RBI Digital Lending Rules: What Borrowers Are Owed

The Reserve Bank's digital lending directions give a person borrowing through an app a defined and enforceable set of entitlements. Money must move directly between the borrower's bank account and the regulated lender's, with no pool account of an intermediary in between; a Key Fact Statement carrying an all-inclusive annual percentage rate must be handed over before the contract is executed; the borrower may walk away inside a cooling-off period by repaying principal and proportionate APR without penalty; and the app may not read contacts, media files or call logs. Where any of that is breached, the route is the lender's grievance redressal officer first and the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme, 2026 where the complaint is rejected or draws no reply in thirty days.

The framework did not begin in 2025. It began with the report of the Reserve Bank's Working Group on Digital Lending in November 2021, was implemented through the Guidelines on Digital Lending of 2 September 2022, supplemented by the default loss guarantee circular of June 2023 and the harmonised Key Facts Statement circular of 15 April 2024, and consolidated into a single instrument — the Digital Lending Directions of 8 May 2025, which expressly repealed the 2022 Guidelines and the default loss guarantee circular and replaced them. That repeal matters when reading older commentary: several widely repeated propositions, the length of the cooling-off period among them, describe the 2022 position and no longer state the rule. In the Reserve Bank's consolidation of its regulatory instructions on 28 November 2025, the provisions of the 2025 Digital Lending Directions were carried into the entity-wise Credit Facilities Directions issued that day for each category of lender — for commercial banks, Chapter III of the Reserve Bank of India (Commercial Banks – Credit Facilities) Directions, 2025, and for NBFCs, Chapter III of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025 — so the obligations described below are now read from the directions applicable to the particular bank, NBFC or co-operative bank. A borrower who does not know a right exists will not ask for the document that would prove its breach, so this note sets out the obligations in the order in which a loan actually happens.

Which loans do the Digital Lending Directions actually cover?

The Directions are addressed to regulated entities — commercial banks including small finance banks and regional rural banks, primary urban co-operative banks, state and central co-operative banks, non-banking financial companies including housing finance companies, and All India Financial Institutions. They are not addressed to the app. That is the structural point on which everything else rests.

A digital lending app (DLA) is a mobile or web interface that facilitates digital lending. A lending service provider (LSP) is an agent of a regulated entity that performs one or more of the lender's functions — customer acquisition, underwriting support, pricing support, credit servicing, monitoring or recovery — on the lender's behalf. Neither of them lends. Every rupee lent through a compliant digital channel is lent by a regulated entity on its own balance sheet, and the regulated entity remains fully responsible and liable for the acts and omissions of its service provider.

Three consequences follow for a borrower:

• There is always an identifiable regulated lender. If the app cannot or will not name the bank or NBFC whose loan it is, that is the first material fact to record.
• Outsourcing does not dilute liability. The regulated entity is responsible for the conduct of its LSPs and DLAs, and the grievance obligation sits on it, not only on the app.
• The lender's own disclosures are verifiable. A regulated entity must keep an up-to-date website carrying, at a single prominent place, the details of all its digital lending products and apps, the details of the service providers and their apps together with the activities each is engaged for, its customer care and internal grievance mechanism, and links to the Reserve Bank's Complaint Management System and Sachet portal. Separately, regulated entities were required to report their digital lending apps on the Reserve Bank's Centralised Information Management System portal by 15 June 2025, and the Reserve Bank publishes a directory of those apps on its website, built from that reporting. The directory is published for the limited purpose of helping a customer verify an app's claimed association with a regulated entity; the data appears as the lender reported it, without validation by the Reserve Bank, and inclusion is not a registration or endorsement. An app absent from both the lender's list and the directory is worth pausing over.

Why must the money move directly between the borrower and the lender?

Because a pool account is where borrower money disappears. The Directions require that all loan disbursals and repayments be executed only between the bank account of the borrower and the bank account of the regulated entity, without any pass-through or pool account of a lending service provider or any other third party.

There are three exceptions on the disbursal side, and they are narrow:

1. Disbursals covered exclusively under a statutory or regulatory mandate, whether of the Reserve Bank or of another regulator.

2. Flow of money between regulated entities in a co-lending transaction.

3. Disbursals for a specified end use, provided the loan is disbursed directly into the bank account of the end beneficiary — a vehicle dealer or an educational institution, for example, rather than an intermediary.

On the repayment side there are two carve-outs. An advance against salary may be repaid by the employer deducting it from the borrower's salary, provided the repayment goes directly from the employer's account to the lender and the service provider has no control over the funds. The second matters to borrowers in arrears. Where a loan is delinquent, the lender may deploy a physical interface to recover in cash, and that recovery is exempt from the requirement of repayment directly into the lender's bank account. Two conditions attach: the cash recovered must be reflected in full in the borrower's account on the same day, and any fee payable to the collecting service provider must be paid by the lender, not taken from the recovery proceeds. A cash collection that does not appear on the account that day is the borrower's grievance, and the receipt is the evidence.

Beyond these, the flow of funds between the borrower's account and the lender's may not be controlled, directly or indirectly, by any third party. None of the exceptions permits an app to sit between borrower and lender as a custodian of funds.

The companion rule is about fees. Any fees or charges payable to a lending service provider in the credit intermediation process must be paid directly by the regulated entity and must not be charged by the service provider to the borrower. A demand for a separate "platform fee", "convenience fee" or "facilitation charge" collected by the app to its own account is not a small commercial irritant; it is a breach of the disbursal architecture. The response is documentary — record the demand and the payment instrument, and raise it in the grievance process rather than paying first and complaining later.

What must the Key Fact Statement contain before the loan is executed?

The Key Fact Statement is the pivot of the whole framework. It must be provided to the borrower before execution of the loan contract, in a language the borrower understands, and it must be in the standardised format prescribed by the Reserve Bank's harmonised Key Facts Statement instructions of 15 April 2024, which apply across retail and MSME lending and not only to digital channels.

Among other things, it must carry:

• the annual percentage rate, which includes all charges the lender levies, with a computation sheet showing how it was arrived at and an amortisation schedule over the loan tenor;
• the contact details of the nodal grievance redressal officer for digital lending complaints;
• any one-time processing fee the lender will retain if the borrower exits during the cooling-off period;
• the amount of, and reason for, any penal charges, and whether pre-payment charges apply.

Two rules give the document teeth. First, the Key Fact Statement carries a validity period during which the borrower may accept the terms, and the lender is bound by those terms if the borrower accepts within it — at least three working days for a loan with a tenor of seven days or more, and one working day where the tenor is under seven days. Second, any fee or charge not mentioned in the Key Fact Statement cannot be charged at any stage during the term of the loan without the borrower's explicit consent. A charge that surfaces on the first statement and is absent from the Key Fact Statement is recoverable as a matter of the borrower's complaint, not as a matter of negotiation.

What goes into the annual percentage rate

The APR is not the interest rate. It is the all-inclusive annualised cost of the loan, expressed that way to defeat the arithmetic by which a headline "1% per month" conceals the real cost once a flat processing fee is loaded onto a fourteen-day tenor.

Penal charges are governed by their own instruction — the Reserve Bank's fair lending practice circular on penal charges of 18 August 2023, since carried into the entity-wise Responsible Business Conduct Directions of 28 November 2025, requires that a breach of a material term be visited with a penal charge, not penal interest, and that such charges not be capitalised so that no further interest runs on them. A digital loan statement showing compounding on a late-payment levy is showing something the framework does not allow.

What must be disclosed about the service provider and the recovery agent?

Two disclosure obligations run through the life of the loan, and both are commonly overlooked because they are procedural rather than financial.

Before the agent makes contact. The rule is triggered by default, not by sanction. Where a loan has defaulted and a recovery agent is assigned, or where an already-assigned agent is changed, the particulars of the agent authorised to approach the borrower must be communicated to the borrower by email or SMS before that agent contacts the borrower for recovery. A caller who cannot be matched to a communicated authorisation is not an authorised agent, and the absence of the prior intimation is itself the breach.

This is worth stating precisely, because the widely repeated version of the rule — that agent details must be given at the time of sanction — belongs to the repealed 2022 Guidelines. Under the 2025 framework the obligation attaches at assignment and change, and it is a pre-contact obligation.

On execution of the contract. The loan documentation set must flow automatically to the borrower on the registered and verified email or SMS once the contract is executed, and the documents must be digitally signed and on the lender's own letterhead: the Key Fact Statement, a summary of the loan product, the sanction letter, the terms and conditions, account statements, and the privacy policies of the lender and its service provider in respect of borrower data. "Automatically" is the operative word — the borrower should not have to ask. A lender that holds these back is withholding the borrower's own file.

The conduct standards that then govern collection — permissible calling hours, prohibition of intimidation, contact with third parties — sit in the lender's conduct directions rather than in the digital lending provisions. For commercial banks and NBFCs they were rewritten on 6 August 2026 by the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Fourth Amendment Directions, 2026 and the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, both of which come into effect on 1 January 2027, and they are set out separately in the note on recovery agent harassment and borrower rights.

How does the cooling-off period work in practice?

The cooling-off period, also called the look-up period, is the borrower's exit from a loan already disbursed. The borrower must be given an explicit option to take it — it is not something the lender may bury or omit.

Its length is fixed by the lender in its credit policy, subject to a floor of not less than one day, which does not vary with the tenor of the loan. This is a change borrowers and advisers get wrong constantly: the tenor-based split — three days for a tenor of seven days or more, one day below that — was the original rule in the 2022 Guidelines. The Reserve Bank replaced it with the one-day floor in its Key Facts Statement circular of 15 April 2024, and the 2025 Directions and the consolidated directions keep that floor. The practical consequence is that the lender's policy, not the regulation, is what determines how much time a particular borrower actually has. Check the loan documents for the number; do not assume three days.

Within that window, the borrower may exit by paying the principal plus the proportionate annual percentage rate, with no penalty. One qualification matters and is frequently missed: the lender may retain a reasonable one-time processing fee where the borrower exits during the cooling-off period, but only where that retention was disclosed upfront in the Key Fact Statement. A processing fee that appears for the first time at the moment of exit is not retainable. Beyond principal, proportionate APR and a pre-disclosed one-time processing fee, nothing else is payable — no penalty, and no foreclosure charge.

After the cooling-off window, prepayment continues to be available under the Reserve Bank's extant instructions on foreclosure charges and pre-payment penalty, which differ for banks and for NBFCs and by category of borrower.

A worked sequence, for a personal loan of INR 60,000 at a stated APR of 30% with a ninety-day tenor, where the lender's policy fixes a cooling-off period of three days and the Key Fact Statement discloses a one-time processing fee retainable on exit:

Where an account has already deteriorated and the question is settlement rather than exit, the structure is different again and is covered in the note on the legal framework of one-time settlement.

Two further conduct rules belong here. A credit limit may not be increased automatically unless an explicit request has been received from the borrower, evaluated, and kept on record. The standard is a request, not merely consent — a silent enhancement on a digital credit line is not permissible, and neither is one manufactured out of a pre-ticked box or a tapped-through screen. And all lending through digital lending apps must be reported to credit information companies, irrespective of nature or tenor, so a short-tenure digital loan sits on the credit record exactly as a term loan does. Where an inaccurate report hardens into a classification dispute with the lender, the analysis is closer to that in the note on challenging a wrongful NPA classification.

What data may a digital lending app collect?

The data rules are stated as prohibitions, which makes them unusually easy to apply.

Collection must be need-based. Data may be collected only with the borrower's prior and explicit consent, only to the extent needed for the purpose, and with a clear audit trail of what was taken and why.

Certain phone resources are off limits entirely. A digital lending app must not access the file and media store, the contact list, call logs or telephony functions of the borrower's device. There is no consent-based route around this; it is a prohibition on the regulated entity, not a default the borrower can waive away by tapping through a permission screen.

One-time access only, for onboarding. Access to the camera, the microphone, location, or a comparable facility is permitted on a one-time basis where it is necessary for onboarding or KYC, and only with explicit consent.

Biometric data must not be stored or collected unless a statutory instruction allows it.

The borrower keeps control after the fact. The borrower must be given the option to give or deny consent for the use of specific data, to restrict disclosure to third parties, to decide on data retention, to revoke consent already given, and to require deletion of data collected by the app or service provider.

Storage must be in India. Data collected by apps and service providers must be held on servers located within India, subject to the lender's other statutory obligations.

These sit alongside, and do not displace, the general data-protection regime. The consent, purpose-limitation and erasure obligations of the Digital Personal Data Protection Act 2023 are not yet in force: the sections imposing them on data fiduciaries commence eighteen months after the commencement notification of 13 November 2025, that is, in May 2027. Until then the RBI directions are the operative rules, and the coming overlap is worked through in the note on DPDP Act compliance for Indian businesses. Once those sections are in force, a borrower whose contact list was harvested will have two distinct complaints available, not one.

How is a complaint escalated, and when does the Ombudsman take it?

The grievance architecture is a ladder; each rung has to be climbed before the next is available.

Rung one — the grievance redressal officer. The regulated entity, and any lending service provider that has an interface with the borrower, must each designate a nodal grievance redressal officer to deal with digital lending complaints, including complaints against their apps. The contact details must be displayed prominently on the website of the regulated entity, on the service provider's website, and on the app itself, as well as in the Key Fact Statement, and a facility to lodge the complaint must be available on the app and the website. Responsibility for redressal remains with the regulated entity whichever officer receives it. The complaint should be in writing, identify the loan account and the specific obligation breached, and attach the Key Fact Statement with the relevant screenshots or statements.

The lender's website must also carry a link to the Reserve Bank's Complaint Management System and to the Sachet portal — which is itself the route for reporting an entity that appears not to be regulated at all.

Rung two — the RBI Ombudsman. The Reserve Bank – Integrated Ombudsman Scheme, 2026 came into force on 1 July 2026 and repealed the 2021 Scheme; complaints received before that date continue to be dealt with under the 2021 Scheme. If the complaint is rejected wholly or partly, if the borrower is dissatisfied with the reply, or if no reply is received within thirty days of the lender receiving the complaint, it may be taken to the Ombudsman through the Complaint Management System portal, or by email or physical complaint to the Centralised Receipt and Processing Centre at Chandigarh in the format the Scheme prescribes.

Note the trigger. The waiting period runs from no reply within thirty days, not from thirty days of the matter remaining unresolved — a lender that replies quickly and refuses has opened the door immediately, and there is no need to wait out the thirty days. Note also the window that follows: the complaint must reach the Ombudsman within ninety days, which is far shorter than the one year the 2021 Scheme allowed.

Two limits matter. The Scheme does not entertain a complaint on a grievance pending before, or already decided by, a court, tribunal or arbitrator — a borrower who has commenced proceedings has chosen a forum. And its coverage of non-banking financial companies is defined by criteria in the Scheme: housing finance companies and certain other categories are excluded, and other NBFCs are covered if they accept deposits or have a customer interface with assets of INR 100 crore or more. A complaint against an entity outside those criteria has to be pursued by other routes.

Where the underlying dispute is not conduct but the debt itself — quantum, security enforcement, or a recovery proceeding already on foot — the Ombudsman is the wrong forum, and the routes are those described in the guide to debt recovery in India.

A verification sequence for a digital loan file

1. Identify the regulated entity behind the app and check it against the lender's published list and the Reserve Bank's public directory.

2. Obtain the Key Fact Statement before accepting, and note its validity period.

3. Read the APR against the computation sheet. If the sheet is missing, the disclosure is incomplete.

4. Note the cooling-off period the lender's policy has actually fixed — the regulatory floor is one day, so the number in the loan documents is the number that governs — together with the exit terms and any one-time processing fee disclosed as retainable on exit. Diarise the last day of the window.

5. Confirm at disbursal that the credit came from the regulated entity's account into your own with no intermediate account in the narration, and that no fee was collected by the app to its own account.

6. Keep the digitally signed documentation set sent to the registered email or mobile — Key Fact Statement, product summary, sanction letter, terms and conditions, account statements, privacy policies. If it did not arrive automatically on execution, that omission is itself recordable. That set is the evidence in any later complaint.

7. Check the app's permission requests against the prohibition on contacts, media and call logs, and revoke anything beyond one-time onboarding access.

8. On the first arrears contact, ask for the recovery agent's authorisation particulars, and check whether any intimation of that agent reached your registered email or mobile before the contact.

9. If a term is breached, write to the grievance redressal officer, date the letter, and diarise thirty days — but escalate at once if a reply comes back refusing the complaint, since the waiting period ends with the reply, and diarise the ninety-day window for the Ombudsman complaint.

What the Directions do not do

They do not make a digital loan cheaper, and they do not make it unenforceable. A borrower who takes a compliant loan and defaults is in the ordinary position of any defaulting borrower, with the lender's remedies intact. The Directions regulate conduct and disclosure — how the loan is presented, how the money flows, what may be collected, how complaints are handled. A breach gives rise to a regulatory grievance and, depending on the facts, a civil claim; it does not extinguish the debt.

They also leave a large field outside their reach. An entity that is neither a regulated entity nor the service provider of one is not lending within this framework at all; the questions there are of state money-lending legislation, the criminal law, and the platform's own liability, none of which the Directions address. A lender that cannot be traced to a bank or an NBFC is a different problem, and a more serious one.

For institutions on the other side of these obligations, the documentation and empanelment expectations are set out on the page for banks, NBFCs and ARCs. Definitions of the statutory vocabulary used above are collected in the glossary of Indian legal terms, and the forums in which lending disputes are ultimately heard are described in the note on courts and tribunals.

This article is general information on the regulatory framework as it stands and is not legal advice; whether a particular digital loan complies with the Directions depends on the documents issued, the flow of funds and the conduct of the parties. Queries may be directed through the contact page.