RBI digital lending rules: what they mean for your loan software

Why this matters to your product team

If you run a digital lending app, provide lending services to a bank or NBFC, or build loan software for one, the Reserve Bank of India's rules are product requirements. They decide what screens you show, what data your app may read, how money flows and what your support team must do.

In May 2025, the RBI issued the Reserve Bank of India (Digital Lending) Directions, 2025. They bring together the 2022 digital lending guidelines, the 2023 rules on default loss guarantees and newer provisions such as multi lender arrangements. Their effect on loan software is set out in plain terms. This is not legal advice: read the current Directions and any later amendments with your compliance team and counsel.

Quick answer

Your loan software must:

1. Disburse and collect money only through bank accounts of the regulated entity (RE), with no pass through or pool accounts held by a lending service provider (LSP).
2. Show a Key Fact Statement (KFS) with the all inclusive annual percentage rate (APR) before the loan contract is signed.
3. Offer a cooling off period in which the borrower can exit by paying principal and proportionate APR, without penalty.
4. Collect only the data it needs, with explicit consent, and store it on servers in India.
5. Show the name of the RE and LSP, the grievance officer and a complaint route inside the app.
6. Where an LSP works with several lenders, show all matching offers in an unbiased way.

Money flows and pricing

Where the money goes

The rule is simple: loan disbursal goes from the RE's bank account directly to the borrower's account, and repayments go from the borrower directly to the RE. An LSP cannot route money through its own account. Narrow exceptions exist, such as disbursals for specific purposes under statutory or regulatory mandates, and those should be checked in the Directions.

For your system this means:

• Disbursal instructions come from the RE's systems or through its payment integrations.
• Repayment links, UPI collect requests and NACH or e-mandate registrations credit the RE's account.
• Reconciliation reports show the RE as the account holder throughout.

The Key Fact Statement and APR

Before the borrower signs, the app must show a KFS in the prescribed format. It includes the loan amount, tenure, the APR covering interest and all fees, the repayment schedule, recovery mechanism, grievance details and the cooling off period.

Software points to get right:

• Calculate APR from the same pricing engine that produces the loan contract, so the two never differ.
• Any fee not in the KFS cannot be charged later. Lock the fee list per loan at sign up.
• Send the KFS, the sanction letter and the loan agreement to the borrower's registered email or SMS after signing, and keep proof of delivery.
• Do not increase a credit limit automatically without the borrower's explicit consent.

Data and the app itself

The RBI is strict about what a digital lending app (DLA) may access.

• Collect data only when it is needed for the loan, with prior, explicit consent and an audit trail.
• Do not access file and media, contact lists, call logs or telephony functions. One time access to camera, microphone and location for onboarding or KYC is allowed with consent.
• Let borrowers deny consent for specific data, revoke consent and request deletion, subject to what the RE must keep by law.
• Store data on servers located in India. If data is processed abroad, it must be deleted there and brought back within the time the Directions set.
• Publish a privacy policy that lists the third parties the data goes to.

These overlap with the DPDP Act 2023, which applies alongside the RBI's rules. Building consent and deletion once, properly, serves both.

Partners, reporting and grievances

• LSP oversight. REs must do due diligence on their LSPs and remain responsible for outsourced functions. Your software should give the RE visibility of what the LSP does on its behalf.
• Reporting DLAs. REs report their digital lending apps to the RBI, and the RBI publishes a directory of DLAs. Make sure your app's name and details match what the RE reports.
• Credit bureau reporting. Loans must be reported to credit information companies, whatever their tenure.
• Default loss guarantees. Where an LSP gives a DLG, the cover is capped, currently at 5 percent of the loan portfolio. Track it in the loan management system.
• Grievances. Name a grievance redressal officer and show their contact in the app and on the website. Track complaints to closure within the timelines in the Directions, after which the borrower can escalate to the RBI Ombudsman.

What to check in your own system this quarter

1. Trace one loan from application to closure and confirm the money never touches an LSP account.
2. Compare the APR on the KFS with the APR in your loan contract for a sample of loans.
3. List every Android and iOS permission your app requests, and justify each one.
4. Confirm where every database, backup and log store sits geographically.
5. Test consent revocation and deletion requests end to end, including vendors you share data with.

If any of these take more than a day to answer, that is your first piece of work.