NBFC Digital Lending 2026: The Complete Compliance Guide

Digital lending has transformed how NBFCs reach borrowers. A loan that once took two weeks of paperwork can now be sanctioned in minutes through a mobile app. But speed without structure is exactly what the RBI has spent the last three years trying to fix.

On 8 May 2025, the RBI issued the Digital Lending Directions, 2025, a single consolidated framework that replaced all earlier guidelines on digital lending, the default loss guarantee framework, and outsourcing instructions for digital channels. For NBFCs running digital lending operations, either directly or through fintech partnerships, this is the definitive rulebook for 2026. It covers how you onboard customers, how funds must flow, how partners must be supervised, and what a borrower can do if something goes wrong.

Two provisions of the Directions took effect on later dates. The multi-lender LSP framework became operational on 1 November 2025, and all DLA reporting to the RBI's CIMS portal had to be completed by 15 June 2025. Both of these deadlines have passed. If your NBFC has not acted on them, you are already in breach.

The Three Pillars of the Digital Lending Framework: RE, LSP, and DLA

The Digital Lending Directions, 2025 organizes the entire digital lending ecosystem around three types of participants. Understanding who occupies which role, and what that role means for liability, is the foundation of compliance.

• A Regulated Entity is any institution licensed by the RBI to extend credit, including NBFCs and housing finance companies. The RE is the lender of record in every digital loan transaction. No matter how many technology partners, apps, or intermediaries sit between the borrower and the actual disbursement, the RE carries full legal and regulatory responsibility for everything that happens in the lending chain. This cannot be contracted away. An NBFC that allows an LSP to operate outside the RBI's guidelines is not protected by the fact that the LSP, not the NBFC, made the error.
• A Lending Service Provider is an agent engaged by the RE to perform one or more digital lending functions. These include customer acquisition, credit assessment support, loan servicing, monitoring, and recovery. A key clarification in the 2025 Directions is that an RE can also act as an LSP for another RE. Only entities directly involved in lending operations qualify as LSPs under the directions. Technology vendors who provide purely back-end infrastructure without touching borrower-facing lending functions fall under the general outsourcing framework rather than the LSP rules.
• A Digital Lending App is any mobile or web-based application used for the purpose of digital lending, whether owned by the RE or by an LSP engaged by the RE. Every single DLA must be registered on the RBI's Centralised Information Management System portal. The Chief Compliance Officer of the NBFC must certify that all DLA data submitted on the CIMS portal is accurate and that each DLA complies with applicable regulations.

LSP Obligations: What Your Fintech Partner Contract Must Contain in 2026

Every NBFC that works with an LSP must have a formal written contract that defines roles, rights, obligations, and responsibilities with precision. A vague partnership agreement or a revenue sharing arrangement without an explicit compliance framework is not adequate under the 2025 Directions.

• The contract must specify the exact digital lending functions the LSP is authorised to perform. Functions not listed in the contract cannot be performed by the LSP.
• The NBFC must conduct enhanced due diligence on every LSP before onboarding. This covers the LSP's technical capabilities, statutory compliance record, data privacy policies, data storage systems, and fairness in conduct with borrowers.
• The NBFC must establish a board-approved monitoring mechanism for loan portfolios originated through LSPs. This is not optional. It must be documented, approved by the board, and operated continuously.
• The NBFC must take corrective action against an LSP when deviations from contractual or regulatory requirements are found. Tolerating non-compliance by an LSP exposes the NBFC to direct regulatory liability.
• LSP fees must be paid by the NBFC, not deducted from the borrower. Under no circumstances can an LSP charge the borrower directly for services rendered on behalf of the NBFC.
• Recovery agents who are LSPs must comply with the RBI Responsible Business Conduct Directions, 2025. Cash recovery for delinquent loans is permitted only if the amount is credited to the RE's account on the same day.

Multi-Lender LSP Platforms: The New Framework Effective November 2025

One of the genuinely new additions in the 2025 Directions is a dedicated framework for LSPs that operate platforms connected to multiple REs. These are the aggregator-style fintech platforms where a borrower submits one application and receives loan offers from several lenders simultaneously. From 1 November 2025, these arrangements carry specific obligations that did not exist before.

When an LSP works with multiple REs on a shared platform, it must display a complete, unbiased list of all loan offers available to the borrower. The platform cannot structure its display to promote one RE's product over another's through hidden ranking systems, differential placements, or dark patterns. Every matched loan offer must clearly show the RE's name, the sanctioned amount, the loan tenor, the Annual Percentage Rate, the monthly repayment figure, applicable penal charges, and a direct link to the Key Fact Statement for that product.

The methodology used to match loan offers to borrowers must be documented and consistently applied. An LSP cannot use different matching criteria for similar borrowers in a way that benefits one RE partner. The principle is information parity for the borrower and structural fairness across all RE partners on the platform.

Borrower Protection: KFS, Cooling-Off Period, and Direct Fund Flows

The 2025 Directions strengthen borrower protection through three mechanisms that every NBFC must implement without exception.

The Key Fact Statement

Before any digital loan is finalised, the borrower must receive a Key Fact Statement that has been digitally signed and delivered via email or SMS. The KFS must show the Annual Percentage Rate, which captures all costs of the loan in a single comparable figure, the loan amount, tenor, repayment schedule, all applicable fees and charges, and information about the grievance redressal mechanism. The KFS must be provided in a simple, standardised format. It is not a marketing document. It is a disclosure tool, and it must be issued before the borrower accepts the loan, not after.

Cooling-Off Period

Every digital loan must include a cooling-off period during which the borrower can exit the loan without penalty. The length of this period is determined by the NBFC's board and must be disclosed in the KFS. The minimum is one day. During the cooling-off window, the borrower pays back only the principal and proportionate interest for the days the loan was outstanding, plus a one-time processing fee if the NBFC's board-approved policy allows it. No other penalty or charge can be levied.

Direct Fund Flows

All loan disbursements must go directly from the RE's bank account into the borrower's bank account. No disbursement can pass through an LSP's account or a pool account. All repayments must flow directly from the borrower to the RE's bank account, with no LSP intermediation. This rule eliminates the practice of LSPs holding funds in transit, which was a significant misuse risk in earlier digital lending arrangements.

Default Loss Guarantee in 2026: Tighter Rules, Fewer Eligible Structures

A Default Loss Guarantee is a contractual arrangement where an entity, typically the LSP, agrees to compensate the NBFC for a portion of losses on a defined loan portfolio in the event of default. The 2025 Directions tighten the DLG framework significantly and restrict the types of portfolios that can be covered.

DLG arrangements are permitted only with LSPs that are companies incorporated under the Companies Act, 2013. The NBFC must have a board-approved DLG policy before entering any such arrangement. DLG can be structured as cash deposited with the NBFC, a fixed deposit with a scheduled commercial bank with a lien marked in the NBFC's favour, or a bank guarantee in the NBFC's favour.

Three categories of portfolio are explicitly excluded from DLG coverage. Revolving credit facilities offered through digital lending channels, including credit card arrangements, cannot be covered by a DLG. Loans already covered under credit guarantee schemes managed through trust funds are excluded. And loans facilitated through NBFC-P2P platforms cannot carry DLG protection. These restrictions reduce the ability to use DLG structures as a way of manufacturing credit risk transfer without genuine capital backing.

Conclusion

Digital lending for NBFCs in 2026 operates under a framework that is more complete, more enforceable, and more borrower-centric than anything that existed before May 2025. The Digital Lending Directions, 2025 leave very little to interpretation. Every function in the lending chain is defined. Every participant carries defined obligations. Every borrower carries defined rights.

For NBFCs that operate digital lending programmes, the compliance priority in 2026 is not just about having the right policy documents. It is about ensuring that your LSP contracts reflect the 2025 Directions, that your DLAs are registered on CIMS, that your KFS is accurate and delivered before sanction, that fund flows are direct, and that your cooling-off period is genuinely available to borrowers. The RBI's supervisory approach now includes direct engagement with LSPs during NBFC audits. What your partners do is what you are responsible for.

Frequently Asked Questions

1, If an LSP makes a compliance error during customer onboarding, is the NBFC liable under the Digital Lending Directions, 2025?

Yes, completely. The Digital Lending Directions, 2025 state explicitly that even when lending functions are outsourced to an LSP, the Regulated Entity, which is the NBFC, remains fully responsible and liable for all acts and omissions of the LSP. The NBFC cannot shift regulatory liability to the LSP by contract. This means if an LSP collects data without proper consent, charges the borrower directly for fees that should have been paid by the NBFC, or fails to follow the KFS disclosure requirements, the RBI holds the NBFC accountable. This is why the directions require NBFCs to conduct enhanced due diligence on LSPs before onboarding, maintain board-approved monitoring mechanisms for LSP-originated portfolios, and take corrective action when deviations are found. An NBFC that discovers its LSP is non-compliant and does not act immediately is compounding its own regulatory risk, not reducing it.

2. What must an NBFC do if it operates on a multi-lender LSP platform and what changed on November 1, 2025?

The multi-lender LSP framework that became effective on November 1, 2025 introduced specific obligations for NBFCs that use platforms where an LSP works simultaneously with multiple regulated entities. Each NBFC on such a platform is individually responsible for ensuring that when loan offers are displayed to borrowers, the display is complete and unbiased. The platform must show all available loan options and cannot use ranking systems, placement preferences, or dark design patterns to promote one NBFC's product over another. Every matched offer must display the NBFC's name, the loan amount, tenor, Annual Percentage Rate, monthly repayment amount, penal charges, and a link to the Key Fact Statement. The matching methodology used by the platform must be documented, consistently applied, and available for regulatory scrutiny. NBFCs should ensure that their contracts with multi-lender LSP platforms specifically address these requirements and that the platform has provided evidence of its compliance with the November 2025 framework.

3. What are the restrictions on Default Loss Guarantee arrangements for NBFCs under the 2025 Directions?

Under the Digital Lending Directions, 2025, NBFCs can enter Default Loss Guarantee arrangements only with LSPs that are incorporated as companies under the Companies Act, 2013. The NBFC must have a board-approved DLG policy before entering any such arrangement, and the policy must cover the DLG provider's eligibility criteria, the monitoring process, and the fee structure. DLG can only be held in three permitted forms: cash deposited with the NBFC, a fixed deposit with a scheduled commercial bank with a lien marked in the NBFC's favour, or a bank guarantee in the NBFC's favour. Three portfolio categories are completely excluded from DLG coverage. Revolving credit facilities accessed through digital lending channels cannot be covered. Loans that are already backed by credit guarantee schemes managed through trust funds are excluded. And loans sourced or facilitated through NBFC-P2P platforms cannot have DLG protection. These exclusions limit the use of DLG structures as substitutes for capital by ensuring they apply only to genuinely term-based credit extended outside government guarantee schemes.