Lending acquisition glossary (CPA, CPD, EPC)

Terms are grouped by topic, and most link to the page that covers them. Entries that describe RBI, Kazakhstan or platform rules summarise the cited texts as at October 2026 and may not reflect later changes. They are general information, not legal advice; lenders should take their own legal advice on how the rules apply to them. If a term your team uses is missing, tell us.

Commercial terms say what is paid for

CPL (cost per lead): A price paid for each lead delivered, whether or not the person is later approved or funded. The pricing models page compares it with outcome-based billing.
CPA (cost per acquisition): A price paid when an agreed acquisition event happens, such as a qualified application or an agreed partner outcome. Some partners read CPA as cost per action, so confirm which event is meant: the price only has meaning once the billable event is defined, and the pricing page sets out how CPA and CPD compare.
CPD (cost per disbursal): A price paid only when a loan is disbursed to the borrower. It moves billing to the end of the funnel, so the lender pays for funded loans rather than for applications.
EPC (earnings per click): The earnings a publisher or network makes per click sent, calculated as payout earned divided by clicks and used to compare traffic sources. A source can earn well per click and still send weak applicants, so read it next to quality metrics by source.
Billable event: The specific outcome that triggers a charge, such as a qualified application or a disbursed loan. CYBERTECH defines it together with the lender before launch, and the pricing page shows where each event sits in the funnel.
Qualified application: An application from an applicant who passed the checks and fits the lender's criteria for market and product. The lender keeps the final credit decision; how screening works describes the checks.
Validation window: The period after a billable event in which the lender can still check the event and reverse it if it proves invalid, for instance fraudulent or a duplicate; see pricing.
Cap: A limit on volume in a period, usually per day or month and set per market and product, counted in clicks, applications or billable outcomes. When a cap is reached, delivery throttles; see pricing and capacity updates by webhook.

Integration terms describe how data and outcomes move

Ping-post: A two-step lead sale: a ping sends partial lead data without personal details to several buyers, who answer with a bid or a rejection, and the complete lead (the post) goes to the winning buyer or buyers. A direct API, by contrast, sends the complete qualified application in one real-time POST.
S2S postback (server-to-server postback): A call from one server to another that reports an outcome, using the click ID the applicant arrived with. Because it runs between servers rather than through client-side data such as cookies or pixels, it does not depend on the applicant's browser; see postback integration.
Click ID: A unique identifier attached to a referral click and passed to the destination. The lender stores it and returns it unchanged in the postback, so each outcome matches the click it came from; see postback integration.
Sub-id: An identifier that names the traffic sub-source behind a click, such as a campaign or placement, so results can be compared below the partner level. CYBERTECH passes sub-ids through on referral traffic, and lead quality by source depends on them.
UTM parameters: Tags added to a landing URL, such as utm_source, utm_medium and utm_campaign, that identify the campaign a visit came from. Analytics tools read them from the URL, and CYBERTECH passes them through on referral traffic.
Idempotency key: A unique value the client sends with a request so the server can recognise a retry and avoid creating a duplicate. For a lead POST, it means a request that timed out can be sent again without creating a second application; see API integration.
Webhook: An HTTP POST that a system sends when an event occurs to an endpoint the receiver has set up and registered in advance. In the direct API, webhooks carry status and capacity updates.
Sandbox: A test environment with its own API keys, where both teams can exercise validation, errors and callbacks before any live applicant is sent. A sandbox and full field mapping come before go-live; see API integration.
Field mapping: The agreed table that links each field in the application payload to the matching field in the lender's schema, including formats and required values. It is settled before go-live as part of API integration.

Credit outcome terms measure what happens after handoff

Approval rate: The share of applications received from a source that a lender approves over a stated period. It reflects both applicant quality and the lender's own credit policy, so compare it by source rather than as one average.
Disbursal: The release of loan funds to the borrower after approval, and the stage at which a CPD is billed. Under RBI's digital lending rules (the Digital Lending Directions, 2025 and, for NBFCs, the NBFC Credit Facilities Directions, 2025), a regulated entity disburses into the borrower's own bank account, with listed exceptions, and not into a lending service provider's account; see India.
FPD (first-payment default): A loan on which the borrower misses the first scheduled repayment; the FPD rate is the share of disbursed loans that do. It is an early read on lead quality because it appears at the first instalment, and lenders set the cut-off, so state it when comparing FPD by source.
DPD (days past due): The number of days a payment is overdue, counted from its due date. Lenders group accounts into DPD buckets to track delinquency and to decide when a loan counts as a non-performing asset (NPA, defined below); see lead quality.
NPA (non-performing asset): A loan that the regulator's rules class as no longer performing. For applicable NBFCs in India, RBI sets the threshold at an overdue period of more than 90 days.

Regulatory terms define who lends and under which rules

Regulated entity (RE): A lender that a financial regulator supervises and holds to its rules, such as a bank, a non-banking financial company or a microfinance organisation. In RBI's digital lending rules the term covers commercial banks; primary (urban), state and central co-operative banks; non-banking financial companies including housing finance companies; and all-India financial institutions. The RE remains fully responsible for the acts of any lending service provider it uses; see India.
NBFC (non-banking financial company): A company registered under the Companies Act that does lending, leasing, hire-purchase or similar financial business as its principal business. Unless an exemption applies it needs an RBI certificate of registration, and unlike a bank it cannot accept demand deposits; see India.
LSP (lending service provider): In RBI's digital lending rules, an agent of a lender (including another lender) that carries out one or more of the lender's digital lending functions, or part of them, in customer acquisition, services incidental to underwriting and pricing, servicing, monitoring or recovery of a specific loan or loan portfolio. Whether a particular arrangement makes a provider an LSP depends on its facts and is a legal question for the lender and its advisers; see India.
DLA (digital lending app): A mobile or web-based application with a user interface that facilitates digital lending services, covering the lender's own apps and those run by an LSP on its behalf. Regulated entities report all DLAs, their own and their LSPs', to RBI's CIMS portal; see India.
DLG (default loss guarantee): A contractual arrangement under which another entity guarantees to compensate a lender for loss due to default, up to a percentage of its loan portfolio specified upfront; RBI also counts any implicit guarantee of a similar nature that is linked to the portfolio's performance and specified upfront. A lender may enter into one only with an LSP or another lender engaged as an LSP, and an LSP providing it must be incorporated as a company under India's Companies Act, 2013. Total cover may not exceed 5% of the amount disbursed from that portfolio at any given time; see India.
MFO (microfinance organisation): In Kazakhstan, a legal entity licensed to provide microloans: loans in the national currency to individuals or legal entities. Under Kazakhstan's credit bureau law, MFOs must supply credit information to the credit bureau with state participation; see Kazakhstan.
KYC (know your customer): The process of identifying and verifying a customer and any beneficial owner using reliable and independent sources, done when the relationship starts (RBI calls this customer due diligence). RBI's KYC directions bar an NBFC from outsourcing the decision on whether KYC norms are met, so screening before handoff does not replace the lender's own KYC; see how screening works.
KFS (Key Fact Statement): The loan-terms disclosure that RBI requires a lender to give a digital borrower. The lender issues it, and where a lending service provider shows offers from several lenders, that view must also link to each lender's Key Fact Statement; see India.
Credit bureau: A company that collects borrowers' repayment data from lenders and supplies it in credit reports. In India, RBI requires lending through digital lending apps to be reported to credit information companies irrespective of tenor. Lenders report at set intervals, so a new loan can take time to appear in a report; see loan stacking.

Fraud terms name the patterns lenders screen for

Loan stacking: Applying for or drawing several loans from different lenders in a short window, before the new loans show in credit bureau records, so no lender sees the full exposure. No single control closes the gap: bureau enquiries, a lookback on your own applicants and a velocity check each catch part of it, and cross-lender stacking is visible only where data is shared; see loan stacking.
Device farm: A set of phones, real or virtual, operated together, often by hand, so the activity looks like that of many users. Genuine devices can pass device-integrity attestation, since Play Integrity's MEETS_DEVICE_INTEGRITY verdict means the app runs on a genuine and certified Android device, so signals are read together; see device farms and emulators.
Emulator: Software that simulates a phone on a computer, built for app testing. One computer can run many virtual devices, so an emulator can pose as the phones of separate applicants. Google's Play Integrity API returns an empty device verdict for an app on an emulator that does not pass Google's checks; see emulators and device farms.
Velocity check: A check that counts how often the same device, phone number or IP address appears in applications within a set time, and flags counts above a threshold. A high count rarely decides alone; it is read with device, network and identity signals, as described under velocity and behaviour signals.
Incentivised traffic: Traffic from users who were offered money, goods or the equivalent in exchange for an action, such as installing an app or opening a form. Google Play's 2017 policy post applies the same test to ratings, reviews and installs, and its current policy prohibits incentivised ratings and reviews and the manipulation of install counts; see incentivised traffic.
Synthetic identity: A person invented by combining pieces of personal information. The Federal Reserve's industry-recommended definition of synthetic identity fraud is the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain; see recycled and synthetic identities.
Recycled identity: The same person, or someone else using the same identity details, applying again with some details repeated, such as name and birth date, a document, phone or email, and others changed. It reads as a new applicant until it is linked to the earlier one, so duplicate detection compares each application with earlier ones; see recycled identities.

How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.
Loan leads reach you by referral or by direct APIReferral with a server-to-server postback and a direct API deliver the same screened applicants; this page helps you choose and walks through a launch.
Loan application fraud and low-intent traffic in six guidesSix guides to the fraud patterns and low-intent traffic that cost lenders money in paid acquisition, and how to measure source quality.
Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.

Lending acquisition glossary, from CPA and CPD to DLG and DPD

Commercial terms say what is paid for

Integration terms describe how data and outcomes move

Credit outcome terms measure what happens after handoff

Regulatory terms define who lends and under which rules

Fraud terms name the patterns lenders screen for

Sources

Discuss your market

Lending acquisition glossary, from CPA and CPD to DLG and DPD

Commercial terms say what is paid for

Integration terms describe how data and outcomes move

Credit outcome terms measure what happens after handoff

Regulatory terms define who lends and under which rules

Fraud terms name the patterns lenders screen for

Related guides

Sources

Discuss your market