RBI rules for fintech: licences, NBFCs and digital lending

The RBI is India's central bank and the regulator of banks, lenders and payments. Fintech startups handle other people's money, so the RBI treats them like financial firms. The question it asks of each business is: do you hold customer funds, lend money, or move money between parties?

The answer decides the licence. Many startups avoid a licence of their own by working with a bank or a licensed non-bank. That is allowed, but the licensed partner stays responsible, so it will insist on strict contracts and checks.

Four licence types cover most fintech products. Each has its own capital requirement and rulebook, and the details change, so check the RBI's current directions before you apply.

• Non-banking financial company (NBFC): a firm that lends but is not a bank. A lending startup that uses its own balance sheet usually needs one. The RBI has raised the minimum net-owned fund for new NBFCs over time.
• Payment aggregator (PA): a firm that collects payments for online merchants and passes them on. Under the 2025 payment aggregator directions, a new non-bank PA needs net worth of ₹15 crore when applying and ₹25 crore by the end of its third financial year after authorisation. Existing non-bank PAs have their own deadline, which the RBI set as March 2028.
• Prepaid payment instrument (PPI) issuer: a firm that issues wallets, gift cards or prepaid cards that hold stored value.
• Account aggregator (NBFC-AA): a firm that moves a user's financial data between banks and apps, only with the user's consent.

Most lending startups do not lend their own money. They act as lending service providers (LSPs): the app finds the customer and collects documents, while a bank or NBFC, called the regulated entity, makes the loan. The RBI holds the regulated entity fully responsible for what its LSP does.

Some startups do hold an NBFC licence, either by building one or by buying a small existing NBFC. The RBI's scale-based rules put larger NBFCs under stricter capital, governance and disclosure norms, and it keeps an eye on how fast an NBFC grows its loan book relative to its capital.

The RBI (Digital Lending) Directions, 2025 took effect on 8 May 2025 and pulled earlier guidelines into one text. The main rules, as of October 2026, are these:

Loans must be paid out directly into the borrower's bank account, not through the LSP. Fees owed to the LSP are paid by the lender, not charged to the borrower by the LSP. Borrowers get a key facts statement with the annual percentage rate (APR) before they sign. Every lender must list all its lending apps, including those run by LSPs, on the RBI's information portal, and a senior compliance officer certifies the list.

• Multi-lender platforms must show all matching offers with each lender's name, APR and a link to the key facts statement. These provisions were due from 1 November 2025.
• Default loss guarantees, where a third party covers a share of a lender's loan losses, are allowed only with proper due diligence and within RBI limits.
• Apps may collect only the data they need, with clear consent, and must not read a borrower's phone contacts or media files for credit decisions.

UPI is run by the National Payments Corporation of India (NPCI), which sits under the RBI's oversight. A startup that offers UPI payments usually works as a third-party app provider through partner banks. Collecting payments for merchants brings the payment aggregator rules above. Storing card details has its own rule: merchants and aggregators generally cannot keep full card numbers and must use tokens instead.

The RBI has also required payment data to be stored only in India, with limited exceptions for the foreign leg of a transaction. A startup with a global cloud setup should confirm where its payment data sits.

The RBI runs a regulatory sandbox that lets approved firms test a product with a limited set of customers under relaxed rules for a fixed period. Themes change each cohort. A sandbox place is not a licence, and a product must still meet the rules before it scales.

Before launching, ask: does the product hold customer money, lend it, or move it? If yes, who holds the licence? Which partner is responsible if something goes wrong? The cheapest path is often a partnership, but it also gives the partner power over the product.

The RBI can fine a firm, cap its business or stop it from onboarding new customers. It has done this to well-known payment and lending firms in the past. For startups, a stop on new customers can hit growth, funding and valuation at once, which is why investors check licences and compliance during due diligence.

Rules in this area change quickly. This guide is general information as of October 2026, not legal advice. Check the RBI's website and a qualified professional before you build or launch a regulated product.