What RBI's digital lending rules ask about apps, data and lending partners.

What the rules are for

In its Digital Lending Directions of 8 May 2025, RBI defined digital lending as a remote and automated lending process, largely by use of seamless digital technologies for customer acquisition, credit assessment, loan approval, disbursement, recovery and associated customer service. Some of that work may be done by a partner rather than the lender: a lending service provider, defined as an agent of the lender that carries out one or more of its digital lending functions, or part of them, or a digital lending app, a mobile or web-based application with a user interface that facilitates digital lending services. The rules set what the lender must do when it lends this way, and make clear that it cannot hand its responsibility to a partner along with the work.

Who they apply to

RBI issued the Reserve Bank of India (Digital Lending) Directions, 2025 on 8 May 2025. They applied to all digital lending activities of commercial banks, primary (urban), state and central co-operative banks, non-banking financial companies including housing finance companies, and all-India financial institutions. RBI's copy of that standalone document now carries a Withdrawn watermark. For NBFCs, the same rules, in nearly the same words, appear in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, dated 28 November 2025 and updated as on 15 July 2026. That Direction's repeal clause is general and does not name the Digital Lending Directions, so the link between the two rests on the watermark and the matching text rather than on an express statement by RBI. Chapter III is the text this article and AuditSahi's rulebook are read from. The paragraph numbers below are that chapter's. This article covers only that NBFC text. Banks, co-operative banks and all-India financial institutions should check which current RBI directions carry these rules for them.

Para 3 of the Credit Facilities Directions applies them to NBFC-D, NBFC-ICC, NBFC-Factor, NBFC-MFI, NBFC-IFC, IDF-NBFC and HFC, in all layers unless specified otherwise. Some other kinds of NBFC are covered only in part or not at all, so an NBFC should check its own class in para 3. Within Chapter III there are no tiers. The rules are triggered by the activity, lending digitally, whether directly or through a lending service provider or app, and not by an NBFC's size.

The lender stays responsible

So if a provider's app collects data it should not, the NBFC remains responsible and liable for it.

Choosing and contracting a lending service provider

The NBFC must also review the provider's conduct against that contract periodically and act on deviations, and its policy must say how loans the provider originates are monitored. Where one provider works with several lenders, it must show the borrower an unbiased digital view of all matching loan offers, without design tricks that steer the choice.

What an app may collect

The purpose of each consent must be told to the borrower at each stage of the app, and explicit consent is needed before personal information goes to any third party, unless a law requires the sharing. No biometric data may be collected or stored unless statutory guidelines explicitly allow it.

Where borrower data is kept

A lending service provider may store only the basic minimum borrower data its service needs, and responsibility for the privacy and security of that data stays with the NBFC. The NBFC and its providers must also follow the technology and cyber security standards RBI and other agencies set for digital lending.

Complaints

The NBFC, and any provider that deals with borrowers, must name a nodal grievance redressal officer whose contact details appear on the website, in the app and in the Key Fact Statement.

Telling RBI which apps you use

The Chief Compliance Officer, or an official the Board designates, certifies that the CIMS data is accurate and that each app complies, including the website link, the grievance officer and data handling. RBI does not verify what is submitted, so the NBFC bears full responsibility for its accuracy, and a listing must not be presented as RBI's endorsement.

Default loss guarantees

Such an arrangement is allowed only with a provider or other lender incorporated as a company. The NBFC needs a Board-approved policy for such arrangements, and must obtain auditor-certified solvency information from the guarantor before entering or renewing one.

What this looks like as evidence

For lending service providers, the due diligence record, the signed contract and the record of periodic reviews. For apps, the permissions each app requests and the consent records with their audit trail. For data, the published data storage policy and a record of where borrower data is held. For complaints, the grievance officer's published details and the complaint log. For RBI, the CIMS submission and the compliance officer's certification. These are the documents an auditor asks for, and they are what AuditSahi asks you to upload for this rulebook.