Digital Lending Guidelines: RBI 2022 Framework, LSP/DLA Regulation, and Predatory Lending Protection

High Court of Delhi Corporate Law Section 35A Section 45 Banking Regulation Act, 1949 RBI Act, 1934 Payment and Settlement Systems Act, 2007
Veritect
Veritect AI
Deep Research Agent
19 min read

Executive Summary

The digital lending ecosystem in India has witnessed explosive growth, with fintech lenders disbursing over Rs. 1.5 lakh crore annually. This rapid expansion, coupled with concerns over predatory lending practices, prompted the Reserve Bank of India to issue comprehensive Guidelines on Digital Lending in September 2022. This guide examines the regulatory framework governing Digital Lending Apps (DLAs), Lending Service Providers (LSPs), First Loss Default Guarantee (FLDG) arrangements, and the measures to protect borrowers from predatory practices.

Key Statistics

Metric Value
Digital lending market size (2025) Rs. 7.5 lakh crore
Registered Entities (REs) in digital lending 500+
Lending Service Providers (LSPs) 2,000+
Digital Lending Apps (DLAs) 3,500+
Complaints against digital lenders (2023-24) 1,25,000+
Predatory lending cases (police complaints) 15,000+
RBI enforcement actions (2022-25) 200+
Apps blocked by Google Play (2022-24) 3,500+

Table of Contents

  1. Regulatory Framework - RBI Digital Lending Guidelines
  2. Key Participants - RE, LSP, DLA Framework
  3. First Loss Default Guarantee (FLDG) Norms
  4. Borrower Protection Measures
  5. Predatory Lending - Regulatory Response
  6. Data Privacy and Technology Standards
  7. Compliance Checklist and Best Practices

1. Regulatory Framework - RBI Digital Lending Guidelines

1.1 Evolution of Digital Lending Regulation

Date Development Key Impact
June 2020 Working Group on Digital Lending First comprehensive study
September 2021 WGDL Report Released 30 recommendations
August 2022 Draft Guidelines Public consultation
September 2022 Final Guidelines (DOR.CRE.REC.66/21.07.001) Effective 02-09-2022
June 2023 FLDG Framework Cap at 5% of portfolio
September 2023 Penal Charges Circular Effective 01-01-2024
December 2024 Enhanced Disclosure Norms APR disclosure mandatory

1.2 Statutory Basis for Guidelines

The Digital Lending Guidelines derive authority from:

Provision Act Authority
Section 35A Banking Regulation Act, 1949 Directions to banks
Section 45-JA RBI Act, 1934 Directions to NBFCs
Section 45-L RBI Act, 1934 Policy determination
Sections 10(2), 18 Payment and Settlement Systems Act, 2007 Payment aggregator regulation

1.3 Scope of Application

Entity Type Applicable? Extent
Scheduled Commercial Banks Yes All digital lending
Small Finance Banks Yes All digital lending
NBFCs (including HFCs) Yes All digital lending
Cooperative Banks Yes All digital lending
Regional Rural Banks Yes All digital lending
Payment Banks No Only permitted activities
Fintech Companies (non-RE) Indirect Through LSP/DLA norms
Peer-to-Peer Platforms Yes Separate framework

1.4 Key Definitions

Term Definition
Regulated Entity (RE) Banks, NBFCs, HFCs, and other entities regulated by RBI
Lending Service Provider (LSP) Entity engaged by RE to perform specific functions in digital lending
Digital Lending App (DLA) Mobile/web application used for digital lending
Digital Lending Remote/automated lending where technology is primary interface
First Loss Default Guarantee (FLDG) Arrangement where LSP provides guarantee against defaults

2. Key Participants - RE, LSP, DLA Framework

2.1 Regulated Entity (RE) Responsibilities

Responsibility Description
Licensing Only REs can extend loans
Credit Decision Must be with RE, not outsourced
Disbursement Directly to borrower's bank account
Collection Only through RE's bank account
Grievance Redressal RE is ultimately responsible
Data Protection RE responsible for borrower data
LSP Oversight Due diligence and monitoring

2.2 Lending Service Provider (LSP) Framework

Aspect Requirement
Definition Agent of RE for specific digital lending functions
Permitted Functions Customer acquisition, underwriting support, pricing support, servicing, recovery
Prohibited Functions Credit approval, direct fund handling, charging borrower directly
Compliance Must comply with RE's guidelines and RBI norms
Disclosure Must be disclosed to borrower
Agreement Written agreement with RE mandatory

2.3 LSP Function Classification

Category Functions Allowed Functions Prohibited
Customer Acquisition Lead generation, KYC assistance, documentation Approving customers, determining eligibility
Underwriting Support Data analysis, credit scoring, risk assessment Final credit decision
Pricing Support Rate benchmarking, fee calculation Setting final interest rate
Loan Servicing Payment reminders, account management Deducting payments directly
Recovery Soft collection, follow-up Harassment, field visits without RE approval

2.4 Digital Lending App (DLA) Requirements

Requirement Specification
Disclosure RE name, LSP name, LSP role must be displayed
Data Access Minimal permissions, explicit consent
Grievance Link Link to RE's grievance mechanism
Privacy Policy Accessible and comprehensive
Audit Trail All transactions logged
Security Encryption, secure data transmission

2.5 Tripartite Structure

                    BORROWER
                       |
         +-------------+-------------+
         |                           |
         v                           v
    DLA/Website                  RE's Bank
    (Interface)                   Account
         |                           |
         v                           |
       LSP                           |
    (Services)                       |
         |                           |
         v                           |
   REGULATED ENTITY (RE) <-----------+
   (Bank/NBFC)
         |
         +---> Credit Decision
         +---> Loan Agreement
         +---> Fund Disbursement
         +---> Collection
         +---> Grievance Resolution

3. First Loss Default Guarantee (FLDG) Framework

3.1 FLDG Definition and Types

Type Description Permitted?
Explicit FLDG Written guarantee by LSP for first loss Yes (with limits)
Implicit FLDG Informal arrangement for loss sharing No
Cash Collateral Deposit by LSP as security Yes (subject to cap)
Corporate Guarantee Guarantee by LSP's parent Yes (subject to cap)
Portfolio Guarantee FLDG on entire portfolio Yes (5% cap)

3.2 FLDG Framework (June 2023)

Parameter Requirement
Maximum FLDG 5% of total loan portfolio amount
Provider Eligibility LSP or corporate group entity
Form Cash deposit, fixed deposit, or bank guarantee
Invocation Only after 120 days past due
Replenishment Within 30 days if invoked
Disclosure In loan agreement to borrower
Accounting As per applicable standards

3.3 FLDG Calculation Example

Parameter Value
Total Portfolio through LSP Rs. 100 crore
Maximum FLDG (5%) Rs. 5 crore
Actual FLDG provided Rs. 4 crore
Default in portfolio Rs. 8 crore
FLDG invocation Rs. 4 crore (capped)
RE's remaining exposure Rs. 4 crore

3.4 FLDG Compliance Requirements

Requirement Responsibility
Written agreement RE and LSP
Board approval (RE) Mandatory
Due diligence on LSP RE
Monitoring and reporting RE to RBI
Disclosure to borrower RE through loan agreement
Annual review RE's Board/Committee

4. Borrower Protection Measures

4.1 Disclosure Requirements

Disclosure Timing Content
Pre-Sanction Before application All charges, APR, terms
Key Fact Statement (KFS) Before disbursal Standardized format
Sanction Letter On approval Loan terms, RE name
Loan Agreement Before disbursal All terms and conditions
Welcome Letter On disbursal Account details, contacts

4.2 Key Fact Statement (KFS) Contents

Element Description
Annual Percentage Rate (APR) All-inclusive annualized cost
Interest Rate Nominal and effective rates
Processing Fee Upfront charges
Insurance Premium If bundled
Other Charges Late payment, prepayment, etc.
Repayment Schedule EMI breakdown
Total Amount Payable Principal + all charges
Cooling-off Period Right to exit

4.3 APR Calculation Standard

APR = (Total Cost of Credit / Principal Amount) x (365 / Loan Tenure in Days) x 100

Where Total Cost of Credit includes:
- Interest charges
- Processing fees
- Insurance premiums (if mandatory)
- Documentation charges
- Verification charges
- Any other upfront or deferred charges

4.4 Cooling-Off Period

Aspect Requirement
Duration Minimum 3 days (suggested), specific period per RE
Applicability All digital loans
Exercise Borrower can exit without penalty
Settlement Principal + proportionate interest only
Disclosure Must be in KFS and loan agreement

4.5 Grievance Redressal Mechanism

Level Timeline Authority
Level 1 Within 30 days RE's Nodal Officer
Level 2 30 days after Level 1 RE's Internal Committee
Level 3 30 days after Level 2 RBI Ombudsman
Escalation - SEBI (for listed), Courts

5. Predatory Lending - Regulatory Response

5.1 Predatory Practices Identified

Practice Description Regulatory Action
Excessive Interest Rates exceeding 36% APR Disclosure mandate, market discipline
Hidden Charges Undisclosed fees KFS mandatory
Harassment Aggressive collection Code of conduct, penalties
Data Misuse Contact list access for shaming Data minimization norms
Unauthorized Deductions Auto-debit without consent E-mandate norms
Bundled Products Forced insurance sales Unbundling required
Short Tenure Traps 7-15 day loans with high costs APR disclosure

5.2 Data Access Restrictions

Permission Allowed? Purpose Limitation
Camera Yes, with consent KYC/document capture only
Location Yes, with consent Fraud prevention only
Contact List NO Prohibited entirely
SMS/Call Logs NO Prohibited entirely
Gallery NO Prohibited entirely
Storage Limited App function only

5.3 Collection Practices Code

Practice Permitted Prohibited
Calling Hours 8 AM - 6 PM Outside permitted hours
Communication Respectful, factual Abusive, threatening
Contact Borrower, guarantor Third parties, relatives
Field Visit With RE approval, during day Night visits, intimidation
Disclosure Debt amount only Public shaming
Digital Methods Registered numbers only Spam, multiple apps

5.4 Penalties for Violations

Violation Penalty
Operating without RE Criminal prosecution
Data misuse DPDP Act penalties (up to Rs. 250 crore)
Harassment Criminal cases + RE penalties
Non-disclosure RBI enforcement action
FLDG violation Cease and desist, penalties
Unlicensed apps FIR, app blocking

6. Data Privacy and Technology Standards

6.1 Data Protection Requirements

Requirement Standard
Consent Explicit, informed, purpose-specific
Data Minimization Collect only necessary data
Storage India-based servers (with exceptions)
Retention As per business need, delete after purpose
Security Encryption, access controls, audit trails
Portability Provide data on request
Deletion Delete on request (subject to legal retention)

6.2 Technology Standards

Standard Requirement
API Security OAuth 2.0 or equivalent
Data Encryption AES-256 for data at rest
Transmission TLS 1.3 for data in transit
Access Control Role-based, MFA for sensitive functions
Audit Logging All transactions, retention 8 years
Penetration Testing Annual, by certified agency
Business Continuity Documented DR/BCP

6.3 Account Aggregator Integration

Aspect Requirement
Consent Architecture AA framework compliance
Data Pull Only through licensed AA
Purpose Limitation Specified in consent artefact
Consent Period As specified, renewable
Revocation Borrower can revoke anytime

7.1 Landmark Case: Lotus Pay Solutions v. Union of India (2022)

Citation: W.P.(C) 8215/2020, Delhi High Court (15-09-2022)

Facts: Lotus Pay Solutions Ltd. (a payment aggregator) challenged Clauses 3, 4, and 8 of RBI's 2020 Guidelines on Regulation of Payment Aggregators and Payment Gateways, arguing they exceeded RBI's statutory authority and violated Articles 14 and 19 of the Constitution.

Held: The High Court dismissed the writ petition, upholding the Guidelines.

Key Principles:

  1. Payment aggregators fall within the definition of "payment system" under Section 2(1)(i) of the Payment and Settlement Systems Act, 2007
  2. RBI's power to issue guidelines under Sections 10(2) and 18, and require authorization under Section 4, is valid
  3. The net-worth and escrow provisions are proportionate and reasonable
  4. The Court applied the "updating principle" to interpret the statute in light of technological evolution

Significance:

"The judgment affirms RBI's expansive regulatory jurisdiction over digital payment intermediaries, clarifying that such entities are 'designated payment systems' and are subject to capital and escrow mandates, thereby shaping future regulatory frameworks for fintech."

7.2 Case: Raj Kumar Kohli v. RBI - NBFC Foreclosure (2019)

Citation: WP(C), Delhi High Court (21-10-2019)

Facts: The petitioners challenged foreclosure charges imposed by an NBFC on floating-rate term loans. The RBI Circular dated 14 July 2014 prohibits foreclosure charges on floating-rate loans to individual borrowers.

Held: The Court allowed the petition and directed refund of foreclosure charges.

Key Principles:

  1. A proprietorship is NOT a separate juridical entity; the borrower is an individual
  2. The plain language of the RBI Circular leaves no room for business-purpose exceptions
  3. All floating-rate loans to individuals are exempt from foreclosure charges

Significance: Clarifies that RBI circulars protecting individual borrowers apply regardless of the purpose of the loan.

7.3 Case: Gunn Agri Foods v. PNB - Pandemic Relief (2020)

Citation: APPL 23066/2020, Delhi High Court (16-12-2020)

Facts: The petitioner sought relief against NPA classification during the COVID-19 pandemic, requesting conversion to Funded Interest Term Loan (FITL) and waiver of penal interest as per RBI circulars.

Held: The Court directed the bank to consider the petitioner's request for FITL conversion and waive penal interest in accordance with RBI guidelines.

Key Principles:

  1. RBI circulars issued during the pandemic have binding effect
  2. Banks must consider waiver requests and FITL conversions when appropriate
  3. Credit facilities should not be recalled contrary to RBI pandemic-relief guidelines

Significance: Establishes that RBI's regulatory relief measures during crises are enforceable.

7.4 Case: M/s Pintoji Foods v. Punjab National Bank (2014)

Citation: LPA 467/2014, Delhi High Court (24-09-2014)

Facts: The petitioner challenged the bank's refusal to rehabilitate an NPA account, alleging non-compliance with RBI guidelines on rehabilitation of Micro and Small Enterprises.

Held: The Court dismissed the petition.

Key Principles:

  1. Banks have discretion over rehabilitation decisions when guided by RBI norms
  2. Courts cannot compel banks to invest public money in projects found unviable
  3. Compliance with RBI guidelines' procedural requirements is sufficient

Significance: Establishes limits on judicial intervention in bank lending decisions while affirming RBI guidelines as the standard.

7.5 Case: Vishwakarma Projects v. Canara Bank - OTS (2012)

Citation: LPA, Delhi High Court (30-03-2012)

Facts: The appellant sought to avail RBI's one-time settlement scheme for NPAs despite being classified as willful default/fraud.

Held: The Court dismissed the appeal.

Key Principles:

  1. RBI OTS guidelines are strictly time-bound
  2. Wilful default/fraud cases are excluded from OTS schemes
  3. Timely application under RBI schemes is essential
  4. DRT Act recovery orders are enforceable despite OTS availability

Significance: Clarifies that RBI's concessional schemes have strict eligibility criteria and timelines.

7.6 Case: Arun Mittal v. PNB - Fraud Classification (2024)

Citation: APPL. 25139/2024, Delhi High Court (30-04-2024)

Facts: The bank declared the petitioner's account as fraud without show-cause notice or opportunity for representation.

Held: The Court set aside the fraud declaration.

Key Principles:

  1. Natural justice principles (audi alteram partem) are mandatory in fraud classifications
  2. RBI Master Directions cannot override procedural safeguards
  3. Banks must issue show-cause notices before blacklisting borrowers
  4. Fraud classifications without personal hearing are vulnerable to challenge

Significance: Strengthens borrower rights and imposes procedural checks on banks, ensuring blacklisting is not exercised arbitrarily.

8. Compliance Checklist and Best Practices

8.1 Compliance Checklist for Regulated Entities

Area Requirement Timeline
LSP Onboarding
1 Due diligence on LSP Before engagement
2 Written agreement Before launch
3 Board approval for FLDG Before accepting
4 LSP code of conduct Signed before engagement
Disclosure
5 KFS format implementation Mandatory for all loans
6 APR disclosure In KFS and all communications
7 Grievance mechanism link On all DLAs
8 RE name prominently displayed All customer touchpoints
Operations
9 Disbursement to bank account 100% compliance
10 Collection from RE's account 100% compliance
11 Cooling-off period Policy documented
12 Data access audit Quarterly
Monitoring
13 LSP performance review Monthly
14 Complaint analysis Monthly
15 FLDG utilization Quarterly
16 Data privacy audit Annual

8.2 Compliance Checklist for LSPs

Requirement Action Frequency
RE agreement Maintain current agreement Ongoing
Function limits Stay within permitted scope Continuous
Data handling Minimize data collection Continuous
Collection practices Follow code of conduct Continuous
FLDG provision Maintain as agreed Continuous
Disclosure RE name, role in all comms Continuous
Training Staff awareness on norms Quarterly
Audit Compliance audit Annual

8.3 Compliance Checklist for DLAs

Requirement Implementation
App Store Compliance Accurate description, permissions
RE Disclosure Prominent display on home screen
Privacy Policy Accessible, comprehensive
Data Permissions Minimum necessary only
Grievance Link Direct link to RE mechanism
KFS Integration Before loan acceptance
Consent Management Explicit, documented
Security Encryption, secure APIs

8.4 Best Practices for Digital Lending

For Regulated Entities:

  1. Establish centralized LSP governance framework
  2. Implement real-time monitoring of collection practices
  3. Create standardized API integrations with audit logging
  4. Conduct mystery shopping on LSP/DLA behavior
  5. Maintain comprehensive borrower communication records

For LSPs:

  1. Invest in compliance technology
  2. Train all staff on RBI guidelines
  3. Implement robust data protection measures
  4. Establish clear escalation paths for complaints
  5. Maintain transparent relationship with RE

For Borrowers:

  1. Verify RE registration on RBI website
  2. Download apps only from official stores
  3. Read KFS carefully before accepting loan
  4. Use grievance mechanisms for issues
  5. Report harassment to police and RBI

8.5 Penalty Framework

Violation Potential Penalty
Operating without RE license Criminal prosecution
FLDG exceeding 5% Cease and desist, penalties
Non-disclosure of APR Direction to correct, penalty
Data misuse DPDP Act penalty (up to Rs. 250 Cr)
Harassment in collection Criminal FIR, RE penalty
Unauthorized data access Criminal prosecution, app blocking
Non-compliance with guidelines Monetary penalty, business restrictions

Key Statistics Summary

Parameter Value
Digital lending market size Rs. 7.5 lakh crore
Number of REs in digital lending 500+
Number of LSPs 2,000+
Number of DLAs 3,500+
FLDG cap 5% of portfolio
Cooling-off period Minimum 3 days
Grievance resolution timeline 30 days (Level 1)
Maximum data retention As per purpose, with deletion

Conclusion

The RBI's Digital Lending Guidelines of 2022 represent a watershed moment in fintech regulation in India. Key takeaways:

  1. RE-centric model - All digital lending must flow through Regulated Entities
  2. LSP accountability - Clear boundaries on LSP functions with RE oversight
  3. Borrower protection - Comprehensive disclosure, cooling-off, and grievance mechanisms
  4. FLDG limits - 5% cap prevents excessive risk transfer
  5. Data minimization - Strict controls on app permissions and data collection
  6. Predatory lending control - APR disclosure, collection code, harassment prohibition

For sustainable digital lending ecosystem development:

  • REs must exercise meaningful oversight over LSPs and DLAs
  • LSPs must operate within permitted boundaries
  • Borrowers must be empowered with information and grievance access
  • Regulators must continue monitoring and enforcement

The evolving jurisprudence, particularly the Lotus Pay Solutions judgment, confirms that RBI has broad powers to regulate digital financial services, and courts will generally defer to regulatory expertise while ensuring natural justice is observed.

Written by
Veritect. AI
Deep Research Agent
Grounded in millions of verified judgments sourced directly from authoritative Indian courts — Supreme Court & all 25 High Courts.
About Veritect

AI research & drafting, purpose-built for Indian litigation.

Veritect indexes 5 million+ judgments from the Supreme Court of India and all 25 High Courts, 1,000+ Central and State bare acts, and 50,000+ statutory sections — including the new BNS, BNSS, and BSA codes.

Built for Indian courts. Trusted by litigation practices from solo chambers to full-service firms.

Try Veritect free