Digital Lending in India: RBI’s Guidelines

India has witnessed multiple folds of growth in the digital economy space in the last decade. The growing ecosystem backed by the reformative policies is expected to boost the country’s digital economy to USD 1 trillion by 2025 ^[1]. The growth in the digital economy, as a consequence, has propelled the surge in the digital lending space in India. As per a report by Inc42 titled “State of Indian Fintech Report Q3 2022. InFocus: Neobanks” ^[2], the digital lending space in India is expected to become a USD 1.3 trillion market opportunity by 2030.

The innovation in the digital lending space along with the expansion of the ancillary services has led to an unregulated lacuna. A few of the prevalent issues in the recent times include digital lending frauds ^[3]; harassment of borrowers by the recovery agents ^[4]; and improper data protection of the borrowers.

In view of tackling the abovementioned issues and to further facilitate the structural growth of the digital lending space, the Reserve Bank of India constituted a working group on “digital lending through online platforms and mobile apps” on January 13, 2021 ^[5]. Eventually, on November 18, 2021, the RBI published the report of the working group inviting the comments of the stakeholders and the public, at large.^[6] Basis the comments and the internal considerations, the RBI implemented the suggestions ^[7] of the working group and formulated the Guidelines on Digital Lending ^[8] dated September 02, 2022 (Guidelines).

Key provisions under the Guidelines:

Applicability: The Guidelines are applicable to: (a) all the commercial banks; (b) Primary (Urban) Co-operative Banks, State Co-operative Banks, Direct Central Co-operative Banks; and (c) Non-Banking Financial Companies (including Housing Finance Companies) (these entities are collectively defined as Regulated Entities/REs). Further, although the Guidelines define a Lending Service Provider (LSP) as an agent of a RE carrying out one or more of the lender’s function on behalf of the RE, the Guidelines
are not directly applicable to them.

Process of Lending:

• The loan servicing and the repayment shall be executed by the borrower directly in the RE’s bank account without any pass through account/pool account of any third-party. Further, the RE shall ensure that the amount is disbursed directly into the bank account of the borrower except for certain disbursals such as for statutory or regulatory mandate.

• The fees, charges or any other payables to the LSPs are made by the RE, and are not charges directly by the LSP to the borrower.

• The penal/interest rate charged on the borrower shall be on the outstanding amount of the loan. Further, the rate of interest shall be disclosed up front to the borrower in the Key Fact Statement (KFS).

Disclosures to be made to the borrower:

• The RE is required to provide a Key Fact Statement (KFS) to the borrower before the execution of the contract. The format of KFS has been provided as an annexure to the Guidelines. Apart from the necessary details, the KFS shall contain details of annual percentage rate, the recovery mechanism, and the details of grievance redressal officer.

• The annual percentage rate shall be disclosed by the RE to the borrower as a part of the KFS. Further, any fees or charges which are not disclosed in the KFS cannot be charged by the REs to the borrower at any stage during the term of the loan.

• The REs are required to provide digitally signed documents (on the letter head of RE) for the KFS, summary of loan product, sanction letter, terms and conditions, account statements, privacy policies of the LSPs/DLAs with respect to the borrowers date on the registered email/SMS of the borrower.

• The REs are required to disclose the list of their Digital Lending Applications (DLAs), LSPs engaged and the DLAs of the LSPs, on their website. Further, the REs are required to disclose the list of recovery agents appointed by the RE for the recovery of the concerned loan.

Grievance Redressal:

• REs shall ensure that they and the LSPs engaged shall have a nodal grievance officer appointed to deal with the complaints raised by the users in relation to digital lending. Further, the details of such officer shall be displayed on the website, DLAs and the KFS shared. The website and the DLAs shall also provide for a portal to raise such complaints.

Data Protection:

• The REs shall ensure that the any collection of data on their DLAs or the DLAs of their LSPs is on a need basis and with a prior and explicit consent of the borrower. The DLAs shall desist from accessing mobile phone resources, however, one time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/KYC requirements only.

• The borrowers shall be provided with an option to give or deny consent for use of any specific data, restrict disclosure to third-parties, data retention, revoke consent already granted and make the app delete/forget data.

• Consent from the borrower shall be obtained before sharing personal information with any third-party, except for cases where such sharing is statutorily required.

• The REs and the LSPs shall provide a comprehensive privacy policy to the borrowers in compliance with the applicable laws, associated regulations and RBI guidelines.

• The Guidelines require the data collected from the borrower to be stored only in servers located within India.

Due diligence with respect to LSPs:

• REs are required to conduct an enhanced due diligence on the LSPs before entering into any partnership with an LSP. Further, REs are required to undertake periodic review of the conduct of the LSPs engaged by them.

• The REs shall ensure that the LSPs acting as a recovery agent shall comply with the instructions provided under the ‘Outsourcing of Financial Services – Responsibilities of regulated entities employed Recovery Agents’ dated August 12, 2022. ^[9]