RBI Notifies Reserve Bank Of India (Digital Lending) Directions, 2025

Introduction

The Reserve Bank of India (RBI) has issued the Digital Lending Directions, 2025, a comprehensive regulatory framework aimed at ensuring the orderly growth of digital lending while safeguarding the interests of borrowers and promoting responsible innovation in the credit ecosystem. These Directions consolidate and update prior instructions, while introducing additional safeguards aimed at fostering innovation with accountability in India’s digital credit market.

Scope and Applicability

The Directions apply to all digital lending activities carried out by regulated entities (REs), which include commercial banks, co-operative banks, non-banking financial companies (NBFCs), housing finance companies, and all-India financial institutions.

These Directions govern every aspect of the digital lending process right from customer acquisition and credit underwriting to disbursal, recovery, data handling, and customer grievance redressal. They also apply to Lending Service Providers (LSPs) that perform one or more functions on behalf of an RE, as well as the Digital Lending Apps (DLAs) used by REs or their LSPs. Importantly, the Directions extend to REs partnering with multiple LSPs or operating through multiple DLAs, thereby creating a uniform regulatory framework across the ecosystem. The provisions are effective from 09.05.2025. Specific compliance timelines have also been prescribed, with some provisions becoming effective from June 15 and November 1, 2025

Key Highlights

1. Due Diligence and LSP Oversight:

REs must carry out enhanced due diligence before engaging with any Lending Service Providers (LSPs) and periodically review such relationships. The LSPs must comply with all RBI outsourcing and digital lending norms. Importantly, any outsourcing by REs does not absolve them of responsibility for borrower outcomes.

2. Fair and Transparent Borrower Engagement:

The Directions mandate:

• Disclosure of a Key Fact Statement (KFS) before loan disbursal.
• Clear indication of Annual Percentage Rate (APR) and other charges.
• Provide a “cooling-off period” (minimum one day) for borrowers to exit loans without penalty, except for a disclosed processing fee
• No automatic increase in credit limits without explicit borrower consent.

3. Disbursal and Repayment Protocols:

Loans must be disbursed directly to the borrower’s account, with servicing and repayments routed through the RE’s account—no pass-through via LSP accounts. Exceptions exist for specific regulatory end-uses and co-lending arrangements.

4. Data Protection and Technology Standards:

Data governance is a core focus. REs and LSPs are required to:

• Obtain explicit borrower consent before collecting or sharing personal data.
  Limit access to mobile phone resources and store data only on Indian servers.
  Publish a comprehensive privacy policy and disclosures of third parties accessing borrower data.
• Storage of all personal data within servers located in India
• Comply with RBI’s cybersecurity standards.
• REs remains responsible for the actions and data practices of their LSPs and DLAs.

5. Digital Lending Apps (DLAs) and Reporting:

All loans including short-term or deferred payments must be reported to Credit Information Companies (CICs). REs must report all DLAs (owned or operated by LSPs) on RBI’s Centralised Information Management System (CIMS) portal by June 15, 2025. A public directory of DLAs will be maintained by RBI.

6. Default Loss Guarantee (DLG) Framework:

DLG arrangements—where LSPs guarantee part of the RE’s loan losses—are allowed with safeguards:

• DLG providers must be companies registered under the Companies Act.
• Cap of 5% of the disbursed loan portfolio.
• Permissible forms: cash, fixed deposit with lien or bank guarantee         
• No revolving credit or credit card DLGs.
• DLG must not substitute robust credit underwriting.

REs must invoke DLGs within 120 days of default and cannot reinstate a guarantee once invoked. All such arrangements must be transparently disclosed on the LSP’s website.

7. Customer Redressal and Accountability:

Borrowers can escalate complaints unresolved within 30 days to the RBI’s Complaint Management System or file written complaints with RBI’s Chandigarh office. REs remains fully accountable for customer grievances arising from the acts of their LSPs.

Conclusion

The 2025 Directions mark a significant regulatory leap to safeguard borrowers and bring uniformity in digital lending practices. By enhancing data governance, curbing mis-selling, regulating LSP engagements, and ensuring borrower-friendly terms, the RBI aims to uphold integrity and public confidence in India’s digital credit infrastructure.