Digital Lending Guidelines for NBFCs: RBI Rules Every IIBF Candidate Must Know

The RBI's digital lending guidelines for NBFCs have reshaped how non-banking financial companies acquire customers, disburse loans, and recover dues through apps and web platforms. First issued in September 2022 and consolidated into a Master Direction in 2025, these rules put the borrower at the centre: transparent pricing, direct bank-to-bank money flow, and firm control over the third-party technology partners that many NBFCs rely on. For anyone preparing for the IIBF NBFC certification, this is one of the highest-yield topics in Module C, because it ties together conduct, compliance, and the "Recent RBI Initiatives" that examiners love to test. This article breaks the framework down cleanly so you can answer both the factual MCQs and the applied case-study questions with confidence.

What the RBI digital lending framework actually covers

Digital lending, in the RBI's language, is a remote and automated lending process that uses digital technologies for customer acquisition, credit assessment, disbursement, and recovery. The framework applies to all Regulated Entities (REs) — banks, cooperative banks, and NBFCs — that lend through their own digital channels or through Lending Service Providers (LSPs) and Digital Lending Apps (DLAs). The central design principle is that the RE, not the app, owns the regulatory relationship with the borrower. An NBFC cannot outsource its accountability to a fintech partner; it remains responsible for compliance, grievance redressal, and fair conduct end to end.

The rules distinguish clearly between an LSP (an agent that performs one or more lending functions on the RE's behalf) and a DLA (the mobile or web interface the borrower actually touches). Every NBFC must publish the list of its DLAs and LSPs on its website, and each DLA must disclose the names of the REs on whose behalf it operates. This transparency requirement closes the loophole that unregulated apps once exploited by hiding who was really lending the money. Understanding this ownership-and-disclosure logic is the foundation for every other rule in the framework, and it maps directly onto the broader compliance expectations you will study in the regulatory requirements and compliance chapter.

Money flow, fees, and the Key Fact Statement

The single most tested rule is the flow of funds. All loan disbursals and repayments must be executed directly between the borrower's bank account and the RE's bank account — no pass-through or pool account of the LSP or any third party is permitted in between. This prevents fintechs from parking borrower money and eliminates a major source of misappropriation. The only carve-outs the RBI allows are for statutory or regulatory mandates and for certain co-lending or specified flows the RBI itself has approved.

Equally important is pricing transparency. Any fees payable to an LSP must be paid by the RE, never charged directly to the borrower. Before a loan is executed, the NBFC must give the borrower a standardised Key Fact Statement (KFS) disclosing the all-inclusive Annual Percentage Rate (APR), the recovery mechanism, the grievance officer's details, and the cooling-off period. The APR must capture every cost — interest, processing fees, and any charges embedded by the LSP — so the borrower sees one honest number rather than a headline rate that hides add-ons.

Borrower protections: cooling-off, consent, and data privacy

The framework builds in several borrower-side safeguards that examiners frequently combine into scenario questions. First is the cooling-off (look-up) period — a window during which the borrower may exit a digital loan by repaying the principal and the proportionate APR, with no penalty. The RBI leaves the exact length to each RE's board-approved policy, but it must be reasonable and clearly stated in the KFS, and it cannot be shorter than the minimum the RBI specifies from time to time.

Second is data minimisation and consent. A DLA may collect only the data it genuinely needs, with the borrower's explicit, auditable consent, and must never access the phone's contact list, media files, or location in a blanket way. Borrowers can withdraw consent, deny specific permissions, and demand deletion of their data. Biometric data storage by DLAs is restricted. Third, automatic increases in credit limit without the borrower's explicit consent are prohibited — a rule aimed squarely at the "buy-now-pay-later" limit creep that trapped many young borrowers. These conduct standards sit alongside the customer-facing duties covered in the customer relationship chapter, and they reflect the same fair-treatment spirit that runs through KYC and grievance handling. For the latest circulars and amendments, always cross-check the official source at rbi.org.in before your exam.

Digital lending guidelines for NBFCs at a glance

The table below consolidates the rules most likely to appear in a fill-in-the-blank or match-the-column question. Treat it as a revision card: memorise the "who is responsible" and "what is prohibited" columns first, because those are where MCQ distractors are usually planted. Note how each requirement traces back to a single idea — the regulated entity, not the app, bears the burden.

Why this matters for the IIBF NBFC exam

Digital lending is not a standalone silo in the syllabus — it threads through KYC, grievance redressal, and the RBI's supervisory push against unregulated apps. Expect questions that ask you to identify a prohibited practice (a pass-through account, a hidden LSP fee, blanket contact access) and questions that ask which document must carry the APR (the KFS). A common trap is confusing the LSP with the DLA, so anchor the distinction firmly: the LSP is the agent performing lending functions, the DLA is the interface the borrower sees.

To lock in the material, pair your reading with the RBI-initiatives context in the recent RBI initiatives chapter, then browse related write-ups through the NBFC blog tag hub to see how these rules interact with scale-based regulation and co-lending. Reinforce the fund-flow and KFS rules with active recall rather than passive rereading, because those are the details that decide a pass. When you feel ready, sit a timed mock so the terminology becomes second nature under pressure — that is where most candidates gain their final marks.

Frequently asked questions

Ready to test yourself? Turn this reading into marks by attempting a full-length, exam-style quiz. Take a free NBFC mock test on iibf.store to check whether the fund-flow, KFS, and consent rules stick under time pressure, then revisit any chapter where you slip. You can also reinforce the terminology with our quick match-the-concept game before exam day.