RBI's Digital Lending Rules: What Every Borrower and Fintech Must Know
You tap 'Apply' on a loan app at 11 pm. Money lands in your account in nine minutes. Somewhere behind that screen, RBI has spent three years writing rules so that speed doesn't come at the cost of you getting cheated. This is what those rules actually say.
- RBI's core Digital Lending Guidelines were notified via circular RBI/2022-23/111 dated September 2, 2022, following its Working Group on Digital Lending report submitted in November 2021
- All loan disbursals and repayments must move directly between the borrower's bank account and the Regulated Entity's (RE) bank account — the lending app or its partner cannot route money through its own pool account
- Every digital loan must come with a Key Fact Statement (KFS) shown before signing, disclosing the Annual Percentage Rate (APR) and all-in cost, in simple language
- RBI's June 8, 2023 circular capped Default Loss Guarantee (DLG) arrangements — where a fintech promises to cover a lender's losses — at 5% of the outstanding loan portfolio
- Borrowers get a cooling-off period during which they can exit the loan by repaying only the principal plus proportionate interest, with no extra penalty — confirm the exact cooling-off duration and any subsequent circular updates on the official RBI website
- A digital loan is only as legitimate as the regulated bank or NBFC standing behind the app — always check who that entity is, not just the app's name
- Money should never sit in the lending app's own account during disbursal or repayment; if it does, that's a red flag against RBI's direct-flow rule
- The Key Fact Statement's APR figure — not the advertised monthly rate — is the number that tells you the true cost of borrowing
- You likely have a short window after taking a digital loan to cancel it by repaying only the principal plus proportionate interest — check this before assuming you're locked in
What is digital lending, and why did RBI step in?
Digital lending simply means borrowing money through an app or website instead of walking into a branch. It sounds convenient — and mostly it is. But between 2020 and 2022, RBI kept seeing the same complaints: apps charging hidden fees, recovery agents calling at odd hours, and borrowers not knowing who actually owned the loan they took. So RBI built a rulebook to separate the real lender (a bank or NBFC) from the tech layer (the app) that just helps them find customers.
Who is an LSP, and what is a DLA?
Two terms do the heavy lifting in this framework. A Lending Service Provider (LSP) is the company or app that markets the loan, collects documents, or helps with recovery — but does not lend its own money. A Digital Lending App (DLA) is the actual mobile app or web platform used to lend. Only RBI-regulated entities — banks, NBFCs, and a few others — can be the real lender behind any DLA. The app you see is often just a storefront; the money always has to come from a licensed entity sitting behind it.
Why can't the loan app just hold your repayment money?
This is the rule with the biggest real-world bite. Before 2022, many apps collected your EMI into their own account first, then passed it to the actual lender later. That created a black box — nobody outside the app knew how much was collected, held, or delayed. RBI's fix: disbursal and repayment must flow directly between the borrower's account and the regulated lender's account, with no pass-through pooling by the app or any third party in between. Any fee the app earns must be paid by the lender, never deducted from your loan amount.
This is also why the plumbing behind repayments matters. Most digital loans still rely on standing instructions similar to what powers regular auto-debits — worth understanding through NACH vs UPI e-Mandate: How Your Auto-Debit Actually Works in India.
What is a Key Fact Statement, and why should you actually read it?
Before you sign anything, the lender must show you a one-page Key Fact Statement (KFS). It lists the loan amount, tenure, all fees, and — most importantly — the Annual Percentage Rate (APR), which is the true yearly cost including every hidden charge, not just the headline interest rate. Two apps can advertise '1% per month' and still have wildly different APRs once processing fees and insurance add-ons are counted. The KFS exists so you compare apples to apples before you borrow, not after.
What is a Default Loss Guarantee, and why did RBI cap it?
Some fintechs offer to cover a lender's losses if borrowers they've sourced don't repay — this is called a Default Loss Guarantee (DLG). It sounds reassuring, but if unchecked, it can push fintechs to originate riskier loans aggressively since the fintech, not the borrower's actual credit quality, is absorbing the downside. RBI's June 2023 circular capped this guarantee at 5% of the outstanding loan portfolio covered by the arrangement, keeping banks and NBFCs — not fintech balance sheets — as the entities primarily on the hook for lending decisions.
Can you cancel a digital loan after taking it?
Yes — this is the part most borrowers don't know exists. RBI's rules give you a cooling-off period right after disbursal. If you change your mind, you can exit by repaying just the principal and a proportionate share of interest for the days you held the loan, without any prepayment penalty. Confirm the exact number of days for your loan category on the official RBI source, since it can vary by loan type and has been refined across subsequent circulars.
How does this connect to KYC and consent-based lending?
Digital lending doesn't work in isolation — it sits on top of two other RBI frameworks most borrowers never see. Every regulated lender still has to verify your identity under the RBI Master Direction on KYC before disbursing, even if the entire journey happens on a phone screen. And increasingly, apps are pulling your bank statements or income data not by asking for PDFs, but through the Account Aggregator consent framework, where you approve exactly what data moves and for how long. Digital lending rules, KYC rules, and consent-based data sharing are really three layers of the same trust stack.
Questions people ask
It's RBI's rulebook (core circular dated September 2, 2022) that separates the app you see from the licensed bank or NBFC actually lending the money, and sets rules on disbursal, disclosure, and grievance redressal.
No. RBI requires disbursal and repayment to move directly between your bank account and the regulated lender's account, without the app pooling the money in between.
It's a mandatory one-page summary given before you sign a digital loan, showing the total cost, fees, and the Annual Percentage Rate (APR) — the real yearly cost of the loan.
A DLG is when a fintech promises to cover a lender's losses on loans it helped source. RBI's June 2023 circular capped this guarantee at 5% of the loan portfolio covered.
Many digital loans come with a cooling-off period letting you exit by repaying the principal plus proportionate interest, without a penalty. Confirm the exact duration for your loan on RBI's official source, as it can vary.
An LSP is the company or app that helps market, originate, or service a loan without actually lending its own money — the real lender is always a separate RBI-regulated bank or NBFC.