Guidelines to protect interest of borrowers

RBI's Digital Lending Guidelines — first issued in 2022 and progressively expanded through 2026 — have re-architected how loans are sourced, disbursed and serviced online in India. The framework places the regulated entity (RE) firmly at the centre of accountability, sharply curtails the role of unregulated app-only lenders, and gives borrowers enforceable rights that did not exist a few years ago.

Who is covered

The guidelines apply to all Regulated Entities (banks, NBFCs and select cooperative entities) and to any Lending Service Provider (LSP) acting on their behalf. They cover all loans originated digitally — through apps, websites, embedded finance partnerships, BNPL constructs and platform-based credit. Group lending and certain microfinance products have specific overlays.

Core borrower-protection principles

• All loan disbursals and repayments must flow directly between the borrower's bank account and the RE's bank account — no pass-through accounts of LSPs.
• Any fees paid to the LSP must be borne by the RE, not the borrower.
• Mandatory disclosure of the Annual Percentage Rate (APR) — capturing all fees, charges and interest — before loan acceptance.
• Standardised Key Fact Statement (KFS) in a prescribed format that the borrower must receive before signing.
• Cooling-off / look-up period during which the borrower can exit the loan by repaying principal and proportionate APR, without penalty.
• Loan agreement and all communications in a language understood by the borrower.

Data, privacy and consent

1. Explicit, granular borrower consent for data collection — purpose-bound and time-bound.
2. Strict prohibition on access to contacts, gallery, files and other phone resources except where directly relevant to the loan service.
3. Data must be stored on servers within India, with explicit DPDP Act compliance.
4. Borrowers can withdraw consent and require deletion of personal data subject to legal retention requirements.
5. All LSPs must publish their privacy policy and grievance officer details prominently.

Recovery practices and limits

Recovery agents and LSPs must follow the RBI Fair Practices Code — contact only during prescribed hours, no harassment, no contacting references unless authorised, and no public shaming. The RE remains directly responsible for any recovery practice deployed by its LSP. Borrowers can complain to the RE's grievance redressal officer and escalate to the RBI Integrated Ombudsman if unresolved in 30 days.

Disclosures and the borrower-facing experience

• Borrower must see the RE's name (not just the app's name) in every credit decision communication.
• Sanction letter and signed loan agreement must be delivered to the borrower's registered email/SMS/app.
• Loan account statement on demand, with full charge break-up.
• Display of APR, fees, late payment policy, conversion to NPA, and recovery process in plain language.
• Co-lending and FLDG arrangements have specific disclosure formats.

Penalties and enforcement

RBI has progressively used its supervisory toolkit — including fines, app delistings (via DLAB), business restrictions and cease-and-desist directions — against non-compliant LSPs and partner REs. The Digital Lending Apps (DLA) framework requires REs to publish whitelists of approved DLAs, and any DLA not whitelisted is liable to be taken down.

FLDG and co-lending overlays

First Loss Default Guarantee (FLDG) arrangements between REs and LSPs are now permitted but capped at a prescribed percentage (around 5% of the underlying loan portfolio at the time of disbursal) and subject to disclosure norms. The RE remains the lender of record, holds the regulatory provisioning, and accounts for the FLDG amount as recovery support, not as a balance-sheet reduction. Co-lending under the RBI Co-Lending Model overlays additional disclosure and back-end accounting requirements on the lead lender.

What a compliant digital loan journey looks like

• Borrower opens app or website of an LSP onboarded by a specified RE; LSP/RE relationship is disclosed upfront.
• Borrower views the RE name, product summary, indicative APR, fees and grievance officer details.
• Eligibility check uses only purpose-bound data with explicit consent.
• Pre-sanction Key Fact Statement (KFS) is delivered with itemised APR before any electronic signature.
• Cooling-off period offered; borrower can exit by repaying principal and proportionate APR.
• Disbursement and repayment flow directly between borrower and RE bank accounts; no LSP pass-through.
• Recovery operations follow the Fair Practices Code; grievances escalate to RE and then to RBI Integrated Ombudsman.

Conclusion

If you are a borrower, the rules now genuinely shift power your way — APR, KFS, cooling-off and direct-account flows are non-negotiable. If you operate or partner with a digital lender, treat the guidelines as the operating manual; the enforcement appetite is high and the reputational cost of breach is higher. Legitimacy is now both a moral and a market-share question.