[By Atish Biswas]
The author is a student of The West Bengal National University of Juridical Sciences.
Introduction
Digital lending, through websites and applications, has transformed the way individuals borrow money by integrating technical innovation with traditional banking services. This has resulted in easy and simple borrowing, quicker loan disbursement with fewer paperwork, and increased credit availability for a wider range of individuals. However, several concerns were raised regarding the business operations and conduct of these platforms, data privacy breaches, and misuse of data collected.
To investigate these issues, the Reserve Bank of India (“RBI”) had set up a Working Group in 2021. Pursuant to the RBI’s Working Group’s Recommendations on Digital Lending[1], the RBI released Guidelines on Digital Lending in September 2022. The Digital Lending Guidelines, along with the Default Loss Guarantee Guidelines and other Circulars, formed the existing Digital Lending Framework in India. On 8 May 2025, the RBI released the Digital Lending Directions, 2025 (“2025 Directions”), consolidating, streamlining, and updating the regulatory framework that governs digital lending.[2] This article analyses the new Digital Lending Directions and suggests some future reforms.
Key Changes
The Reserve Bank of India’s 2025 Directions on Digital Lending broaden the regulatory scope and tighten compliance to enhance customer protection, data privacy, and institutional accountability. The definition of “Digital Lending” remains unchanged, referring to “remote and automated lending process, largely by use of seamless digital technologies for customer acquisition, credit assessment, loan approval, disbursement, recovery, and associated customer service”. However, its applicability has been expanded. In addition to commercial banks, co-operative banks, and NBFCs, All-India Financial Institutions are now covered under the framework. Furthermore, Digital Lending Apps (DLAs) now include any web or mobile app offering digital lending services, either standalone or as part of a larger suite. The definition of Lending Service Providers (LSPs) has been expanded to include not just agents of Regulated Entities (REs) but also those acting as LSPs for other REs, provided they are involved in the digital lending process.
The 2025 Directions impose additional compliance obligations on REs. REs must enter into written contracts with LSPs, clearly defining their roles, rights, and responsibilities. REs have to periodically review the conduct of LSPs and enforce accountability. If LSPs serve multiple lenders, REs must ensure neutrality and transparency in loan offers. Creditworthiness assessments must, at a minimum, consider the borrower’s age, occupation, and income. REs have been allowed to process data outside India is now permitted, but processed data must be repatriated and deleted from foreign servers within 24 hours.
The 2025 Directions lay down various measures to protect borrowers. REs are required to publicly display key details on digital products, grievance redress mechanisms, and privacy policies, along with links to the RBI’s CMS and Sachet Portal. All DLAs must be reported on the RBI’s Centralised Information Management System (CIMS). Any increase in credit limit must be explicitly requested by the borrower and recorded. Lending apps are barred from accessing sensitive mobile data, and LSPs may only retain borrower data as long as necessary. Camera and microphone use is restricted to onboarding with borrower consent. Borrowers can exit loans without penalty within a board-determined “cooling-off” period (minimum one day).
Increased Scrutiny: A Positive for the Digital Lending Sector?
The 2025 Directions brings digital lending participants under the ambit of a risk-based framework, balancing innovation with consumer safeguards. It consolidates fragmented guidelines into a unified framework and removes ambiguities in earlier definitions. The change in definition of LSP clearly lays down who is covered under the new Directions. By explicitly mentioning that only agents involved in the Digital Lending process are to be covered under the Directions, it clarifies that the Directions are not applicable to agents involved in non-digital loans, who would be covered under the RBI’s Directions on Outsourcing of Financial Services. Expanded definitions bring previously unregulated fintech intermediaries under scrutiny.
The 2025 Directions is a positive step towards ensuring transparency and accountability in the Digital Lending Sector in India. It reduces the possibility of misrepresentation or deception in loan offers and enables productive cooperation between REs and LSPs while protecting borrowers’ interests. Furthermore, the Directions align data collection, processing, and storage with the DPDP Act. However, the success of these Directions will depend on monitoring by the RBI and implementation of the Directions.
One of the most significant changes brought about by the Direction is the creation of the CIMS Portal, a public repository of authorised DLAs. The proliferation of unauthorised DLAs has posed a significant challenge to regulators and the industry. With new digital lending apps appearing frequently, it is challenging for consumers to distinguish between legitimate and dubious platforms. The rise of unauthorised DLAs erodes consumer confidence in Digital Lending. To counter this problem, the RBI Working Group had proposed a ‘Whitelisting Framework’. It recommended setting up an independent nodal agency named Digital India Trust Agency, which would verify DLAs and maintain a public repository of authorised DLAs. The RBI has adopted a modified version of this framework, with the RBI being the nodal agency. The public repository will serve as a reference point for individuals seeking loans, allowing them to confirm whether a digital lending app is officially recognised and regulated.
The New Digital Lending Framework: A Missed Opportunity?
Despite the positives, the new Digital Lending Framework misses certain issues. Borrowers have been left unprotected against potential data breaches and the pitfalls of automated decision making. Furthermore, there are no changes concerning regulations relating to Short-Term Credit Products.
Baseline Cybersecurity Standards to Prevent Data Breaches
The RBI Working Group recommended the formulation of baseline digital hygiene guidelines and technology and cybersecurity standards for LSPs and DLAs. Uniform technical/cybersecurity standards and baseline digital health guidelines are necessary for safeguarding sensitive borrower data. With digital lending apps handling large volumes of personal and financial information, the use of outdated security and technical measures can increase the risk of data breaches and misuse of customer information.[3]
Algorithmic Fairness
DLAs are relying increasingly on automated decision-making (“ADM”) for various activities, most notably assessing the creditworthiness of a borrower. Bias in algorithms can negatively affect the decisions made by ADMs. The RBI Working Group had suggested algorithmic transparency, demanding that REs document the rationale for algorithmic features and conduct regular algorithmic audits. These recommendations were never incorporated into the previous Guidelines, and the RBI has overlooked these recommendations this time too. The lack of transparency in algorithms can result in discrimination and perpetuate bias, with marginalised groups being excluded from availing credit facilities. RBI should prescribe where ADMs can be used in cases of lending, and the REs must be mandated to disclose the logic of automated decision-making, ensuring fairness and transparency in the process.[4]
No changes for Short-term Consumer Credit and newer forms of Digital Lending
Short-term Consumer Credit (“STCC”) has witnessed a surge in popularity in recent years, partly due to its flexibility and convenience and partly due to a change in consumer behaviour. STCC is a practice of lending smaller amounts of money for short periods at higher interest rates. Such loans can be between a few days to a few months.
The RBI Working Group recommended the adoption of specific lending norms suited for STCC Lenders. It suggested the RBI to take a balanced approach to protect consumers from usurious lending while at the same time ensuring innovation and growth. Instead of a balanced approach, the RBI has increased regulatory scrutiny over STCC products. Digital lenders have found it challenging to provide STCC products due to the tightened regulations and have requested the RBI for relaxations.[5]
Buy Now Pay Later (“BNPL”) platforms are an example of lenders offering STCC through apps and websites. BNPL primarily functions as an arrangement between a consumer, a financier, and a merchant, where the financier pays the merchant on behalf of the consumer for the goods and services purchased by the consumer. The consumer repays the financier over time.
The 2025 Directions, like the previous Digital Lending Guidelines, prohibit such arrangements since the loan amount has to be disbursed directly to the borrower’s account.[6] Earlier, BNPL Platforms partnered with banks/NBFCs to offer real-time credit disbursals through prepaid instruments. This structure enabled users to instantly reload PPIs using sanctioned credit lines, driving widespread adoption due to its convenience and speed. However, platforms were forced to change their model after the RBI banned BNPL platforms from loading Pre-Paid Instruments with credit lines.[7]
Similar to other STCC Products, the increased regulatory scrutiny has a negative effect on the BNPL Industry. Many BNPL platforms, especially those that operate in riskier segments, have struggled to get capital due to the First Loss Default Guarantee (“FLDG”) cap imposed by the RBI. BNPL platforms earlier guaranteed to compensate the Bank/NBFC 20% to 100% of the loan amount in cases of bad loans. However, the RBI Guidelines have capped this at 5% of the overall loan portfolio. The onus of managing risks is now transferred to the Bank/NBFC that provides capital to such platforms, and as a result, Banks and NBFCs have been hesitant to provide loans to platforms operating in riskier segments.[8] While some platforms have modified their business operations to comply with the RBI’s regulations, other BNPL Platforms continue to thrive unregulated, in contravention of the RBI’s Guidelines.
The BNPL market has witnessed tremendous growth in recent years. This is primarily because such platforms have made short-term, small-ticket loans accessible to consumers. However, the industry-unfriendly regulations and frequent regulatory changes regarding BNPL Platforms thwart their growth and stifle innovation. The frequent changes in regulations force businesses to change their modus operandi, increasing costs and reducing profitability. Therefore, regulatory certainty would have provided clarity and relief to the BNPL players.
Conclusion
The RBI’s 2025 Digital Lending Directions mark a significant step forward in strengthening consumer protection, increasing transparency, and streamlining the regulatory landscape for digital lending in India. While they address many pressing concerns, the framework falls short in areas like algorithmic accountability, cybersecurity standards, and regulation of short-term credit products. For the digital lending ecosystem to thrive sustainably, future reforms must balance innovation with robust oversight, especially in emerging segments like BNPL and other STCC Products. Continuous monitoring and adaptive regulation will be key to realising the full potential of digital lending.
[1] Reserve Bank of India, ‘Report of the Working Group on Digital Lending including Lending through Online
Platforms and Mobile Apps’, available at
<https://rbidocs.rbi.org.in/rdocs/PublicationReport/Pdfs/DIGITALLENDINGF6A90CA76A9B4B3E84AA0EBD
24B307F1.PDF>.
[2] Reserve Bank of India (Digital Lending) Directions, 2025, available at https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12848&Mode=0.
[3] The Dialogue, ‘Customer Protection in the Digital Lending Ecosystem’, available at https://thedialogue.co/wp-content/uploads/2024/08/White-Paper-Customer-Protection-in-the-Digital-Lending-Ecosystem-in-India-TD-X-DLAI.pdf
[4] Sundaraparipurnan Narayanan & Mahesh Hariharan, ‘Beyond Algorithms: Navigating Fairness in India’s Lending Landscape’, available at https://nasscom.in/ai/beyond-algorithms-navigating-fairness-in-india-lending-landscape/
[5] Pratik Bhakta, ‘Stuck Digital Lenders look to RBI to ease unsecured loan rules’ available at https://economictimes.indiatimes.com/tech/technology/stuck-digital-lenders-look-to-rbi-to-ease-unsecured-loan-rules/articleshow/118154395.cms?from=mdr
[6] Shilpa Mankar Ahluwalia, ‘Digital lending regulations: Impact on businesses, buy now pay later products, more; key things to know’ available at https://www.financialexpress.com/business/banking-finance-digital-lending-regulations-impact-on-businesses-buy-now-pay-later-products-more-key-things-to-know-2636530/
[7] Avisha Gupta & Ananya Mishra, ‘Changing Face Of The PPI Linked Buy Now Pay Later’ available at https://www.mondaq.com/india/fin-tech/1231900/changing-face-of-the-ppi-linked-buy-now-pay-later
[8] ETBFSI Research, ‘How BNPL players are faring after RBI’s FLDG cap’ available at https://bfsi.economictimes.indiatimes.com/news/financial-services/how-bnpl-players-are-faring-after-rbis-fldg-cap/102955856.