Background:
The Reserve Bank of India (“RBI”) on May 8, 2025, issued the Reserve Bank of India (Digital Lending) Directions, 2025 (“DL Directions”).
The idea of these new directions was to consolidate the various directions and circulars on digital lending by Regulated Entities (“RE”), previously issued by the RBI[1], provide greater clarity on consumer/ customer centric rights from a customer protection point of view and create a repository with the RBI of all digital lending apps/ platforms (“DLA”) provided by REs/ lending service providers (“LSP”).
Some of the key changes addressed by the new DL Directions include: (a) RE and LSP arrangement involving multiple lenders; (b) an RBI-maintained central repository of DLA; and (c) alignment with the DPDP Act.
RE-LSP arrangements involving multiple lenders:
Under the new DL Directions, where an LSP has agreements with multiple REs for digital lending, each RE must ensure the following:
- Disclosure of all available loans: LSP must display a comprehensive digital view of all relevant loan offers on their DLAs, enabling borrowers to easily compare options, by providing the name of the lending institution (RE), loan amount and duration, annual percentage rate (APR), monthly repayment amount, any applicable penalties, and a direct link to each RE’s Key Fact Statement (KFS). This will lead to the creation of a marketplace of loans wherein customers can select lenders offering the most suitable terms.
- Matching borrowers with lender(s): While LSP can choose their method for connecting borrowers with lenders, they are required to maintain a consistent approach for borrowers and products in similar situations and to thoroughly document their chosen mechanism and any modifications made to it. This may be particularly relevant for LSPs who adopt novel technologies for matching borrowers with lenders and introduce transparency and mitigate bias.
- Content on DLA: LSPs are obligated to present unbiased and objective content on their DLAs. They must avoid directly or indirectly promoting specific lenders or using deceptive “dark patterns”[2] that might manipulate borrowers into selecting a particular loan offer.
DLA Repository:
Noting the presence of unscrupulous digital lending players who falsely claim to be associated with REs, on August 8, 2024,[3] the RBI had mulled the creation of a public repository of DLAs deployed by REs, which would be available on the RBI’s website.
In this regard, the DL Directions now require REs to report all DLAs deployed/ joined by them, whether own or those of LSPs, either exclusively or as a platform participant, on the Centralised Information Management System (“CIMS”) portal of the RBI. This will create a repository of all DLAs and also give visibility to the regulator on reliance on certain apps by multiple REs as this could pose a concentration risk to the sector. This will also cast additional responsibility on the chief compliance officer or any designated official in the area to ensure the veracity of DLAs reported.
Interface with Digital Personal Data Protection Act, 2023 (“DPDP Act”):
Obligations with respect to collection, processing and storage of data has been broadly aligned with the DPDP Act. REs are required to collect data need-based after taking explicit consent, with auditable trail. The purpose for collecting consent must be disclosed at each stage of the interface with the borrower. Further, access to certain functionalities and features on devices are restricted in entirety. Borrowers have also been given the right to withdraw consent for usage of specific data sets, restrict sharing of data with third parties and seek deletion/ forgetting of data sets.
REs are also required to have a comprehensive privacy and customer data retention policy on their website, with specific disclosures around data destruction protocol, standards for security breach, etc., on their website. These requirements are arguably more detailed than those prescribed under the DPDP Act.
Interestingly, Paragraph 12 of the DL Directions does not use the term personal data, but extends to all data collected. Further, implementation of the requirement to disclose purpose at each stage of the interface may be difficult to visualise from a user journey perspective.
While previously the DL Guidelines mandated REs to ensure that all data is stored only in servers located within India, the DL Directions now permit processing of data outside India, as long as such data is deleted from servers outside India and brought back to India within 24 hours of processing.
Conclusion:
The new DL Directions aim to ensure that borrowers are fully informed of the terms and conditions associated with the loans offered by various lenders. These directions promote transparency and accountability, mitigate the risk of misrepresentation or bias in loan offerings, and facilitate effective collaboration between REs and LSPs while safeguarding the interests of borrowers. This transparency is essential for promoting ethical lending practices and enhancing confidence in the digital lending ecosystem.
The automated publication of DLA data on the RBI website empowers borrowers to verify lending platform legitimacy, curbing fraud and unethical practices. This framework bolsters borrower protection, builds trust in digital lending, and ensures fair and responsible practices by REs and their DLAs.
Further, the relaxation of data localisation norms and allowing data to be processed outside India, albeit only for 24 hours, will enable REs to utilise global technology in its processes, especially in the current age of AI enabled tools.
[1] The DL Directions consolidate and repeal the following:
- Guidelines on Digital Lending dated September 2, 2022 (“DL Guidelines”);
- Guidelines on Default Loss Guarantee (“DLG”) in Digital Lending dated June 8, 2023 (here); and
- Loans Sourced by Banks and NBFCs over Digital Lending Platforms: Adherence to Fair Practices Code and Outsourcing Guidelines dated June 24, 2020 (here).
[2] As defined under section 2(e) of the ‘Guidelines for Prevention and Regulation of Dark Patterns, 2023’ dated November 30, 2023, issued by Central Consumer Protection Authority (here).
[3] Paragraph 1 of the RBI’s Statement on Developmental and Regulatory Policies dated August 8, 2024 (here).
