IIBF Digital Banking: RBI digital lending guidelines explained

The RBI digital lending guidelines have turned what used to be a lightly supervised fintech corner into one of the most tightly specified areas of Indian banking. If you run a retail credit desk, own a co-lending partnership, or simply sign off on a partner app, the Reserve Bank now expects you to know exactly who disburses, who collects, and who pays the intermediary.

This guide walks through the framework the way the IIBF Digital Banking paper actually tests it — definitions first, then the conduct rules, then the traps that cost marks.

🏦 What the RBI Digital Lending Guidelines Actually Cover

The rules are today consolidated in the Reserve Bank of India (Digital Lending) Directions, 2025, which folded the September 2022 guidelines, the default loss guarantee circular and the accumulated FAQs into a single instrument. They bite whenever credit is sourced, appraised, disbursed, serviced or recovered through a digital channel with minimal or no physical interface.

Applicability is broad. Every Regulated Entity (RE) is covered — commercial banks including small finance banks and regional rural banks, co-operative banks, and NBFCs — with no carve-out for small ticket sizes or short tenors.

Two definitions carry most of the exam weight:

• Digital Lending App (DLA) — the mobile or web interface the borrower actually touches. It may belong to the RE or to its partner.
• Lending Service Provider (LSP) — an agent engaged by the RE to perform one or more lending functions for a fee: sourcing, KYC support, credit assessment support, servicing, or recovery.

The word agent is the whole point. An LSP is not a regulated lender; the RE remains fully liable to the borrower and to the Reserve Bank for everything its LSP does or fails to do. Outsourcing the app never outsources the accountability.

The Directions also require REs to report the DLAs they operate or engage to the Reserve Bank's Centralised Information Management System, which in turn feeds a public directory. A borrower can therefore check whether the app on their phone is genuinely backed by a regulated lender — a simple but powerful anti-fraud device. If you are starting this subject cold, anchor the vocabulary using Digital Banking Class 3 before you attempt to memorise the conduct rules, and browse the wider digital banking collection to see how the pieces connect.

📋 Key Fact Statement, APR and the Cooling-Off Period

Before a digital loan contract is executed, the RE must hand the borrower a Key Fact Statement (KFS) in a standardised format and a language the borrower understands. It is the definitive statement of what the loan costs: anything omitted from it cannot be recovered at any stage.

The most tested number in the KFS is the Annual Percentage Rate (APR), the all-inclusive annualised cost of credit. It absorbs processing, verification and documentation charges, insurance premium arranged through the RE, and — critically — any fee the RE pays its LSP. Contingent charges such as penal charges sit outside the APR, arising only on default.

Three conduct rules travel with the KFS:

1. The RE pays the LSP, never the borrower. No exception exists.
2. A cooling-off (look-up) period must be offered. Within it the borrower exits by repaying principal plus proportionate APR, with no penalty. Its length is set by board-approved policy subject to the regulatory floor, and must be printed in the KFS.
3. No automatic credit-limit increase. Any enhancement needs explicit borrower consent — the rule that ended silent limit hikes on app-based credit lines.

Where an LSP fronts several lenders' products, it must show a neutral digital view of all matched offers — the name of each RE, amount, tenor, APR and other key terms — with no dark patterns steering traffic to a favoured lender. That is the design philosophy behind the Open Credit Enablement Network OCEN and the Unified Lending Interface in India, a theme developed in Developments in Digital Technology.

💡 Exam Tip: If a question asks what the APR "includes", the answer usually hinges on the LSP fee. It sits inside the APR because the RE pays it and prices it into the loan.

🔐 Data, Disbursal and Recovery Safeguards

Money movement is the hardest rule in the RBI digital lending guidelines and the easiest to test. All disbursals and repayments must be executed directly between the borrower's bank account and the RE's account. No pass-through account, pool account or nodal account of an LSP or any other third party may sit in the middle. The exceptions are narrow: flows mandated by statute or regulation, flows between REs under a co-lending arrangement, and disbursal to a merchant for a specified end-use.

On data, the principle is need-based collection with prior explicit consent and a clear audit trail. A DLA may not demand access to the borrower's files, media, contact list, call logs or telephony functions. One-time camera, microphone or location access strictly for onboarding and KYC is permitted with consent. The borrower may revoke consent, have data deleted and restrict its disclosure, and the data must sit on servers located in India.

Recovery conduct is disclosed upfront: the KFS must state the recovery mechanism and the details of the recovery agent authorised to contact the borrower. Because a DLA holds identity documents, income proofs and repayment histories, the access controls and monitoring described in database security in banks are the operational backbone of these privacy promises, and the channel-level hardening in Mobile Banking completes the picture.

🧾 Grievance Redressal, DLG and Reporting Obligations

The RBI digital lending guidelines close the loop with a two-tier complaint mechanism. Both the RE and its LSP must appoint a nodal grievance redressal officer specifically for digital lending complaints, and publish those details on the DLA, the website and the KFS. If a complaint is unresolved after 30 days, it can be escalated to the RBI Ombudsman under the RBI Integrated Ombudsman Scheme, 2026, which replaced the 2021 scheme on 1 July 2026 and runs a tighter 90-day filing window with raised compensation limits. Quoting the 2021 scheme as current is a straightforward mark lost.

Default loss guarantee

A default loss guarantee (DLG) is an arrangement under which an LSP or another entity compensates the RE for losses up to a pre-agreed share of the portfolio. It is capped at 5% of the amount of the underlying loan portfolio and may be accepted only in specified forms — a cash deposit, a lien-marked fixed deposit, or a bank guarantee. Uncapped, DLG would quietly convert an unregulated fintech into the real risk-taker.

Two consequences are examinable. The RE must still recognise a loan as non-performing on its own merits — DLG defers neither classification nor provisioning — and the guarantee must be invoked within a stipulated period of the account turning overdue.

Credit reporting

Every loan extended through a DLA must be reported to credit information companies, irrespective of nature, size or tenor. A borrower stacking six app loans is now visible to the seventh lender.

⚠️ Common Mistake: Candidates assume an LSP is directly regulated and penalised by RBI. It is not. The Reserve Bank supervises the Regulated Entity, and the RE answers for its LSP's conduct — the same accountability logic you saw in Positive Pay System in India, where the bank, not the customer's software, carries the duty.

📎 Always cross-check the current text of the governing circular on the Reserve Bank of India website before you rely on it in the exam hall or at your desk.

🧠 Practice MCQs: RBI digital lending guidelines

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

The RBI digital lending guidelines sit exactly where conduct regulation, technology risk and credit policy meet, which is why examiners like them — and why a serving banker cannot afford to be vague about them. Keep tracking amendments through IIBF and RBI updates, and if you are stacking this certificate alongside your promotion track, the same principles resurface across the CAIIB syllabus in ABM and BRBL. Learn the definitions cold, then drill them until the KFS, APR and disbursal rules are reflexes rather than recall.