RBI Digital Lending Directions: what changed in 2025 for startups

They are rules from the RBI on how regulated lenders offer loans through apps and websites. A regulated entity (RE) is a bank, a non-bank finance company (NBFC) or another lender the RBI supervises. The directions say what an RE must do whether it runs an app itself or uses a fintech partner.

The RBI issued them as a consolidated set on 8 May 2025. They follow the digital lending guidelines of 2022 and later circulars, bringing the instructions together. They are rules for lenders, so a fintech startup that is not itself a lender feels them through its lending partners.

A related point is who is outside the directions. A company that only sells software to a lender, without touching the customer, is closer to a vendor than an LSP. Where the line falls depends on the tasks it performs, so a startup should read its lender contract as closely as the RBI text.

A lending service provider is an agent of a regulated lender that carries out one or more of the lender's digital lending tasks. Many fintech startups are LSPs. They find borrowers, collect documents, build the app, run credit models or manage collections, while the loan itself comes from a bank or NBFC.

The lender must have a written agreement with each LSP that sets out roles, rights and duties, and must act against an LSP that breaks the rules. The lender stays responsible for the loan and for how customers are treated, even if the LSP did the work.

Lenders must also keep a record of the LSPs they use and check their conduct. In practice, a bank or NBFC will ask a fintech partner for audits, data access and proof of grievance handling. A startup that can show these from the start usually finds it easier to sign a bank partner.

Before the loan agreement is signed, the borrower must get a key fact statement (KFS), a one-page summary of the loan's cost: amount, interest, charges, annual percentage rate and repayment schedule. The rule on the format comes from an RBI circular of April 2024, which the 2025 directions did not repeal.

The borrower also gets a cooling-off period. As described in law-firm notes, each lender's board decides its length, subject to a minimum of one day, during which the borrower can exit by paying the principal and interest for the days used, with no penalty.

Lenders must also tell borrowers where to complain, including the option of a physical complaint to the RBI, and when a complaint can be escalated. Apps run by LSPs must have grievance officers with public contact details.

Disclosure also covers fees. Charges must be stated clearly in the KFS, and a lender should not add fees that were not shown. For borrowers, the practical test is simple: if the cost of the loan was not shown before signing, the lender has missed a core duty.

Lenders had to report every digital lending app tied to their lending, whether run by themselves or by an LSP, to the RBI on its Centralised Information Management System (CIMS) portal. As described in law-firm summaries, the deadline for this was 15 June 2025, the data is updated on a rolling basis, and a chief compliance officer or a board-designated official must certify it is accurate.

The RBI uses the reports to keep a public directory of lending apps, so borrowers can check whether an app is linked to a regulated lender. The notes also say a third-party app may not show its listing as RBI approval or endorsement. A listing is a disclosure record, not a licence.

For a young lender, the listing creates a new risk. A fintech that runs a lending app while the partner lender forgets to report it may find the app missing from the directory, which can raise questions from users, app stores and partners. Keeping the list of apps in sync with lenders has become routine compliance work.

The 2025 directions added extra duties for LSPs that work with more than one lender on the same app, effective 1 November 2025. As of November 2026, law-firm notes list these points.

• Offers are shown in a neutral and comparable way, and lenders that did not match are also shown.
• Each offer shows the lender's name, amount, tenure, interest rate and charges, plus a link to its KFS.
• The matching logic is applied the same way for every user and is documented.
• Promoted offers are not allowed unless ranking follows a publicly disclosed, objective criterion.

The 2025 directions allow lending data to be processed outside India if it is brought back to India and deleted from foreign servers within 24 hours of processing, according to law-firm summaries. The earlier guidelines required storage in India only.

On money flows, the long-standing principle is that loan funds should go between the borrower's bank account and the lender's account, not through the LSP's own account. Startups should confirm the exact rule in the text, since this guide does not cover every clause.

A fintech lender that depends on partner banks and NBFCs now has to show that its apps can produce a KFS, deliver the cooling-off right, handle grievances and provide data the lender needs for CIMS reporting. Lenders pass these duties down in the contract, so a fintech that cannot comply may lose partners.

Marketplaces that compare offers must show their ranking logic. A model that sold prominent placement to the highest bidder has to change or be disclosed in an objective way.

For investors reading a headline, the sign of a healthy digital lender is a clear set of regulated lenders behind each product, a listing in the directory and no dependence on a single partner. A related topic is first loss default guarantees, covered in a separate guide. Check with a legal professional before acting on any rule here.

Founders often ask whether to build or partner. Applying for an NBFC licence, covered in a separate guide, brings direct control but also direct compliance. Partnering is faster, but the partner's rules become the startup's rules.