Part 02 — RBI Regulatory Framework

Digital Lending Directions

The governing document for app-led and web-led SME loans is the Reserve Bank of India (Digital Lending) Directions, 2025, May 8, 2025. It consolidated RBI’s 2020 circular on loans sourced over digital lending platforms, the September 2, 2022 Digital Lending Guidelines and the June 8, 2023 Default Loss Guarantee (DLG) circular. The new directions came into force immediately, except para 6 on multi-lender LSP arrangements from November 1, 2025 and para 17 on DLA reporting from June 15, 2025.

Actors: RE, LSP and DLA

RBI uses three terms precisely:

Term	Meaning in practice
Regulated Entity (RE)	The bank/NBFC/HFC/AIFI actually extending credit and carrying regulatory responsibility.
Lending Service Provider (LSP)	An agent of the RE performing one or more digital lending functions: acquisition, underwriting support, pricing support, servicing, monitoring or recovery.
Digital Lending App/platform (DLA)	Mobile or web interface used for digital lending, whether owned by the RE or by the LSP.

This classification changes how partnerships are built. A marketplace such as a merchant platform, GST/accounting SaaS, payment aggregator, loan aggregator, e-commerce seller dashboard or supply-chain anchor may be an LSP if it performs lending functions. A pure Payment Aggregator is outside the direction only if it is not acting as an LSP; RBI says a PA that also performs an LSP role must comply with the Digital Lending Directions.

Borrower Disclosures

Before execution, the borrower must receive a Key Facts Statement (KFS) as prescribed in RBI’s Key Facts Statement (KFS) for Loans & Advances circular, April 15, 2024. In SME lending, the KFS should not be a PDF generated after disbursement. It must show the amount, annual percentage rate (APR), all fees included in APR, tenor, instalment, recovery mechanism, cooling-off period, grievance contacts and penal charges. Digital lending also requires digitally signed documents on the RE’s letterhead to flow automatically to the borrower’s registered email/SMS: KFS, sanction letter, loan summary, terms and conditions, account statements and privacy policies (RBI Digital Lending Directions, para 8).

In multi-lender DLAs, from November 1, 2025 the LSP must show all matching loan offers, disclose unmatched lenders, use a consistent matching mechanism, show RE name, loan amount, tenor, APR, monthly repayment obligation and penal charges, and avoid dark/deceptive patterns. This is directly relevant to embedded SME lending where a merchant sees “best offer” cards from multiple banks/NBFCs.

Fund Flow Rules

The most operationally consequential rule is fund flow. Loan disbursement must go directly from the RE to the borrower’s bank account, except for specific permitted cases: statutory/regulatory mandates, co-lending fund flows between REs, and specific end-use disbursement directly to the end-beneficiary such as machinery supplier or invoice seller (RBI Digital Lending Directions, para 9). Servicing and repayment must also flow directly from borrower to RE bank account. LSP pool accounts are not allowed.

This means a loan management system must not treat partner collections as a generic virtual account unless it is clearly the RE’s collection account or a permitted escrow under co-lending. If cash is collected for delinquent accounts through physical interface, the recovery must be reflected in the borrower’s account on the same day and LSP fees cannot be deducted from the recovery proceeds.

Cooling-Off and Creditworthiness

The borrower must have a cooling-off option to exit the digital loan by paying principal and proportionate APR without penalty. RBI leaves the exact period to the RE’s Board-approved policy, but it cannot be less than one day. A reasonable one-time processing fee may be retained if disclosed upfront in the KFS.

The RE must assess creditworthiness before lending and keep age, occupation and income/economic profile information at minimum. For SMEs this should translate into business vintage, GST/banking turnover, bureau, existing debt, owner cash flows, seasonality, business constitution and end-use. Automatic credit-limit increases are barred unless explicitly requested, evaluated and recorded.

DLAs can collect only need-based data with prior explicit consent and audit trail. They must not access mobile resources such as contacts, call logs, files/media or telephony functions. One-time access to camera, microphone, location or similar permissions is permitted only for onboarding/KYC with explicit consent. Borrowers must be able to give or deny consent, restrict third-party disclosure, revoke consent and request deletion/forgetting where applicable.

Storage is strict: LSPs may store only minimal borrower data needed for operations, no biometric data unless legally permitted, and all data must be stored in servers located in India. If data is processed outside India, it must be deleted from offshore servers and brought back to India within 24 hours (RBI Digital Lending Directions, paras 12-13).

DLG Mechanics

Default Loss Guarantee (DLG), formerly called FLDG in market practice, is allowed only within guardrails:

Rule	Requirement
Provider	LSP or another RE acting as LSP; non-RE LSP must be incorporated as a company.
Form	Cash deposit with RE, fixed deposit with scheduled commercial bank lien-marked to RE, or bank guarantee in favour of RE.
Cap	Maximum 5% of total amount disbursed out of the fixed DLG loan portfolio at any given time.
Portfolio	Identifiable and measurable “DLG set”; it is fixed, not dynamic.
Invocation	RE must invoke within a maximum overdue period of 120 days unless borrower cures before that.
No set-off	Borrower liability and NPA/provisioning remain with the RE; DLG does not reduce borrower dues.
No reinstatement	Invoked DLG cannot be replenished through later recovery.

DLG cannot be used for revolving digital credit, credit cards, loans already covered by specified trust-fund guarantee schemes such as CGTMSE/NCGTC, or NBFC-P2P platform loans (RBI Digital Lending Directions, paras 20-28).