RBI Digital Lending Rules: What Borrowers Are Owed

The Reserve Bank of India (Digital Lending) Directions, 2025 give a person borrowing through an app a defined and enforceable set of entitlements. Money must move directly between the borrower's bank account and the regulated lender's, with no pool account of an intermediary in between; a Key Fact Statement carrying an all-inclusive annual percentage rate must be handed over before the contract is executed; the borrower may walk away inside a cooling-off period by repaying principal and proportionate APR without penalty; and the app may not read contacts, media files or call logs. Where any of that is breached, the route is the lender's grievance redressal officer first and the Reserve Bank – Integrated Ombudsman Scheme, 2021 where the complaint is rejected or draws no reply in thirty days.

The framework did not begin in 2025. It began with the report of the Reserve Bank's Working Group on Digital Lending in November 2021, was implemented through the Guidelines on Digital Lending of 2 September 2022, supplemented by the default loss guarantee circular of June 2023 and the harmonised Key Facts Statement circular of 15 April 2024, and consolidated into a single instrument — the Digital Lending Directions of 8 May 2025, which expressly repealed the 2022 Guidelines and the default loss guarantee circular and replaced them. That repeal matters when reading older commentary: several widely repeated propositions, the length of the cooling-off period among them, describe the 2022 position and no longer state the rule. As an Advocate practising at the Delhi High Court and Senior Partner at Unified Chambers And Associates, what I see most often is not a borrower who has been denied a right but a borrower who does not know the right exists, and therefore never asks for the document that would prove the breach. This note sets out the obligations in the order in which a loan actually happens.

Which loans do the Digital Lending Directions actually cover?

The Directions are addressed to regulated entities — commercial banks including small finance banks and regional rural banks, primary urban co-operative banks, state and central co-operative banks, non-banking financial companies including housing finance companies, and All India Financial Institutions. They are not addressed to the app. That is the structural point on which everything else rests.

A digital lending app (DLA) is a mobile or web interface that facilitates digital lending. A lending service provider (LSP) is an agent of a regulated entity that performs one or more of the lender's functions — customer acquisition, underwriting support, pricing support, credit servicing, monitoring or recovery — on the lender's behalf. Neither of them lends. Every rupee lent through a compliant digital channel is lent by a bank or an NBFC on its own balance sheet, and the regulated entity remains answerable for everything its app and its service provider do.

Three consequences follow for a borrower:

• **There is always an identifiable regulated lender.** If the app cannot or will not name the bank or NBFC whose loan it is, that is the first material fact to record.
• **Outsourcing does not dilute liability.** The regulated entity is responsible for the conduct of its LSPs and DLAs, and the grievance obligation sits on it, not only on the app.
• **The lender's own disclosures are verifiable.** A regulated entity must keep an up-to-date website carrying, at a single prominent place, the details of all its digital lending products and apps, the details of the service providers and their apps together with the activities each is engaged for, its customer care and internal grievance mechanism, and links to the Reserve Bank's Complaint Management System and Sachet portal. Separately, regulated entities were required to report their digital lending app details on the Reserve Bank's Centralised Information Management System portal by 15 June 2025, and a directory of digital lending apps built from that reporting has been operational on the Reserve Bank's website since 1 July 2025. Its stated purpose is to let a customer verify an app's claimed association with a regulated entity. An app absent from both the lender's list and the directory is worth pausing over.

Why must the money move directly between the borrower and the lender?

Because a pool account is where borrower money disappears. The Directions require that all loan disbursals and repayments be executed only between the bank account of the borrower and the bank account of the regulated entity, without any pass-through or pool account of a lending service provider or any other third party.

There are three exceptions on the disbursal side, and they are narrow:

1. Disbursals covered exclusively under a statutory or regulatory mandate, whether of the Reserve Bank or of another regulator.

2. Flow of money between regulated entities in a co-lending transaction.

3. Disbursals for a specified end use, provided the loan is disbursed directly into the bank account of the end beneficiary — a vehicle dealer or an educational institution, for example, rather than an intermediary.

On the repayment side there is one further carve-out, and borrowers in arrears should know it exists. Where a loan is delinquent, the lender may deploy a physical interface to recover in cash, and that recovery is exempt from the requirement of repayment directly into the lender's bank account. Two conditions attach: the cash recovered must be reflected in full in the borrower's account on the same day, and any fee payable to the collecting service provider must be paid by the lender, not taken from the recovery proceeds. A cash collection that does not appear on the account that day is the borrower's grievance, and the receipt is the evidence.

Beyond these, the flow of funds between the borrower's account and the lender's may not be controlled, directly or indirectly, by any third party. None of the exceptions permits an app to sit between borrower and lender as a custodian of funds.

The companion rule is about fees. Any fees or charges payable to a lending service provider in the credit intermediation process must be paid directly by the regulated entity and must not be charged by the service provider to the borrower. A demand for a separate "platform fee", "convenience fee" or "facilitation charge" collected by the app to its own account is not a small commercial irritant; it is a breach of the disbursal architecture. The response is documentary — record the demand and the payment instrument, and raise it in the grievance process rather than paying first and complaining later.

What must the Key Fact Statement contain before the loan is executed?

The Key Fact Statement is the pivot of the whole framework. It must be provided to the borrower before execution of the loan contract, in a language the borrower understands, and it must be in the standardised format prescribed by the Reserve Bank's harmonised Key Facts Statement instructions of 15 April 2024, which apply across retail and MSME lending and not only to digital channels.

It must set out, at a minimum:

• the annual percentage rate, computed on an all-inclusive basis;
• the recovery mechanism the lender will use;
• the details of the grievance redressal officer designated to deal with digital lending complaints;
• the cooling-off or look-up period and the terms on which the borrower may exit during it;
• a computation sheet showing how the APR was arrived at, and an amortisation schedule over the loan tenor.

Two rules give the document teeth. First, the Key Fact Statement carries a validity period during which the borrower may accept the terms — not less than three working days for a loan with a tenor of seven days or more, and not less than one working day where the tenor is under seven days. Second, any fee or charge not mentioned in the Key Fact Statement cannot be levied at any stage during the term of the loan without the borrower's express consent. A charge that surfaces on the first statement and is absent from the Key Fact Statement is recoverable as a matter of the borrower's complaint, not as a matter of negotiation.

What goes into the annual percentage rate

The APR is not the interest rate. It is the all-inclusive annualised cost of the loan, expressed that way to defeat the arithmetic by which a headline "1% per month" conceals the real cost once a flat processing fee is loaded onto a fourteen-day tenor.

Because contingent charges sit outside the APR, they must be disclosed separately and in absolute terms in the Key Fact Statement. Penal charges are governed by their own instruction — the Reserve Bank's fair lending circular of 18 August 2023 requires that a breach of a material term be visited with a penal charge, not penal interest, and that such charges not be capitalised so that no further interest runs on them. A digital loan statement showing compounding on a late-payment levy is showing something the framework does not allow.

What must be disclosed about the service provider and the recovery agent?

Two disclosure obligations run through the life of the loan, and both are commonly overlooked because they are procedural rather than financial.

Before the agent makes contact. The rule is triggered by default, not by sanction. Where a loan has defaulted and a recovery agent is assigned, or where an already-assigned agent is changed, the particulars of the agent authorised to approach the borrower must be communicated to the borrower by email or SMS before that agent contacts the borrower for recovery. A caller who cannot be matched to a communicated authorisation is not an authorised agent, and the absence of the prior intimation is itself the breach.

This is worth stating precisely, because the widely repeated version of the rule — that agent details must be given at the time of sanction — belongs to the repealed 2022 Guidelines. Under the 2025 Directions the obligation attaches at assignment and change, and it is a pre-contact obligation.

On execution of the contract. The loan documentation set must flow automatically to the borrower on the registered and verified email or SMS once the contract is executed, and the documents must be digitally signed and on the lender's own letterhead: the Key Fact Statement, a summary of the loan product, the sanction letter, the terms and conditions, account statements, and the privacy policies of the lender and its service provider in respect of borrower data. "Automatically" is the operative word — the borrower should not have to ask. A lender that holds these back is withholding the borrower's own file.

The conduct standards that then govern collection — permissible calling hours, prohibition of intimidation, contact with third parties — sit in the Fair Practices Code applicable to the lender rather than in the Digital Lending Directions, and they are set out separately in the note on recovery agent harassment and borrower rights.

How does the cooling-off period work in practice?

The cooling-off period, also called the look-up period, is the borrower's exit from a loan already disbursed. The borrower must be given an explicit option to take it — it is not something the lender may bury or omit.

Its length is fixed by the board of the regulated entity in its loan policy, subject to a floor. Under the 2025 Directions that floor is not less than one day, and it no longer varies with the tenor of the loan. This is a change borrowers and advisers get wrong constantly: the tenor-based split — three days for a tenor of seven days or more, one day below that — was the position under the 2022 Guidelines, and those Guidelines stand repealed. The practical consequence is that the floor is now lower, so the board-approved policy, not the regulation, is what determines how much time a particular borrower actually has. Read the Key Fact Statement for the number; do not assume three days.

Within that window, the borrower may exit by paying the principal plus the proportionate annual percentage rate, with no penalty. One qualification matters and is frequently missed: the lender may retain a reasonable one-time processing fee where the borrower exits during the cooling-off period, but only where that retention was disclosed upfront in the Key Fact Statement. A processing fee that appears for the first time at the moment of exit is not retainable. Beyond principal, proportionate APR and a pre-disclosed one-time processing fee, nothing else is payable — no penalty, and no foreclosure charge.

After the cooling-off window, prepayment continues to be available under the Reserve Bank's extant instructions on foreclosure charges and pre-payment penalty, which differ for banks and for NBFCs and by category of borrower.

A worked sequence, for a personal loan of INR 60,000 at a stated APR of 30% with a ninety-day tenor, where the lender's board has fixed a cooling-off period of three days and the Key Fact Statement discloses a one-time processing fee retainable on exit:

Where an account has already deteriorated and the question is settlement rather than exit, the structure is different again and is covered in the note on the legal framework of one-time settlement.

Two further conduct rules belong here. A credit limit may not be increased automatically unless an explicit request has been received from the borrower, evaluated, and kept on record. The standard is a request, not merely consent — a silent enhancement on a digital credit line is not permissible, and neither is one manufactured out of a pre-ticked box or a tapped-through screen. And all lending through digital lending apps must be reported to credit information companies, irrespective of nature or tenor, so a short-tenure digital loan sits on the credit record exactly as a term loan does. Where an inaccurate report hardens into a classification dispute with the lender, the analysis is closer to that in the note on challenging a wrongful NPA classification.

What data may a digital lending app collect?

The data rules are stated as prohibitions, which makes them unusually easy to apply.

Collection must be need-based. Data may be collected only with the borrower's prior and explicit consent, only to the extent needed for the purpose, and with a clear audit trail of what was taken and why.

Certain phone resources are off limits entirely. A digital lending app must not access the file and media store, the contact list, call logs or telephony functions of the borrower's device. There is no consent-based route around this; it is a prohibition on the regulated entity, not a default the borrower can waive away by tapping through a permission screen.

One-time access only, for onboarding. Access to the camera, the microphone, location, or a comparable facility is permitted on a one-time basis where it is necessary for onboarding or KYC, and only with explicit consent.

Biometric data must not be stored or collected unless a statutory instruction allows it.

The borrower keeps control after the fact. The borrower must be given the option to give or deny consent for the use of specific data, to restrict disclosure to third parties, to decide on data retention, to revoke consent already given, and to require deletion of data collected by the app or service provider.

Storage must be in India. Data collected by apps and service providers must be held on servers located within India, subject to the lender's other statutory obligations.

These sit alongside, and do not displace, the general data-protection regime. The consent, purpose-limitation and erasure obligations of the Digital Personal Data Protection Act 2023 apply to the lender and its processors in their own right, and the compliance overlap is worked through in the note on DPDP Act compliance for Indian businesses. A borrower whose contact list was harvested therefore has two distinct complaints available, not one.

How is a complaint escalated, and when does the Ombudsman take it?

The grievance architecture is a ladder; each rung has to be climbed before the next is available.

Rung one — the grievance redressal officer. The regulated entity, and any lending service provider that has an interface with the borrower, must each designate a nodal grievance redressal officer to deal with digital lending complaints, including complaints against their apps. The contact details must be displayed prominently on the website of the regulated entity, on the service provider's website, and on the app itself, as well as in the Key Fact Statement, and a facility to lodge the complaint must be available on the app and the website. Responsibility for redressal remains with the regulated entity whichever officer receives it. The complaint should be in writing, identify the loan account and the specific obligation breached, and attach the Key Fact Statement with the relevant screenshots or statements.

The lender's website must also carry a link to the Reserve Bank's Complaint Management System and to the Sachet portal — which is itself the route for reporting an entity that appears not to be regulated at all.

Rung two — the Reserve Bank – Integrated Ombudsman Scheme, 2021. If the complaint is rejected wholly or partly, if the borrower is dissatisfied with the reply, or if no reply is received within thirty days of the lender receiving the complaint, it may be taken to the Ombudsman through the Complaint Management System portal, or by physical complaint to the Centralised Receipt and Processing Centre at Chandigarh in the form the Scheme prescribes.

Note the trigger. The waiting period runs from no reply within thirty days, not from thirty days of the matter remaining unresolved — a lender that replies quickly and refuses has opened the door immediately, and there is no need to wait out the thirty days.

Two limits matter. The Scheme does not entertain a complaint pending before, or already decided by, a court, tribunal or arbitrator on the same cause of action — a borrower who has commenced proceedings has chosen a forum. And its coverage of non-banking financial companies is defined by criteria in the Scheme relating to deposit acceptance, customer interface and asset size; a complaint against a smaller entity outside those criteria goes to the Reserve Bank's consumer education and protection machinery instead. Both points should be checked against the current text before filing.

Where the underlying dispute is not conduct but the debt itself — quantum, security enforcement, or a recovery proceeding already on foot — the Ombudsman is the wrong forum, and the routes are those described in the guide to debt recovery in India.

A verification sequence for a digital loan file

1. Identify the regulated entity behind the app and check it against the lender's published list and the Reserve Bank's public directory.

2. Obtain the Key Fact Statement before accepting, and note its validity period.

3. Read the APR against the computation sheet. If the sheet is missing, the disclosure is incomplete.

4. Note the cooling-off period the board policy has actually fixed — the regulatory floor is one day, so the number in the document is the number that governs — together with the exit terms and any one-time processing fee disclosed as retainable on exit. Diarise the last day of the window.

5. Confirm at disbursal that the credit came from the regulated entity's account into your own with no intermediate account in the narration, and that no fee was collected by the app to its own account.

6. Keep the digitally signed documentation set sent to the registered email or mobile — Key Fact Statement, product summary, sanction letter, terms and conditions, account statements, privacy policies. If it did not arrive automatically on execution, that omission is itself recordable. That set is the evidence in any later complaint.

7. Check the app's permission requests against the prohibition on contacts, media and call logs, and revoke anything beyond one-time onboarding access.

8. On the first arrears contact, ask for the recovery agent's authorisation particulars, and check whether any intimation of that agent reached your registered email or mobile before the contact.

9. If a term is breached, write to the grievance redressal officer, date the letter, and diarise thirty days — but escalate at once if a reply comes back refusing the complaint, since the waiting period ends with the reply.

What the Directions do not do

They do not make a digital loan cheaper, and they do not make it unenforceable. A borrower who takes a compliant loan and defaults is in the ordinary position of any defaulting borrower, with the lender's remedies intact. The Directions regulate conduct and disclosure — how the loan is presented, how the money flows, what may be collected, how complaints are handled. A breach gives rise to a regulatory grievance and, depending on the facts, a civil claim; it does not extinguish the debt.

They also leave a large field outside their reach. An entity that is neither a regulated entity nor the service provider of one is not lending within this framework at all; the questions there are of state money-lending legislation, the criminal law, and the platform's own liability, none of which the Directions address. A lender that cannot be traced to a bank or an NBFC is a different problem, and a more serious one.

For institutions on the other side of these obligations, the documentation and empanelment expectations are set out on the page for banks, NBFCs and ARCs. Definitions of the statutory vocabulary used above are collected in the glossary of Indian legal terms, and the forums in which lending disputes are ultimately heard are described in the note on courts and tribunals.

This article is general information on the regulatory framework as it stands and is not legal advice; whether a particular digital loan complies with the Directions depends on the documents issued, the flow of funds and the conduct of the parties. Queries may be directed through the contact page.