RBI digital lending guidelines for NBFCs and DSAs, and what changed

The RBI digital lending guidelines were withdrawn as a standalone book. As of October 2026, the Department of Regulation’s withdrawn-circulars list includes the Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025, and that page on rbi.org.in is stamped with a red “Withdrawn” watermark. For an NBFC, those duties are Chapter III of the Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, number RBI/DOR/2025-26/347, issued on 28 November 2025 and marked updated as on 15 July 2026. The citation change leaves the NBFC as the lender. This is an operations reading of the public directions, and it is not legal advice.

Were the RBI digital lending guidelines withdrawn?

Yes, the separate directions book was withdrawn, and the obligations a desk still has to run sit in the NBFC chapter under new paragraph numbers.

We read the primary pages on 26 October 2026. Search still mixes three of them, which is why the table gives each instrument its own row.

What is still open on rbi.org.in

The May 2025 directions still render in full, and a text scrape misses the stamp. The page background is the Reserve Bank’s withdrawn mark, the word “Withdrawn” in red. The same instrument, circular number DOR.STR.REC.19/21.07.001/2025-26, is rowed on the circulars withdrawn by the Department of Regulation.

The repeal instrument is the 28 November 2025 notification, RBI/2025-26/100. It says 9,445 circulars listed in the annex are withdrawn with immediate effect, because their instructions were consolidated or because they are obsolete. The annex link on that notification is the withdrawn-circulars index. We found the May 2025 directions on the Department of Regulation’s list. We did not tick all 9,445 rows by hand. That list is also a living register and includes later withdrawals. The date on a row is the date of the old circular, which is not the day it was withdrawn.

The 2 September 2022 guidelines carry an older repeal line that still sends the reader to the May 2025 directions, which now carry the withdrawn watermark. A policy that followed the 2022 page’s pointer in 2026 would cite a withdrawn book. The 2022 guidelines had already been repealed by the May 2025 directions, which is why they appear on the withdrawn list as well.

What did not change in November 2025

The operating duties below are in Chapter III. We compared them with the May 2025 text and did not redline every annex. The May book barred default loss guarantee on revolving digital credit and on credit cards, and we did not find that bar in paragraphs 19 to 21. A definitions proviso tells a payment aggregator that also acts as a lending service provider to comply with Chapter IV, which on this document is lending against gold and silver, and we are not building a control from that cross-reference. The 15 July 2026 cover date is second amendment RBI/2026-27/183, which adds explanations to project-finance paragraphs 70 and 72 and leaves paragraphs 6 to 30 unchanged.

Where an NBFC reads the rules

Open the NBFC Credit Facilities Directions at Chapter III. They take effect on issue unless a paragraph says otherwise. We did not find a later start date inside paragraphs 6 to 30. The multi-lender screen and the app-directory filing, deferred in the May 2025 book to 1 November 2025 and 15 June 2025, are written here as current duties.

Who the chapter covers

It covers NBFC-D, NBFC-ICC, NBFC-Factor, NBFC-MFI, NBFC-IFC, IDF-NBFC and housing finance companies, for all layers unless a paragraph carves a piece out. A base-layer NBFC with a customer interface that does not take public funds follows the conduct parts, and the prudential parts do not apply to it. An NBFC-P2P is inside only for paragraph 21(2), the bar on default loss guarantee for loans facilitated on its platform. Mortgage guarantee companies, account aggregators, standalone primary dealers, NOFHCs and Type I NBFCs are named as outside. A bank cites the Credit Facilities Directions issued for banks, a different document from this chapter.

When a loan file is digital lending

Digital lending, in paragraph 4, is a remote and automated process, largely through digital tools, across acquisition, credit assessment, approval, disbursement, recovery and the service around them. A digital lending app is a mobile or web application that facilitates that service, including an app the provider operates. A lending service provider is an agent of the NBFC, and another lender can sit in that role, doing any of acquisition, underwriting support, pricing support, servicing, monitoring or recovery, under the outsourcing directions named in paragraph 6(6).

A connector who only passes a name is a different contract from a DSA who logs the file, chases papers and works on the NBFC’s screen, and the functions in the agreement are what separate the two, whatever label the payout grid uses. A branch file, with a person chasing a salary slip on the lender’s WhatsApp and a human sanctioning, can fall inside that definition or fall outside it. Read paragraph 4 before the desk skips the chapter, and before it bolts every paragraph onto a file that never went through an app.

What the NBFC must do and what a DSA must not

Paragraph 6(7) keeps the NBFC liable for the provider’s acts and omissions, and the contract states the roles. Due diligence before signature covers technical capability, data privacy, storage, borrower conduct and the record, and the NBFC reviews the provider against that contract.

On a salaried home-loan file, the DSA can log the applicant in and the missing page can be named on the NBFC’s own WhatsApp. The system stops before a key fact statement, a fee demand or a recovery name goes out in the DSA’s words. The processing fee, if the borrower bears one, sits inside the NBFC’s statement and is settled on the NBFC’s payout grid, so the desk does not send a second message asking the applicant to pay “file charges” into a personal account. Disbursal goes to the applicant’s bank account, and a person named on the file signs the sanction. The papers themselves, and what counts as a received month, are a separate list: documents required for a business loan.

Key fact statement, disbursal and fees

What the key fact statement has to show

Paragraph 9(1) points the key fact statement at the Responsible Business Conduct Directions. Paragraph 29 of those directions applies the standardised annex to new retail and MSME term loans sanctioned on or after 1 October 2024, including a fresh loan to an existing customer. Credit-card receivables are exempt there. The statement is in a language the borrower understands, the contents are explained, and the NBFC takes an acknowledgement. It has a unique proposal number and a validity period of at least three working days where the tenor is seven days or more, or one working day where it is shorter. If the borrower agrees inside that window, the NBFC is bound by those terms.

The annex includes the annual percentage rate, taking in every charge the NBFC levies, plus the repayment schedule. Insurance or legal fees the NBFC recovers on actuals are part of that rate, shown separately, with receipts. A fee absent from the statement needs fresh explicit consent. Penal charges, under conduct paragraph 30, are a charge recorded separately from interest added to the rate, and they are not capitalised. They have to be written into the agreement and the statement, and a link to a website schedule does not place that text in either document.

On execution, paragraph 9(3) sends the signed pack, on the NBFC’s letterhead, to the verified email or SMS. The signature standard is the Information Technology Act, 2000. We can flag that the pack has not gone, and we do not lay out our own sheet and mark it sent. Where the loan sits outside retail and MSME term loans, applying paragraph 29 is the NBFC’s call.

Whose bank account the money uses

Disbursement goes to the borrower’s bank account. Paragraph 10(1) allows a statutory mandate, funds moving between co-lending lenders, and a specific end use paid to the end-beneficiary. A salary advance may be deducted by the employer, if the provider never controls the flow and the employer pays the NBFC from the employer’s account. Repayment is into the NBFC’s account, with no pass-through account, and the provider does not control the flow or collect its own fee from the borrower. Cash taken on a delinquent loan is posted in full the same day, and the NBFC still pays the provider for that recovery.

Cooling-off, complaints and recovery calls

The borrower can exit a digital loan during cooling-off by paying the principal and the proportionate annual percentage rate, with no penalty. The credit policy sets the length, and it cannot be under one day. A reasonable one-time processing fee on that exit is allowed only if the key fact statement disclosed it. Validity is how long the offer stays open before agreement, and cooling-off is how long the borrower has to leave after the loan exists. Prepayment after cooling-off follows the conduct directions.

The NBFC and any provider with a borrower interface each name a nodal grievance officer. The details sit on both websites, on the app and in the key fact statement. Complaints can be lodged on the app and the website. The NBFC keeps the responsibility. If it rejects the complaint, the borrower is dissatisfied, or 30 days pass from receipt with no reply, the borrower can use the Complaint Management System under the Reserve Bank Integrated Ombudsman Scheme, as applicable, or write to the Centralised Receipt and Processing Centre, 4th Floor, Reserve Bank of India, Sector 17, Central Vista, Chandigarh 160017. The NBFC tells the borrower this path. Its website also links that system and the Sachet portal, and lists products, apps, providers and the privacy policy. Those two hosts did not return an HTTP response when we checked, so they are named as the directions name them and are not linked.

The agent’s particulars go by email or SMS before contact, and again if the agent changes. Paragraph 100 of the conduct directions bars intimidation, harassment, intrusion on family or referees, and calls for overdue recovery before 8:00 a.m. or after 7:00 p.m. It does not apply to microfinance, which uses paragraph 91, including no calls before 9:00 a.m. or after 6:00 p.m. Some 2026 explainers add a calling change from 1 January 2027. We did not read an amendment that moves these hours, so the control uses the hours in paragraphs 100 and 91.

Borrower data, consent and where it is stored

What a lending app must not read on the phone

Collection by either app is need-based, with prior explicit consent and an audit trail. The app does not open files and media, the contact list, call logs or telephony. Camera, microphone, location, or another facility needed for onboarding or KYC, may be used once, with consent, for that step only. The borrower can allow or refuse a specific use, limit third-party disclosure, set retention, revoke consent, and require deletion. Purpose is stated at each stage, and a share with a third party needs its own explicit consent, unless a statute or regulation requires it. The privacy policy is public on both websites, and it names third parties allowed to collect through the app.

Servers in India, and the DPDP calendar

The provider stores only basic data the agreement needs in order to operate. The directions give name, address and contact details as the sort of minimum, and ongoing privacy and security stay with the NBFC. Both parties publish what is stored, for how long, what use is off limits, how data is destroyed and how a breach is handled. Biometrics are not collected or stored unless a statute allows it. Data sits on servers in India, and if it is processed outside India, it is deleted abroad and brought back within 24 hours.

If a vendor holds statement PDFs, the agreement has to allow that holding and the servers have to meet paragraph 14. We do not put “stored in India” or “DPDP compliant” on a build. The Digital Personal Data Protection Act, 2023 commenced in pieces. G.S.R. 843(E) of 13 November 2025 appoints the dates. Notice and consent in sections 5 and 6, other than section 6(9), and the rights in sections 11 to 17, start eighteen months later, on 13 May 2027. Section 6(9), registration of a Consent Manager, starts on 13 November 2026. Section 10, the significant-data-fiduciary duties, is in the eighteen-month group, and we do not decide which entity is a significant data fiduciary. Until those sections commence, the consent rule on a digital lending file is paragraph 13, which is already in force.

Reporting the app, and the multi-lender screen

Every loan through the NBFC’s app or a provider’s app is reported to a credit information company, whatever the tenor, including short credit or a deferred payment on a merchant platform, and the NBFC files the report.

The NBFC also reports every app it deploys or joins, its own or a provider’s, on the Centralised Information Management System, and updates the filing when an app is added or dropped. The chief compliance officer, or another officer the board names, certifies the data and that the app meets the directions: the link to the NBFC site, a nodal officer where the provider owns the app, paragraphs 13 and 14 on data, and the website disclosures in paragraph 9(4). The Reserve Bank publishes the filing and does not verify it. Grievances about the app stay with the NBFC. A directory line is not a registration, authorisation or endorsement, and a DSA’s marketing cannot say it is. The 8 May 2025 press release placed the public list under Citizen’s Corner, as apps deployed by regulated entities. We took that path from the press release and did not open a directory URL.

What the multi-lender screen has to show

Where a provider has agreements with several lenders, each NBFC sees that the app shows every offer matching the borrower’s request, and names the lenders that did not match. The matching method is consistent for similarly placed borrowers and products, and it is documented, including later changes. Each match shows lender, amount, tenor, annual percentage rate, monthly repayment and penal charges where they apply, with a link to that lender’s key fact statement. The screen does not push one lender, including by dark patterns as the Central Consumer Protection Authority defined them on 30 November 2023. Ranking on a metric disclosed publicly in advance is allowed.

Default loss guarantee, still at five per cent

Whatever the contract calls it, default loss guarantee covers loss from default up to a percentage fixed at the start, and an implicit arrangement of that kind counts. Only a lending service provider, or another lender in that role, may give it, and only if that provider is a company under the Companies Act, 2013, so a proprietorship DSA cannot give one. The guarantee does not replace the credit read, and the sanction remains a person’s name on the file. The only forms are cash with the NBFC, a fixed deposit at a scheduled commercial bank under lien, or a bank guarantee. Cover stays within five per cent of the amount disbursed out of that fixed pool. The NBFC invokes within 120 days unless the borrower cures, and the contract lasts at least as long as the longest loan. Invoked cover is not set off against the borrower’s dues and is not reinstated by recovery. CGTMSE, the low-income housing fund, NCGTC schemes and the official-sector guarantees in paragraph 29 are outside the definition. The provider publishes the portfolios and amounts each month, within seven working days.

A checklist with the paragraph numbers

Paragraph numbers below are Chapter III of RBI/DOR/2025-26/347 unless a line says otherwise. Tick them on the consolidated page.

1. The policy cites that chapter, not RBI/2025-26/36 and not the 2 September 2022 guidelines.
2. The agreement states roles and leaves liability with the NBFC. Due diligence is on file before go-live, and a review date is diarised. Paragraph 6.
3. A multi-lender screen shows every match, with lender, amount, tenor, annual percentage rate, monthly repayment, penal charges and a statement link, and names lenders that did not match. Paragraph 7.
4. The key fact statement is the NBFC’s annex, explained in a language the borrower understands, inside its validity, and copied into the agreement. Conduct directions, paragraph 29.
5. On execution, the signed pack reaches verified email or SMS on the NBFC’s letterhead. Paragraph 9(3).
6. Disbursal and repayment follow paragraph 10. Any borrower charge is inside the statement. The NBFC pays the provider.
7. Cooling-off is in the credit policy, at least one day, and a fee on exit appears in the statement if it will be charged. Paragraph 11.
8. Nodal officers, the 30-day path, the complaint system and Sachet are visible. Paragraphs 9(4) and 12.
9. Consent is logged. The app does not read contacts, call logs, files, media or telephony. Camera, microphone and location are one-time KYC. Paragraph 13.
10. Storage policy, India servers, 24-hour return, and basic data only at the provider. Paragraph 14.
11. Every digital loan goes to a credit information company. Paragraph 17.
12. The CIMS app list matches the website, is certified, is updated when an app joins or leaves, and is not called an RBI registration. Paragraph 18.
13. Any guarantee is from a company provider, capped at five per cent, in an allowed form, invoked within 120 days, and is not the credit decision. Paragraphs 19 to 27.
14. Recovery particulars go by email or SMS before contact. Hours follow conduct paragraph 100, or paragraph 91 for microfinance.

The document chase beside these rules

Chapter III does not say how many months of bank statement a business file needs, or which GST return closes it. That list, and the second message that only says “pending documents”, is documents required for a business loan. Beside that list, this chapter adds the consent, the statement of terms before the contract, the account the money uses, and the hours a recovery call may use.

The chase can name the missing page and log what was asked, what arrived and what a person decided. It does not issue the key fact statement, collect a fee the statement does not contain, or name a recovery agent before the NBFC has. Credit keeps title, the income judgement, and the decision to approve or decline. Lending and loan agents is that split for a DSA desk, including a Navi Mumbai file we are mapping: one partner sent 600 leads, and the chase was three or four WhatsApp messages a file. Results are not in yet.

On a live file, check one product for who sends the key fact statement, which account the disbursal hits, and whether a fee line leaves from the DSA’s phone. The work sits on the NBFC’s number and the NBFC’s store, the same constraint as the systems we build.

Frequently asked questions

Does a DSA need its own RBI registration under these rules?

A DSA is not made a regulated entity by Chapter III. A lending service provider is an agent of the NBFC that carries out one or more of the NBFC's digital lending functions. The NBFC remains fully liable for that agent's acts and omissions. Whether a connector is inside that definition depends on the functions in the agreement. The NBFC's compliance owner makes that call.

Does a bank follow the same chapter as an NBFC?

No. The 28 November 2025 consolidation split the old single book by type of regulated entity. An NBFC reads Chapter III of the NBFC Credit Facilities Directions. A bank, a co-operative bank or an all-India financial institution should open its own Credit Facilities Directions and read the digital lending chapter there. Citing the NBFC paragraphs in a bank policy is the wrong document, even where the duty looks familiar.

Did the 15 July 2026 update rewrite the digital lending rules?

The cover of RBI/DOR/2025-26/347 says updated as on 15 July 2026. That day's second amendment, RBI/2026-27/183, adds explanations to paragraphs 70 and 72 in the project-finance chapter, on separate project units and on right of way for electricity projects. We did not find an edit to digital-lending paragraphs 6 to 30 in that amendment. Check the consolidated page anyway, because earlier amendments are already folded in.

Are credit-card EMIs covered by the digital lending chapter?

Paragraph 30(1) says EMI programmes on a credit card follow the NBFC credit-card directions and are not covered by the Credit Facilities Directions. Other loan products offered on credit cards, where those card directions do not cover them, fall under the digital lending chapter. A card EMI and a personal loan sold inside a card app are different rows. Match the product before the file is built.

Does a line in the RBI app directory mean the app is approved?

Paragraph 18 says the public list is built from what the NBFC files on the CIMS portal, and that the Reserve Bank does not verify or validate those filings. The same paragraph says a listing must not be presented as registration, authorisation or endorsement, including in marketing material. The chief compliance officer, or another officer the board names, certifies the data. A directory line is the NBFC's report.

Which PDF should a credit policy cite now?

Cite the consolidated directions on rbi.org.in, notification id 12957, number RBI/DOR/2025-26/347, the page marked updated as on 15 July 2026, and name Chapter III. RBI also publishes a PDF from that page. The May 2025 digital lending PDF and the 2 September 2022 guidelines PDF are the withdrawn instruments. Match the cover date to the page you mean to cite, rather than a copy hosted on a vendor site.