RBI holds the lender responsible for its lending service providers
The Reserve Bank of India (Digital Lending) Directions, 2025 (RBI/2025-26/36), issued on 8 May 2025, apply to banks, non-banking financial companies (NBFCs) and all-India financial institutions. For most NBFCs RBI restated them on 28 November 2025 as Chapter III of its NBFC Credit Facilities Directions, 2025 (RBI/DOR/2025-26/347), updated on 15 July 2026.
The rules bind the regulated entity, such as a bank or an NBFC, and reach partners through its contract: the lender stays fully responsible and liable for all acts and omissions of its LSP. An LSP is an agent that carries out the lender's digital lending functions in customer acquisition, services incidental to underwriting and pricing, servicing, monitoring or recovery. A DLA is a mobile or web application for digital lending, including apps run by an LSP.
Customer acquisition is on that list. Whether a partner is an LSP turns on the functions it carries out for the lender. The lender assesses this with its own counsel and records the outcome in the contract.
| Topic | What the NBFC chapter requires |
|---|---|
| Due diligence | A written contract sets out each party's roles, rights and obligations. Enhanced due diligence covers technical capability, data privacy, conduct and past record, and periodic review follows (para 6). |
| Several lenders | An LSP working with several lenders shows all matching offers, names the lenders that did not match, applies one documented approach to similar borrowers and avoids dark patterns (para 7). Applied from 1 November 2025 under the Digital Lending Directions. |
| Disclosures | The lender's website lists its digital lending products, DLAs, LSPs and what each LSP does, and DLAs and LSPs link back to it. Borrowers receive a Key Fact Statement. Nodal grievance redressal officers, named by the lender and by any LSP that deals with borrowers, are displayed on their websites, on the DLA and in the Key Fact Statement (paras 9 and 12). |
| Fees and funds | The lender pays LSP fees directly and the LSP does not charge borrowers separately. Disbursal goes to the borrower's bank account, with narrow exceptions such as co-lending flows, and never to an LSP's account. Repayment goes straight to the lender and no third party controls the flow of funds, apart from cash recovery of delinquent loans (para 10). |
| Data | Collection is need-based, with prior explicit consent and an audit trail. Apps stay out of files, contacts and call logs; one-time camera, microphone or location access for onboarding or KYC needs explicit consent. LSPs hold minimal borrower data. Data is stored on servers in India, and data processed abroad is deleted there and returned within 24 hours (paras 13 and 14). |
| Credit reporting | The lender reports lending done through its own DLAs or an LSP's DLAs to credit information companies, whatever its nature or tenor (para 17). Bureau reporting timetables are covered under loan stacking. |
| App directory | The lender reports every DLA on RBI's Centralised Information Management System (CIMS) portal. RBI publishes entries without verifying them, and a listing is not RBI registration or endorsement (para 18). |
The DPDP Act adds a second layer, phased in until 2027
The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) were notified in the Gazette of 13 November 2025 under the Digital Personal Data Protection Act, 2023. Consent manager provisions apply from 13 November 2026, and the duties on notice, consent, security, breach intimation and erasure from 13 May 2027 (G.S.R. 843(E)). Check for later amendments.
- Where consent is the basis, it must be free, specific, informed, unconditional and unambiguous, and limited to the data needed for the stated purpose (section 6). RBI separately requires prior explicit consent for data collected through lender apps (para 13).
- A Data Fiduciary, the party that decides why and how personal data is processed, answers for processing done on its behalf by a Data Processor and may use one only under a valid contract. A partner that decides what applicant data it collects and why may be a Data Fiduciary itself (sections 2 and 8).
- Minimum security safeguards include encryption, masking or virtual tokens, access controls, one year of logs and personal data unless another law requires otherwise, and safeguard terms in the processor contract (Rule 6).
- After a breach, the Data Fiduciary tells affected people and the Data Protection Board without delay, and gives the Board detailed information within 72 hours, or longer if the Board allows (Rule 7).
- Data is erased when consent is withdrawn or the purpose ends, unless a law requires retention (section 8).
The Act also reaches processing outside India for offering services in India (section 3), so read it with the RBI storage rule.
A lender's contract with an acquisition partner should settle eight points
Most points follow from the rules above and the NBFC outsourcing Directions; the outcomes point is commercial. This list is for the lender and its counsel, not a statement of what RBI requires of every partner.
- Scope: the functions the partner performs, the lender's written assessment against the LSP definition, and the credit decision and disbursal that stay with the lender.
- Oversight: due diligence evidence, periodic review, and the audit rights, subcontractor consent, RBI access to records and RBI inspection of the partner that the outsourcing Directions list as key provisions (para 34).
- Offshore: where the partner is outside India, the governing law, records available to the lender and RBI, original records kept in India, and other offshore terms (para 53).
- Fees: outcome fees billed to the lender, nothing charged to the borrower. Have counsel read any clawback or repayment-linked adjustment against the default loss guarantee rules: an implicit guarantee linked to portfolio performance counts as a DLG, only an LSP or a lender engaged as one may provide it, an LSP must be a company incorporated under the Companies Act, 2013, and cover is capped at 5% of the amount disbursed from the portfolio (Chapter III, paras 4, 19 and 24).
- Data: the fields exchanged and why, who is Data Fiduciary and who is Data Processor, consent records, retention and deletion, breach timings and where data may be stored.
- Disclosure: if the partner is classed as an LSP, the lender's website names it, its role and any app it runs, the partner's website and apps link back, and its nodal grievance redressal officer is displayed prominently.
- Outcomes: the billable event, validation window and postback fields, set before launch. See pricing and the postback guide.
- Exit: data return or deletion, preserved records and confidentiality that continues after the contract ends (para 34).
This is general information about rules published as at 29 October 2026, not legal advice, so check the current texts with counsel.
CYBERTECH screens Indian applicants and the lender decides on credit
CYBERTECH provides borrower acquisition for lenders in India. It is not a lender and not a bank partner. Supply varies by product, and each launch is confirmed market by market. Company details are on the about page.
The lender defines the product criteria and capacity, for instance serviceable PIN codes, and keeps the final credit decision. Applicants are screened against those rules before handoff in five checks: device integrity, network, identity, behaviour and velocity, and fit to the lender's criteria. Signals are read together and none decides alone. See how screening works. Whether a given arrangement with CYBERTECH makes it an LSP is for the lender to settle with its own counsel.
Delivery options are on the integration page. Pricing is CPA on a qualified application or an agreed partner outcome, or CPD on a disbursed loan, with the billable event defined together before launch; see pricing. To start, discuss an India launch.
Related guides
- Loan leads reach you by referral or by direct APIReferral with a server-to-server postback and a direct API deliver the same screened applicants; this page helps you choose and walks through a launch.
- Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.
- How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.
- Loan stacking works in the gap before a bureau record existsHow one borrower takes loans from several lenders before bureau records update, how it shows, and which controls shorten the blind spot.
Sources
- Reserve Bank of India: Digital Lending Directions, 2025, RBI/2025-26/36 (2025)
- Reserve Bank of India: NBFC Credit Facilities Directions, 2025, Chapter III Digital Lending (2025, updated 2026)
- Reserve Bank of India: NBFC Managing Risks in Outsourcing Directions, 2025 (2025)
- Reserve Bank of India: Press Release 2025-2026/1588, consolidated Master Directions (2025)
- Government of India: Digital Personal Data Protection Act, 2023 (2023)
- MeitY: Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (2025)
- MeitY: G.S.R. 843(E), commencement of the DPDP Act provisions (2025)