RBI Digital Lending Guidelines: NBFC Rules for IIBF Exams

The rbi digital lending guidelines put one principle above everything else: whatever number of apps, agents or technology partners sit between the lender and the borrower, the Regulated Entity (RE) alone owns the loan, the money flow and the complaint. For an NBFC that sources customers through a mobile app, that single sentence decides how the contract is signed, whose bank account the disbursal touches, what the borrower is told before clicking "accept", and who answers when the loan goes wrong.

This is now one of the most heavily tested areas in the IIBF NBFC paper, because it cuts across conduct, outsourcing, data privacy and asset quality all at once.

🏦 Who the Directions Cover: RE, LSP and DLA

Digital lending is defined by process, not by product. If the loan is sourced, underwritten, disbursed, serviced or recovered through a predominantly digital channel with minimal physical interface, it falls inside the framework — irrespective of whether the loan is a consumer durable EMI, a personal loan or a small-ticket business advance.

Three actors matter, and examiners test the boundaries between them constantly:

• Regulated Entity (RE) — the bank or NBFC on whose books the loan sits. Only an RE can lend. Compliance is non-delegable.
• Lending Service Provider (LSP) — an agent of the RE that performs one or more functions of the lending value chain: customer acquisition, underwriting support, pricing support, servicing, monitoring or recovery. An LSP is not a lender.
• Digital Lending App / Platform (DLA) — the mobile or web interface itself, whether owned by the RE or by the LSP.

The practical consequence is that outsourcing risk sits entirely with the NBFC. Due diligence on the LSP, a written outsourcing agreement, periodic review of its conduct, and a published list of the LSPs and DLAs engaged are all RE obligations. If an LSP's collection staff misbehaves, the RE is answerable to the Reserve Bank, not the app.

Candidates who work through the recent RBI initiatives chapter will notice that this agent-principal logic is the same one used for recovery agents and for business correspondents — the regulator simply extended a settled doctrine to a new channel. How heavily the conduct rules bite also depends on where the lender sits in the regulatory pyramid, so read this topic alongside the NBFC Upper Layer framework.

📄 Key Fact Statement, APR and Upfront Disclosure

Before the loan contract is executed, the RE must hand the borrower a standardised Key Fact Statement (KFS). The KFS is the anchor of the entire disclosure regime and the single most examinable item in this topic.

The KFS must state the Annual Percentage Rate (APR) — the all-inclusive annualised cost of the digital loan, covering interest, processing fee, documentation charges, insurance premium collected as part of the loan and any other charge, but excluding contingent charges such as penal charges or bounce charges. Anything not itemised in the KFS cannot be charged to the borrower at any later stage. That last clause is the one candidates forget.

Three further disclosure rules follow from it:

1. Fees payable to an LSP are borne by the RE, never recovered directly from the borrower by the LSP.
2. The KFS must carry the cooling-off period, the recovery mechanism, and the contact details of the grievance redressal officer.
3. A copy of the sanction letter, the loan agreement and all key documents must reach the borrower on record, typically on the registered email or messaging channel.

Product bundling deserves special care. Where credit-linked insurance is sold along with a digital loan, the premium sits inside the APR and the insurance details must be visible to the borrower; the loan cannot be silently priced up through an add-on. NBFCs running embedded-finance models on merchant checkouts are exactly the ones that stumble here.

💡 Exam Tip: APR is all-inclusive and annualised. If a question gives you a flat processing fee plus a monthly rate and asks what the borrower must be shown, the answer is the APR in the KFS — not the contracted interest rate.

💸 Fund Flow, Cooling-Off Period and Credit Limits

The fund-flow rule is deceptively simple and enormously consequential: all disbursals and repayments must be executed directly between the borrower's bank account and the RE's bank account. No pass-through account, pool account or nodal account of an LSP or a DLA may sit in the middle.

The narrow carve-outs are for flows mandated by statute, disbursals made directly to a merchant or service provider for a specified end use (a consumer-durable dealer, for instance), and flows between REs in a co-lending style arrangement. Outside those, money touching an LSP account is a straight breach.

The cooling-off period — also called the look-up period — lets the borrower exit a digital loan by repaying the principal and the proportionate APR without any penalty. Its length is fixed by the RE's board, subject to a regulatory floor: not less than three days for loans with a tenor of seven days or more, and not less than one day for loans with a tenor below seven days.

Two further conduct rules complete this block. First, no automatic increase in a credit limit is permitted without the borrower's explicit prior consent — the silent limit-bump used by app-based revolving credit is prohibited. Second, penal charges must be levied on the outstanding amount, and the framework does not permit charges to be computed on a basis the borrower was never shown.

⚠️ Common Mistake: Candidates assume the cooling-off period is a free cancellation. It is not — the borrower repays principal plus the proportionate APR. Only the penalty is waived.

🔐 Data, Consent and Grievance Redressal

Data collection by a DLA must be need-based, with clear audit trails and only after explicit borrower consent. The borrower must be able to accept or deny consent for specific data, revoke consent already given, delete the data collected, and make the DLA forget the data — a set of rights examiners love to list as distractors.

Access to the borrower's mobile phone resources — contact list, call logs, telephony functions and stored files — is not permitted. A one-time access to the camera, microphone or location is allowed only where it is needed for on-boarding or KYC. Biometric data cannot be stored on the DLA unless expressly permitted. This is why the KYC, AML and CFT norms chapter is worth revising alongside this topic: digital on-boarding sits at the intersection of both frameworks.

On complaints, the RE and its LSPs must each have a nodal grievance redressal officer for digital lending, with the name and contact details displayed prominently on the DLA, on the website and in the KFS. If a complaint is not resolved within 30 days, the borrower may escalate to the Reserve Bank under the Reserve Bank – Integrated Ombudsman Scheme, which was refreshed with effect from 1 July 2026 — the complaint window is one year from the RE's reply, escalation must be filed within 90 days of that reply, and the award ceiling is Rs 30 lakh, with up to Rs 3 lakh for consequential loss.

📌 Remember: Consent is not a one-way switch. The right to revoke consent and to have data deleted is part of the framework, and a question that offers only "obtain consent" as the answer is usually incomplete.

🛡️ Default Loss Guarantee, Reporting and the DLA Directory

A Default Loss Guarantee (DLG) is a contractual arrangement under which an LSP or another RE compensates the lender for losses up to an agreed share of the portfolio — the market calls it first-loss default guarantee. It is permitted, but bounded.

The cover is capped at 5% of the amount of the underlying loan portfolio, must be backed only by a cash deposit, a fixed deposit with a lien in favour of the RE, or a bank guarantee, and its tenor cannot be shorter than the longest tenor of a loan in that portfolio. Critically, DLG does not change asset classification: the RE must still recognise the NPA on its own books and invoke the guarantee within 120 days of the account turning overdue, unless repaid earlier.

Reporting duties close the loop. Every loan sourced through a DLA — including short-tenor and deferred-payment credit — must be reported to the credit information companies, so that no digital exposure stays invisible to the system. REs also report the DLAs they use to the Reserve Bank, which publishes a public directory so a borrower can check whether an app is actually backed by a regulated lender. Read the primary text on the RBI Master Directions page before the exam; the regulatory requirements and compliance chapter maps the same duties to the NBFC syllabus.

🧠 Practice MCQs: RBI Digital Lending Guidelines

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

🎯 Key Takeaways and Next Step

Remember the four load-bearing rules: the RE owns the loan and the compliance, the KFS with an all-inclusive APR must precede the contract, money moves only between the borrower's account and the RE's account, and DLG caps risk transfer at 5% without touching asset classification. Everything else in this topic hangs off those four.

Round the topic off with the neighbouring platform models: the p2p lending platform norms keep an NBFC-P2P to a marketplace role, and consent-based data sharing flows through the NBFC Account Aggregator framework rather than raw app permissions. Trade-finance candidates meet the same disclosure discipline in packing credit in foreign currency. More topic-wise notes sit on the NBFC exam notes hub, and current policy rates are tracked on the RBI rates page.

Practise them under timed conditions before the exam — start with the digital lending and regulatory compliance sets in the IIBF NBFC mock tests.