RBI (Digital Lending) Directions, 2025 – Same Same, But Different

A. On May 8, 2025, the Reserve Bank of India ("RBI") issued the Reserve Bank of India (Digital Lending) Directions, 2025 ("2025 Directions") with an objective to consolidate, streamline, and update the regulatory framework that governs digital lending by Regulated Entities ("REs"). The 2025 Directions not only subsume various prior circulars and guidelines under the Existing DL Framework (defined below) but also introduce new compliance obligations aimed to strengthen transparency, customer protection, data privacy, and accountability in digital lending operations.

B. Prior to the issuance of the 2025 Directions, the existing instructions and guidelines in respect of digital lending, which collectively formed the digital lending regulatory framework ("Existing DL Framework") included:

1. Circular on 'Loans Sourced by Banks and NBFCs over Digital Lending Platforms: Adherence to Fair Practices Code and Outsourcing Guidelines' dated June 24, 2020
2. Circular on 'Outsourcing of Financial Services - Responsibilities of regulated entities employing Recovery Agents' dated August 12, 2022
3. Guidelines on Digital Lending dated September 2, 2022 ("DL Guidelines") read with the FAQs on DL Guidelines dated February 14, 2023
4. Guidelines on Default Loss Guarantee ("DLG") in Digital Lending dated June 8, 2023 ("DLG Guidelines") read with the FAQs on DLG Guidelines dated April 26, 2024 (and updated on November 5, 2024)
5. Circular on 'Key Facts Statement ("KFS") for Loans & Advances' dated April 15, 2024

The 2025 Directions effectively repeal (i), (iii) and (iv) mentioned above.

C. Key changes introduced in 2025 Directions:

1. Applicability: The 2025 Directions extend the applicability of the digital lending framework to include All-India Financial Institutions, in addition to the entities already covered under the existing framework namely, commercial banks, co-operative banks, and NBFCs.
2. Clarification in definitions:
   1. DLA: The 2025 Directions have updated the definition of Digital Lending Apps ("DLAs"), to clarify that DLA now includes mobile and/or web-based applications, either on a standalone basis or as a part of suite of functions of an application facilitate digital lending services.
   2. LSP: The definition of a Lending Service Provider ("LSP") under the 2025 Directions includes "an agent of an RE (including another RE) who carries out one or more of the RE's digital lending functions". Hence, the updated definition explicitly acknowledges that even an RE may act as an LSP of another RE while further clarifying the functional scope of such LSPs is limited only to the digital lending functions of the RE.
3. Additional obligations imposed on REs: The 2025 Directions impose additional compliance obligations on REs, including:
   1. a requirement to mandatorily have a written agreement to engage with an LSP (for undertaking digital lending). Such agreement should contain the respective roles, rights and obligations of each party involved in the digital lending arrangement;
   2. an obligation to take appropriate action against LSPs in case of any breach of the contractual terms governing the RE-LSP relationship;
   3. a requirement to incorporate, as part of their internal policy framework, robust monitoring mechanisms for loan portfolios originated with the support of LSPs;
   4. detailed an obligation to obtain, at a minimum, the borrower's age, occupation and income details as a part of the credit worthiness assessment prior to extending any loan;
   5. modified the process for increasing the credit limit of the borrower subject to receiving an explicit request (unlike the erstwhile regime which was based on obtaining explicit consent) from such borrower, followed by a proper evaluation of the request; and
   6. a mandate to clearly communicate to borrowers the available modes of grievance redressal, including the option to file a physical complaint with the RBI under its prescribed grievance mechanism, and to specify the circumstances under which such escalation may be pursued, such as where the RE has rejected or only partially resolved the borrower's complaint.
4. LSPs contracting with Multiple Lenders: The 2025 Directions have introduced certain additional compliances regarding an LSP engaging with multiple lenders on DLA, which will come into effect from November 1, 2025. In such cases, each RE is required to ensure that:
   1. the LSP presents all loan offers matching a borrower's request in a neutral, unbiased, and comparable manner, including also displaying the names of unmatched lenders.
   2. the digital display containing the loan offers from matching lenders must include key mandatory disclosures, such as the name of the lending RE, loan amount, tenure, applicable interest rate and charges, and a link to the KFS for each offer.
   3. the LSP's loan-matching mechanism must be applied uniformly across similarly placed borrowers and products, and must be properly documented, including any subsequent modifications.
   4. the use of promotional bias or manipulative interface practices is expressly prohibited, except where loan offers are ranked based on a publicly disclosed, objective criterion.
5. Relaxation in the Cooling off period: Under the earlier DLG Guidelines, borrowers were permitted to exit digital loans without penalty during a minimum look-up period of three days for loans exceeding seven days, and one day for shorter-tenure loans. The 2025 Directions replace this with a more flexible "cooling-off" framework, allowing the Board of RE to determine the duration of the cooling-off period, subject to a minimum period of 1 (one) day.
6. Reporting of the DLA on CIMS Portal by the RE: As part of the 2025 Directions, with effect from June 15, 2025, all the REs are mandatorily required to report details of all DLAs associated with them, whether self-operated or operated by their LSPs, and whether used exclusively or as part of a shared platform, on the RBI's Centralised Information Management System ("CIMS") portal in the prescribed format. Further, REs are required to ensure that:
   1. the information on the CIMS portal is updated, by reporting any additions or discontinuations of DLAs on a rolling basis.
   2. its Chief Compliance Officer or another official designated by its Board must certify the accuracy of the data submitted and confirm compliance of all DLAs with the applicable regulatory framework.
   3. the above certification must also confirm (i) that borrower-facing disclosures are accessible via the RE's website, (ii) that LSP-operated DLAs have appointed grievance redressal officers with publicly available contact details, (iii) that data collection and storage practices comply with the 2025 Directions, and (iv) that the RE's website discloses the DLA particulars reported to the RBI.
   4. the listing of any third-party DLA on the CIMS portal is not misrepresented by such DLA or its affiliates as RBI approval or endorsement in any form.
7. Relaxed offshore processing of data: Unlike the earlier DL Guidelines (which mandated the storage of lending-related data exclusively within India), the 2025 Directions expressly permit offshore processing of such data subject to the condition that any data processed outside India must be repatriated to India and erased from foreign servers within 24 hours of processing. This appears to be similar to the regulatory position that exists under the data localization directive applicable to payment system operators.

Originally published 14 May 2025

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.