digital financial consumer protection

[By Ojas Sharma] The author is a student of Maharashtra National Law University, Nagpur.   INTRODUCTION The Non-Banking Financial Company Peer-to-Peer Lending Platform (NBFC-P2P) has gained a significant standing in the Indian money lending scenario. India’s ambitious financial inclusion drive, combined with regulatory arbitrage opportunities, has led to the emergence of an unconventional ecosystem of shadow credit providers operating outside the purview of traditional banking oversight. Often, algorithms are used for decision-making, credit scoring, underwriting, and risk pricing, which generally operate through NBFC-P2P structures or partnerships with unregulated digital platforms. RBI’s Master Directions of 2017 struggle to address the opacity and systemic risks in these structures, as the directions cater to conventional institutions, and the P2P structure is an ever-evolving contemporary subject. This article seeks to map the legal and regulatory landscape governing algorithm-driven shadow banking in India and to identify the business risks and regulatory gaps. Ultimately, this article proposes reforms from comparative jurisdictions. EXISTING SCHOLARSHIP Existing scholarship on shadow banking emphasises traditional NBFCs and their systemic risks. These risks are often noted, but the scope is very limited. There is very limited scholarship on algorithm-driven credit intermediaries and their financial implications on consumer protection and systemic stability. There is data available highlighting emerging risks in P2P digital lending, but a lack of granular analysis of business model innovations like embedded finance is observed. This article addresses this gap. LEGAL FRAMEWORK The NBFC-P2P Master Directions serve as a statutory framework through which registration, prudential norms, and operational limits of P2P platforms are regulated. The direction describes P2P as an intermediary providing loan services via an online platform and an NBFC-P2P as a non-banking institution carrying P2P work. The aim is to cover unregulated lending under legal purview, but with the emergence of artificial intelligence and AI-based underwriting and embedded finance partnerships, the regulation appears to be redundant. RBI’s Digital Lending Guidelines introduced restrictions on first-loss default guarantees and mandated disclosure norms in 2025. An attempt was made to set up a grievance redressal mechanism; however, enforcement against algorithmic opacity remains weak even in the recent RBI guidelines. Even in the DPDP Act 2023, only the baseline is touched for data protection, algorithmic transparency and auditability in financial services. P2P remains highly unregulated even after constant guidelines by the RBI and the DPDP Act. A striking need for inclusion of specific provisions for algorithmic transparency and auditability is the need of the hour in the legal framework. LEGAL IMPLICATIONS AND ANALYSIS Primarily, fintech platforms engage in regulatory arbitrage by structuring their operations to escape the purview of conventional banking regulations. Often, partnering with licensed NBFCs to act like a legal front while these companies drive credit decision-making, customer acquisition and repayment collection through digital interfaces is one of the prominent strategies used by the fintech companies. By operating through this mode, bypassing RBI scrutiny while accessing credit markets becomes possible, ultimately allowing platforms to circumvent caps on exposure norms, risk-weighted capital requirements, and provisioning obligations to banks and larger NBFCs. The most common model for many digital lenders is to engage in ‘Bank NBFC-Fintech-Tri-Paritite-Structures’ where the NBFC originates the loan, but it is the fintech that handles disbursement, collections, and risk modelling, ultimately proving to be a grey zone not properly regulated under the current RBI guidelines. The Buy Now, Pay Later (BNPL) credit service is also used to exploit a legal vacuum via e-commerce or aggregator platforms operating as unregistered lenders. These products have a tendency to mimic credit offerings, putting on a façade to adhere to compliance standards, which include risk disclosure obligations and Know Your Customer (KYC). RBI, through its guidelines in 2022 and 2025 attempts to limit this arbitrage by using various measures like imposing sanctions, enhancing disclosure requirements, and mandating direct loan disbursements. However, these measures remain inconsistent for entities bypassing jurisdictions, often failing to unravel shell NBFCs through layered partnerships and fintechs. The existing arrangements, while showing a promising intention, lack clear, structured directions, which result in systematic vulnerability and ambiguity. This ambiguity can have grave consequences like consumer harm, default spikes, data misuse and serious litigation. ALGORITHMIC BIASES AND OPACITY The opaque nature of proprietary credit algorithms deployed by fintech platforms serves as a poignant risk in India’s invisible credit networks. These models are often trained on unregulated data and non-traditional data points like social media activity, smartphone metadata and behavioural patterns, operating as black boxes with minimal regulatory compliance or consumer transparency requirements. These underwriting systems, while positioned to be neutral, can perpetuate social and economic biases present in the historical data, as there is barely any regulation. This risk is amplified in India because there is a sheer lack of formal credit histories, as India is still a growing economy with a majority relying on informal credit sources to avoid hassle in obtaining loans. Empirical reviews indicated that first-time borrowers, women-led enterprises and applicants from certain geographical locations suffer from this algorithmic bias, which makes obtaining credit from these models a hassle. As of now, no regulation discusses algorithmic biases. While the DPDP Act is empowered to enforce data rights, it lacks jurisdiction over algorithmic accountability, creating a regulatory vacuum in decisions for credit and loan disbursements, affecting financial access and compromising the right to equality. Australia’s Consumer Data Right and the EU’s proposed Artificial Intelligence Act classify credit underwriting as a highly risky AI application, mandating transparency to mitigate bias and including robust grievance redressal mechanisms. However, Indian regulators are yet to formally acknowledge these risks in the digital lending context. This lack, clubbed with the lack of auditability, exacerbates legal risks for platforms, causing fintech firms to face potential class actions, consumer complaints and data privacy violations. Without transparent creditworthiness parameters, borrowers are often discouraged and denied procedural fairness, a fundamental right under Indian constitutional jurisprudence as enshrined in Article 19(1)(g) of the Indian Constitution. SYSTEMIC RISK CONTAGION A key vulnerability in this interconnected lending arrangement of invisible credit networks is the widespread practice of risk layering through