Home / Prompts / Check compliance

Prompt to draft an RBI digital lending compliance checklist

What you get: A yes / no checklist against RBI digital lending rules with evidence to keep. Copy it, fill in the parts in [BRACKETS], and run it in Kriyā or any AI assistant.

The prompt

You are a compliance lead at an Indian lending startup. Draft a checklist against the RBI Digital Lending Directions for this product.

Product: [PRODUCT]
Our role: [ROLE]
Lending partner: [PARTNER]

The checklist should cover, each as a yes / no line with the evidence to keep:
1. Who lends and who we are (regulated entity, lending service provider)
2. Money flow: disbursal and repayment only between the borrower and the regulated entity
3. Key Fact Statement, all-in cost, cooling-off period
4. Data: what we collect, consent, storage in India, deletion
5. Grievance officer and complaint timelines
6. Recovery agents and what they may not do
7. Default loss guarantee, if any
End with the five items most startups miss. Say clearly this is a draft to check with a lawyer.

Rules:
- Use the India figures listed below and name the source and month next to each one you use.
- If you need a figure that is not listed, write "Assumption:" and give your reasoning instead of a number you cannot source.
- Plain words. Short sections with headings. No filler.

India figures to use (from productgrowth.in/numbers):
- India had 124.05 million credit cards in circulation in August 2026 (RBI). Source: https://productgrowth.in/numbers/credit-cards-india/
- India had 55.49 crore users onboarded on UPI in June 2026 (Ministry of Finance, in a written reply to the Lok Sabha). Source: https://productgrowth.in/numbers/upi-users-india/
Run this in Kriyā → Kriyā opens with this prompt in its box; nothing is sent until you press send. Replace the [BRACKETS] first.

What to fill in

ReplaceWithExample (used for the sample answer)
[PRODUCT]Your productSalary-advance app for factory workers
[ROLE]Your roleLending service provider (LSP)
[PARTNER]Who lendsAn NBFC partner

The numbers this prompt uses

The prompt carries these figures so the answer starts from dated, sourced numbers instead of guesses. Each page shows the source, the month and the history.

Sample answer

Sample answer from Kriyā, 26 October 2026, for the example inputs above. Kept as it came back; links added beside each figure.

Draft Compliance Checklist: Salary-Advance App (LSP + NBFC partner)

Draft only. Have a lawyer check it against the current RBI Digital Lending Directions, and verify every threshold before relying on it. Sources [1], [3] and [6] are summaries, not the Directions' text.

Two figures given are context, not compliance inputs: 124.05M credit cards, Aug 2026, RBI [5], and 55.49 crore UPI users, June 2026 (Ministry of Finance, Lok Sabha reply). Factory workers are mostly outside the card base but inside UPI, so design repayment for UPI.

1. Who lends, who we are

  • [ ] Yes/No: NBFC partner holds a valid RBI licence. Keep: certificate, RBI listing screenshot, dated.
  • [ ] Yes/No: LSP agreement signed, with scope, fees, audit rights, termination. Keep: signed agreement.
  • [ ] Yes/No: App and every screen name the NBFC as lender and us as LSP. Keep: dated screenshots.
  • [ ] Yes/No: LSP list kept current on the NBFC's site. Keep: page snapshot.

2. Money flow

  • [ ] Yes/No: Disbursal goes NBFC account → worker's bank account directly. Keep: bank statements, flow diagram.
  • [ ] Yes/No: Repayment goes worker → NBFC account directly, never via our pool or wallet. Keep: UPI mandate/collection settings.
  • [ ] Yes/No: Employer salary-deduction route (if used) also lands in NBFC's account. Keep: employer agreement.
  • [ ] Yes/No: Our fees are paid by the NBFC, not charged to the worker. Assumption: confirm this against the current Directions.

3. Key Fact Statement, cost, cooling-off

  • [ ] Yes/No: Key Fact Statement shown before the worker accepts. Keep: screen flow, version log.
  • [ ] Yes/No: All-in cost shown as APR with every fee itemised. Keep: APR calculation sheet.
  • [ ] Yes/No: Cooling-off exit available, with exit terms stated. Keep: policy text, exit logs. Assumption: period and terms must be checked against the current Directions.
  • [ ] Yes/No: Loan agreement in the worker's language (Hindi/regional). Keep: translated copies.
  • [ ] Yes/No: Sanction letter and repayment schedule emailed or sent on WhatsApp. Keep: delivery logs.

4. Data

  • [ ] Yes/No: Only data needed for the loan is collected. Keep: data inventory.
  • [ ] Yes/No: Explicit, itemised consent per purpose, no bundling. Required under DPDPA [3]. Keep: consent logs with timestamp and version.
  • [ ] Yes/No: Data stored in India. Keep: cloud region proof.
  • [ ] Yes/No: Deletion on request works. DPDPA gives erasure rights [3]. Keep: request log, deletion proof.
  • [ ] Yes/No: No access to phone contacts, media or files. Assumption: confirm against the Directions. Keep: app permission list.

5. Grievance

  • [ ] Yes/No: Grievance officer named in app and on website. Keep: screenshots.
  • [ ] Yes/No: Complaints logged with ticket ID and resolved within the timeline the Directions set. Assumption: I have no sourced figure here; verify it. Keep: ticket export.
  • [ ] Yes/No: Escalation to NBFC, then RBI's complaint portal, explained to the worker. Keep: in-app text.

6. Recovery agents

  • [ ] Yes/No: Agents are named, trained and covered by contract. Keep: agent list, training records.
  • [ ] Yes/No: Agents banned from threats, abuse, contacting employer or colleagues, and calls outside permitted hours. Assumption: confirm hours against RBI recovery norms. Keep: code of conduct, call recordings.
  • [ ] Yes/No: Worker told who will contact them. Keep: notice copy.

7. Default loss guarantee (DLG)

  • [ ] Yes/No: If we give any DLG, it is capped at 5% of the loan portfolio, invoked within 120 days overdue [1]. Keep: DLG agreement, cap workings.
  • [ ] Yes/No: DLG is in the form the rules allow, and the NBFC's provisioning treatment is checked. The 2026 reinstatement applies to NBFC provisioning [1]. Keep: written treatment note.
  • [ ] Yes/No: If no DLG, confirm no informal buyback or first-loss promise exists. Keep: signed declaration.

Five items most startups miss

  1. Repayment pooled through the LSP's account. One shortcut breaks item 2.
  2. Key Fact Statement shown after acceptance or buried. Test it in the real flow.
  3. Informal DLG (buybacks, first-loss promises) outside the 5% cap [1].
  4. Employer data used without worker consent (attendance, payroll). Employer consent is not worker consent under DPDPA [3].
  5. Recovery by employer pressure or HR calls. Very tempting in salary-advance, and a violation.

Next action: Run the full worker journey (install to repayment) with this checklist and screenshot every screen as evidence.

<followups>How should we collect repayment through UPI AutoPay safely?|Do we need an NBFC licence if employers fund the advances?|What consent screens does DPDPA require for payroll data?|How do we structure a DLG

Beside each figure: source links the number page it comes from, your input means it came from the example inputs, and Kriyā's estimate marks a figure Kriyā worked out or assumed with no source given; check those before you use them. Your own run will differ.

More prompts for this job