Author name: CBCL

[By Rajeev Dadhich] The author is a student at the Institute of Law, Nirma University. The Digital Lending route has acquired prominence, which raised Reserve Bank of India’s  (“RBI”) concerns over the unbridled engagement of third parties, mis-selling, breach of data privacy, unfair business conduct, charging of exorbitant interest rates, and unethical recovery practices. To curb these concerns, on November 18, 2021, RBI released the Report of the ‘Working Group on digital lending including lending through online platforms and mobile apps’ (“the Report”), which targets the enhancement of customer protection and making the digital lending ecosystem safe and sound while encouraging innovation. Moving a step forward, on August 10, 2022, RBI issued a Press Release ‘Recommendations of the Working group on Digital Lending’ (“the Press Release”), which targets implementing the recommendations the Working Group gave. Against the backdrop, this article provides the scope of the Press Release and analyze the recommendations. Further, this article provides a detailed discussion on key factors of the Press Release like the cooling-off period, data privacy, reporting mechanism, and framework on FLDG. Lastly, the article provides concluding remarks and suggestions. Scope of the guideline issued The guideline comprises three Annexures which broadly illustrate three types of entities included in the digital lending process: Annexures I: Entities regulated by the RBI and permitted to carry out lending business; Annexures II: Entities authorized to carry out a lending as per other statutory/regulatory provisions but not regulated by RBI; and Annexures III: Entities lending outside the purview of any statutory/ regulatory provisions. First, the recommendation envisaged under Annexure I is implemented with immediate effect. This guideline will regulate not only Regulated entities (“REs”) but also the Lending Service Providers (“LSPs”)/ Digital Lending Apps (“DLAs”) engaged by REs to extend various permissible credit facilitation services. The entities included in the ambit of REs have been defined under Regulation 3 of KYC Direction, 2016. Second, in furtherance of Annexure II, the respective regulator/ controlling authority still requires some deliberations before implementing them. The non-regulated entities are defined in question 4 of FAQ published by RBI as stock exchange, and housing finance companies. Third, with respect to Annexure III, the Working Group has suggested specific legislative and institutional interventions for consideration by the Central Government. Recommendations implemented with immediate effect Operational Conduct and Customer Protection The disbursement of the loan, repayment of loan, etc. shall directly take place between REs and borrowers, and there shall be no intervention of any third party viz LSPs in transferring the loan or repayment amount. LSPs will operate as an agent of RE and will carry out functions like customer acquisition, underwriting support, pricing support, etc. RE shall monitor the activities of LSPs and be accountable for the same. Further, REs shall be liable to pay any fees applicable to LSPs, and no fees can be directly charged on borrowers by LSPs. Annual Percentage Rate (“APR”): The APR is required to be disclosed to the borrowers. The APR means all-inclusive cost and margin including the cost of funds, processing fee, maintenance charges, etc., except contingent charges like penal charges, late payment charges, etc. The borrowers should be provided with a cooling-off/ look-up period, which means an exit opportunity without the levy of any penalty for a certain period by just paying the principal and APR amount. A Grievance Redressal Officer (“GRO”) should be appointed who will be dealing with borrowers’ complaints regarding FinTech and digital lending. The details of the GRO shall be published on the website of the RE, its LSPs, and on DLAs. The responsibility of engaging GRO lies on REs. Key Facts Statement (“KFS”) is required to be disclosed. KFS includes a recovery mechanism, cooling-off/ look-up period, details of grievance redressal, and APR. Further, the consent of the borrower is required to increase the credit limits. Data Protection of the borrowers DLAs should obtain absolute consent from the borrowers before collecting any data with an option to accept or deny the consent and a right to be forgotten. LSPs are prohibited from storing any personal data of borrowers except the primary data viz name, address, contact details of the customer, etc. REs will be held accountable for data privacy and security of the customer’s personal data. Regulatory framework In cases where REs is extending credits through new digital products such as ‘Buy Now Pay Later’ (“BNPL”) need to report to CIC and adhere to outsourcing guidelines issued by individual Banks. Analysis This guideline is just the first installment in a three-series process. Till further instructions, the present Press Release will be the operative guideline for Res, LSPs, and DLAs. Cooling-off/look-up period As stated above, the Press Release provides the borrower with the option of a cooling-off/ look-up period. However, it does not specify the timeframe allowed to borrowers under this period, and the same has been left on the deliberation of the board approval policy. It is noted that a cooling-off period is a right of the borrowers to save them from paying the entire interest for the facility period, and the same should be reasonable. Inference can be drawn from Master Direction – Reserve Bank of India (Transfer of Loan Exposures) Directions, 2021, which state that a cooling period shall not be less than 12 months from the date of such transfer. Therefore, a similar timeframe should be allowed for the borrowers in the present digital lending regime. Data Privacy The Report highlights an exponential increase in complaints regarding the operations of DLAs. The Report explained DLAs as mobile and web-based applications with an interface that facilitate borrowing by a financial consumer from a digital lender. Subsequently, on December 23, 2020, RBI through Press Release cautioned borrowers regarding illegal players, excessive interest rates, hidden charges, breach of data privacy, and regressive recovery process by DLAs. Moreover, DLAs largely being mobile application poses a potential threat to data stored in mobiles viz sensitive personal data, etc. For instance, the recent data breach of CashMama leaked the personal information of thousands of people bearing

[By Sarthak Virdi] The author is a student at the National Law School of India University, Bangalore. Introduction Regulatory Sandboxes (RS) are artificial environments used to test innovations and have been relied on in the fintech sector. The RBI defines them to be testing environments with regulatory relaxations, the purpose of which is to gauge the viability of products by estimating benefits and risks. The benefits of RS have generally been that first, they help in foreseeing the risks of emergent technologies and the appropriate legal strategies to contain them; second, they are cost-efficient methods of testing products before a market roll-out and third, they enable financial inclusion and help regulators maintain control. The current literature on RS analyses their viability from two perspectives – first, the role of regulators as promoters of innovation or ‘opportunity-based regulation’[1] and second, the shift towards a principles-based regulation instead of a rules-based regulation.[2] However, there is a dearth of literature addressing RS in the Indian fintech market, especially in the context of cryptocurrencies. This paper fills this gap by arguing for RS for cryptocurrencies by first, taking the two perspectives to show that RBI is already operating with an opportunity-based and a principle-based regulatory approach. Second, it shows that across the RS models employed worldwide, the legalization of cryptocurrencies is not a prerequisite to promoting innovation in cryptocurrencies through RS, while protecting consumers. India by not allowing RS for cryptocurrencies and conflating the question of legalisation with experimentation can miss out on a big opportunity in the fintech market. Regulatory Approaches Opportunity-Based Regulation & Experimental Legal Regimes The role of regulators is generally understood to not be one that engages in active promotion of innovation and supporting entrepreneurs, but rather one that controls market disruption.[3] RS problematize this conception by making them active participants in the creation and promotion of market disrupters.[4] The benefits of RS however make it worthwhile for regulators to engage with them. They activate and increase the inflow of venture capital while simultaneously reducing the regulatory uncertainty and risk that can arise as a result of disruptive technology. The success of RS in kickstarting innovation has been well-documented, especially in the context of the UK, where RS have increased average venture investment amounts by 6.6 times.[5] The RBI has already made a shift towards opportunity-based regulation by promoting competition in Payments and Settlement Systems in India through sandboxes. It recognized the role sandboxes can play in promoting innovation while avoiding systemic risks. In the absence of any principled opposition to such an approach to regulation, the justification for not excluding cryptocurrencies from RS lies in a mistrust of the technology in itself. However, the question of the legality of cryptocurrency as a form of legal tender needs to be separated from the promotion of blockchain technology, for as Imelda Maher argues, competition has entered regulatory domains and the role of regulators has shifted to that of ‘steering’ from that of ‘rowing’[6] and the RBI must not miss the opportunity of experimentation. Rules-Based Approach v. Principles-Based Approach Strict, rule-based regimes post compliance costs that act as barriers to entry and thus discourage innovation, which is highly disadvantageous because fintech can drive growth in other industries while simultaneously addressing concerns like financial inclusion.  Principle-based regulation, which implies adherence to broader principles instead of hard rules, provides regulatory flexibility which reduces compliance costs while creating a collaborative relationship between regulators and private firms. RS employ the principle-based approach, for regulators exempt them from adherence to legislation while agreeing on principles they must comply with. Principle-based regulation helps contain the disruptive effects of unanticipated innovations for it provides regulators sufficient exposure to the technology to develop a legal framework to respond to it, instead of completely distancing themselves from emerging technologies. Further, given that innovations in fintech are fast-paced, RS create temporary regulatory frameworks that can help contain disruptive effects, instead of disincentivizing innovation. In the context of RS, the principles regulators generally require adherence to include consumer protection, market competition, and investor protection.[7] The table below summarizes the approach worldwide to show a move towards opportunity-based regulation, with regulators involved in promoting disruptive technologies, even cryptocurrencies. Further, the principle-based approach employed in RS does not lead to ignorance of consumer interests, for as shown, all jurisdictions build strong measures to protect consumer interests. Jurisdiction Conditions to Apply for Inclusion in a Regulatory Sandbox Is the regulator promoting disruptive technologies? Is Cryptocurrency a part of the RS Program? Legal status of cryptocurrency Protection of Consumer Interests Hong Kong Innovative technologies need to be utilized along with an increase in the range and quality of products. Yes Yes No law to regulate cryptocurrency; not accepted as legal tender. Compensation for financial losses and the option to exit the trail lies wits consumers.[8] United Kingdom The product must support businesses in the financial services market or any regulated activity, it must significantly differ from existing products and must produce consumer benefits.[9] Yes Yes Cryptocurrency exchanges are legal. Compensation for losses and the business must prove adequacy of capital to cover the losses. Australia The product must be new in itself or an adaptation or an improvement of an existing service or product. Applies the Net Public Benefit Test and the Innovation Test. Yes Yes Cryptocurrency exchanges are legal. Consumers are to be compensated for losses.[10] Singapore The financial service should include a new or emerging technology or use the present technology in an innovative way while bringing some benefits to consumers. Yes Yes Not accepted as legal tender, but can be legally exchanged. Boundary conditions are to be clearly defined in order to protect consumer interests. Arizona, United States of America The product must be innovative and should be based on an emerging technology or be a reimagination of existing technology. Yes Yes Not accepted as legal tender, but can be legally exchanged. Arizona consumer protection laws remain applicable and laws relating to consumer lending are incorporated within the RS.[11] Lessons From Foreign Jurisdictions This

[By Sukarm Sharma] The author is a student at the National Law School of India University, Bengaluru. Introduction Buy-Now-Pay-later (“BNPL”), as the name indicates, is a point-of-sale credit mechanism, where consumers can purchase a product immediately, and pay it off in various installments. This is enabled by a third-party fintech firm. The fintech firm pays for the product to the merchant (like Amazon, Zomato, etc.) through a pre-paid instrument (“PPI”) and gets repaid by the consumer in installments. Although generally no interest is levied on the credit, the profit for the fintech BNPL firm is primarily through consumer default fees and merchant fees. BNPL is one of the fastest growing fintech industries in India, overtaking UPI with a growth of 637% in 2021, reaching a market size of 6.3 Billion USD. Through a notification on 20 July 2022,[i] the Reserve Bank of India (“RBI”) clarified that non-bank entities would not be allowed to ‘load credit lines’ as per the Master Directions on Pre-Paid Instruments (“MD-PPI”). This caused major BNPL fintech credit providers like Lazypay, EarlySalaryetc. to halt their service since post-notification it was clear that the MD-PPI did not permit them to issue credit through PPIs. Consequently, the MD-PPI was criticized to be disproportionate, since it disallowed BNPL firms from issuing credit, even when tied to banks/Non-Banking Financial Companys (“NBFC”). Questions were also raised as to whether this regulation was a “flex move” by the banks in to reduce competition in the lucrative credit card market. Moreover, this degree of regulation was considered to be disproportionate to the risks posed by BNPL since they engage in micro-lending and enhance financial inclusion. The MD-PPI is therefore under question on the grounds that it restricts financial innovation and places a disproportionate burden on fintech payment platforms by preventing them from loading their PPIs. Although this has not been hitherto applied to Indian fintech regulation, the traditional model to assess proportionality in fintech regulation as per current literature involves gauging whether the necessity for regulation is commensurate to the stringency of regulation[ii] with regards to the three core objectives of regulation: (I) fair competition, (II) market integrity and (III) financial stability.[iii] This article argues that the MD-PPI provision which prevents BNPL fintech firms from issuing PPIs is proportionate in meeting the aforementioned core objectives. The original contribution of this article is that it introduces the concept of regulatory-proportionality in Indian fintech regulation using the example of BNPL and the MD-PPI by engaging Amstad, Restoy, and Lehmann on fintech regulatory theory. To this end, three arguments are made. First, the MD-PPI promotes fair competition by highlighting that since they engage in veiled balance-sheet lending without the license to lend rather than as payment systems, the MD-PPI is not unfair in restricting BNPLs from issuing credit. Second, relying on regulatory theory to argue that the information asymmetry and other market integrity concerns extant in the BNPL credit market justify the relatively stricter regulation as per the MD-PPI. Third, that fintech balance-sheet lending in BNPL poses a sufficient threat to financial stability, meriting regulatory intervention proportionate to the MD-PPI. Regulatory Fairness, Protecting Competition, and the ‘Duck’ Principle Simply put, the ‘Duck’ principle dictates fintech institutions performing the same functions must be regulated in the same way.  The Duck principle rests on regulatory fairness, i.e., in so far as institutions entail similar risks and activities, they shall be regulated with proportional stringency, as to not unfairly advantage one fintech domain over the other.[iv] It is based on the principle of activity-based regulation vis-à-vis entity-based regulation. This means the legal nature of the entity (for example, whether it is a payment gateway or a bank) is less important than the actual activity it engages in.[v] This is pertinent in the context of BNPL service providers. The MD-PPI targets only those who engage in credit lending under the fig leaf of acting as payment gateways. This is because the exposure for the loans is on the BNPL provider and not the banks/NBFC they are partnered with. For example, the fintech firms Slice and Uni are partnered with the State Bank of Mauritius and the RBL bank respectively for a ‘first loss default guarantee’ scheme. Here, the third-party bank acts to mitigate risks in cases of default but does not itself lend. This association proves useful to the fintech BNPL firms since banks/NBFCs are authorized under the PPI-MD to pre-fund the PPIs. However, as noted by the RBI’s Working Group on Digital Lending, (para. 5.3.1.5) the risk of issuing credit is not borne by the banks/NBFCs since they don’t issue credit in PPIs. The lending and concomitant exposure are instead from the balance sheets of the unregulated fintech firms rather than by the licensed and regulated partner banks. Consequently, even though the fintech firms are payment gateway entities on paper, their activity is that of lending (even if masked through ‘rented’ NBFCs/Banks). The risks of fintech balance-sheet (FBS) lending without regulation and licensing have been acknowledged as a risk to financial stability and market integrity.[vi] Since the fintech BNPL firms do not possess the license and the concomitant regulation of credit issuing, their debarment from loading credit lines is proportional to the risk entailed, and in line with the objectives of Duck-type regulation. Market Integrity, Information Asymmetry, and Consumer Safety: Justifying Tighter Regulatory Scrutiny on BNPLs Another essential element of proportionate regulation is that the stringency of regulation should be correlated to the threats to the market integrity of the domain being regulated.[vii] A greater risk to consumers would permit proportionately closer scrutiny by the regulators. This is rooted in an understanding of regulation theory, that regulation functions for the public interest, which requires the elimination of information asymmetries since they lead to market inefficiencies and consumer detriment.[viii] The potential counter-argument to the MD-PPI being proportionate is that BNPL is a convenient, user-friendly, and quick way to access credit typically at 0% interest rates. In that light, questions arise as to why BNPL firms should comply with similar restrictions as credit-card

[By Shaurya Singh and Sanya Goel] The authors are students at the Jindal Global Law School, Sonipat. The shareholder rights plan, commonly known as the ‘Poison-pill’ is a strategy used to defend against a hostile takeover by issuing new shares at discount to the existing shareholders other than the acquirer. This dilutes the shareholding of the acquirer while providing an opportunity to the other shareholders to raise their holdings at a discounted price. Therefore, the cost of acquisition significantly rises which would make the target company less attractive to the acquirer considering its higher price. Hence, deterring the hostile acquirer to complete the acquisition and pull out of the deal. This defense strategy has proven its mantle by breaking the jaws of some of the biggest corporate sharks over the years in the US. However, a series of regulations make the poison pill illegal in India. This article stresses the need for importing the poison pill to safeguard Indian companies and points out the fault in the current regulations which freely facilitate hostile takeovers. The Paramount of Defence: There have been several instances where this strategy has proved its effectiveness by saving well-known companies from non-consensual takeovers. Yahoo, acquired the poison pill in 2001 to save itself from being acquired by Microsoft. Along the same lines, Netflix, the current largest streaming service used the strategy as a defence against Carl Icahn’s takeover. Hence, the viability of the Poison Pill is very evident but especially when being used as the only defence strategy it might not guarantee complete safety from the takeover. Swallowing the pill: Poison-pill on paper makes up for a very robust strategy, however, there might be some cases where the acquirer has enough resources to complete the deal regardless, especially when the acquisition is happening without keeping profitability at the centre. In such cases, the acquirer would not care if the profitability of the venture is being compromised or not. Hence, the higher cost of acquisition is less likely to create a deterrence making the poison pill useless. For instance, Elon Musk’s bid for Twitter was not motivated by profits but was rather being done to save the freedom of speech of individuals on the internet. According to Musk, Twitter being one of the most influential social media platforms, was not fully allowing individuals to express free speech and he wished to acquire it to allow free expression. He pitched an offer of 43 billion dollars which was more than entire the market capitalisation of Twitter (37 billion USD). Here, Twitter did initially deploy the poison pill to avoid acquisition but the board later did accept the Musk’s Bid considering the value of the offer. The offer was withdrawn later, but the pill would not have saved Twitter given the amount of money Musk was ready to spend on the deal. A key take away from the said case is that if the acquirer has enough resources, is willing to pay the high cost of acquisition, and can directly or indirectly influence the board of the company, then the target company would not be able to defend itself only by relying on the pill. However, the case of Twitter itself is an exceptional scenario as a majority of the hostile takeovers are motivated by profitability. Therefore, a higher cost of acquisition due to the poison pill can save the target company in most cases. Additionally, the presence of a staggered board of directors comprised of firm individuals adds to the effectiveness of the pill. The Staggered Aegis: The provision for a staggered board of directors has been introduced in India through the Companies Act, 2013. While Section 169 of the Companies Act, 2013 allows for the removal of a director from the company before their period in office expires given that they are given a fair chance to be heard, exceptions to the same are provided in Section 242 and Section 163. A director appointed by the NCLT under Section 242 is not subject to the provisions of Section 169. Similarly, the provisions of Section 169 do not apply in a situation where the company has availed the option to appoint two-thirds of the total number of directors in compliance with the principle of proportional representation of Section 163 which basically translates to the existence of a staggered board. The staggered board complements the pill and these two together make a very viable defence. Theoretically, the acquirer could fire the entire current board and exert control over the newly elected board, thereby dismantling the pill. The staggered board prevents that. Therefore even in the presence of multiple resisting shareholders, the acquirer would not gain control over the board for a long time. The introduction of the staggered board is indeed a positive step but to fully utilize its defensive aspect poison pill is needed, which is restricted by a series of regulations framed by SEBI. The Fault in Our Codes Considering the regulations that regulate takeovers, it is safe to claim that India is a takeover-friendly country. This may not necessarily be a negative thing, given that the legislation has also been flexible enough to permit M&A transactions with minimum intrusion. But that does not mean that the law should freely allow hostile takeovers. The SEBI (Substantial Acquisitions of Shares and Takeovers) Regulations, 2011 or the ‘Takeover Code’ mandates the acquirer to make a public announcement once it obtains 25% of the shares and this is the only major obligation for the acquirer to undertake a takeover. On the other hand, 26(c) of the takeover code prohibits poison pills, as it states that the target company can not issue any securities which entitle the holder to voting rights. Also,26(d) refrains the target company to “implement any buy-back of shares or effect any other change to the capital structure”. Additionally paragraph 13.1.2 chapter 13 SEBI (Disclosure and Investor Protection) Guidelines, also restricted a company from deploying the poison pill as it did not allow for discount warrants less than the