Digital Lending in India: How Far Do RBI's New Borrower Protections Really Go?

This Blog is Written by Sakshi Jagdishchandra Joshi, 5th Year, B.A.LLB, M.K.E.S College of Law, Malad, Mumbai.

Blog 09 | Edition VIII

A few years ago, getting a personal loan usually meant visiting a bank branch, submitting several documents and waiting for a few days. Today, a borrower can apply through an app and receive a decision within minutes. This has made credit easier to access, including for people who may earlier have found it difficult to obtain a bank loan. At the same time, the rapid growth of digital lending created problems that the existing regulatory framework did not always address effectively. Loan decisions can be made through algorithms, while the app dealing with the borrower may actually be a service provider working for a bank or NBFC. In the past, this distance between the borrower, the app and the regulated lender contributed to practices such as aggressive recovery calls, unclear interest charges, unnecessary access to phone data and misuse of personal information. The RBI responded through the Digital Lending Directions, 2025 and the March 2026 update. The important question is whether these measures provide meaningful protection to the person actually taking the loan.

From Scattered Rules to One Regulatory Framework

Before the 2025 Directions, digital lending was largely governed by the guidelines issued in 2022. Those guidelines were introduced in response to complaints about recovery practices and the collection and use of borrowers' personal data. They addressed several concerns, but the regulatory position remained spread across different instructions. There was also a practical difficulty: lending service providers themselves were not directly regulated entities of the RBI. As a result, a rule aimed at the regulated lender could be harder to enforce against the service provider that the borrower actually interacted with. The Digital Lending Directions, 2025, which came into force on 8 May 2025, brought the earlier digital lending guidelines and the default loss guarantee framework into a consolidated framework. More importantly, the regulatory boundary became wider. Commercial banks, cooperative banks, NBFCs including housing finance companies, all-India financial institutions, and the lending service providers and digital lending apps working with them are covered by the framework. This is important because many borrower-facing activities take place through the app or service provider rather than directly through the bank or NBFC.

What Changes for the Borrower?

For a borrower, the changes can be seen in a few practical requirements. Before entering into the loan arrangement, the borrower must receive a Key Fact Statement containing important information about the loan, including its annual percentage rate. The purpose is to make the actual cost of borrowing clearer instead of leaving the borrower to work it out from different charges and documents. The lender is also required to assess relevant information about the borrower, including details such as age, occupation and income. A lending decision therefore cannot simply depend on an automated model without the required assessment and record-keeping. Similarly, a credit limit cannot be increased automatically. Any increase has to be specifically requested by the borrower and separately assessed. The Directions also place greater restrictions on the collection and use of personal data. Consent has to be specific and informed and must be obtained before the relevant data is collected. Borrowers have rights relating to particular categories of data, withdrawal of consent and deletion of information, subject to the applicable framework. Digital lending apps are also restricted from accessing unnecessary information such as a borrower's contact list, photographs or messages merely for processing a loan. Data storage is another important part of the framework. The Directions require the relevant financial data to be stored in India, with the localisation requirement taking effect in April 2026. This is intended to ensure that data relating to Indian borrowers remains within the reach of Indian regulatory oversight.

Recovery Practices and Additional Charges

The treatment of recovery practices is one of the more visible parts of the Directions. Recovery agents cannot contact borrowers before 8 a.m. or after 7 p.m. They are also restricted from contacting family members or other persons who have not co-signed the loan and from using social media or third-party communications to publicly pressure a borrower over a default. The March 2026 update also addresses charges imposed on borrowers. A charge cannot be added if it was not disclosed in the Key Fact Statement when the loan was sanctioned. This is important because borrowers should be able to understand the cost of the loan at the beginning rather than discovering additional charges later under descriptions such as administrative or convenience fees.

Who is Responsible when Something Goes Wrong?

A regulatory framework becomes meaningful only when responsibility for a violation is clear. The 2025 framework places responsibility on the regulated bank or NBFC that provides the loan, even where the borrower deals mainly with an app or lending service provider. An agreement between the lender and its service provider cannot be used to transfer away the lender's regulatory responsibility. This approach is significant because the RBI has limited direct regulatory control over an unlicensed service provider. Making the regulated lender responsible creates an incentive for the lender to monitor the entities working on its behalf and to ensure that their practices comply with the applicable requirements. The Directions also deal with the movement of loan funds. Loan disbursement and repayment are required to take place directly between the lender's account and the borrower's account, rather than through an account of the lending service provider or a pooled account. This reduces the possibility of borrower funds being diverted, delayed or misused while passing through an intermediary account.

What Remains Outside the Framework?

The regulatory framework does not automatically cover every lending app available to consumers. An app operating independently and without being connected to a regulated bank or NBFC may fall outside the RBI's Digital Lending Directions. This leaves an important gap because a borrower may not always know whether the app being used is connected to a regulated lender. Access to complaint mechanisms is another practical issue. The protections available under the Directions are useful only if borrowers know about them and are able to use the available grievance redressal mechanisms. This can be particularly difficult for people taking small or urgent digital loans, who may have limited awareness of the regulatory requirements. There is also an overlap with data protection law. The Digital Personal Data Protection Act deals with several aspects of personal data and consent from a separate legal perspective. Regulated lenders therefore need to consider both the RBI framework and the requirements applicable under data protection law. The DPDP framework can also impose significant financial penalties, separately from any action that may be taken by the RBI.

Conclusion

The Digital Lending Directions, 2025, together with the March 2026 update, have brought a more consolidated set of protections into the digital lending sector. The framework places responsibility on regulated lenders, introduces clearer requirements around loan costs and data collection, restricts certain recovery practices and controls the movement of loan funds. However, the effectiveness of these protections will depend on how they work in practice. A significant issue remains the lending apps that operate outside the regulated ecosystem. Borrowers also need to be able to identify the regulated lender behind an app and understand the rights available to them. The real test of the framework will therefore be whether these protections reach the borrower at the point when they actually need them, rather than remaining only as requirements imposed on paper.

 

(Write to the author at joshisakshi498@gmail.com.)