RBI Digital Lending Directions 2025: the 11-point engineering checklist for lending apps

Summary. The Reserve Bank of India (Digital Lending) Directions, 2025, numbered RBI/2025-26/36 and dated 8 May 2025, replaced the 2022 digital lending guidelines with a single instrument across seven chapters. Most came into force immediately; para 17 on reporting digital lending apps applied from 15 June 2025, and para 6 on multi-lender arrangements from 1 November 2025. The document is unusually specific for a regulator, and the specificity lands on engineers rather than lawyers: it names the mobile permissions your app may not request, caps default loss guarantee cover at 5 per cent of the disbursed portfolio, requires all data to sit on servers in India, and gives you 24 hours to delete anything processed offshore and bring it back. One widely repeated claim about these rules is wrong — the minimum cooling-off period is one day, not three. This is the build checklist, mapped paragraph by paragraph to what changes in the codebase.

What the Directions actually are

RBI consolidated the earlier circulars into one instrument and repealed the instructions listed in its Annex III. The structure is worth knowing because the paragraph numbers are how compliance reviewers will talk to you.

Chapter	Subject	Paragraphs that hit engineering hardest
I	Preliminary, applicability, definitions	Definitions of Digital Lending App (DLA), Lending Service Provider (LSP), APR, DLG
II	General requirements for RE-LSP arrangements	Para 6, multi-lender loan offers, in force from 1 November 2025
III	Conduct and customer protection	Paras 7 to 11: creditworthiness, KFS disclosure, fund flow, cooling-off, grievance
IV	Technology and data	Paras 12 to 15: permissions, consent, storage, residency, cybersecurity
V	Reporting of credit information and DLAs	Paras 16 and 17, the second in force from 15 June 2025
VI	Loss sharing on default	Paras 18 to 26, the DLG regime including the 5 per cent cap
VII	General and repeal	Para 30, repeal of the earlier circulars

The scope is broad. The Directions apply to the digital lending activities of all commercial banks, primary urban co-operative banks, state and central co-operative banks, and the other regulated entities RBI lists — collectively "REs". If you build the app, you are almost certainly building it for an RE or for an LSP acting on an RE's behalf, and RBI closes the outsourcing loophole in plain language: "any outsourcing agreement entered into by the RE with an LSP shall in no manner dilute or absolve the RE of its obligations under any statutory or regulatory provision, and the RE shall remain fully responsible" for the LSP's conduct.

That sentence is why your RE client will push every one of these requirements into your contract.

The 11-point engineering checklist

#	Requirement	Where it sits	What it changes in the build
1	Disbursal only to the end-beneficiary's bank account	Para 9	No LSP-held pool or nodal account in the disbursal path; no third-party account of any kind
2	Repayment executed by the borrower directly into the RE's account	Para 9	Payment rails must terminate at the RE; the LSP cannot hold or route funds
3	No third-party control of the fund flow, direct or indirect	Para 9	Mandate, escrow and sweep designs need review, not just the happy path
4	KFS with APR before the borrower commits	Para 8	KFS generation is a blocking step in the origination state machine
5	Cooling-off exit at principal plus proportionate APR, no penalty	Para 10	A first-class "exit loan" flow with proportionate APR computation
6	No automatic credit limit increase	Para 7	Limit increases require a recorded, evaluated, explicit borrower request
7	Multi-lender offers shown as an unbiased digital view	Para 6, from 1 Nov 2025	Offer comparison UI with RE name, amount, tenor, APR, EMI, penal charges and a KFS link per offer
8	Permission restrictions on the mobile app	Para 12	Remove contacts, call log, file and media, and telephony access outright
9	Data stored only on servers located in India	Para 13	Region pinning, and an audited inventory of every store including logs and backups
10	Offshore-processed data deleted and repatriated within 24 hours	Para 13	A hard deletion SLA on any non-Indian processing, with evidence
11	Every DLA loan reported to CICs regardless of nature or tenor	Para 16	Credit bureau reporting for small-ticket and short-tenor products too

The rest of this article works through the five that most often force a rewrite.

Fund flow: the design most likely to be non-compliant

Para 9 is the paragraph that has killed the most product architectures. RBI requires that all loan disbursements be made directly into the bank account of the end-beneficiary, and states that in no case shall disbursal be made to a third-party account, including the accounts of the LSP. All loan servicing and repayment must be executed by the borrower directly into the RE's bank account. The flow of funds between the borrower's account and the RE's account must not be controlled, directly or indirectly, by any third party including the LSP.

If your platform holds funds even momentarily — a pooling account for settlement convenience, a wallet float, a partner-controlled nodal account — that design does not survive this paragraph. The same applies to fees: any fees, charges or reimbursements payable to the LSP must be paid directly by the RE and cannot be charged to the borrower by the LSP, directly or indirectly.

There is one carve-out worth knowing. For delinquent loans, the RE may deploy a physical interface to recover in cash where necessary, and those transactions are exempt from the direct-repayment requirement. Even then, fees to LSPs for that recovery are paid by the RE, not netted out of the recovery proceeds.

Cooling-off: one day, not three

This is where secondary coverage most often misleads. Several 2026 guides state a three-day minimum cooling-off period, which was the position under the earlier framework for loans of seven days or longer. The 2025 Directions say something different.

Para 10 gives the borrower an explicit option to exit a digital loan by paying the principal and the proportionate APR without any penalty during an initial cooling-off period. The length is determined by the Board of the RE and set out in its loan policy, "subject to the period so determined not being less than one day." The floor is one day, and it applies regardless of tenor.

For engineering that means two things. The cooling-off duration must be configurable per lender, because your RE clients will each set their own Board-approved figure and you cannot hardcode a constant. And the exit path is a real transaction, not a support ticket: it needs proportionate APR computation, a penalty suppression rule, and an audit trail proving no penalty was levied. Build it as a first-class state in the loan lifecycle rather than a manual reversal, because a manual reversal cannot be evidenced at scale.

Mobile permissions: an explicit deny list

Para 12 is the rare regulation that reads like a code review comment. RBI requires that data collection by the DLA of the RE or its LSP be need-based, with prior and explicit consent from the borrower and an audit trail. Then it names what your app must not touch.

Phone resource	Permitted?	Condition
Contact list	No	RBI requires DLAs to desist from accessing it
Call logs	No	Same
File and media	No	Same
Telephony functions	No	Same
Camera	One-time only	For onboarding or KYC, with explicit borrower consent
Microphone	One-time only	Same
Location	One-time only	Same

The word doing the work is "one-time". Camera, microphone and location may be accessed once for onboarding or KYC purposes, with explicit consent. That rules out background location collection for underwriting signals, and it rules out the persistent permission grants that many lending apps shipped before 2022. On both Android and iOS the enforceable pattern is a just-in-time request tied to the KYC step, with the permission not re-requested afterwards, plus a consent record with a timestamp you can produce on audit.

The purpose of obtaining consent must be disclosed at each stage of interface with the borrower, and explicit consent is required before sharing personal information with any third party, except where a statute or regulation requires the sharing. Teams that have already built consent infrastructure for the Digital Personal Data Protection Act 2023 have a head start here; our DPDP engineering playbook for Indian startups covers the audit-trail patterns that satisfy both regimes at once.

Data residency and the 24-hour repatriation rule

Para 13 has three parts, and the third is the one that breaks cloud architectures.

LSPs must not store personal information of borrowers except the minimum necessary. No biometric data may be stored or collected by the RE or the LSP unless permitted under statutory guidelines. And all data must be stored only on servers located within India.

Then the clause teams miss: where data is processed outside India, it must be deleted from servers outside India and brought back to India within 24 hours of processing.

Twenty-four hours is short enough to rule out several common patterns. A model-training pipeline that ships feature data to a US region and leaves it in object storage does not comply. Nor does an observability stack that ships application logs containing borrower identifiers to a foreign-region SaaS with a 30-day retention. Nor does a third-party fraud or credit-scoring API whose vendor retains request payloads. The practical audit is to inventory every place borrower data lands — primary datastore, replicas, caches, message queues, logs, backups, analytics warehouse, error trackers, and every vendor API — and for each one outside India, prove deletion within 24 hours or move it. In most cases moving it is cheaper than proving it.

Para 15 adds that REs must comply with the technology and cybersecurity standards RBI and other agencies stipulate for digital lending, which keeps the usual controls in scope on top of the residency rules.

DLG: 5 per cent, and NPA recognition stays with the lender

Chapter VI governs loss-sharing. A DLG arrangement may only be entered into with an LSP or another RE engaged as an LSP, and the LSP providing the guarantee must be incorporated as a company under the Companies Act, 2013. That alone excludes LLPs and partnership structures from providing DLG.

The cap is explicit: DLG cover may not exceed 5 per cent of the total amount disbursed out of that loan portfolio at any given time, and for implicit guarantee arrangements the provider may not bear performance risk beyond the equivalent of 5 per cent of the underlying portfolio. RBI's own illustration puts a ₹2 crore ceiling on a ₹40 crore DLG set.

The DLG set must consist of identifiable and measurable loan assets, fixed for the purpose of the specific arrangement, with no loans added or removed except through repayment or write-off. An RE may run multiple DLG sets. Recognition of individual loans as non-performing assets, and the consequent provisioning, remains the RE's responsibility under the normal asset classification norms regardless of any portfolio-level DLG cover.

For a platform business, the engineering consequence is that a DLG set is a static, auditable cohort with its own ledger, not a dynamic filter over the loan book. Build it as a materialised, immutable membership list with a computed exposure figure, because the 5 per cent ceiling must hold "at any given time" and someone will ask you to prove it for a historical date.

Reporting: DLAs, CICs and the CIMS certification

Two reporting obligations sit in Chapter V.

Every loan extended through a DLA of the RE or of its LSP must be reported to Credit Information Companies, irrespective of its nature or tenor. Small-ticket and very short-tenor products are not exempt. If your product ships pay-later or micro-credit with a fourteen-day cycle, the bureau reporting pipeline is part of the minimum viable product, not a later phase.

Para 17, in force since 15 June 2025, requires REs to report DLA details on RBI's CIMS portal, with the Chief Compliance Officer or another Board-designated official certifying that the submitted data is correct and that the DLAs comply with the extant instructions including these Directions. In practice, an engineering team gets pulled into this: someone has to produce an accurate, current list of every app and web property that originates loans, mapped to the LSPs operating them.

Para 8 supports it with a public-disclosure requirement. The RE must maintain its own website, kept up to date, listing the DLAs of the RE and the DLAs of its LSPs along with the activities each is engaged for, and the DLAs must carry links to that page. Treat the DLA inventory as a maintained artefact with an owner, not a spreadsheet someone rebuilds each quarter.

Grievance redressal is a product surface, not a mailbox

RBI requires nodal grievance redressal officers for digital lending complaints, with their contact details prominently displayed on the RE's website, the LSP's website and the DLA itself, as well as in the KFS handed to the borrower. A complaint-lodging facility must be available on the DLA and on the website.

The Directions also require the borrower to be told they can escalate to the Reserve Bank - Integrated Ombudsman Scheme, or send a physical complaint to the Centralised Receipt and Processing Centre at the Reserve Bank of India, Sector-17, Central Vista, Chandigarh 160017. That address belongs in the app's help content, not only in a policy PDF.

On default, the particulars of the recovery agent authorised to approach the borrower must be communicated to the borrower, and again whenever the assigned agent changes. That is a notification pipeline keyed to an agent-assignment event, which most collections stacks do not emit today.

What to do first

If you are building or reviewing a lending app against these Directions, the order that finds the expensive problems fastest is: fund flow, then data residency, then permissions. Fund flow because a pooled or LSP-controlled account is an architectural change measured in months. Residency because the 24-hour repatriation rule usually implicates a vendor contract you cannot change unilaterally. Permissions because they are quick to fix and quick for a reviewer to check — an app store listing that still requests READ_CONTACTS is the first thing anyone will notice.

Only after those three is it worth working through KFS timing, the cooling-off exit flow, the multi-lender offer view and the DLG ledger. Teams already integrating regulated data rails will find the consent and audit-trail work overlaps with what they built for account aggregator integration, and the payment-side constraints rhyme with the transaction-cap questions covered in our note on UPI in 2026 for fintech builders.

The compliance work that hurts is never the disclosure text. It is the place where money touches an account you control.

FAQ

What is the minimum cooling-off period under the 2025 Directions?

One day. Para 10 says the cooling-off period is determined by the Board of the regulated entity in its loan policy, subject to that period not being less than one day. During it, the borrower may exit by paying principal and proportionate APR without any penalty, regardless of the loan's tenor.

Can a lending service provider hold or route loan funds?

No. Para 9 requires disbursal directly into the end-beneficiary's bank account and prohibits disbursal to any third-party account, including LSP accounts. Repayment must be executed by the borrower directly into the regulated entity's account, and the fund flow may not be controlled directly or indirectly by any third party.

Which mobile permissions are prohibited for digital lending apps?

Para 12 requires apps to desist from accessing file and media, contact list, call logs and telephony functions. Camera, microphone and location may be accessed on a one-time basis only, and only where necessary for onboarding or KYC requirements, with the explicit consent of the borrower recorded.

Where must borrower data be stored?

Only on servers located within India. Para 13 also states that where data is processed outside India, it must be deleted from the servers outside India and brought back to India within 24 hours of processing. Lending service providers may not store borrower personal information beyond the minimum necessary.

What is the cap on default loss guarantee cover?

Five per cent. DLG cover cannot exceed 5 per cent of the total amount disbursed out of that loan portfolio at any given time, and implicit guarantee providers cannot bear performance risk beyond the equivalent of 5 per cent. RBI illustrates this as a ₹2 crore ceiling on a ₹40 crore DLG set.

Does a default loss guarantee change who recognises the bad loan?

No. Para 24 places recognition of individual loan assets as non-performing, and the consequent provisioning, on the regulated entity under the normal asset classification and provisioning norms. This applies irrespective of any portfolio-level DLG cover available, so the guarantee does not move the accounting responsibility.

Do very small or short-tenor digital loans need bureau reporting?

Yes. Para 16 requires that any lending done through the digital lending apps of a regulated entity or its lending service providers be reported to Credit Information Companies irrespective of its nature or tenor. Small-ticket and short-cycle credit products carry the same reporting obligation as conventional loans.

When did the different provisions come into force?

The Directions came into force immediately on issue, dated 8 May 2025, with two exceptions. Para 17, covering reporting of digital lending app details and the compliance certification, applied from 15 June 2025. Para 6, covering lending service provider arrangements involving multiple lenders, applied from 1 November 2025.

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified technology consultancy in Gurugram, and our senior engineering teams build and review regulated fintech products for Indian lenders and platforms. We audit lending stacks in the order the risk actually sits: trace the fund flow end to end, inventory every store and vendor that touches borrower data against the residency and 24-hour rules, then work through permissions, KFS timing, the cooling-off exit and the DLG ledger. If you want that review before your next RBI inspection or a new lender integration, talk to our team.

References

1. Reserve Bank of India (Digital Lending) Directions, 2025 — RBI/2025-26/36, DOR.STR.REC.19/21.07.001/2025-26, 8 May 2025
2. Key Facts Statement (KFS) for Loans and Advances — RBI circular DOR.STR.REC.13/13.03.00/2024-25, 15 April 2024
3. Guidelines on Digital Lending — RBI, 2022 (superseded)
4. Guidelines on Default Loss Guarantee in Digital Lending — RBI, 8 June 2023
5. Master Direction on Securitisation of Standard Assets, 2021 — RBI, 24 September 2021
6. RBI Master Directions index — Reserve Bank of India
7. RBI Notifications — Reserve Bank of India
8. Rewriting the rules of digital lending: RBI Digital Lending Directions, 2025 — Obhan and Mason
9. RBI (Digital Lending) Directions, 2025: an overview — Argus Partners
10. RBI's Digital Lending Directions, 2025: enhancing transparency and consumer protection — Mondaq
11. Reserve Bank of India (Digital Lending) Directions, 2025: brief overview and analysis — Legal 500
12. India's DPDP timeline: critical compliance deadlines for 2026-27 — India Briefing

Last updated: 22 July 2026.