Key Takeaway: The RBI Digital Lending Directions 2025, effective May 8, 2025, and supplemented by a stricter Master Direction on March 1, 2026, create a comprehensive compliance framework for all digital lending activities in India. Key rules include direct disbursal from RE to borrower (no LSP pool accounts), mandatory Key Fact Statement with all-in APR, 5% cap on First Loss Default Guarantee, and a public DLA directory. Non-compliance can result in suspension of lending operations, making this the most consequential regulatory change for Indian fintech since UPI.
Table of Contents
- 1. Overview of the Framework
- 2. Direct Disbursal: The Top Enforcement Priority
- 3. Key Fact Statement and APR Disclosure
- 4. First Loss Default Guarantee (FLDG/DLG) Rules
- 5. DLA Directory and SRO Regime
- 6. Collection Practice Rules (March 2026)
- 7. Borrower Rights and Grievance Redressal
- 8. Frequently Asked Questions
1. Overview of the Framework
The Reserve Bank of India (Digital Lending) Directions, 2025 represent the culmination of a multi-year regulatory process that began with the Working Group on Digital Lending in 2022. The Directions, issued on May 8, 2025, consolidated a scattered set of earlier circulars into one unified rulebook covering every aspect of digital lending in India. A Master Direction supplement on March 1, 2026 tightened several provisions, particularly around the Key Fact Statement, fee disclosure, and collection practices.
The framework applies to all Commercial Banks, Primary (Urban) Co-operative Banks, State/Central Co-operative Banks, Non-Banking Financial Companies (including HFCs), and All-India Financial Institutions. It also materially affects Lending Service Providers (LSPs), Digital Lending Apps (DLAs), and any fintech startup that touches borrower acquisition, credit assessment, loan offer display, document flow, data collection, repayment, or recovery support.
2. Direct Disbursal: The Top Enforcement Priority
The single most important rule in the framework is the direct disbursal requirement. Loan funds must flow directly from the regulated entity (bank or NBFC) to the borrower’s bank account, and repayments must flow directly back to the RE. No intermediate LSP pool account is permitted anywhere in the disbursal or repayment path.
This is RBI’s number one enforcement priority. Two mid-sized NBFCs had co-lending arrangements suspended in Q4 2025 for failing this rule — and a suspension effectively ends a lending business. For fintech founders, confirming that the fund-flow architecture is genuinely direct, with no pool account anywhere, is the first compliance item to check.
The March 2026 supplement reinforced this with stricter reporting requirements, requiring REs to document and verify the entire fund-flow chain for every lending product.
3. Key Fact Statement and APR Disclosure
Every borrower must receive a digitally signed, time-stamped Key Fact Statement (KFS) before loan sanction. The KFS must show the all-inclusive Annual Percentage Rate (APR) — interest plus every fee expressed as a single rate — along with the recovery mechanism and cooling-off terms. The March 2026 supplement made the KFS format more prescriptive and required it to be tamper-evident.
This is the rule that catches the most fintechs. Audits routinely reject a KFS where the APR excludes processing fees or the document is not tamper-evident. For founders, the actionable requirement is: build the KFS generation and delivery into the product workflow, not as a PDF that can be buried in a terms page, but as a prominent disclosure the borrower sees and acknowledges before accepting the loan.
The cooling-off period gives borrowers the right to cancel a loan within three days of disbursement without penalty. During this period, the borrower can return the principal amount, and the lender must cancel the loan with zero charges.
4. First Loss Default Guarantee Rules
The FLDG/DLG regime has been one of the most frequently amended parts of the framework. A First Loss Default Guarantee from an LSP to a lender is capped at 5% of the covered loan portfolio, must be in cash, bank guarantee, or lien-marked deposit form, and requires board approval at the RE. Corporate and soft guarantees do not count.
RBI removed DLG from provisioning calculations in May 2025, then restored recognition from February 2026 under strict Ind AS-aligned conditions. The ECL (Expected Credit Loss) must be recalculated each time DLG is used. This back-and-forth has made DLG one of the most carefully watched compliance areas, and founders should verify the current cap before relying on any specific figure.
The Directions also restrict DLG arrangements for revolving credit facilities and credit cards, and for loans covered by government credit guarantee schemes.
5. DLA Directory and SRO Regime
RBI operationalized a public directory of Digital Lending Apps on its CIMS portal effective July 1, 2025. Every RE must report all DLAs they deploy or join — whether their own or those of LSPs. The directory helps customers verify whether a lending app is genuinely associated with a regulated entity.
RBI also approved FACE (Fintech Association for Consumer Empowerment) as the self-regulatory organization (SRO) for digital lending. SRO membership is expected to become best practice, if not effectively necessary, for LSPs and DLAs. The SRO is responsible for monitoring member compliance, handling industry-level complaints, and recommending additional regulatory measures to RBI.
For founders, this means app identity and partner mapping must be clean. Internal records must clearly map app name, regulated entity partner, LSP role, product category, website and app store details, borrower-facing disclosures, and change history. This also affects M&A and fundraising diligence — investors will ask whether DLAs and RE partnerships are reported, documented, and aligned.
6. Collection Practice Rules (March 2026)
The March 1, 2026 supplement specifically regulated recovery and collection practices for the first time. Agents cannot contact a borrower before 8 AM or after 7 PM. They cannot contact family members who are not co-borrowers. They cannot use social media or messaging platforms to share default information with anyone but the borrower.
Post-sanction fees disguised as administrative or convenience charges that were not disclosed in the KFS are now explicit violations. Late payment penalties are capped at 2% per month of the overdue amount, preventing the compounding of excessive penalty fees.
Regulatory responsibility sits with the RE, not the LSP, even when the LSP is the customer-facing brand. You cannot contract your way out of compliance. This is why bank and NBFC partners now audit their fintech LSPs rigorously, and why a weak compliance posture can cost you the partnership before it costs you a penalty.
7. Borrower Rights and Grievance Redressal
Borrowers have several new rights under the framework. The right to prepayment or foreclosure without penalty applies to all floating-rate loans and any loan where the interest rate changes during tenure. Lenders must provide a clear repayment schedule in the borrower’s preferred language.
Every RE must have a registered grievance redressal officer. Complaints must be acknowledged within 24 hours and resolved within 30 days. If unsatisfied, borrowers can escalate to the RBI’s ombudsman scheme for digital lending.
The right to be forgotten for rejected applications means lenders must delete all borrower data collected during the application process within 30 days unless the borrower explicitly consents to retention for future offers. Blanket consent for accessing phone contacts, photos, and SMS is illegal.
Data localization is a central requirement: all borrower data must be stored on servers located within India. DLAs cannot transfer borrower data outside the country without explicit RBI approval.
8. Frequently Asked Questions
Do the RBI Digital Lending Directions apply directly to fintech startups?
The Directions are issued for regulated entities (banks and NBFCs). However, fintech startups acting as LSPs, DLA operators, or technology partners are affected through partner contracts, audits, disclosures, and operational controls. Banks now push stricter obligations onto their LSPs.
What is the penalty for non-compliance?
Non-compliance can result in penalties of up to Rs 1 crore per violation. For serious violations — including unauthorized data sharing or operating without registration — RBI can direct MeitY to block the lending app. Suspension of co-lending arrangements has already occurred for two NBFCs.
What is the cooling-off period for digital loans?
Borrowers have a three-day cooling-off period after loan disbursement during which they can return the principal amount and cancel the loan without any charges or penalties.
How can borrowers verify if a lending app is registered?
RBI publishes a whitelist of registered digital lending apps on its official website through the CIMS portal. Apps not on the whitelist are operating without RBI approval.
What data can lending apps collect under the new rules?
Only data directly necessary for credit assessment and loan servicing. Access to phone contacts, call logs, SMS, and device files is prohibited unless the borrower explicitly consents for a specific, disclosed purpose.
Related Reading
- CIBIL Score Rules 2026: How RBI’s New Credit Reporting Framework Affects Your Loan Eligibility
- Digital Rupee CBDC: India’s Central Bank Digital Currency Progress
Sources
- Reserve Bank of India — Digital Lending Directions 2025 Notification
- EQMINT — RBI Fintech Regulation 2026: What Founders Need to Track
- PIB India — Government and RBI Strengthen Measures Against Fraudulent Loan Apps
- Bhavya Sharma and Associates — RBI Digital Lending Directions: Fintech Founder Checklist
Disclosure: This article provides educational information about RBI regulations and does not constitute legal or financial advice. Please consult qualified legal counsel for compliance guidance specific to your business.
