29 October 2026 • 7 min read
In India a digital lender must follow the Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025, which replaced the 2022 digital lending guidelines and the 2023 default loss guarantee (DLG) guidelines. For a product team the checklist comes down to six controls: the loan is paid straight into the borrower’s own bank account and repaid through the lender’s account, never through your app’s pool account; the borrower sees a Key Fact Statement (instalment, total cost of credit, penalties) before signing; the borrower can exit without penalty during a look-up period of at least one day, whose length the lender’s Board sets; borrower data may be processed abroad only if it comes back to India and is erased abroad within 24 hours; every lending app is reported to RBI’s CIMS portal by the lender; and any first-loss guarantee you give the lender stays within a 5% cap. The sources below are law-firm summaries of the Directions, not the RBI text, so read the current RBI text before you ship.
Source for the first six rows: Law-firm summaries of the 8 May 2025 Directions, seen 29 Oct 2026 (RBI text not opened). The last two rows are practice we kept from the earlier guidelines and could not re-confirm.
| Control | What it means in your product | Where it comes from | Checked |
|---|---|---|---|
| Money flow | Disburse directly to the borrower’s bank account. Collect repayments through the lender’s account. Nothing passes through an account of the app or lending service provider (LSP). | Disbursal and repayment rules | 29 Oct 2026 |
| Key Fact Statement | Show it before the borrower signs: the monthly instalment, the total cost of credit and the penalties, in plain language. Store when it was shown, not only that “agree” was tapped. | Key Fact Statement rules | 29 Oct 2026 |
| Look-up (cooling-off) period | Let the borrower exit without a penalty. The lender’s Board sets the length, with a minimum of one day; only a reasonable one-time processing fee may be kept. The older rule had three days for loans longer than seven days, so a hard-coded 3 is out of date. | Look-up period rules | 29 Oct 2026 |
| Where data is processed | Processing abroad is allowed if the data is brought back to India and erased from foreign servers within 24 hours. Check the exact wording with your lender’s counsel. | Data rules | 29 Oct 2026 |
| Reporting the app | Every digital lending app, including an LSP’s, is reported by the lender to RBI’s CIMS portal. The first deadline, 15 June 2025, has passed; new apps are reported before launch. | CIMS reporting | 29 Oct 2026 |
| Default loss guarantee | A guarantee from the LSP to the lender is capped at 5%. Sources disagree on what the 5% is measured against, and one reports a change for NBFCs in February 2026; check the RBI text and your contract. | DLG rules | 29 Oct 2026 |
| Grievance contact | Keep the grievance officer’s contact visible inside the app, not buried in settings. This is standard practice from the earlier guidelines; we did not re-confirm the 2025 wording. | Practice | 29 Oct 2026 |
| App permissions | Ask only for what a feature needs. The 2022 guidelines barred access to contacts, call logs and files; we have not confirmed how the 2025 text words it. | Practice | 29 Oct 2026 |
Your lender is responsible for your compliance as well as its own, so expect it to audit your flows and to ask for these records.
No. Under the 2025 Directions the loan is disbursed directly into the borrower’s bank account and repayments are routed through the regulated lender’s account. A pool or escrow account in the app’s name is the pattern the rules were written to stop.
A Key Fact Statement that sets out the loan in simple language, including the monthly instalment, the total cost of credit and the penalties. Build it as a step the borrower cannot skip, and keep a timestamp of when it was shown.
At least one day. The Directions let the lender’s Board set the period, so your lender may require longer. The borrower can leave without a penalty and pays only the principal, the proportionate interest and a reasonable one-time processing fee. Older write-ups that say three days describe the earlier rule for loans longer than seven days.
Summaries of the 2025 Directions say yes, with a condition: the data must be brought back to India and erased from the foreign servers within 24 hours. That is a change from the earlier insistence on storage in India, so confirm the wording with your lender’s counsel before you choose a cloud region.
5%. The cap sits in the DLG rules now folded into the 2025 Directions. Sources differ on the base the 5% applies to, and one reports that the treatment of NBFCs changed in February 2026. Read the current RBI text and your contract; do not build the ledger from a blog.
General information, not legal advice. We removed figures from the earlier version of this page that we could not source. Something wrong? Tell us.
One actionable growth breakdown every morning, across 12 industries — with an audio version in English and 10 Indian languages. No fluff, just hard product teardowns and India benchmarks.