RBI Digital Lending Directions 2025: 10 Borrower Rights Every App User Should Know

In May 2025, the RBI consolidated years of piecemeal digital-lending regulation — the 2022 guidelines, the default-loss-guarantee rules, the Key Fact Statement framework — into one rulebook: the Reserve Bank of India (Digital Lending) Directions, 2025. If you borrow through any app in India, this document is your bill of rights. Lenders and their service providers have compliance teams that know it line by line; this guide is the borrower's side of that asymmetry.

First, the cast of characters, because every right below hangs on these definitions:

• RE (Regulated Entity): the bank or RBI-registered NBFC actually lending the money. Only REs are regulated by RBI — an app itself is never "approved by RBI"; it is operated by, or partnered with, an RBI-registered lender.
• LSP (Lending Service Provider): an agent of the RE — the platform doing sourcing, comparison, or servicing. KredBaba is an LSP: we help you find and compare lenders' products; we never lend, hold funds, or collect repayments. The Directions exist substantially to police the RE–LSP boundary in your favour.
• DLA (Digital Lending App): the app itself — the RE's or the LSP's glass over the RE's loan.

Now the ten rights that matter most in practice.

1. The right to know who is actually lending to you

The RE's identity must be disclosed to you up front — in the app, in the loan documents, in the KFS. REs must publish, on their own websites, the lists of their DLAs and LSPs, and RBI now maintains a directory of DLAs reported by REs (a reporting record, not an endorsement). If you cannot trace an app to a named RE, you are not in the regulated system at all — stop and verify before anything else.

2. The right to an unbiased digital view of offers (multi-lender platforms)

When an LSP works with multiple lenders — as comparison platforms do — the Directions require it to show you a digital view of all the offers that match you: the name of each lending RE, loan amount, tenor, APR, monthly obligation, penal charges, and a link to each KFS. The ranking mechanism must be consistent and disclosed, and the platform may not use dark patterns to push you toward a product that suits its commissions over your interests. In plain terms: a comparison site must actually compare, not funnel.

3. The right to a Key Fact Statement — and to pay nothing outside it

Before you execute any loan contract, you must receive a standardised KFS: sanctioned amount, every fee, the all-inclusive APR, the full repayment schedule, penal-charge terms, cooling-off period, and grievance contacts. The enforcement teeth: a charge not disclosed in the KFS cannot be collected from you at any stage of the loan's life. A "platform fee" that materialises at disbursal, an "extension charge" invented mid-loan — contestable, and winnably so. Read our KFS guide for the line-by-line.

4. The right to direct disbursal and direct repayment

Loan money must flow directly from the RE's bank account to yours, and repayments directly from you to the RE — no routing through the LSP's account, no third-party pool accounts, no wallets in the middle (narrow exceptions exist for things like co-lending between REs and statutory flows). Corollary: any fee owed to an LSP for its services is paid by the lender, not charged to you separately. If an app asks you to pay it — rather than the lender — anything at all, that alone tells you the arrangement violates the Directions or isn't a regulated loan.

5. The right to a cooling-off exit

Every digital loan carries a cooling-off / look-up period — minimum one day, set by the lender's board and stated in the KFS — during which you may exit by repaying the principal plus a proportionate APR-based cost for the days elapsed, with no penalty. On a ₹20,000 loan at 36% APR, exiting on day 2 costs about ₹39 over principal. It is the regulator's undo button for midnight borrowing; our cooling-off guide covers the mechanics and templates.

6. The right to data minimalism — no contacts, no call logs, no gallery

The Directions draw bright lines around your phone:

• DLAs cannot access your contact lists, call logs, or media/files. Full stop.
• Camera, microphone, location: one-time, need-based access only (e.g., live selfie for KYC), with your explicit consent.
• Data collection must be need-based, with your consent, and you retain the right to revoke consent and to require deletion of your data, subject to legal record-keeping.
• No biometric data may be stored by the app/LSP unless permitted under law.

An app demanding contacts access is announcing either non-compliance or fraud — treat it as a stop sign, and as evidence if things later go wrong (contact-scraping is the fuel of harassment rackets).

7. The right to a grievance process with a real clock

Both the RE and its LSP must prominently publish a Grievance Redressal Officer — name, contact — in the app and on websites. The RE remains fully responsible for its LSPs' conduct. The clock: if your complaint isn't resolved within 30 days, you may escalate to the RBI Ombudsman (cms.rbi.org.in — free, online). This 30-day SLA is what converts polite customer-service limbo into an enforceable path; date-stamp your first complaint accordingly.

8. The right to consent before any credit-limit change

No automatic increase in your credit limit without your explicit request/consent. The pre-2022 pattern — "congratulations, we've enhanced your limit", followed by nudges to draw it down — is banned. A limit change you didn't ask for is a reportable violation, not a favour.

9. The right to humane, identified recovery

Collections against digital loans must follow RBI's conduct framework: agents must be identified to you (the lender communicates recovery-agent details), calls confined to civil hours (8 am–7 pm under RBI's recovery-conduct norms), no abuse, no third-party disclosure of your debt, no intimidation. Penal charges, meanwhile, may be levied only on the overdue amount, must be reasonable, and cannot be capitalised into fresh interest. Violations are Ombudsman material — see our harassment guide for the full escalation ladder with evidence practice.

10. The right to a portfolio that isn't secretly guaranteed into recklessness

One structural right you never see but benefit from: the Directions cap default loss guarantees (DLG) — arrangements where an LSP promises to absorb a lender's losses — at 5% of the relevant portfolio, with disclosure requirements. Why you should care: uncapped DLG historically let unregulated platforms effectively lend with the RE as a rubber stamp, which is exactly the structure that produced the predatory-app era. The cap keeps the regulated lender's own money — and therefore its underwriting discipline — in the game.

The rights, mapped to action

Right	Where to verify	If violated
Named RE	App, KFS, RE website, RBI NBFC list	Don't borrow; report on Sachet
Digital view of offers	Comparison screen shows RE names + APRs + KFS links	Complain to LSP GRO → RE GRO
KFS before signing; no off-KFS charges	KFS document vs actual deductions	GRO → RBI Ombudsman
Direct disbursal/repayment	Bank narration shows RE's name	GRO → Ombudsman; Sachet if unregulated
Cooling-off exit	KFS cooling-off line	Written exit notice → Ombudsman
Data minimalism	App permission screen	Revoke, complain, cybercrime if abused
30-day grievance SLA	GRO details in app	cms.rbi.org.in after 30 days
No auto limit increase	Any unsolicited "limit enhanced"	GRO → Ombudsman
Recovery conduct	Agent identification, call hours	Evidence + GRO → Ombudsman; 1930 if criminal

The honest summary

The 2025 Directions did something rare: they made the borrower's version of events — who lent to me, what it costs, where my money and data went — the legally mandatory version. But rights in a PDF protect no one; rights exercised do. The practical trio to remember: read the KFS before signing, screenshot everything, and use the 30-day clock. Regulation ne aapko auzaar de diye hain — ab unhe uthana aapka kaam hai.