RBI digital lending rules for NBFCs: what you have to evidence after disbursal

If your NBFC lends through an app or a partner, much of what RBI’s digital lending rules ask you to show keeps running after the money goes out. Onboarding screens get the attention. The obligations that run for the life of the loan sit in the repayment flow, the borrower’s documents, the recovery calls and the filings.

Those obligations stay with the NBFC whoever does the work. Paragraph 6(7) says an agreement with a lending service provider (LSP) does not dilute the NBFC’s obligations, and that the NBFC “shall remain fully responsible and liable for all acts and omissions of the LSP”. The evidence that the rules were followed has to be something the NBFC can produce itself.

Where do RBI’s digital lending rules for NBFCs sit now?

In Chapter III, “Digital Lending”, of the Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, updated as on 15 July 2026. Paragraph 112 of those Directions repeals the existing directions relating to credit facilities for NBFCs, as RBI communicated on 28 November 2025. RBI’s list of withdrawn circulars includes the Digital Lending Directions of 8 May 2025. If your policies, partner contracts or audit notes cite them, the substance carries over but the references need updating: the old chapters on LSP arrangements, customer protection, technology and data, reporting, and loss sharing are now sections A to E of the new chapter.

The definitions explain why so much of it lands after disbursal. RBI defines digital lending as a remote and automated process covering customer acquisition, credit assessment, loan approval, disbursement, recovery and associated customer service. A lending service provider is an agent that carries out one or more of the NBFC’s digital lending functions, or part of one, and the definition names servicing, monitoring and recovery.

Which digital lending rules apply after disbursal?

Eleven, each with a paragraph number in Chapter III.

How must repayments move?

Directly. Paragraph 10(2) requires the borrower to repay into the NBFC’s bank account, with no pass-through or pool account of any third party, the LSP included. Paragraph 10(3) adds that no third party may control the flow of funds between the borrower’s account and the NBFC’s, directly or indirectly.

Three exceptions are written in:

• a salary advance can be repaid by the employer, deducted from salary and paid from the employer’s bank account to the NBFC, with no LSP control over the money
• co-lending flows follow RBI’s co-lending rules, provided no one other than the co-lenders controls the funds, and the co-lending post covers the escrow those rules require
• on a delinquent loan the NBFC may collect cash in person, provided the full amount shows in the borrower’s account the same day

The fee rule closes the other gap. Paragraph 10(4) says anything owed to the LSP is paid by the NBFC, and the LSP does not charge or collect it from the borrower. Paragraph 10(5) repeats the point for cash recoveries: the LSP’s fee cannot come out of the money the borrower handed over. So every receipt needs the account it landed in and its date, and every partner fee needs to trace to a payment the NBFC made.

What does the cooling-off period require?

An exit the borrower can take without penalty. Paragraph 11 gives the borrower an explicit option to leave a digital loan during an initial cooling-off period by paying the principal and the proportionate APR. The NBFC sets the length in its credit policy, and it cannot be shorter than one day. The NBFC may keep a reasonable one-time processing fee on an exit, if the Key Fact Statement (KFS) disclosed it upfront. Once the window closes, prepayment follows the Responsible Business Conduct Directions.

For the loan system, that is a product rule with dates attached. It has to know when each loan’s window ends, quote the exit amount on any day inside it, close the loan on that amount without a prepayment charge, and keep the processing fee only where the KFS named it.

What must reach the borrower, and when?

Three kinds of message, each with its own trigger:

• on execution of the loan contract or a transaction, digitally signed documents go automatically to the registered and verified email or SMS: the KFS, the product summary, the sanction letter, the terms and conditions, account statements and the privacy policies (paragraph 9(3))
• when a defaulted loan is assigned to a recovery agent, or the agent changes, the agent’s particulars go to the borrower by email or SMS before the agent makes contact (paragraph 9(6))
• when a reminder about a breach of a material term goes out, it states the applicable penal charges, and every levy of a penal charge is communicated with its reason (Responsible Business Conduct Directions, paragraph 30(7))

Each one comes down to a timestamp. If a borrower says an agent called before any notice arrived, the answer is the send time of the notice against the time of the first call.

The calls themselves follow the conduct directions too. Paragraph 6(5) of Chapter III requires the NBFC to guide an LSP acting as a recovery agent and make sure it complies with them, which brings in paragraph 100 of the conduct directions and its bar on recovery calls before 8 a.m. or after 7 p.m.

Who owns a complaint about an LSP?

The NBFC. Paragraph 12 requires the NBFC, and any LSP that deals with borrowers, to name nodal grievance redressal officers for digital lending complaints. Their contact details go on the NBFC’s website, the LSP’s website, the app and the KFS. Borrowers must be able to lodge a complaint on the app and the website. The paragraph states that responsibility for grievance redressal stays with the NBFC.

If the NBFC rejects the complaint, the borrower is not satisfied with the reply, or no reply comes within 30 days, the borrower can take it to RBI’s Complaint Management System under the Integrated Ombudsman Scheme. The practical test is whether a complaint made on a partner’s app reaches the NBFC’s own register with the date it was received, so that the 30 days can be counted. An EMI dispute investigation shows the records needed to connect the complaint, account correction and any separate credit-report correction.

Which data rules keep running after disbursal?

Paragraphs 13 and 14 apply for as long as the NBFC or its partners hold the borrower’s data:

• collection is need-based, with prior and explicit consent and an audit trail, and apps may not access files, media, contacts, call logs or telephony functions
• the borrower can deny consent for specific data, restrict disclosure, revoke consent and ask for the data to be deleted
• the LSP keeps only basic minimal data, such as name, address and contact details, and the NBFC remains responsible for privacy and security
• data is stored on servers in India, and anything processed abroad is deleted there and brought back within 24 hours
• no biometric data is stored or collected unless a statute allows it

The contact-list ban matters for collections. A partner’s app cannot read the borrower’s contacts, so a calling list built from them has no place in the recovery workflow.

What does the NBFC report, and to whom?

To the credit bureaus and to RBI. Paragraph 17 requires every loan made through the NBFC’s apps or its LSPs’ apps to be reported to the credit information companies, whatever its nature or tenor, including short-term or deferred-payment credit offered over a merchant platform. The calendar is the same as for the rest of the book, and the credit bureau reporting post sets out the four reference dates.

Paragraph 18 requires the NBFC to report every DLA it uses, its own or an LSP’s, on RBI’s Centralised Information Management System (CIMS), and to update the list when an app is added or an engagement ends. The Chief Compliance Officer, or another official the board designates, certifies that the data is correct and the apps comply. The certificate covers, among other things, that each app links to the NBFC’s website, that LSP-owned apps have a grievance officer, and that data collection and storage follow paragraphs 13 and 14.

RBI publishes the submitted data on its website automatically and states that it does not verify it. A stale entry is public, and the certificate behind it carries a name.

How does a default loss guarantee work once loans are live?

As a fixed amount against a fixed set of loans. Default loss guarantee, DLG in RBI’s text and often called FLDG by lenders and partners, can come only from an LSP, or another lender acting as one, incorporated as a company. It must take one or more of three forms: cash deposited with the NBFC, a fixed deposit with a scheduled commercial bank under lien to the NBFC, or a bank guarantee in the NBFC’s favour.

The cover on a portfolio cannot exceed 5% of the amount disbursed from it. The portfolio, the DLG set, stays fixed, and loans leave it only by repayment or write-off. RBI’s own illustration earmarks a ₹40 crore set with a ceiling of ₹2 crore, which becomes available in proportion as loans are disbursed.

After disbursal, four rules shape servicing:

• the NBFC must invoke the guarantee within 120 days overdue, unless the borrower makes the dues good first
• invoking it does not reduce what the borrower owes, and later recoveries can be shared with the provider as the contract says
• an invoked amount is never reinstated, even through recovery
• the NBFC makes sure the LSP publishes on its website, monthly and within seven working days of the month’s end, the number of portfolios under DLG and the amount of each

Asset classification and provisioning on the underlying loans follow the usual NPA rules, guarantee or not. The loan system has to hold each DLG set as a fixed list, count each loan’s days overdue against the 120-day limit, and record an invocation without touching the borrower’s balance.

What should the NBFC’s own loan record show?

Enough to answer for every obligation above without asking a partner:

• each receipt with the account it landed in, its date and channel, and cash recoveries posted the same day
• each partner fee traced to the NBFC’s payment, with nothing charged to the borrower
• each cooling-off exit with the quote, the amount paid and any disclosed processing fee
• each document and notice sent, with its send time: statements, recovery-agent details, penal charge reminders
• consent given and withdrawn, and deletion requests, with their dates
• complaints received through partner apps, with the date received and the outcome
• the DLA list as filed on CIMS, and who certified it
• each DLG set with its loans, cover, invocations and shared recoveries

When an LSP runs servicing, much of this is created on the partner’s systems first. The NBFC needs the same record on its side, because it is the one liable for what the partner did.

Where do agents fit in digital lending compliance?

In checking and assembling, with people deciding. An agent can test each outgoing notice against the rule it serves before it is sent, flag a loan in a DLG set as it nears 120 days overdue, and pull the receipts, notices and call times behind a complaint into one file for the grievance officer. What an agent produces is a proposal. It reaches the loan record only through the NBFC’s core, after the policy check and any approval the policy requires.

Who should hold the servicing record for a digital loan?

If you want to be the compliance head who can answer for any digital loan from the NBFC’s own record, start with which system holds that record.

1. Leave servicing, notices and records with the LSP and rely on the contract. It needs the least setup. The NBFC stays liable for what the partner does and has to ask the partner for evidence each time a complaint or an inspection needs it.
2. Keep the loan record, receipts, notices and partner list on the NBFC’s own system, and have each LSP work through it or feed it. Every receipt, notice and complaint lands on a record the NBFC controls, and each partner’s activity stays separate.
3. Bring all post-disbursal work in-house and stop using LSPs for servicing and recovery. Control is complete. It gives up the partners’ reach in collections and customer service, and it rarely fits a book built on partner distribution.

The second path costs integration work with every partner. Someone at the NBFC has to own the mapping between each partner’s events and the NBFC’s record, and keep it current as partners change their apps.

Lokta’s loan management system keeps each sourcing partner’s operated digital lending apps and grievance officer on the partner record, stores the arrangement version each loan was booked under, and generates partner fees from those terms with maker-checker approval. Lokta’s AI Loan Servicing records the tools behind each AI response, its confidence and any human override, and holds low-confidence replies for a person to approve. Apache Fineract, the open-source lending core, is earlier work by Lokta’s team.

Frequently asked questions

---

Sources:

• RBI, Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, updated as on 15 July 2026: paragraph 4 (definitions), Chapter III paragraphs 6 to 29 (digital lending), paragraph 112 (repeal).
• RBI, Reserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) Directions, 2025, updated as on 1 July 2026: paragraph 30(7) (penal charges in reminders) and paragraph 100 (recovery conduct).
• RBI, Reserve Bank of India (Digital Lending) Directions, 2025, 8 May 2025, the earlier text.