RBI Digital Lending Guidelines Compliance: Tech Checklist
RBI Digital Lending Guidelines Compliance: A Technology Checklist for NBFC and Fintech Leadership
Last reviewed: November 2026
RBI digital lending guidelines compliance means proving that every loan you source, sanction or service through an app follows the RBI's rules. Those rules cover LSP partners, fund flows, disclosures, data storage, app reporting and loss guarantees.
Most of these rules cannot be met with a policy document alone. This guide maps each obligation to the system control that enforces it, for CEOs, Chief Compliance Officers and CTOs.
Key Takeaways
- The RBI consolidated its digital lending rules on 8 May 2025, then moved them into entity-wise Credit Facilities Directions on 28 November 2025.
- The lender stays fully liable for its LSPs, so partner controls must be enforced in systems, not just contracts.
- Disbursals go to the borrower's account and repayments come to the lender's account, with no LSP pool accounts.
- All data must sit on servers in India, and every app must be reported on the RBI's CIMS portal.
What Are the RBI Digital Lending Guidelines Today?
The RBI digital lending guidelines are the rules for lending through a mobile or web app. They now sit inside consolidated directions, not a standalone circular.
| Instrument | Date | Status |
|---|---|---|
| Guidelines on Digital Lending | 2 September 2022 | Repealed |
| Reserve Bank of India (Digital Lending) Directions, 2025 | 8 May 2025 | Withdrawn on consolidation |
| NBFC Credit Facilities Directions, 2025 (Chapter III) | 28 November 2025 | In force for NBFCs |
Commentary indicates the substance carried over, but paragraph numbers changed. Update the references in your policies and LSP contracts.
Who Must Comply?
The rules apply to commercial banks, co-operative banks, NBFCs including housing finance companies, and All-India Financial Institutions. Fintech LSPs are not licensed under them, but the lender must ensure they comply.
Payment aggregators that only provide payment services are outside scope. A payment aggregator that also acts as an LSP must meet the LSP obligations.
What Counts as a DLA and an LSP?
A digital lending app (DLA) is any mobile or web app that facilitates digital lending. That includes your own app and every app run by your LSPs.
A lending service provider (LSP) is your agent for one or more lending functions, such as sourcing, underwriting support, pricing support, servicing, monitoring or recovery. Another regulated entity can also act as your LSP.
The RBI holds the lender "fully responsible and liable" for the acts and omissions of its LSPs.
What Do the Rules Require From Your Systems?
Each obligation needs a system control and an evidence trail. The table below shows both.
| Obligation | What the Rules Require | System Control |
|---|---|---|
| LSP oversight | Contract, due diligence and periodic review | LSP register linking contracts, apps and reviews |
| Multi-lender offers | Show all matching offers and name unmatched lenders | Documented matching logic and offer logs |
| Borrower profile | Age, occupation and income before lending | Mandatory origination fields |
| Credit limits | No automatic increases | Increases blocked without a logged borrower request |
| KFS | KFS with APR, signed documents sent automatically | KFS generated from the loan booking engine |
| Fund flows | Disburse to borrower, collect into lender account | Payment links settle only to lender accounts |
| Cooling-off | Penalty-free exit for at least one day | Exit flow charging principal and proportionate APR |
| Grievances | Nodal officers, Ombudsman route after 30 days | Complaint ageing tracked by LSP |
| Data | Explicit consent, no contacts or media access, India servers | Permission audits and vendor hosting checks |
| Credit reporting | Report all DLA loans to bureaus | Short-tenor products in bureau files |
| CIMS reporting | Report every app, certified by the CCO | No partner app live before reporting |
| Default loss guarantee | 5% cap, invoked within 120 days overdue | Fixed DLG portfolios with cap tracking |
Why Do Fund Flows and Data Need the Most Attention?
In both areas, a partner's technology can put you in breach without your team touching the loan.
Fund flows. Disbursals must go to the borrower's own bank account, except for statutory mandates, co-lending flows between regulated entities and specific end-use payments. Repayments must go straight into the lender's account, with no pass-through or pool account of an LSP.
You pay LSP fees directly, and the LSP cannot recover them from borrowers. Cash recovery on delinquent loans is a narrow exception, and it must be credited to the borrower's account on the same day.
Data. Collection must be need-based, with explicit consent and an audit trail. DLAs cannot access files, media, contact lists, call logs or telephony functions, though one-time camera, microphone or location access is allowed for KYC with consent.
All data must be stored on servers in India. Data processed abroad must be deleted there and brought back within 24 hours, and LSPs may keep only minimal data such as name, address and contact details.
What Changed for Multi-Lender Marketplaces?
Since 1 November 2025, an LSP working with several lenders must show a digital view of all matching offers. It must also name the lenders whose offers did not match.
Each offer must show the lender's name, amount, tenor, APR, monthly repayment and any penal charges, with a link to that lender's KFS. The display must be unbiased, with no dark patterns, and the matching logic must be documented and applied consistently.
If you lend through a marketplace, ask for its matching logic and screenshots of the offer view. Digiqt's embedded lending matching AI agent shows how matching can be made consistent and auditable.
Digiqt's compliance policy mapping AI agent links regulatory clauses to internal controls. That link matters when paragraph numbers change, as they did in November 2025.
Could your team show which LSPs, apps and loan books each RBI obligation applies to?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending journeys with compliance controls built in.
How Does a Compliance Review Work in Practice?
A compliance review tests live journeys against each rule, partner by partner. In this illustrative scenario, an NBFC lends through three LSPs.
| Check | LSP A (Consumer App) | LSP B (Marketplace) | LSP C (Employer Platform) |
|---|---|---|---|
| Reported on CIMS | Yes | Yes | No |
| Repayments into NBFC account | Settle to LSP account | Yes | Yes |
| Contacts access | Requested | No | No |
| Unmatched lenders disclosed | Not applicable | Not shown | Not applicable |
| Data hosted in India | Yes | Vendor abroad | Yes |
Five gaps appear, and the NBFC is liable for each one. Most fixes are technical rather than legal.
LSP A must switch its payment links to settle into the NBFC's account and drop the contacts permission in its next release. LSP B must add unmatched lenders to its offer view and move its vendor's processing to India.
LSP C's app must be reported on CIMS and certified before it takes more applications.
Now test the cooling-off flow. A borrower takes ₹50,000 at an 18% APR and exits on day 2, so the proportionate APR is ₹50,000 × 18% × 2 ÷ 365, or about ₹49.
The borrower repays about ₹50,049, plus any one-time processing fee disclosed in the KFS. No prepayment penalty applies.
Finally, the DLG check. If LSP A guarantees a fixed portfolio with ₹40 crore disbursed, the maximum guarantee is 5% of that, or ₹2 crore.
The lesson for leadership: most breaches sit in partner technology you do not run. Controls should block a non-compliant journey before go-live.
Should You Fix Your Current Stack or Rebuild?
Not every gap needs a new platform. Use this table to decide.
| Situation | Route |
|---|---|
| KFS figures sometimes differ from the booked loan | Fix: generate the KFS from the pricing engine |
| An LSP collects repayments in its own account | Fix urgently: re-route to lender-owned accounts |
| Consent is one checkbox for all purposes | Rebuild the consent layer for purpose-level consent |
| The core system cannot support cooling-off exits or DLG tagging | Consider a platform upgrade |
Fix where the gap is a single process. Rebuild where several obligations depend on a system that cannot hold the data.
Which Compliance Mistakes Do Digital Lenders Make?
Each of these mistakes is cheap to prevent and expensive to fix later.
- Citing repealed rules. Old policies miss newer duties such as multi-lender disclosures.
- Treating LSP compliance as the LSP's problem. The lender stays fully liable, whatever the contract says.
- Missing vendor data. Analytics tools that process data abroad still fall under the India storage rule.
- Marketing a CIMS listing as RBI approval. A listing is not an endorsement.
Where Can AI and Automation Help With Compliance?
Automation helps most with repetitive checks across many partners and loans. It does not replace the board's accountability or the CCO's certification.
Useful tasks include tracking complaint ageing against the 30-day limit, auditing app permissions in each release and reconciling repayment flows daily. Digiqt's complaints and regulatory reporting AI agent and consumer data request AI agent cover two of these tasks.
What Is Changing Next?
The framework changed twice in 2025, and more change is likely. Track amendments on the RBI's notifications page.
In August 2026, the RBI released a draft that would stop most NBFCs offering revolving credit products. Lenders with digital credit lines should assess their products now.
For where automation fits across the loan lifecycle, see AI agents in digital lending. If your stack cannot support these controls, a purpose-built digital lending platform may cost less than workarounds.
Want every LSP partner to pass these checks before go-live?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we keep onboarding, disbursal and reporting aligned with RBI rules.
