guidelines 2023”).

By unifying these earlier guidelines, the DL Directions aim to enhance transparency, customer protection, and responsible lending practices in the growing digital lending ecosystem.

Applicability

The DL Directions apply to “all digital lending activities” undertaken by Regulated Entities (“REs”)such as banks and non-bank financial companies. These activities are typically facilitated through mobile or web-based platforms. In this context, it is important to understand the meaning assigned to two key terms under the DL Directions: (i)Digital Lending and (ii) Digital Lending Application.

• Digital Lending: Digital Lending is defined as a remote, automated lending process that leverages seamless digital technologies for the following - customer acquisition, credit assessment, loan approval, disbursement, repayment, recovery, and ongoing customer service.

• Digital Lending Application: Such lending is carried out through Digital Lending Applications(“DLAs”), which are mobile or web-based platforms that may operate independently or as part of a broader application interface. DLAs may be operated either by the RE itself or by a Lending Service Provider (“LSP”) of the RE.

Key Stakeholders

• Regulated Entities (“RE”) : REs under the DL Directions include (i) commercial banks; (ii) primary (urban) co-operative banks, state co-operative banks, central co-operative banks; (iii) non-bank financial companies (including housing finance companies); and (iv) all-India financial institutions.

• Lending Service Provider (“LSP”): An LSP is an “agent” of the RE engaged to perform one or more digital lending functions or part thereof. These functions include customer acquisition, services incidental to underwriting and pricing, servicing, monitoring, recovery of specific loan or loan portfolio.

These functions must be provided in compliance with the RBI’s extant outsourcing guidelines. Notably, another RE may also act as an LSP to the primary lending RE. 

1. DIGITAL LENDING

Fund Flows

The DL Directions mandate that the flow of funds must remain strictly between the RE and the borrower, with no control—direct or indirect—exercised by the LSP or any third party. The flow of funds is described below:¹

From RE to the borrower:

Loan disbursals must be made directly to the borrower’s bank account, except in the following cases:

• Disbursals under statutory or regulatory mandates,

• Co-lending arrangements between REs,

• Loans with specific end-use, where funds are credited to the end-beneficiary’s account, and

Disbursal to third-party accounts, including those of LSPs, is prohibited unless expressly permitted under the Directions.

From borrower to the RE:

Borrowers must make repayments directly to the RE’s bank account. Use of pass-through or pool accounts maintained by third parties (including LSPs) is not permitted. However, an exemption is provided in case of delinquent loans which may be recovered by the RE through physical interface, and such recovery may be made in cash, wherever necessary. In such cases, the requirement for repayment to be made to the RE’s bank account does not apply. However, any cash recovered must be reflected in the borrower’s account on the same day.

Restricted role of the LSP:

LSPs or third parties must not control (directly or indirectly) the flow of funds between the borrower and the RE. Additionally, any fees, charges, reimbursements etc. payable to LSPs must be paid directly by the RE. Such payments cannot be charged to or collected from the borrowers.

Analysis: This is consistent with the previous DL Guidelines 2022, where the LSP engaged by an RE is not involved in the fund flow. This reinforces the control over disbursal and repayment remains solely with the RE (the regulated lender) and continues to bring transparency and clarity.

Further, the exemption in case of delinquent loans permitting recovery in cash, along with the requirement for same-day reflection of the recovered amount in the borrower's account, offers a practical alternative for REs while maintaining a degree of protection for borrowers.

Transparency

The DL Directions incorporate the amendments to the DL Guidelines 2022 on the Key Fact Statement (“KFS”) format, in addition to mandating compliance with the RBI’s notification on disclosure of penal charges.²

Standardisation of KFS Format: The format of the KFS has been standardised pursuant to RBI’s notification on Key Fact Statement for Loans & Advances dated April 15, 2024.³ This notification repeals the KFS format prescribed under the DL Guidelines 2022 and the DL Directions require REs to adopt the format specified under this notification.

Disclosure of Penal Charges: Under the earlier DL Guidelines 2022 REs were prohibited from charging any fees or charges that were not explicitly disclosed in the KFS. The DL Directions mandate adherence to the changes introduced by the Fair Lending Practice – Penal Charges in Loan Accounts dated August 18, 2023,⁴ which among other obligations require REs to clearly disclose the quantum and reason for penal charges in the loan agreement and the most important terms and conditions/the KFS, as applicable.

Analysis: Standardising the KFS format helps streamline internal processes for REs, especially those operating across multiple credit products. Further, upfront and ongoing disclosures regarding penal charges strengthens borrower protection and improves transparency and enabling borrowers to remain informed not only at the time of sanction but also during instances of default or non-compliance.

Multiple REs and LSPs: LSPs must provide borrowers with a digital view of all loan offers that match the borrower’s request in the event a LSP services multiple REs. The digital view must clearly mention the name(s) of the RE(s), loan amount, tenor, APR, monthly repayment obligation, and applicable penal charges to enable fair comparison. Further, a KFS link must be provided for each RE. This view must also include the names of unmatched lenders. The LSP may use any matching logic but must apply it consistently across similar borrowers and products. Further the LSPs must ensure that all content is neutral and objective, and LSPs must not promote or prioritize any specific RE or their products. Use of dark patterns or deceptive designs by the LSP to influence borrower choices is prohibited. However, ranking based on a “pre-disclosed public metric” (such as ratings given by borrowers) is permissible and would not be considered promotional.

Analysis: The DL Directions intend that the LSPs should uphold transparency in their engagements with borrowers and not prioritize or provide preferential treatment to select REs. This helps in the borrowers being providing all relevant information so as to aid the borrower in making the right choice. 

Accountability

Prior to engagement, the RE must conduct thorough due diligence on the LSP, assessing the following: (i) technical capabilities; (ii) data privacy practices and system security; (iii) fairness in borrower dealings, (iv) historical conduct, and (v) regulatory compliance capabilities. REs must periodically review the LSP’s performance against contractual obligations and take corrective action for any deviations.⁵ REs must also establish internal monitoring mechanisms for loan portfolios originated through LSPs.⁶ Notably, REs would be “fully responsible” for all acts and omissions by the LSPs.⁷

Analysis: The DL Directions place the primary responsibility for safeguarding borrower interests on the RE. This includes both initial due diligence and ongoing monitoring of the LSP’s operations.

From a contractual perspective, REs may consider incorporating suitable clauses in their agreements with LSPs to address potential risks arising from misrepresentation or non-compliance. Conversely, LSPs must ensure that all information provided during the due diligence process is complete and accurate, and may seek to negotiate appropriate limitations on liability, including capped indemnities, to balance risk allocation fairly between the parties

Recovery Process

Under the past DL Guidelines 2022, borrowers had to be informed of the recovery agent at the time of loan issuance. The new DL Directions revise this by requiring such disclosure only at the time of loan default, specifically when a borrower defaults and a recovery agent is assigned or if there is a change in the assigned recovery agent. The borrower must be informed of the details of the authorised recovery agent via email or SMS, prior to the agent initiating contact for recovery.⁸

Analysis: This approach appears more operationally practical, as it ensures that recovery agent details are shared with the borrower only when relevant—i.e., at the time of default. It can potentially reduce the risk of misinformation to the borrower regarding the recovery agent and ensures that the borrower is informed of the correct authorised agent before any recovery action is initiated.

Data Minimization and Storage

The DL Directions retain the earlier obligations on need-based data collection and borrower rights. REs must ensure DLAs (of REs and LSPs) collect data only as needed, with prior, explicit borrower consent and audit trail. DLAs must not access phone resources like files, contacts, call logs, etc. One-time access to camera, mic, or location is allowed only for onboarding/KYC with explicit consent. Borrowers must have the option to give/deny consent for specific data use, restrict third-party sharing, revoke consent, and request that their data be forgotten.⁹

The DL Directions also continue to require that all data related to digital lending be stored on Indian servers. In a notable addition, the DL Directions now clarify that if such data is processed outside India, it must be deleted from the overseas servers and brought back to India within 24 hours.¹⁰

Analysis: The data provisions under the DL Directions align with the global privacy principles, including data minimisation. However, these provisions including the obligation to obtain informed borrower consent and uphold their data rights must be in consonance with the forthcoming Digital Personal Data Protection Act, 2023 (DPDPA). For example, consent must be accompanied by a detailed notice as required under the DPDPA. This requirement provides greater clarity for businesses (particularly multinational entities) engaged in digital lending activities in India. While cross-border data processing is permitted, the DL Directions make it explicit that such data cannot remain stored outside India. The mandatory deletion and repatriation of data within 24 hours enhances legal certainty and reinforces the regulatory expectation of strict data localisation, thereby aiding REs in aligning their operations with Indian compliance frameworks.

DLA Reporting

The DL Directions require the reporting of DLAs to the RBI. A few key points pertaining to this reporting requirement are listed below:¹¹

• Initial Reporting: REs are required to report the all DLAs used by them, irrespective of whether these DLAs are the RE’s own or those of the LSP engaged by the RE. Reporting must be carried out through the RBI’s Centralised Information Management System (“CIMS”) portal in the format prescribed under the DL Directions by June 15, 2025.

• Ongoing Updates: REs must also ensure timely updates to the reported list. Any addition of a new DLA or cessation of an existing engagement must be reflected promptly on the CIMS portal.

• Certification Requirement: The RE’s Chief Compliance Officer (“CCO”) or any other designated officer is required to certify that the data submitted pertaining to the DLA is correct and that the DLA is also compliant with required regulatory instructions (including those under the DL Directions).

Further, the CCO or designated officer must specifically certify that: (i) the DLA includes a link to the RE’s website carrying the prescribed information; (ii) any DLA owned by an LSP has a designated nodal grievance redressal officer; (iii) the DLA complies with the data collection and storage norms given under the DL Directions; and (iv) the RE’s website discloses key particulars of the DLA in accordance with regulatory expectations.

Analysis: The requirement for REs to report the list of DLAs deployed or engaged by them enhances transparency and provides borrowers with accurate and reliable information about the RE’s operations. This measure also acts as a safeguard against fraud by helping borrowers identify and avoid fake or unauthorised platforms, thereby protecting consumer interests.

Further, the responsibility for certifying the accuracy and compliance of DLA-related data lies solely with the RE. The RBI does not undertake any verification or validation of this information. Hence, REs must ensure, to its satisfaction, that the DLAs onboarded (particularly those operated by LSPs engaged by the RE) are in compliance with all applicable legal and regulatory requirements. As a result, REs must exercise heightened caution and rigour in their due diligence processes while onboarding LSPs and their DLAs.

Grievance Redressal

The DL Directions largely retains the grievance redressal framework outlined in the earlier DL Guidelines 2022. Both the RE and the LSP are required to appoint nodal grievance redressal officers, whose contact details must be prominently displayed on the websites of the RE, the LSP, and on the DLA itself. However, the ultimate responsibility for grievance redressal lies solely with the RE.¹²

In addition to the above, the DL Directions now explicitly state that all issues and grievances relating to a DLA, irrespective of whether the DLA is deployed by the RE or by an LSP, must be handled directly by the concerned RE.¹³

2. DEFAULT LOSS GUARANTEE

The DL Directions retain several core provisions relating to Default Loss Guarantee (“DLG”) from the withdrawn DLG Guidelines 2023, while also introducing certain changes. Some of the key provisions have been discussed below. 

Cap on DLG Cover

The cap on the DLG cover remains the same under the earlier DLG Guidelines 2023 and the DL Directions which is that the DLG cover must not exceed five percent of the amount actually disbursed by the RE from the loan portfolio.¹⁴ The DL Directions reiterate the illustrations provided under the DLG Guidelines 2023 that clarify how the five percent amount would be calculated. The underlying principle is that the DLG cover shall be calculated based on the actual amount exposed to default, i.e., the loan amounts disbursed to the borrowers, rather than the entire loan portfolio. Furthermore, once a loan has been repaid, it shall no longer be considered as part of the disbursed amounts on which the five percent DLG cover is computed.

Form of DLG Cover

The formats in which the RE can accept a DLG remain unchanged, namely: (i) cash deposit with the RE; (ii) fixed deposit with a Scheduled Commercial Bank with a lien marked in favour of the RE; and (iii) bank guarantee in favour of the RE.

Capital Reduction by RE

If the DLG provider is a RE, it must deduct the entire outstanding amount of the DLG from its capital.¹⁵ This means that the RE must treat the DLG amount as a direct reduction from its capital base, reflecting the financial risk it assumes under the guarantee.¹⁶

Analysis: This requirement ensures that the RE fully accounts for the credit risk it undertakes when providing a DLG. By mandating a full deduction from capital, the RBI is effectively trying to ensure REs from offering DLGs without carefully assessing their financial impact.

Due Diligence

The DL Directions continue to impose the due diligence obligations on a RE in respect of entering into a DLG arrangement, as previously set out under the DLG Guidelines 2023.¹⁷ The obligations are reiterated below:

• Board approved policy: REs (including those acting as DLG providers) must have a Board-approved policy before entering any DLG arrangement. The policy shall cover: (a) eligibility criteria for DLG providers, (b) nature and extent of DLG cover, (c) monitoring and review process, and (d) details of fees, if any, payable to or received from the DLG provider.

• Underwriting standards: REs should maintain robust underwriting standards regardless of DLG cover. DLG arrangements must not substitute credit appraisal.

• Information pertaining to the DLG provider: For each new or renewed DLG arrangement, REs must obtain adequate information to ensure the DLG provider’s ability to honour guarantees, which includes a declaration, certified by the provider’s statutory auditor, stating the aggregate DLG amount outstanding, number of REs and portfolios covered, and past default rates on similar portfolios.

In addition to the above, the DL Directions clarify that the due diligence to be conducted by the RE before engaging a DLG provider is in addition to the due diligence required before engaging an LSP.

Analysis: The retention of due diligence obligations under the DL Directions reinforces the accountability of the RE when entering into a DLG arrangement. It ensures that the RE assesses the adequacy and capability of the DLG provider to honour the DLG commitment. Fruther, the additional obligation ensures that where the same entity functions as both LSP and DLG provider, the RE must independently assess and document due diligence for each role.

Disclosure Requirements

The core disclosure obligation under the withdrawn DLG Guidelines 2023 has been retained in the DL Directions.¹⁸ REs must ensure that any LSP with whom they have a DLG arrangement publishes the following information on its website: (i) the total number of loan portfolios covered under DLG; and (ii) the respective amounts for each such portfolio.

The DL Directions introduce two key changes: (i) the name of the RE involved in the DLG arrangement may or may not be disclosed; and (ii) the disclosure must now be made on a monthly basis, with the information for each month to be published within seven (7) working days from the end of that month.

Analysis: The flexibility around disclosing the RE’s name allows for some confidentiality.

Further, the shift to monthly disclosures with a defined timeline reflects the RBI's intent to improve transparency and timeliness in the digital lending ecosystem.

Conclusion

The DL Directions consolidate previous lending guidelines and reiterate trust, transparency and accountability into the fabric of India’s digital lending ecosystem, placing borrowers’ interest squarely at the centre of the framework.

By reinforcing the role of the RE as the handler of funds and limiting the operational influence of the LSPs, the Directions ensure that financial control and borrower safety remain within the regulated perimeter. The emphasis on clear disclosures, data governance, and standardised borrower communications empowers users to make informed decisions, while placing LSPs firmly under the oversight of the RE.

Critically, the DL Directions impose robust due diligence and ongoing monitoring obligations on REs, ensuring that the lending lifecycle (from onboarding to recovery) remains under regulatory and operational control. This comprehensive accountability framework signals a maturing regulatory vision, which balances innovation and integrity.

As digital lending scales to reach more users in India, the true challenge will be translating these principles into practice, without compromising agility. Achieving this balance will require active cooperation across the ecosystem, including sustained regulatory engagement.

 

Authors

- Palak Kapoor and Huzefa Tavawalla

You can direct your queries or comments to the relevant member.

---

¹Direction 9, DL Directions.

²Direction 8, DL Directions.

³See: https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12663&Mode=0 (Last accessed: May 26, 2025).

⁴See: https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12527&Mode=0 (Last accessed: May 26, 2025).

⁵Direction 5(iii), DL Directions.

⁶Direction 5(iv), DL Directions.

⁷Direction 5(vii), DL Directions.

⁸Direction 8(v), DL Directions.

⁹Direction 12(ii), DL Directions.

¹⁰Direction 13(iv), DL Directions.

¹¹Direction 17, DL Directions.

¹²Direction 11, DL Directions.

¹³Direction 17(v), DL Directions.

¹⁴Direction 23(i), DL Directions.

¹⁵Direction 25(ii), DL Directions.

¹⁶Direction 25(ii), DL Directions.

¹⁷Direction 19, DL Directions.

¹⁸Direction 27, DL Directions.