The app may market, score and service the loan. The regulated bank or NBFC behind it remains responsible for the credit relationship and borrower protection.
RBI Directions, 2025
KFS and APR
Borrower to lender
Need-based consent
The Reserve Bank of India (Digital Lending) Directions, 2025 consolidate requirements for regulated entities and their lending service providers. They apply to digital lending by banks, specified co-operative banks, NBFCs including housing finance companies and all-India financial institutions.
Borrowers should see the regulated entity’s name, loan amount, tenor, APR, monthly repayment obligation, penal charges and a link to the KFS. Digitally signed loan documents should flow to the registered email or SMS channel.
The directions also restrict pass-through fund flows and unnecessary mobile-data access. The regulated entity remains responsible even when an LSP operates the interface.
| Stage | What happens | Control |
|---|---|---|
| Offer | The app presents one or more lender offers. | Compare lender, APR, instalment and charges. |
| Contract | The borrower receives KFS and signed documents. | Save them before disbursal. |
| Money | Disbursal and repayment normally flow directly between borrower and lender. | Avoid personal or pool accounts. |
| Data | Collection must be need-based with explicit consent and audit trail. | Reject access to contacts and call logs. |
Start with the exact decision being made. A payment choice, credit facility, investment, policy, remittance or compliance step should not be judged only by convenience or headline return. For Digital Lending: Finding the Real Lender, the four useful lenses are main rule: RBI Directions, 2025; disclosure: KFS and APR; fund flow: Borrower to lender; data rule: Need-based consent.
Next, identify the downside before considering the expected benefit. Ask how much money can be lost or delayed, which obligation becomes fixed, who controls the data or asset, what happens when the provider fails, and which official complaint or appeal route remains available. This converts a marketing claim into a testable decision.
Finally, define the review trigger. A rule change, missed payment, benefit revision, sharp market move, data incident, unresolved reconciliation or change in personal cash flow should reopen the decision. Evidence should be collected when the transaction occurs, not reconstructed after a dispute.
| Participant | Primary responsibility | Failure to avoid |
|---|---|---|
| User or customer | Read the terms, authorise deliberately, preserve records and act within personal cash-flow or risk limits. | The lender’s name is hidden. |
| Provider or intermediary | Make accurate disclosures, operate the agreed process, protect data or assets and maintain a usable grievance route. | The app requests contacts or call logs. |
| Adviser or finance team | Apply the current rule to the actual facts, separate assumptions from evidence and explain material downside clearly. | Repayment goes to a personal account. |
Regulation can allocate duties, but it cannot remove commercial or market risk. The safest operating approach is to know which participant owns each step and to escalate an exception before money, data or legal rights become difficult to recover.