#1 RBI Digital Lending Guidelines: Tech & Compliance Guide

India’s digital credit market has grown faster than almost any other lending segment over the past decade. Borrowers can now compare offers, complete KYC, sign an agreement and receive funds in a single session on a phone. That convenience also brought real problems: unclear pricing, aggressive recovery practices, misuse of personal data, and apps that implied an association with regulated lenders when none existed. The Reserve Bank of India (RBI) has responded with a steadily tighter framework, and today that framework sits in one place: the Reserve Bank of India (Digital Lending) Directions, 2025.

This guide explains what the Directions require, what they mean for the technology behind a lending journey, and how banks, NBFCs, lending service providers (LSPs) and fintech platforms can build compliance into their products instead of bolting it on later. It is written for product, risk, compliance and engineering teams. It is general information and not legal advice, so please confirm interpretations against the RBI’s published text and with your own counsel.

Why the RBI Consolidated Its Digital Lending Rules

Before 2025, digital lending was governed by a patchwork of instructions. The September 2022 Guidelines on Digital Lending laid the foundation with direct fund flows, data minimisation and borrower disclosures. The 2023 guidelines on Default Loss Guarantee (DLG) arrangements set conditions for risk-sharing with third parties, and a 2024 circular on the Key Fact Statement (KFS) standardised how loan costs are disclosed. Separate announcements covered the aggregation of loan offers from multiple lenders and a public directory of lending apps.

On 8 May 2025, the RBI issued the Digital Lending Directions, 2025 (RBI/2025-26/36), which bring these instructions together and add two significant pieces: transparency rules for platforms that present offers from more than one lender, and mandatory reporting of every digital lending app (DLA) to the RBI. For compliance teams, consolidation means one document and one set of definitions. For technology teams, it signals that the regulator expects compliance to be visible in how a product actually behaves, not only in a policy document.

Who the Directions Apply To, and Key Dates

The Directions apply to regulated entities (REs), which include commercial banks, co-operative banks, NBFCs and certain other RBI-regulated lenders. They cover lending that an RE carries out through its own app or website, as well as lending through LSPs: the technology companies, aggregators and marketplaces that help acquire borrowers, assess creditworthiness or service loans on an RE’s behalf. One principle runs through the whole document: the RE remains fully responsible for what its LSPs and DLAs do.

Several provisions were phased in, so the dates are worth knowing:

8 May 2025: most provisions came into force immediately.
15 June 2025: deadline for REs to complete their first reporting of all DLAs on the RBI’s Centralised Information Management System (CIMS) portal.
1 November 2025: rules for arrangements in which an LSP works with multiple lenders became effective.

All three dates have now passed, so they are no longer transition milestones. They are the baseline that auditors, lenders and supervisors will test against. The 2025 Directions remain the core framework at the time of writing in November 2026, but we recommend checking the RBI website for any later amendments before you finalise a compliance plan.

The Core Compliance Requirements

Direct Disbursal and Repayment

Loans must be disbursed directly from the RE’s bank account to the borrower’s bank account, and repayments must flow directly from the borrower to the RE, without a pass-through or pool account of an LSP or other third party in the middle. Any fee payable to an LSP for its services is paid by the RE and not charged to the borrower. This has a direct design consequence: payment integrations, e-mandate set-up and reconciliation logic must be built around the RE’s accounts, with audit trails that show money never rested with an intermediary.

Key Fact Statement and All-Inclusive APR

Before a loan contract is executed, the borrower must receive a standardized KFS in simple language. The KFS carries the Annual Percentage Rate (APR), which expresses the effective cost of credit including interest and applicable fees and charges. It also covers recovery mechanisms, penal charges, grievance contacts and the cooling-off terms. Timing matters: when several lenders are shown, the KFS needs to be available at the offer stage, and sharing it only inside a loan agreement kit at disbursal is hard to reconcile with the intent of the rules.

In practice, the APR cannot be a static figure on a marketing page. It has to be computed per borrower and per offer from the actual amount, tenor, fees and charges, and stored together with the exact KFS version the borrower saw. A tested APR engine and a versioned KFS template store are therefore core compliance components, not nice-to-have features.

Cooling-Off Period and Exit Rights

Borrowers must be able to exit a digital loan during a cooling-off period without penalty. The RE’s board decides the length, it must be disclosed in the KFS, and it must be at least one day. During this window the borrower repays the principal and the proportionate APR, and the RE may retain only a one-time processing fee that was disclosed upfront. Systems need to track the window for each loan, calculate the exit amount correctly, and close the loan cleanly across loan management, payments and credit reporting.

Data Collection, Consent and Storage

Data rules are among the most operationally demanding parts of the Directions. In summary:

Collect only data that is necessary for a stated purpose, with the borrower’s explicit consent and a verifiable audit trail.
Do not access phone resources such as files and media, contact lists or call logs. One-time access to the camera, microphone or location can be taken for onboarding or KYC with explicit consent.
Let borrowers review and revoke consent and request deletion of their data, subject to legal retention requirements.
Limit what LSPs and DLAs store, and keep borrower data in line with the storage and localisation expectations in the Directions.
Align practices with the Digital Personal Data Protection (DPDP) Act, 2023, which the 2025 Directions explicitly bring into the picture.

Technically, this points to a central consent-management layer, data minimisation built into APIs, role-based access, encryption in transit and at rest, and logs that show who accessed which borrower’s data and for what reason.

Grievance Redressal

Each RE must run a clear grievance mechanism for digital lending, including a nodal grievance redressal officer whose details are visible in the app, on the website and in the KFS. LSPs must direct borrowers to this mechanism. If a complaint is not resolved within the prescribed timeline, the borrower can escalate through the RBI’s Complaint Management System. Complaint intake, ticketing, SLA tracking and escalation should be part of the product, not an email address in the footer.

Default Loss Guarantee (DLG) Arrangements

Some LSPs offer to absorb part of a lender’s credit losses. The Directions allow DLG arrangements only under tight conditions, including a cap of 5 percent of the loan portfolio covered and permitted forms of cover such as a cash deposit, a fixed deposit with lien or a bank guarantee. The RE must also disclose its DLG arrangements publicly on its website. Platforms that rely on DLG need accurate portfolio tracking so that the cap is never breached without anyone noticing.

Multi-Lender Platforms and Transparent Aggregation

Where an LSP or DLA shows offers from more than one RE, the Directions, effective 1 November 2025, require transparency. Each offer must clearly show the RE’s name, sanctioned amount, tenor, APR, monthly repayment, applicable penal charges and a link to the KFS. Offers must be presented without deceptive patterns, and any ordering of offers should follow a transparent, pre-disclosed logic rather than a hidden commercial incentive. The RE stays accountable throughout.

For marketplaces and lending-as-a-service platforms, this is where architecture matters most. The comparison screen has to pull live, lender-specific terms through APIs, generate a KFS link for each offer, and apply a documented ranking logic that product, compliance and the participating lenders have all reviewed. Interface choices such as pre-selected options, hidden fees or manufactured urgency should be reviewed as potential dark patterns.

DLA Reporting, the CIMS Portal and the Public Directory

REs must report every DLA they deploy, whether their own or operated by an LSP, on the RBI’s CIMS portal, and update the list when apps are added or discontinued. The RBI uses this information to publish a public directory so that borrowers can verify an app’s link to a regulated lender. Reporting does not amount to RBI endorsement, and no app should suggest otherwise. REs must also maintain an easily accessible section on their website listing digital lending products, DLAs, engaged LSPs and their roles, customer care details and grievance channels. Operationally, this means a live register of apps, versions, owners and LSPs, with change control that triggers a CIMS update.

Credit Reporting

Digital loans must be reported to credit information companies in line with the Credit Information Companies (Regulation) Act, 2005 and RBI instructions. Data quality, timely submission and correct status handling, including loans closed during the cooling-off window, need to be part of the loan servicing flow rather than a month-end clean-up.

Technology Considerations for Compliant Digital Lending

Compliance with the Directions is largely an engineering problem. Policies matter, but regulators and lenders increasingly ask for evidence: logs, versions, timestamps and reconciliations. It helps to think in terms of capabilities that your platform must have.

API-First Architecture with Configurable Lender Rules

Multi-lender journeys depend on stable APIs between the LSP, the RE and downstream systems. Every lender has its own eligibility rules, pricing and KFS format. A configurable rules layer lets you update terms or onboard a lender without redeploying core code, and it reduces the risk of displaying stale pricing, which is a direct disclosure risk.

Business Rules Engine and Decision Transparency

A business rules engine (BRE) encodes eligibility, routing and underwriting policies in a form that can be reviewed, versioned and tested. When a borrower or a lender asks why a particular offer appeared, you should be able to reproduce the decision from the logged inputs and the rule version in force. For multi-lender platforms, the same engine can hold the ranking logic that is disclosed to borrowers.

Consent, Privacy and Data Governance

Treat consent as a first-class data object that records purpose, timestamp, notice version, channel and revocation status. Pair it with a data inventory, retention schedules, encryption, key management and masked views for support teams. If third-party analytics or SDKs run inside an app, review what they collect against the permission limits in the Directions.

Disclosure, KFS and APR Engines

Build the APR calculation as a versioned service with unit tests against known examples, and generate the KFS from structured data instead of manually edited documents. Store the exact KFS shown and the borrower’s acknowledgement, so that you can answer any later dispute with a record, not a recollection.

Payments, Reconciliation and Audit Trails

Direct fund flow needs dependable payment rails, automated reconciliation and exception handling so that mismatches between loan records and bank statements are caught the same day. Keep tamper-evident logs of disbursal and collection events, and make them easy to export for audits.

Security, Resilience and Monitoring

Digital lending apps are attractive targets for fraud. Apply secure development practices, regular vulnerability assessment and penetration testing, strong API authentication and rate limiting, device and fraud-risk signals, and an incident response plan aligned with the RBI’s IT and cyber-security expectations for regulated entities. Monitoring the communication channels used for collections is also part of conduct risk.

Reporting and Compliance Dashboards

A single register of DLAs, LSPs, DLG arrangements and complaints helps compliance teams see exceptions early. Useful indicators include the share of loans with a KFS delivered before contract execution, the gap between disclosed APR and actual cost, complaint turnaround time, the number of cooling-off exits, and any mismatch between your internal app register and the CIMS record.

Governance and Operating Model Considerations

Technology cannot compensate for weak governance. REs should maintain a board-approved digital lending policy, carry out due diligence on LSPs before onboarding them (covering data practices, financial soundness and technology security), and review them periodically. Contracts with LSPs should clearly allocate responsibility for data protection, complaint handling, recovery conduct, audit rights and exit.

LSPs, for their part, should expect lenders to ask for evidence such as logs, test reports and screenshots, not just assurances. Training for sales, collections and support teams also matters, because many borrower complaints arise from conduct on calls and messages rather than from the app itself.

Common Compliance Pitfalls to Avoid

Showing indicative rates that differ from the final APR.
Presenting the KFS late, or only inside a bundle of loan documents.
Requesting broad app permissions “just in case”.
Ranking offers by commission without disclosing the logic.
Letting LSP accounts handle disbursal or repayment funds.
Forgetting to update CIMS when an app, white-label version or LSP changes.
Treating cooling-off exits as manual exceptions instead of designed flows.
Using DLG cover without tracking the portfolio cap.

A Practical Compliance Checklist

Use this list as a starting point for an internal review:

Map every digital loan journey and identify the RE, LSP and DLA involved at each step.
Confirm that funds move only between the borrower’s and the RE’s accounts.
Test that the KFS and APR appear before contract execution, and at the offer stage on multi-lender screens.
Document and publish the ranking logic used to order offers.
Audit app permissions, SDKs and data flows against the data rules and the DPDP Act.
Verify the grievance officer’s details across the app, website and KFS.
Reconcile your DLA register with what is reported on CIMS and shown on the RE’s website.
Check credit reporting accuracy, including cooling-off closures.
Review LSP contracts, due diligence files and audit rights.
Run security testing and rehearse an incident response.

How a Lending-as-a-Service Platform Can Help

Many fintechs and channel partners do not want to build all of this alone. A lending infrastructure platform can provide shared building blocks: lender integrations through APIs, a configurable customer journey builder, a business rules engine, lender management and disbursal tracking, and analytics. Roopya’s lending-as-a-service platform, for example, connects channel partners with 25+ lenders through APIs, includes a business rules engine for origination, underwriting and servicing logic, and brings a journey builder and reporting tools into one place. Capabilities like these can make it easier to apply consistent disclosures, keep decision logic documented and keep data audit-ready.

One caution applies to every platform choice: using a platform does not transfer regulatory responsibility. The RE remains accountable, and each LSP should confirm how a platform’s features map to the Directions and to its lender agreements before going live.

The RBI’s Digital Lending Directions, 2025 reward lenders and platforms that treat transparency as a product feature. Clear pricing through the KFS and APR, consent-led data practices, direct fund flows, honest presentation of multiple offers and accurate reporting of every app all point in one direction: borrowers should know who is lending to them, at what cost, and how to complain if something goes wrong.

Teams that design these requirements into their architecture from the start will find audits easier, lender relationships stronger and borrower trust easier to earn. Teams that retrofit them will keep chasing exceptions. If you are planning a digital lending launch or reviewing an existing journey, start with the checklist above, involve compliance and engineering together, and revisit the RBI’s official text regularly as the framework evolves.

Frequently Asked Questions

What are the RBI Digital Lending Directions, 2025?

They are the Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025 (RBI/2025-26/36). They consolidate earlier digital lending guidelines, DLG rules and KFS instructions into one framework, and add rules for multi-lender platforms and mandatory reporting of digital lending apps.

Who must comply with the RBI digital lending rules?

The Directions apply to RBI-regulated entities such as banks and NBFCs. They also reach lending carried out through lending service providers and digital lending apps, because the regulated entity remains fully responsible for the actions of its LSPs and apps.

What is a Key Fact Statement (KFS) in digital lending?

A KFS is a standardised, plain-language summary of a loan’s key terms, including the all-inclusive APR, fees, penal charges, recovery process, cooling-off terms and grievance contacts. Borrowers must receive it before the loan contract is executed.

What is the cooling-off period for digital loans?

It is a window, set by the lender’s board and disclosed in the KFS, during which a borrower can exit the loan without penalty by repaying the principal and proportionate APR. The period must be at least one day, and only a disclosed one-time processing fee may be retained.

Can a lending service provider collect loan repayments directly?

No. Disbursals and repayments must flow directly between the borrower’s and the regulated entity’s bank accounts, without a pass-through or pool account of an LSP. Fees owed to an LSP are paid by the regulated entity, not charged to the borrower.

What is DLA reporting on the RBI CIMS portal?

Regulated entities must report every digital lending app they use, whether their own or an LSP’s, on the RBI’s CIMS portal and keep the list updated. The RBI publishes this as a public directory so borrowers can verify an app’s association with a regulated lender.

What rules apply when an app shows offers from multiple lenders?

Since 1 November 2025, each offer must show the lender’s name, amount, tenor, APR, monthly repayment, penal charges and a KFS link. Offers must be free of deceptive patterns, and any ranking must follow a transparent, pre-disclosed logic.

Does using a lending-as-a-service platform make a lender compliant?

No. A platform can provide APIs, rules engines, journey builders and audit data that make compliance easier, but the regulated entity stays accountable. Always check how a platform’s features map to the Directions and your lender agreements.