RBI Digital Lending Directions, 2025: A Working Guide
What Regulated Entities and Lending Service Providers actually need to have in place, and what changed from the old rules.
On May 8, 2025, the RBI consolidated years of scattered circulars, the 2022 Digital Lending Guidelines, the outsourcing rules for recovery agents, and the separate Default Loss Guarantee guidelines, into one unified framework: the Reserve Bank of India (Digital Lending) Directions, 2025. If you're a Regulated Entity (bank, NBFC, or All India Financial Institution) or a Lending Service Provider working with one, this is now the single rulebook, not three overlapping ones.
This is a working reference, not legal advice. Confirm current requirements with counsel before relying on this for a live product or partnership.
What Regulated Entities need to have in place
| Requirement area | What it covers | Who it applies to |
|---|---|---|
| Key Fact Statement (KFS) | A digitally signed statement showing APR, all fees, and repayment schedule, given before the loan is executed | Every RE, on every digital loan |
| Cooling-off period | Board-approved exit window (minimum one day) letting the borrower repay principal plus proportionate APR with no penalty beyond a disclosed processing fee | Every RE |
| LSP due diligence | A contractual agreement defining roles and liabilities, enhanced due diligence before onboarding, and periodic conduct reviews | REs partnering with any LSP |
| DLG caps and structure | Default Loss Guarantee exposure capped at 5% of the covered loan portfolio, with restrictions on revolving credit and NBFC-P2P structures | REs using DLG arrangements |
| Disbursal and repayment flow | Funds must move directly between RE and borrower; no LSP pass-through accounts, except cash recovery on delinquent loans, credited same day | Every RE and LSP |
| Recovery conduct | Borrowers must be told a recovery agent's identity before contact; LSP recovery fees are paid by the RE, never deducted from what's recovered | REs and LSPs handling delinquency |
| CIMS reporting | Every digital lending app, RE-owned or LSP-owned, must be reported on RBI's Centralised Information Management System | Every RE |
| Grievance redressal | A named nodal officer, contact details on the app and website, and a path to RBI's CMS or Sachet portal if unresolved in 30 days | Every RE and interfacing LSP |
What actually changed from the old rules
The core borrower protections, KFS, cooling-off, direct disbursal, aren't new; they existed in the 2022 guidelines. What's new is the consolidation itself, the explicit recognition that an RE can act as an LSP for another RE, an expanded scope that now includes All India Financial Institutions, and materially tighter DLG restrictions, particularly around revolving credit and NBFC-P2P-linked structures.
Where lenders and LSPs actually get caught out
Three areas come up repeatedly in practitioner commentary: LSP contracts that don't clearly define liability if something goes wrong, DLG structures that were fine under the old guidelines but now breach the 5% portfolio cap, and websites or apps that haven't been updated to disclose every LSP partnership and product, which the Directions now require to be current, not just accurate at launch.
The practical takeaway
This isn't a one-time filing. CIMS reporting, LSP due diligence, and website disclosures are all standing obligations that need to stay current as partnerships and products change. Treat this table as a working checklist to revisit each time a new LSP relationship or lending product goes live, not a box to check once.
Want a one-page PDF version of this table to keep on hand? Drop your email and it'll be sent your way, along with updates whenever RBI issues a clarification.