Digital Lending by Fintech Companies – Recent Updates

Home     Articles      Digital Lending by Fintech Companies – Recent Updates

Digital Lending by Fintech Companies – Recent Updates

December 4, 2023


The term, ‘Fintech’ is an umbrella term to denote technological innovation in the field of financial services, and the term is derived from the combination of both the word “finance” and “technology.” According to Financial Stability Board, “Fintech is technologically enabled financial innovation that could result in new business models, applications, processes, or products with an associated material effect on financial markets and institutions and the provision of financial services.” [1]

The products and services associated with Fintech includes (without limitation) Peer-to-Peer (P2P) lending platforms, crowdfunding, blockchain technology, distributed ledger technology, big data analytics, smart contracts, robo-advisors, and e-aggregators. These innovations are reshaping international finance by connecting lenders and borrowers, information seekers and providers, often without the need for traditional intermediaries.[2]

We would like to focus on one of the emerging products in Fintech, i.e., ‘Digital Lending.’  According to the Reserve Bank of India (“RBI”), digital lending is defined as the “access of credit intermediation services majorly over digital channels or assisted by digital channels.” [3] Digital lending has led to a more efficient borrowing process, swift loan disbursal with minimal paperwork, and increased access to credit for a broader demographic.

In its report[1], RBI has noted that, with respect to Non-Banking Financial Companies (NBFCs), most loans disbursed through digital medium are personal loans; primarily comprising of consumer finance loans. In this regard, the NBFCs have been observed to enormously engaging/ partnering with digital lending entities for disbursement of aforementioned loans.

Through its portal ‘Sachet’ (under State Level Coordination Committee (SLCC) mechanism for registering complaints by public), RBI has been known to receive multiple complaints against these digital lending entities. Accordingly, RBI had initiated an examination of the operations of digital lending apps and websites in response to concerns related to potential mis-selling to unaware customers, breaches of data privacy, misuse of collected data, undisclosed costs, unethical business practices (including harassment by recovery agents), and illegitimate operations.

Report on digital lending by the RBI

In January 2021, the RBI Working Group was established [4] with the focus of thoroughly assessing this concern and focusing on three primary aspects: conduct, technology, and charges. From the above assessment, it was determined towards introduction of laws with respect to regulating these digital lending platforms.

Subsequently, in November 2021, the Working Group released its recommendations based on these identified issues. (“Recommendation”). The RBI Implementation of the Recommendations was released in August 2022 and based on the Recommendation, RBI released the Digital Lending Guidelines, 2022 on September 02, 2022.

Overview of Digital Lending Guidelines, 2022 (“Guidelines”)

The Guidelines are issued by the RBI under sections 21, 35A and 56 of the Banking Regulation Act, 1949, sections 45JA, 45L and 45M of the Reserve Bank of India Act, 1934, sections 30A and 32 of the National Housing Bank Act, 1987, section 6 of the Factoring Regulation Act, 2011 and section 11 of the Credit Information Companies (Regulation) Act, 2005.

The Guidelines primarily imposes compliance requirements on the Regulated Entities (as defined below) with the intent to also pass the compliance down to the Lending Service Providers (as defined below) commercially and/or contractually.

Key highlights of the Guidelines are given below:

1. Applicability: The Guidelines apply to digital lending services provided by banks and NBFCs, including housing finance companies (collectively referred to as “Regulated Entities” or “REs“). It is specified that the scope of digital lending encompasses activities that entail some physical interaction with borrowers, such as customer acquisition, credit assessment, loan approval, disbursement, recovery, and associated customer service. [5]The Guidelines are applicable to new loans for existing customers and new customers onboarded from September 2, 2022. For existing digital loans sanctioned as of September 2, 2022, REs are granted time until November 30, 2022, to establish adequate systems and processes to ensure compliance with the guidelines.[6]

2. Digital Lending:  The Guidelines defines ‘Digital Lending’ as “a remote and automated lending process, largely by use of seamless digital technologies for customer acquisition, credit assessment, loan approval, disbursement, recovery, and associated customer service.” [7]

3. Bifurcation of ‘Digital Lending Apps’ from ‘Lending Service Providers’: The Guidelines also distinguishes between Digital Lending Apps (“DLAs”) and Lending Service Providers (“LSPs”). DLAs are mobile and web-based applications with a user interface facilitating digital lending services (e.g., a bank’s mobile banking app allowing users to access loans through their phones). DLAs can be operated either by an LSP or directly by an RE. [8]  LSPs, on the other hand, act as intermediaries between the RE and the borrower, performing various functions such as customer acquisition, underwriting support, pricing support, servicing, monitoring, and recovery of specific loans or loan portfolios. [9]

4. Non-exemption on outsourcing: The Guidelines emphasize that any outsourcing by an RE to an LSP or a DLA does not exempt such RE from adhering to existing RBI guidelines on outsourcing. Additionally, REs are also required to ensure that LSPs and DLAs comply with the provided guidelines. [10]

5. Customer Protection: The Guidelines stipulate that loan disbursal and repayment should not occur through a third party’s account, such as a pass-through account or a pool account, including those of LSPs and DLAs. Disbursals and repayments are to be directly conducted between the Regulated Entity (RE) and the borrower’s bank account, with exceptions outlined in the following specific cases:

  1. Disbursals covered exclusively under statutory or regulatory mandate;
  2. Money flow between REs for co-lending transactions, for both priority and non-priority sector lending; and
  3. Disbursals for specific end use, provided the loan is disbursed directly into the bank account of the end-beneficiary. [11]

6. Appointment of nodal grievance officer: The Guidelines mandates every REs to appoint and ensure that their LSPs have a nodal grievance officer to address issues related to digital lending, fintech, and DLAs, who must resolve their issue within 30 days. [12]

7. Non-resolution of grievances: If a complaint filed by a borrower against an RE or its engaged LSP is not resolved within 30 days, the borrower has the option to file a complaint on the Complaint Management System portal under the RBI-Integrated Ombudsman Scheme. [13]

8. Disclosures by REs via Key Fact Statement: The guidelines mandate that REs must provide a Key Fact Statement (“KFS”) in a standardized format for all digital lending products. [14] The KFS is required to include the all-inclusive cost of the digital loan presented as an annual percentage rate, details of the recovery mechanism, and information about the designated grievance redressal officer for digital lending and fintech-related matters. Any charges or fees not mentioned in the KFS cannot be imposed on the borrower. The KFS must also outline the borrower’s right to a cool-off/lookup period, during which the borrower can exit the digital loan by repaying the principal and a proportionate annual percentage rate, including a one-time processing fee, without incurring any penalty. [15] REs are obligated to automatically send digitally signed documents, such as the KFS and sanction letter, to borrowers via email or SMS upon the execution of the loan contract or transaction.[16]

9. Non-passing of charges:  REs must ensure that charges payable to LSPs are borne by the RE and not passed on to the borrower. [17] Penal interest or charges levied by the RE on borrowers should be based on the outstanding loan amount, and the rate of such charges should be disclosed upfront in the KFS. [18]

10. Disclosure of LSPs and DLAs on the website of REs: The Guidelines require REs to publish on their website the list of LSPs and DLAs engaged by them, along with details of their activities.[19] DLAs of REs and LSPs must prominently display product and loan-related information during the onboarding stage for borrower awareness.[20] Additionally, REs should also provide borrowers with details of the LSPs acting as a recovery agent at the time of loan sanction and when transferring recovery responsibilities to or changing an LSP. [21] In cases where the borrower fails to repay the loan and a recovery agent is assigned, the RE must communicate the recovery agent’s contact information to the borrower before any contact is made. REs must ensure that DLAs of both REs and LSPs have links on their websites to the REs’ website, providing detailed information about loan products, lenders, LSPs, customer care particulars, etc.[22]

11. Reporting and Due Diligence: REs are mandated to ensure that any lending conducted through DLAs and/or LSPs is reported to Credit Information Companies (CIC), regardless of the nature or tenor of the loan. [23] This reporting requirement extends to digital lending products offered by REs or their LSPs over merchant platforms, encompassing short-term, unsecured, or secured credits, and deferred payments. Before entering into a partnership with an LSP for digital lending, REs are obligated to conduct enhanced due diligence. This due diligence encompasses an assessment of the LSP’s technical capabilities, data privacy policies, storage systems, fairness in conduct with the borrowers, and the ability to comply with regulations and statutes. REs are also required to conduct periodic reviews of the conduct of LSPs and guide them on responsible practices, especially when acting as recovery agents. [24]

12. Data Protection: Data collection by LSPs should be need-based and requires explicit consent from the borrower at every stage. One-time access to the camera, microphone, location, or any other facility necessary for onboarding and/or KYC requirements is permitted only with the explicit consent of the borrower. Additionally, no biometric data can be stored or collected in the systems of DLAs and LSPs of REs. [25] The user must provide explicit consent for sharing their information with third parties. [26] LSPs and DLAs should refrain from storing most personal information, except basic data such as name, address, and contact details necessary for their operations. [27] Phone data, including files, media, contact lists, and call logs, should not be accessed. [28]

13. Comprehensive privacy policy: The RE is responsible for ensuring that all DLAs and LSPs they engage with have comprehensive privacy policies, disclosing details of third parties allowed to collect personal information through DLAs, the type of data that can be stored, the duration of storage, limitations on data use, etc. Privacy policies must be prominently disclosed by DLAs and LSPs on their websites or apps. REs bears the responsibility for ensuring the privacy and security of customers’ personal information. [29] All collected data must be localized, i.e., stored on servers located within India. [30]

Recent updates on regulations pertaining to digital lending by Fintech Companies

On February 15, 2023, the Reserve Bank of India took a significant step by releasing Frequently Asked Questions (FAQs) as part of its ongoing efforts to address the challenges faced by relevant stakeholders in relation to the Guidelines. This initiative aims to provide clarity and assistance on common queries that have arisen in connection with the Guidelines.

The FAQs inter-alia brings forth the following clarifications on the Guidelines;

1. Scope of ‘Digital Lending: Through the FAQs, RBI has clarified that the expression ‘largely by use of seamless digital technologies’ is intended to provide operational flexibility to REs engaged in digital lending. The RBI acknowledges that, under this definition, even lending activities involving a certain degree of physical interaction with the ultimate borrower would still be considered within the scope of ‘Digital Lending.’ [31]

2. Activities of LSP: The RBI has clarified that an entity will be categorized as a LSP only if the lending transaction it facilitates meets the criteria for ‘Digital Lending,’ as outlined in the Guidelines. [32]

3. Appointment of grievance officer: The FAQs clarifies that the obligation to appoint a nodal Grievance Redressal Officer applies exclusively to LSPs with a direct interface with borrowers. It is emphasized once again that the REs retains the overarching responsibility for resolving complaints stemming from the actions of all engaged LSPs. [33]

4. Handling of funds: The FAQs emphasizes on that third parties, including LSPs, cannot control the flow of funds between the bank accounts of lenders and borrowers in digital lending transactions. The FAQs clarify that payment aggregators’ services for handling funds are exempt from the Guidelines, as long as they do not assume the role of an LSP. The underlying principle is that an LSP should not be involved in the handling of funds between the lender and the borrower. However, if a payment aggregator also acts as an LSP, it must adhere to the Guidelines’ requirements. [34]


While the FAQs and Guidelines are a positive step toward regulating REs and establishing a consumer protection-focused ecosystem for digital lending, certain aspects of these financial arrangements remain ambiguous. Stakeholders, in their pursuit of compliance, have revised commercial agreements to ensure that LSPs are not parties to contracts between REs and borrowers, that LSP service costs are not passed on to borrowers, and that loan book risk remains with the lender. Despite these measures, certain practices persist in the industry, indicating the significant impact of the Guidelines on the digital lending ecosystem and the altered relationships among LSPs, REs, and borrowers.


[1] FinTech – Financial Stability Board (

[2] Report of the Working Group on FinTech and Digital Banking

[3] Report of the Working Group on Digital Lending

[4] Reserve Bank of India – Press Releases (

[5] Clause 1 of the Guidelines

[6] Para 3 of the Guidelines

[7] Clause 2.3 of the Guidelines

[8] Clause 2.4 of the Guidelines

[9] Clause 2.5 of the Guidelines

[10] Para 2 of the Guidelines

[11] Clause 3 of the Guidelines

[12] Clause 6.1 of the Guidelines

[13] Clause 6.2 of the Guidelines

[14] Clause 5.2 of the Guidelines

[15] Clause 5.2.2 of the Guidelines

[16] Clause 5.3 of the Guidelines

[17] Clause 4.1 of the Guidelines

[18] Clause 4.2 of the Guidelines

[19] Clause 5.4 of the Guidelines

[20] Clause 5.5 of the Guidelines

[21] Clause 5.6 of the Guidelines

[22] Clause 5.7 of the Guidelines

[23] Clause 14.1 of the Guidelines

[24] Clause 9 of the Guidelines

[25] Clause 10 to 10.1 of the Guidelines

[26] Clause 10.2 of the Guidelines        

[27] Clause 11.1 of the Guidelines

[28] Clause 10 of the Guidelines

[29] Clause 12 of the Guidelines

[30] Clause 11.4 of the Guidelines

[31]Q1of FAQs

[32] Q2 of FAQs

[33] Q3 of FAQs

[34] Q7 & Q8 of FAQs

Author: Dippyaman Bhattacharya, Senior Associate (assisted by Shishank Shaw)

Disclaimer: The content of this article is intended to provide a general guide to the subject matter and that the same shall not be treated as legal advice. For any queries, the author can be reached at


Join Our List To Stay In Touch

Leave your email id to receive regular updates on
corporate law changes that have impact on businesses.