Quick Summary
Digital lending apps have grown rapidly as borrowing seem quick and easy loans with minimal paperwork.
However, many borrowers face issues like harassment, hidden fees and personal data misuse by lending agents after taking loans from such apps.
To address this, the Reserve Bank of India has introduced strict rules to clean up the digital lending space.
This new rules aim to balance innovation with consumer protection, tighten oversight of Lending Service Providers (LSPs) and ensure secure and ethical lending practices.
Applicable To
These rules are applicable to:
- All Commercial Banks
- Co-operative Banks
- NBFCs (non-banking financial companies)
- All India Financial Institutions (AIFIs) like NABARD, SIDBI
- Lending Service Provider (LPAs) and Digital Lending Apps (DLA's) such as InstaRupee, RapiRupee etc. partnering with Regulated Entities.
Major Rules in Digital Lending Direction
Transparency & Borrower Rights
- Lenders must now show a comprehensive list of all available digital loan option like loan amount, interest rates, tenures, repayment schedules, late fees, penalties upfront to borrowers and Identity of lending institution.
- Digital lending apps must clearly mention partnership details with Regulated Entities (like Axis Bank, SBI, etc.) — ensuring borrowers know who’s actually giving the loan.
- This prevents mis selling and coercive upselling by Lending Service Providers.
Loan Disbursement and Repayment
- All the funds must directly flow between the borrower’s and the Regulated Entity's bank accounts.
- No third-party wallets or intermediaries are allowed to handle the money.
- Auto-debit of EMIs from borrower accounts is not allowed without prior consent, protecting borrowers from unauthorized debits.
Data Privacy Measures
- Borrowers must be informed clearly what data is being collected.
- Lending Apps cannot access such as Phone contacts, Media Files, Call Logs, SMS Inbox without explicit, need based consent.
- Consent must be revocable and data usage must be minimized.
- All collected data must be stored on servers located in India.
- If processed abroad , it must be erased from foreign servers and re-imported with 24 hours.
Digital Lending App Verification
- All the Regulated Entities must submit details of DLAs they work with on CIMS portal by 15th June 2025.
- By 1st July 2025, RBI will publish a public directory of DLAs i.e., list of valid Digital Lending App.
- Unlisted DLAs will be considered unauthorized.
The rules apply to all Commercial Banks, Co-operative Banks, NBFCs, All India Financial Institutions (AIFIs), Lending Service Providers (LSPs), and Digital Lending Apps (DLAs) that partner with Regulated Entities.
Lenders must clearly show all loan options, including loan amount, interest rates, tenures, repayment schedules, late fees, and penalties. They must also disclose the identity of the lending institution and partnership details with Regulated Entities.
All funds must flow directly between the borrower's and the Regulated Entity's bank accounts. Third-party wallets or intermediaries cannot handle money, and auto-debit of EMIs requires prior borrower consent.
Lending apps need explicit, need-based consent to access data like phone contacts, media files, call logs, and SMS. Consent must be revocable, data usage minimized, and all collected data must be stored on servers located in India.
Regulated Entities must submit DLA details to the CIMS portal by June 15, 2025. The RBI will then publish a public directory of valid DLAs by July 1, 2025; unlisted apps will be considered unauthorized.
CAclubindia
