RBI issues Reserve Bank of India (Digital Lending) Directions, 2025

Business Standard

09-05-2025

The Reserve Bank of India (RBI) has issued Reserve Bank of India (Digital Lending) Directions, 2025 yesterday. Reserve Bank of India has from time to time issued various directions and circulars on digital lending by Regulated Entities (REs). As part of the efforts to consolidate various regulatory instructions and streamline them, consolidated directions on the subject have been prepared and issued as the Reserve Bank of India (Digital Lending) Directions, 2025 today. Further, instructions on two key aspects have also been included as part of these Directions for the first time. These include Instructions on Digital Lending Transparency in Aggregation of Loan Products from Multiple Lenders and Instructions regarding operationalization of the Public Directory of Digital Lending Apps (DLAs) as announced in the Statement on Developmental and Regulatory Policies dated August 08, 2024. The list of DLAs is being made available on the website for the limited purpose of aiding the customers in verifying the claim of a DLAs association with a RE. Here are the major guidelines set by the central bank:
Digital lending by a RE involving a LSP, shall be carried out under a contractual agreement between the RE and the LSP, which clearly defines the respective roles, rights, and obligations of each party thereto. RE shall conduct enhanced due diligence before they enter into an agreement with a LSP for digital lending, taking into account LSP's technical capabilities, robustness of data privacy policies and storage systems, fairness in conduct with borrowers, past records of conduct and ability to comply with all applicable regulations and statutes.RE shall carry out periodic review of the conduct of the LSP vis-?-vis the terms of the contractual agreement and shall take appropriate action in the event of any deviation therefrom.
RE shall obtain the necessary information relating to economic profile of the borrower with a view to assessing the borrower's creditworthiness before extending any loan, including, at a minimum, age, occupation and income details. The same shall be kept on record for audit purposes. RE shall ensure that there is no automatic increase in credit limit unless an explicit request is received, evaluated and kept on record from the borrower for such increase.
Disbursement of loan by the RE shall always be made into the bank account of the borrower except for disbursals covered exclusively under statutory or regulatory mandate (of RBI or of any other regulator), flow of money between REs for co-lending transactions6 and disbursals for specific end use, provided the loan is disbursed directly into the bank account of the end-beneficiary7. RE shall ensure that in no case, disbursal is made to a third-party account, including the accounts of LSP, except as provided for in these Directions.
The borrower shall be given an explicit option to exit a digital loan by paying the principal and the proportionate APR without any penalty during an initial "cooling-off period". The cooling off period shall be determined by the Board of the RE as laid down in their loan policy, subject to the period so determined not being less than one day. For borrower continuing with the loan even after cooling-off period, pre-payment shall continue to be allowed as per applicable RBI guidelines.
The RE, and the LSP which has an interface with the borrower, shall designate nodal grievance redressal officers to deal with digital lending related complaints/ issues raised by the borrower. Contact details of the nodal grievance redressal officers shall be prominently displayed on the websites of the RE, its LSP and on the DLA, as well as in the KFS provided to the borrower. The facility of lodging complaint shall also be made available on the DLA and on the website as stated above. It is reiterated that responsibility of grievance redressal shall continue to remain with the RE.
RE shall ensure that any collection of data by their DLA and DLA of their LSP is need-based and with prior and explicit consent of the borrower having audit trail. In any case, RE shall also ensure that DLA of RE/LSP desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions, etc. A one-time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/ KYC requirements only, with the explicit consent of the borrower.
RE shall ensure that LSP engaged by them do not store personal information of borrower except some basic minimal data (viz., name, address, contact details of the customer, etc.) that may be required to carry out their operations or service within the scope of the RE-LSP agreement. Responsibility regarding data privacy and security of the customer's personal information on an ongoing basis shall be that of the RE.
As per the provisions of the Credit Information Companies (CIC) (Regulation) Act, 2005; CIC Rules, 2006; CIC Regulations, 2006 and related guidelines issued by RBI from time to time, RE shall ensure that any lending done through their DLAs and/ or DLAs of LSPs is reported by them to CICs irrespective of its nature/ tenor.
RE, including a RE acting as DLG provider, shall put in place a Board approved policy before entering into any DLG arrangement. Such policy shall include, at a minimum, the eligibility criteria for DLG provider, nature and extent of DLG cover, process of monitoring and reviewing the DLG arrangement, and the details of the fees, if any, payable to/ received by the DLG provider, as the case may be.