The Reserve Bank of India consolidated its digital lending rules into the Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025. Many of the requirements land on engineering teams: what a lending app may access on a phone, where data sits, how loan offers are shown, and what gets reported to RBI. One rule sets a 24-hour limit for bringing data processed abroad back to India. This checklist turns the Directions into build items.
Who the 2025 Directions apply to
The Directions, reference RBI/2025-26/36, apply to commercial banks, primary urban, state and central co-operative banks, NBFCs including housing finance companies, and all-India financial institutions. They also reach lending service providers, or LSPs, and the digital lending apps they run, because the regulated entity remains responsible for what its partners do. A digital lending app here means a mobile or web app, standalone or part of a larger suite.
The 2025 text replaces the earlier framework. According to a Mondaq analysis, it effectively repeals the June 2020 circular on loans sourced over digital platforms, the September 2022 Digital Lending Guidelines and the June 2023 default loss guarantee guidelines, along with their FAQs. The Key Facts Statement circular of 15 April 2024 still applies.
App permissions and device data
Paragraph 12 is the rule most visible to product teams. A lending app run by the regulated entity or its LSP must not access phone resources such as files and media, the contact list, call logs or telephony functions. A one-time access to the camera, microphone or location is allowed only for onboarding or KYC, and only with the borrower's explicit consent.
Audit both the Android manifest and the iOS permission strings, and check every third-party SDK in the build, because an analytics or attribution library can request permissions you never asked for. Collection of biometric data is not allowed unless a law requires it, according to an Argus Partners summary of the Directions.
- Remove contacts, call log, SMS, files and telephony permissions from lending apps
- Request camera, microphone and location once, only for KYC, with explicit consent
- Scan third-party SDKs for hidden permission requests before each release
- Do not store biometric data unless a law requires it
Data storage, consent and the 24-hour rule
Paragraph 13(iv) requires all data to be stored only on servers located in India. Processing outside India is permitted, but the data must be deleted from foreign servers and brought back to India within 24 hours of processing. If you use an overseas fraud, scoring or messaging service, confirm in writing where it stores data and how fast it purges it.
Data collection needs the borrower's express consent, and LSPs should keep only the minimum data they need. At a minimum, lenders must collect the borrower's age, occupation and income before lending. Each regulated entity must publish its privacy policies in one easily found section of its website, including which third parties may collect personal data through its apps.
Loan journey controls: KFS, documents, cooling-off and disbursal
Borrowers must receive a Key Facts Statement under the April 2024 KFS circular. On loan execution, digitally signed documents on the lender's letterhead must go automatically to the borrower's verified email or SMS. The borrower can exit the loan during a cooling-off period, set by the lender's board at a minimum of one day, by repaying principal and proportionate APR without penalty. A disclosed one-time processing fee may be kept.
Loans must be disbursed straight into the borrower's bank account, not into an LSP or other third-party account, except in specific cases such as co-lending or payment to an end beneficiary. Any increase in a credit limit needs an explicit request from the borrower followed by an assessment, so automatic limit raises must be switched off.
Multi-lender display rules for LSPs
From 1 November 2025, an LSP that works with several lenders must show every matching loan offer neutrally and in a comparable format, and also name lenders who did not match. Each offer needs the lender's name, loan amount, tenor, APR, monthly repayment, penal charges and a link to the KFS. The matching logic must be applied the same way for every user and documented.
Dark patterns are banned. The interface cannot push one offer through placement or styling, unless ranking follows an objective criterion that is publicly disclosed. Engineering teams should version the matching and ranking code, log which offers each user saw, and keep the documentation where an auditor can read it.
CIMS reporting of digital lending apps
Regulated entities had to report every digital lending app, their own and those run by LSPs, on RBI's Centralised Information Management System portal by 15 June 2025, in the Annex I format. Additions and discontinued apps must be updated on a rolling basis. The Chief Compliance Officer, or another official the board designates, must certify the data.
That certification also confirms that borrower disclosures are on the lender's website, that LSP apps show a grievance officer with public contact details, and that data practices follow the Directions. Being listed on CIMS does not mean RBI has approved an app. Keep an internal register of every app, version and LSP so the CIMS record stays accurate.
Grievance handling and security standards
A borrower can escalate to RBI's Complaint Management System under the Integrated Ombudsman Scheme if the lender rejects the complaint, the borrower is unhappy with the reply, or no reply arrives within 30 days. Websites must list grievance channels, customer care details and links to the CMS and the Sachet portal. Track complaint age automatically so nothing passes 30 days unnoticed.
Paragraph 15(i) requires regulated entities and LSPs to meet the cybersecurity technology standards set by RBI and other relevant agencies. One compliance consultancy notes that vulnerability assessment and penetration testing for RBI-regulated entities must be done by a CERT-In empanelled auditor. As of 2025, CERT-In had empanelled 231 audit organisations.
The full technology checklist
Use this table as a starting audit. XDQ Labs builds and tests lending apps and LSP platforms against checklists like this one. This guide reflects the Directions and public commentary as of November 2026. It is not legal advice. RBI updates its rules often, so confirm the current text on rbi.org.in and with qualified counsel before you rely on it.
| Area | Requirement | Reference |
|---|---|---|
| App permissions | No access to files, media, contacts, call logs or telephony; one-time camera, mic, location for KYC only | Para 12 |
| Data location | Store on servers in India; offshore data deleted and returned within 24 hours | Para 13(iv) |
| Cooling-off | Board-set exit period of at least 1 day | Para 10 |
| Grievances | Escalation to RBI CMS if unresolved after 30 days | Para 11(iv) |
| Security | Meet RBI and agency cybersecurity standards | Para 15(i) |
| App reporting | Report all lending apps on CIMS, certified by the CCO | Para 17 |
| Default loss guarantee | Cover capped at 5% of the portfolio amount disbursed | Para 23(i) |
| Multi-lender display | Neutral, documented offer matching from 1 November 2025 | Multi-lender provisions |
Frequently asked questions
Can a digital lending app access a borrower's contacts?
No. Paragraph 12 of the RBI Digital Lending Directions, 2025 bars lending apps from accessing files, media, contact lists, call logs and telephony functions. A one-time access to camera, microphone or location is allowed only for onboarding or KYC, with the borrower's explicit consent.
Can digital lending data be processed outside India?
Yes, but only briefly. Data must be stored on servers in India. If it is processed abroad, it must be deleted from the foreign servers and brought back to India within 24 hours of processing, under paragraph 13(iv) of the 2025 Directions.
What is the minimum cooling-off period for a digital loan?
The lender's board sets the period, but it must be at least one day. During it, the borrower can exit by repaying principal and proportionate APR without a penalty. A reasonable one-time processing fee may be kept if it is disclosed in the Key Facts Statement.
What is CIMS reporting for digital lending apps?
Regulated entities must report every digital lending app, including those run by LSPs, on RBI's Centralised Information Management System portal. The first deadline was 15 June 2025, and changes must be updated on a rolling basis. The Chief Compliance Officer or a board-designated official certifies the data.
Sources
- Reserve Bank of India (Digital Lending) Directions, 2025, Reserve Bank of India, 2025
- RBI Digital Lending Directions 2025: an overview, Argus Partners, 2025
- AZB Update: Digital Lending Directions 2025, AZB & Partners, 2025
- RBI Digital Lending Directions 2025: same same but different, Mondaq, 2025
- The RBI's Digital Lending Directions 2025: a unified code for a fragmented sector, The Legal 500, 2025
- RBI cybersecurity compliance, Tranquility Cybersecurity, 2026
- CERT-In: India's Frontline Defender against Cyber Threats, Press Information Bureau, 2026
