[By Ojas Sharma]
The author is a student of Maharashtra National Law University, Nagpur.
INTRODUCTION
The Non-Banking Financial Company Peer-to-Peer Lending Platform (NBFC-P2P) has gained a significant standing in the Indian money lending scenario. India’s ambitious financial inclusion drive, combined with regulatory arbitrage opportunities, has led to the emergence of an unconventional ecosystem of shadow credit providers operating outside the purview of traditional banking oversight. Often, algorithms are used for decision-making, credit scoring, underwriting, and risk pricing, which generally operate through NBFC-P2P structures or partnerships with unregulated digital platforms. RBI’s Master Directions of 2017 struggle to address the opacity and systemic risks in these structures, as the directions cater to conventional institutions, and the P2P structure is an ever-evolving contemporary subject. This article seeks to map the legal and regulatory landscape governing algorithm-driven shadow banking in India and to identify the business risks and regulatory gaps. Ultimately, this article proposes reforms from comparative jurisdictions.
EXISTING SCHOLARSHIP
Existing scholarship on shadow banking emphasises traditional NBFCs and their systemic risks. These risks are often noted, but the scope is very limited. There is very limited scholarship on algorithm-driven credit intermediaries and their financial implications on consumer protection and systemic stability. There is data available highlighting emerging risks in P2P digital lending, but a lack of granular analysis of business model innovations like embedded finance is observed. This article addresses this gap.
LEGAL FRAMEWORK
The NBFC-P2P Master Directions serve as a statutory framework through which registration, prudential norms, and operational limits of P2P platforms are regulated. The direction describes P2P as an intermediary providing loan services via an online platform and an NBFC-P2P as a non-banking institution carrying P2P work. The aim is to cover unregulated lending under legal purview, but with the emergence of artificial intelligence and AI-based underwriting and embedded finance partnerships, the regulation appears to be redundant. RBI’s Digital Lending Guidelines introduced restrictions on first-loss default guarantees and mandated disclosure norms in 2025. An attempt was made to set up a grievance redressal mechanism; however, enforcement against algorithmic opacity remains weak even in the recent RBI guidelines. Even in the DPDP Act 2023, only the baseline is touched for data protection, algorithmic transparency and auditability in financial services. P2P remains highly unregulated even after constant guidelines by the RBI and the DPDP Act. A striking need for inclusion of specific provisions for algorithmic transparency and auditability is the need of the hour in the legal framework.
LEGAL IMPLICATIONS AND ANALYSIS
Primarily, fintech platforms engage in regulatory arbitrage by structuring their operations to escape the purview of conventional banking regulations. Often, partnering with licensed NBFCs to act like a legal front while these companies drive credit decision-making, customer acquisition and repayment collection through digital interfaces is one of the prominent strategies used by the fintech companies. By operating through this mode, bypassing RBI scrutiny while accessing credit markets becomes possible, ultimately allowing platforms to circumvent caps on exposure norms, risk-weighted capital requirements, and provisioning obligations to banks and larger NBFCs. The most common model for many digital lenders is to engage in ‘Bank NBFC-Fintech-Tri-Paritite-Structures’ where the NBFC originates the loan, but it is the fintech that handles disbursement, collections, and risk modelling, ultimately proving to be a grey zone not properly regulated under the current RBI guidelines.
The Buy Now, Pay Later (BNPL) credit service is also used to exploit a legal vacuum via e-commerce or aggregator platforms operating as unregistered lenders. These products have a tendency to mimic credit offerings, putting on a façade to adhere to compliance standards, which include risk disclosure obligations and Know Your Customer (KYC). RBI, through its guidelines in 2022 and 2025 attempts to limit this arbitrage by using various measures like imposing sanctions, enhancing disclosure requirements, and mandating direct loan disbursements. However, these measures remain inconsistent for entities bypassing jurisdictions, often failing to unravel shell NBFCs through layered partnerships and fintechs. The existing arrangements, while showing a promising intention, lack clear, structured directions, which result in systematic vulnerability and ambiguity. This ambiguity can have grave consequences like consumer harm, default spikes, data misuse and serious litigation.
ALGORITHMIC BIASES AND OPACITY
The opaque nature of proprietary credit algorithms deployed by fintech platforms serves as a poignant risk in India’s invisible credit networks. These models are often trained on unregulated data and non-traditional data points like social media activity, smartphone metadata and behavioural patterns, operating as black boxes with minimal regulatory compliance or consumer transparency requirements. These underwriting systems, while positioned to be neutral, can perpetuate social and economic biases present in the historical data, as there is barely any regulation. This risk is amplified in India because there is a sheer lack of formal credit histories, as India is still a growing economy with a majority relying on informal credit sources to avoid hassle in obtaining loans. Empirical reviews indicated that first-time borrowers, women-led enterprises and applicants from certain geographical locations suffer from this algorithmic bias, which makes obtaining credit from these models a hassle. As of now, no regulation discusses algorithmic biases.
While the DPDP Act is empowered to enforce data rights, it lacks jurisdiction over algorithmic accountability, creating a regulatory vacuum in decisions for credit and loan disbursements, affecting financial access and compromising the right to equality. Australia’s Consumer Data Right and the EU’s proposed Artificial Intelligence Act classify credit underwriting as a highly risky AI application, mandating transparency to mitigate bias and including robust grievance redressal mechanisms. However, Indian regulators are yet to formally acknowledge these risks in the digital lending context. This lack, clubbed with the lack of auditability, exacerbates legal risks for platforms, causing fintech firms to face potential class actions, consumer complaints and data privacy violations. Without transparent creditworthiness parameters, borrowers are often discouraged and denied procedural fairness, a fundamental right under Indian constitutional jurisprudence as enshrined in Article 19(1)(g) of the Indian Constitution.
SYSTEMIC RISK CONTAGION
A key vulnerability in this interconnected lending arrangement of invisible credit networks is the widespread practice of risk layering through simultaneous access to credit through multiple partnership models, including NBFCs, digital lenders and payment aggregators, known as ‘credit invisibility stacking’. This creates latent default risk clusters, which are undetectable to regulators as well as lenders. Adding to the injury, aggressive adoption of First-Loss Default Guarantee (FLDG) arrangements before the RBI’s 2022 ban exacerbated risk accumulation. Under this arrangement, fintech partners would cover a pre-agreed percentage of defaults on loans originated by NBFCs, which incentivises aggressive, riskier lending practices without appropriate capital buffers. While measures have been taken to mitigate this, the BNPL system continues to prevail in the contemporary scenario.
This calls for concern as a single stress event, that is, a fintech liquidity crunch or a mass loan recall, can trigger cascading defaults, liquidity freezes, and NBFC instability owing to their concentrated exposure to digital lending portfolios. While the root cause of the inception of these risks is the lack of a clear resolution framework in fintech-induced credit crises, a glance at global financial regulations could be beneficial in the Indian context to increase consumer confidence and to broaden macroeconomic resilience and financial stability.
COMPARATIVE JURISDICTIONS
A comparative review of regulatory frameworks offers a structured and balanced oversight model to safeguard financial and consumer stability. Singapore’s Monetary Authority pioneered one of the earliest regulatory sandboxes in 2016 to facilitate financial innovation. Further, it mandates regulatory algorithm audits and disclosure obligations for sandbox participants dealing with credit scoring. The UK’s Financial Conduct Authority (FCA), on the other hand, operates on a similar progressive sandbox program involving the integration of Open Banking to monitor algorithmic credit risk models. It requires the participants to demonstrate bias mitigation strategies and crisis resolution protocols for systemic risk events. Compared to India, this framework provides stability in NBFCs’ shadow banking scenario, addressing algorithmic biases. Australia’s Consumer Data Right (CDR), operational since 2020, grants consumers control over their financial data, mandating that fintech lenders and banks obtain explicit consent before accessing, processing, or sharing consumer credit information. CDR-compliant fintech platforms report higher consumer trust metrics and improved credit model accuracy, debunking concerns over regulatory burdens inhibiting operational efficiency.
CONCLUSION AND WAY FORWARD
While India gears up for a digital and economic boom, structural frameworks that introduce algorithmic audit requirements under the RBI’s digital lending framework appear essential. Establishment of a fintech regulatory sandbox exclusively for credit algorithms similar to the Singaporean system and amending the DPDP Act to mandate explainability and bias audits for AI-based lending models would ultimately result in a robust measure, negating the current gaps and preventing algorithmic bias, strengthening transparency in lending and restoring trust in NBFC P2P lending. A credit exposure mapping tool should be introduced to integrate data from NBFC-P2Ps, to monitor interconnected credit risks and to preempt systemic defaults. India stands at a critical inflection point: either act now to meaningfully regulate the invisible credit networks and algorithmic lenders or risk financial contagion, consumer rights erosion, and fintech sector instability. A dynamic, globally harmonised regulatory infrastructure, built on principles of transparency, fairness, consumer data control, and real-time risk monitoring, is essential for India’s fintech ecosystem to achieve inclusive, resilient, and sustainable growth.
Ultimately, the need to regulate the NBFC P2P ‘Shadow Banking’ system appears not to be a question of ‘if’ but ‘how urgently’. Following the current status quo, the general public will be vulnerable to financial risks spiralling beyond control, creating a regulatory vacuum through algorithmic bias. Therefore, the proposed reforms are not just mere policy suggestions, but an imperative to safeguard the integrity of India’s future digital lending landscape.