Digital Lending Rules 2025: A Borrower’s Safety Checklist
1. Current position
The Reserve Bank of India (Digital Lending) Directions, 2025 apply to regulated banks, co-operative banks, NBFCs including housing finance companies, and specified institutions. They require credit assessment, KFS and APR disclosure, direct disbursal and repayment flows, cooling-off, grievance officers, data controls, credit-bureau reporting and reporting of digital lending apps by regulated entities.
2. How it works in practice
The DLA directory is not an RBI endorsement of an app or return promise. RBI states that app information is submitted by regulated entities and inclusion should not be marketed as authorisation. Borrowers should verify the lender on its official website and avoid apps demanding contacts, call logs or unnecessary device data.
A reliable decision separates the legal rule, the commercial contract and the actual cash flow. A regulatory permission does not guarantee suitability, and a product label does not override the substance of the transaction.
3. Key rules and measurement boundaries
| Item | Position | How to read it |
|---|---|---|
| Borrower document | KFS with APR and charges | Receive before/at contract |
| Fund flow | Borrower/end-beneficiary and regulated entity | No unauthorised pass-through pool |
| Complaint escalation | Regulated entity, then RBI CMS if eligible | Lender remains responsible for LSP |
4. Practical example
A loan app offers ₹20,000 instantly but credits ₹17,000 after an unexplained deduction and demands ₹22,000 in seven days. The borrower should compare the KFS, APR and disbursal record. If the lender is hidden or repayment is sought to a personal account, stop and report the conduct rather than paying an unknown collector.
5. Action checklist
- Confirm the regulated lender and its official website.
- Read KFS, APR, fees, penal charges and repayment schedule.
- Check that disbursal and repayment follow permitted account flows.
- Use cooling-off rights within the disclosed period if appropriate.
- Deny unnecessary device permissions and preserve consent records.
6. Evidence and document checklist
- KFS, sanction letter and signed loan agreement.
- Bank statement showing disbursal and repayment.
- App permissions and privacy policy screenshots.
- Recovery-agent identity communication.
- Complaint reference and credit report.
7. Common mistakes
- Comparing only the disbursed cash with instalment.
- Assuming app listing equals RBI approval.
- Paying a collector’s personal account.
- Giving access to contacts or call logs.
8. Red flags
- No lender name or KFS.
- Threats to contact family or publish data.
- Upfront fee to “release” an approved loan.
- Automatic limit increase without request.
9. Complaint or escalation route
Complain to the regulated entity and its nodal grievance officer. If rejected, unsatisfactory or unanswered for 30 days, use RBI CMS where covered. Harassment, extortion or data misuse should also be reported to police/cybercrime authorities.
10. FAQs
Does RBI approve every app in the DLA directory?
No. RBI states that publication of submitted app data is not registration, authorisation or endorsement.
What is APR?
A standardised annual measure that incorporates interest and specified charges, enabling better comparison.
Can an LSP collect repayment in its account?
The directions generally require repayment directly to the regulated entity, subject to specified exceptions.
Can a borrower exit immediately?
The directions require an explicit cooling-off option for at least the lender’s board-approved minimum, not less than one day.
11. Official sources
- RBI — Digital Lending Directions, 2025
- RBI — Digital lending FAQs
- RBI — Integrated Ombudsman Scheme FAQs
Information date: 20 June 2026. Rates, thresholds, portal processes and live proceedings can change; use the linked official material for the transaction or filing date.