Digital Lending Business in India: RBI Guidelines and Compliance for 2026

Digital lending in India is governed by the RBI Digital Lending Guidelines issued on September 2, 2022 (Circular DOR.CRE.REC.66/21.07.001/2022-23), which regulate every entity involved in disbursing credit through digital channels. Starting a digital lending business requires either NBFC registration with RBI (minimum Net Owned Fund: ₹2 crore) or a partnership with an existing RBI-regulated entity as a Lending Service Provider (LSP). The guidelines cover three entity categories, mandate loan disbursal only through borrower bank accounts, cap First Loss Default Guarantee (FLDG) at 5% of outstanding portfolio, and prohibit lending apps from accessing borrower phone contacts. Whether you are planning a lending app, a P2P platform, a Buy Now Pay Later service, or an embedded lending product, this guide covers every compliance requirement, registration step, and cost involved in running a digital lending business in India in 2026.

What Is Digital Lending? Definition and Business Models

Digital lending is the process of providing credit facilities to borrowers through online platforms, mobile applications, or web-based services where the entire loan lifecycle, from application to disbursal to repayment, is managed through digital channels. It is regulated by the Reserve Bank of India under the Digital Lending Guidelines dated September 2, 2022, and governed by the RBI Act, 1934, the Banking Regulation Act, 1949, and NBFC-specific Master Directions.

The Indian digital lending market has grown rapidly, with disbursements crossing ₹1.7 lakh crore through fintech platforms in FY 2024-25. This growth has been driven by increasing smartphone penetration, India Stack infrastructure (Aadhaar, UPI, Account Aggregator), and the demand for quick, small-ticket credit among MSMEs and individuals who are underserved by traditional banks. But with growth came regulatory concerns about predatory lending, data misuse, and hidden charges, which prompted RBI's comprehensive framework.

Digital Lending Business Models in India

There are five primary digital lending business models operating in India, each with different regulatory requirements:

RBI Digital Lending Guidelines: Summary of Key Provisions

The RBI circular dated September 2, 2022 introduced a comprehensive framework that fundamentally changed how digital lending operates in India. Before these guidelines, lending apps operated in a regulatory grey zone, with widespread reports of harassment, hidden charges, and data misuse. The circular addresses these issues through mandatory transparency, data protection, and borrower rights. Every provision traces back to one principle: the regulated entity (bank or NBFC) bears full responsibility for the loans disbursed through digital channels.

Core Provisions of the September 2022 Circular

1. Loan disbursal and repayment: All loan amounts must be disbursed directly into the borrower's bank account and repaid from the borrower's bank account. No pass-through accounts or wallets are permitted for disbursal.
2. RE responsibility: The regulated entity is fully accountable for the actions of its LSPs and DLAs. Any customer grievance or regulatory violation by a partner is treated as the RE's violation.
3. Fee transparency: All fees, charges, and the Annual Percentage Rate (APR) must be disclosed upfront through a standardized Key Fact Statement (KFS) before the loan agreement is executed.
4. Cooling-off period: Borrowers must be given a defined look-up or cooling-off period during which they can repay the loan with principal and proportionate APR, without any penalty.
5. Data minimization: DLAs can collect only essential data with explicit, one-time consent. Phone contacts, call logs, media storage, and other irrelevant data cannot be accessed.
6. Reporting to credit bureaus: All digital loans must be reported to credit information companies (CICs) by the regulated entity, regardless of the loan amount or tenure.
7. Grievance redressal: Every RE must designate a nodal grievance officer whose details are displayed on the DLA and the RE's website. Unresolved complaints can be escalated to the RBI Ombudsman under the Integrated Ombudsman Scheme.
8. No automatic loan enhancements: Increasing a borrower's credit limit or sanctioning a new loan without explicit borrower consent is prohibited.

Three Categories of Digital Lending Entities

RBI's framework classifies every participant in the digital lending ecosystem into one of three categories. Understanding which category your business falls into determines your compliance obligations, licensing requirements, and operational boundaries.

Category 1: Regulated Entities (REs)

Regulated Entities are banks and NBFCs that hold valid licences from the RBI. They are the only entities authorized to disburse loans and collect repayments. In the digital lending context, an RE either operates its own lending app or partners with LSPs and DLAs to reach borrowers digitally. The RE bears full regulatory responsibility for every digital loan, regardless of which technology partner facilitates the process. Examples include scheduled commercial banks, small finance banks, NBFCs (ICC, MFI, P2P), and cooperative banks.

Category 2: Lending Service Providers (LSPs)

LSPs are entities that perform specific lending functions on behalf of regulated entities through outsourcing arrangements. Their roles can include customer acquisition, credit assessment support, loan processing, disbursement support, and recovery operations. LSPs do not hold separate RBI licences but operate under contractual agreements with REs. They must comply with all guidelines on disclosure, data handling, and borrower treatment. Common LSP models include fintech companies that provide underwriting algorithms, loan marketplaces that connect borrowers with multiple lenders, and digital platforms that facilitate loan origination.

Category 3: Digital Lending Apps (DLAs)

DLAs are the customer-facing mobile or web applications through which borrowers access digital lending services. A DLA can be owned by the RE itself, by an LSP, or by a third-party technology provider. Regardless of ownership, the DLA must clearly display the RE's identity to the borrower. DLAs face the strictest data access restrictions: they can access only camera, microphone, and location, and that too only with purpose-specific, one-time consent.

Compliance Requirements by Entity Type

Each category has different levels of compliance obligations. This comparison helps you identify exactly what applies to your digital lending business model.

Registration and Licensing for Digital Lending

The registration path depends entirely on your business model. If you want to lend from your own balance sheet, you need an NBFC licence from RBI. If you want to facilitate lending for others, you register as an LSP under a contractual arrangement with existing REs. Here is a breakdown of both routes.

Route 1: NBFC Registration with RBI

If your digital lending business will disburse loans from its own funds, you must register as a Non-Banking Financial Company with the Reserve Bank of India. The process requires careful planning because RBI evaluates the promoter's track record, the business plan's viability, and compliance readiness. For a digital lending-focused NBFC, you will typically apply under the NBFC-Investment and Credit Company (ICC) category.

1. Incorporate a Private Limited Company: Register a Private Limited Company under the Companies Act, 2013 with financial services as the main object in the Memorandum of Association. Timeline: 7 to 15 working days.
2. Build the Net Owned Fund: Inject a minimum of ₹2 crore as equity capital. This must be unencumbered and certified by a Chartered Accountant. The NOF must be maintained at all times after registration.
3. Prepare the business plan: Submit a 3 to 5 year projection covering target segments, lending products, interest rate structure, technology infrastructure, risk management framework, and capital adequacy projections.
4. Submit the application to RBI: File the application through the RBI COSMOS portal with all supporting documents. Pay the application fee of ₹10,000.
5. RBI due diligence: RBI conducts background verification of promoters and directors, evaluates the business plan, and may conduct an in-person interview. Timeline: 3 to 6 months.
6. Certificate of Registration (CoR): On approval, RBI issues the NBFC CoR. You can begin lending operations only after receiving this certificate.
7. Post-registration compliance: Set up the technology platform, implement KYC and AML processes, register for GST, and begin operations within the scope approved by RBI.

Route 2: P2P Lending Licence (NBFC-P2P)

Peer-to-peer lending platforms must register as NBFC-P2P with RBI under the Master Direction on NBFC-Peer to Peer Lending Platform, 2017. The requirements are similar to standard NBFC registration with additional conditions: individual lender exposure capped at ₹50 lakh across all P2P platforms, individual borrower exposure capped at ₹50 lakh, loan tenure capped at 36 months, and mandatory escrow account arrangements for fund movement between lenders and borrowers.

Route 3: Operating as an LSP (No Separate Licence)

If you do not want to lend directly, you can partner with one or more RBI-regulated entities as a Lending Service Provider. This route does not require an RBI licence but demands a formal outsourcing agreement with the RE. The RE must conduct due diligence on your operations, technology, and data practices before onboarding you. While the entry barrier is lower (no ₹2 crore NOF requirement), you earn commission rather than interest income, and the RE retains control over credit decisions and loan pricing.

Key Compliance Provisions: What Every Digital Lender Must Follow

Whether you are an RE, an LSP, or a DLA operator, these compliance provisions apply to your operations. Ignoring any of these is the fastest way to attract RBI's attention, and not in a good way.

KYC and Customer Verification

All borrower verification must follow the RBI KYC Master Direction, 2016. For digital lending, this means implementing Aadhaar-based e-KYC (through UIDAI's authentication service) or Video-KYC (Video-based Customer Identification Process, or V-CIP). The KYC process must be performed by or under the supervision of the regulated entity. While LSPs and DLAs can assist in collecting KYC data, the RE cannot outsource the verification decision entirely. PAN verification is mandatory for all loan applications, and enhanced due diligence applies for loans above ₹10 lakh.

Data Privacy and Protection

Data protection in digital lending has two layers: RBI guidelines and the DPDP Act, 2023. Under RBI norms, DLAs can only access camera, microphone, and location on a borrower's phone, and that too with one-time, purpose-specific consent. Phone contacts, call logs, SMS messages, media files, and other device storage are off-limits. All data must be stored in servers located within India. The DPDP Act adds requirements for explicit consent, purpose limitation, data minimization, breach notification (within 72 hours to the Data Protection Board), and the borrower's right to data erasure. Non-compliance with the DPDP Act can attract penalties up to ₹250 crore.

Loan Agreement Transparency and Key Fact Statement

Before executing any loan agreement, the RE must provide the borrower with a Key Fact Statement (KFS) in a standardized, machine-readable format. The KFS must include: the Annual Percentage Rate (APR) covering all costs, the loan amount, tenure, repayment schedule, processing fees, late payment charges, prepayment penalties (if any), and the total cost of borrowing. The borrower must actively acknowledge receipt of the KFS. Burying terms in fine print or within lengthy agreements is treated as non-compliance.

Cooling-Off Period

The cooling-off period (also called the look-up period) is a defined window after loan disbursal during which the borrower can return the loan amount with proportionate APR and no additional penalties. This provision tackles predatory lending practices where borrowers were trapped in high-interest loans without time to evaluate the terms. The duration of the cooling-off period is set by each RE's board, but it must be clearly communicated to the borrower in the KFS and loan agreement.

FLDG (First Loss Default Guarantee) Norms

The FLDG framework, introduced by RBI on June 8, 2023, governs guarantee arrangements between REs and their LSP/DLA partners. An FLDG is a guarantee provided by an LSP or DLA to the RE, promising to compensate the RE for a portion of defaults on the loan portfolio sourced by the LSP/DLA. The key rules:

• 5% cap: The total FLDG from an LSP/DLA cannot exceed 5% of the outstanding loan portfolio sourced by that entity, or 5% of the incremental portfolio in the case of new arrangements
• Acceptable forms: FLDG must be in the form of cash deposits, fixed deposits with the RE's bank, or bank guarantees. No other form (equity pledge, future revenue commitments) is permitted
• Invocation timeline: The FLDG must be invoked within 120 days of the loan becoming overdue (NPA classification)
• Disclosure: The existence and terms of the FLDG arrangement must be disclosed to borrowers
• Board approval: The RE's board must approve the FLDG policy, and each arrangement must be reviewed periodically

Technology and Data Requirements

Building a compliant digital lending platform is not just about the front-end app. The back-end infrastructure must meet specific RBI requirements on data handling, storage, and security. Cutting corners on technology compliance is one of the most common reasons RBI rejects NBFC applications or penalizes existing operators.

Data Localization

All data generated, processed, or stored in connection with digital lending operations must reside within India. This applies to customer personal data, KYC records, transaction data, loan performance data, and credit assessment data. Cloud infrastructure must use servers physically located in India. If you use a global cloud provider (AWS, Azure, GCP), ensure your instances are deployed in Indian data centre regions (Mumbai, Hyderabad). Cross-border data sharing, even for analytics, is restricted without explicit regulatory approval.

No Third-Party Data Access

The DLA or LSP cannot share borrower data with any third party beyond what is strictly necessary for the lending process. Data collected for credit assessment cannot be repurposed for marketing, advertising, or selling to data brokers. Borrower data cannot be retained after the loan is fully repaid and the borrower requests deletion. Any data sharing with third parties (such as credit bureaus or insurance partners) requires separate, explicit consent from the borrower.

App Permissions and Device Access

This is where many lending apps have historically violated norms. RBI's guidelines explicitly limit DLA permissions to three categories: camera (for document scanning and selfie verification), microphone (for V-CIP or voice recording during consent), and location (for address verification). Accessing phone contacts, call logs, SMS, photo gallery, file storage, or any other device data is prohibited. Apps must request permissions only when needed for a specific function, and borrowers must have the ability to revoke permissions without affecting their loan status.

IT Security Standards

Digital lending platforms should implement ISO 27001 certification for information security management. Additional requirements include: data encryption at rest and in transit (AES-256 or equivalent), secure API integrations with banking partners, multi-factor authentication for app access, regular vulnerability assessments and penetration testing (at least annually), and incident response plans for data breaches. RBI expects REs to audit the IT security of their LSP and DLA partners before onboarding and periodically thereafter.

How to Start a Digital Lending Business in India: Step-by-Step

Here is the complete roadmap from idea to launch, covering both the regulatory and operational steps. The path differs based on whether you are building an NBFC or operating as an LSP, but the first three steps are common to both.

1. Choose your business model: Decide between operating as an NBFC (own balance sheet lending), NBFC-P2P (marketplace lending), or LSP (facilitation model). This choice determines your capital requirement, timeline, and revenue structure.
2. Incorporate a Private Limited Company: RBI issues licences only to companies incorporated under the Companies Act, 2013. Register a Private Limited Company with financial services as the main object in the MoA. Cost: ₹6,000 to ₹15,000. Timeline: 7 to 15 working days.
3. Apply for Startup India recognition: Register on the Startup India portal for tax benefits under Section 80-IAC, self-certification compliance, and access to the Fund of Funds. Timeline: 2 to 5 working days.
4. Build capital (for NBFC route): Raise ₹2 crore as equity to meet the NOF requirement. This must be in place before filing the RBI application. For the LSP route, there is no minimum capital requirement, but you will need working capital for technology and operations.
5. Apply for NBFC registration with RBI: Submit the application through the RBI COSMOS portal with all documents, business plan, and NOF certificate. Timeline: 3 to 6 months for RBI approval.
6. Build the technology platform: Develop or procure the lending platform (borrower app, lender dashboard, credit scoring engine, KYC module, disbursal and repayment integration). Ensure compliance with data localization and app permission restrictions. Timeline: 3 to 6 months.
7. Set up KYC and AML infrastructure: Integrate with UIDAI for Aadhaar e-KYC, implement Video-KYC, set up PAN verification, and establish transaction monitoring systems for STR reporting to FIU-IND.
8. Register for GST: Apply for GST registration before commencing operations. Lending facilitation services attract 18% GST. Timeline: 3 to 7 working days.
9. Draft compliance policies: Create your Fair Practices Code, KYC/AML policy, data privacy policy, grievance redressal mechanism, and FLDG policy (if applicable). These must be board-approved.
10. Partner with banking institutions: Open an escrow account (mandatory for NBFC-P2P), set up disbursal and collection channels through banking partners, and integrate with credit bureaus (CIBIL, Equifax, Experian, CRIF) for credit reporting.
11. Launch and monitor: Go live with a soft launch, monitor compliance metrics, track KFS delivery rates, ensure cooling-off period adherence, and submit regulatory returns to RBI as required.

Cost Breakdown: Starting a Digital Lending Business

The total investment varies dramatically based on your business model. Here is a detailed cost comparison between the three primary routes.

The LSP route is where most fintech startups begin. It lets you build a lending product, prove your credit model, and generate revenue without the ₹2 crore capital lockup. Once you have demonstrated traction and built a loan book track record, applying for your own NBFC licence becomes a stronger application because RBI can see real portfolio performance.

Penalties for Non-Compliance

RBI has significantly increased its enforcement activity against non-compliant digital lenders. In 2024-25 alone, RBI took action against multiple NBFCs and issued warnings to several unregistered lending apps. Understanding the penalty structure helps you appreciate why compliance is not optional.

Digital Lending vs Traditional Lending: Comparison

For entrepreneurs evaluating whether to enter the digital lending space, here is how it stacks up against the traditional bank lending model across every key parameter.

FLDG Guidelines: The 5% Rule Explained

The FLDG framework deserves its own section because it is the revenue backbone of many LSP business models. Before the June 2023 circular, there was no cap on FLDG, and some LSPs were providing 100% guarantees to REs, effectively bearing all the credit risk while the RE earned risk-free interest income. RBI viewed this as a regulatory arbitrage that undermined the spirit of lending norms.

How FLDG Works in Practice

Suppose your LSP sources a loan portfolio of ₹10 crore for an NBFC partner. Under the 5% cap, you can provide a maximum FLDG of ₹50 lakh. This ₹50 lakh must be deposited as cash or fixed deposit with the NBFC or backed by a bank guarantee. If ₹30 lakh of loans from your sourced portfolio become NPAs, the NBFC invokes the FLDG and recovers ₹30 lakh from your deposit. Your remaining FLDG balance is ₹20 lakh. You cannot source new loans under the FLDG arrangement until the balance is replenished to the required level.

FLDG Impact on LSP Business Models

The 5% cap fundamentally changed LSP economics. Before the cap, many LSPs charged low fees to REs but provided high FLDG, earning through the spread between interest income and default costs. Now, LSPs must focus on credit quality rather than guarantees. This has pushed the industry toward better underwriting models and genuine risk sharing rather than risk transfer.

Recent Updates and 2026 Outlook

The digital lending regulatory framework continues to evolve. Here are the key developments that will shape the industry in 2026 and beyond.

What Changed in 2024-25

• SRO for fintech: RBI approved the Fintech Association for Consumer Empowerment (FACE) as the Self-Regulatory Organization for fintechs, specifically covering digital lending. SRO membership is expected to become a best practice, if not mandatory, for LSPs.
• Increased NOF for NBFCs: The minimum NOF for new NBFC registrations was increased to ₹2 crore, raising the entry barrier for small-ticket digital lenders.
• Lending app crackdown: Google Play and Apple App Store removed thousands of non-compliant lending apps in coordination with RBI and MeitY.
• DPDP Act enforcement: The Data Protection Board started operationalizing, and digital lending businesses are among the first sectors expected to face scrutiny.

What to Expect in 2026

• Tighter LSP regulation: RBI is expected to introduce a formal registration or accreditation framework for LSPs, moving beyond the current self-regulation model.
• UPI lending integration: Pre-approved credit lines on UPI are expanding, creating new opportunities for NBFCs and their LSP partners to deliver instant credit at the point of transaction.
• Account Aggregator ecosystem maturity: The AA framework is enabling cash flow-based lending, reducing reliance on credit bureau scores and potentially opening the market to borrowers with thin credit files.
• Climate and green lending: RBI has signaled interest in frameworks for green digital lending, which could create new product categories for lending platforms focused on sustainable finance.

Digital Lending Compliance Checklist for 2026

Use this checklist before launching your digital lending operations. Every item on this list is derived from current RBI guidelines and applicable laws.

Choosing the Right Entity Structure for Digital Lending

Entity selection is not a formality for digital lending businesses. It determines what licences you can apply for, how you raise capital, and your compliance obligations going forward.

Private Limited Company (Recommended)

A Private Limited Company is the only viable option for any digital lending business that plans to apply for an NBFC licence. RBI does not issue lending licences to LLPs, partnerships, or sole proprietorships. Beyond regulatory eligibility, a Pvt Ltd structure enables equity fundraising, ESOPs for the tech team, and structured governance that investors and banking partners expect.

LLP or Partnership (Limited Use)

An LLP can work if you are building a pure technology or consulting business that supports digital lending (such as a credit scoring algorithm provider or a compliance tools vendor) but does not itself participate in lending, loan processing, or borrower-facing operations. The moment your business model touches lending activities, you need a company structure.

Summary

Starting a digital lending business in India in 2026 requires navigating a well-defined regulatory framework centred on the RBI Digital Lending Guidelines of September 2022 and the FLDG norms of June 2023. The three routes available are NBFC registration (₹2 crore NOF, own balance sheet lending), NBFC-P2P registration (₹2 crore NOF, marketplace model), or LSP partnership (no minimum capital, facilitation model). Regardless of the route, data privacy, transparent pricing through the Key Fact Statement, and borrower protection through the cooling-off period are non-negotiable compliance requirements. The first step for every digital lending founder is incorporating a Private Limited Company and building a clear, realistic business plan before approaching RBI or potential RE partners.