The RBI issued the Digital Lending Directions, 2025 on 8 May 2025, consolidating years of scattered guidance into one framework. Most provisions took effect immediately, the requirement to register digital lending applications with the RBI through the CIMS portal applied from 15 June 2025, and the rules governing multi-lender arrangements applied from 1 November 2025. If you are building or maintaining a lending product, this is the document your architecture is judged against.
The vocabulary matters because obligations attach to roles. A regulated entity is a commercial bank, cooperative bank, NBFC or all-India financial institution authorised to lend. A digital lending application is the mobile or web application through which lending happens, whether standalone or embedded in a larger product. A lending service provider performs credit functions — acquisition, underwriting, servicing or recovery — on behalf of a regulated entity. A software company usually builds for one of these rather than being one, and establishing which before scoping avoids designing for the wrong obligations.
The rule with the largest architectural consequence concerns fund flow. Loans must be disbursed directly into the borrower's bank account, with narrow exceptions for co-lending and payments made directly to a beneficiary. Repayments must go directly to the regulated entity's account without passing through an intermediary, including the lending service provider. Any design in which a platform pools, holds or routes borrower money is outside the framework, and this is precisely the design that a product team building a marketplace naturally reaches for.
Disclosure is prescribed rather than left to judgement. A Key Fact Statement setting out loan terms, the annual percentage rate and other material conditions must be provided. Where a lending service provider presents offers from multiple lenders, the APR must be displayed clearly alongside every offer — which rules out interfaces that show a monthly instalment prominently and bury the rate. Borrowers get a cooling-off period of at least one day to exit without penalty, though reasonable processing fees may be retained.
Data handling is constrained in ways that affect what you may even ask for. Express borrower consent is required for collection, and biometric data may not be collected unless a law requires it. The permissions your application requests are therefore a compliance surface, not a product preference — a lending app requesting contacts or media access is making a statement about its recovery practices whether or not that was intended.
Grievances must receive a response within thirty days, with escalation available through the RBI's Complaint Management System, and every deployed digital lending application must be registered by the regulated entity through the CIMS portal. That last obligation is easy to miss on a project where the software vendor ships and the regulated entity assumes the vendor handled it. Confirm explicitly who filed the registration, because an unregistered application in production is a problem that belongs to the licence holder.
