RBI’s Digital Lending Guidelines: What Changed Since 2022
Lenders and NBFCs that built compliance frameworks on RBI’s 2022 Digital Lending Guidelines are now referencing a formally repealed set of rules. The RBI (Digital Lending) Directions, 2025, issued on 8 May 2025, replaced those guidelines along with two other circulars, added new structural requirements for borrower protection, and tightened data obligations with measurable deadlines. Precisa’s automated bank statement analysis tools are built for precisely this compliance environment, where dated, accurate regulatory alignment matters more than generic adherence. This article maps each material change so that compliance teams can identify gaps precisely.
In this article:
- What did RBI’s original 2022 Digital Lending Guidelines actually require?
- What’s new in the RBI (Digital Lending) Directions, 2025 and which circulars did it repeal?
- 2022 vs. 2025 at a glance: what changed for lenders and borrowers
- What does RBI’s new FREE-AI framework mean for AI-driven lending tools like automated bank statement analysis?
- What should lenders, NBFCs, and DSAs do differently under the 2025 rules?
Consider a VP Lending at a mid-sized NBFC whose internal compliance team recently flagged an issue with a data vendor contract. They cited the 2022 RBI Digital Lending Guidelines as the reference standard. The citation was accurate in 2022. In 2025, it is not. The exact circular the guidelines were built on, RBI/2022-23/111 dated 2 September 2022, is listed in Annex III of the RBI (Digital Lending) Directions, 2025 as one of three formally repealed instruments. Precisa works with lenders navigating precisely this kind of regulatory update, where a document that was authoritative yesterday has since been consolidated into a different framework with materially different provisions.
In short, the 2022 guidelines no longer exist as a standalone instrument. The RBI (Digital Lending) Directions, 2025 consolidated three circulars into one framework and introduced requirements that were absent in 2022. Banks, NBFCs, lending service providers (LSPs), and digital lending apps (DLAs) operating in India now operate under this 2025 framework, not its predecessors.
What did RBI’s original 2022 Digital Lending Guidelines actually require?
The 2022 guidelines established the first regulatory floor for digital lending operations in India. The core provisions covered four areas.
1. Data collection and consent
Lenders and their LSPs could collect borrower data only on a need basis. Explicit consent was required in writing. One-time access permissions for device features (camera, contacts, location) were prohibited. Apps could not request persistent access.
2. Key Fact Statement
Every borrower had to receive a standardised Key Fact Statement before signing a loan agreement. It had to disclose the annual percentage rate, all fees and charges, the grievance redressal mechanism, and the lender’s name.
3. Data storage
All borrower data collected during the lending process had to be stored in India. This requirement applied to both the lender and any LSP acting on its behalf.
4. LSP accountability
Regulated entities, banks and NBFCs, retained full regulatory accountability for their LSPs. The 2022 guidelines made explicit that outsourcing the lending process to a digital platform did not transfer compliance responsibility.
These provisions were significant at their time. What the 2022 framework did not address: multi-lender aggregator dynamics, a formal cooling-off right post-disbursement, or the rapidly expanding use of AI-driven decisioning tools in the lending workflow.
What’s new in the RBI (Digital Lending) Directions, 2025 and which circulars did it repeal?
On 8 May 2025, RBI issued the RBI (Digital Lending) Directions, 2025 under reference RBI/2025-26/36 DOR.STR.REC.19/21.07.001/2025-26. The preamble states that the Directions “consolidate the earlier instructions along with certain new measures.” Annex III of the same document lists three circulars formally repealed upon issuance:
- RBI/2019-20/258, 24 June 2020: Loans sourced by banks and NBFCs over digital lending platforms (the original outsourcing circular)
- RBI/2022-23/111, 02 September 2022: Guidelines on Digital Lending (the 2022 guidelines)
- RBI/2023-24/41, 08 June 2023: Guidelines on Default Loss Guarantee (DLG) in Digital Lending
The Directions did not amend these circulars. They repealed them. Three separate regulatory instruments, spanning a five-year arc of digital lending policy, were replaced by a single consolidated framework. This is the specific repeal chain that the December 2022 post on RBI’s digital lending data privacy guidelines could not have anticipated, and which no existing content in Precisa’s blog has yet addressed.
Key new or materially changed provisions include:
1. 24-hour overseas data repatriation
The 2022 rule required Indian storage. The 2025 Directions add a specific enforcement mechanic: data processed outside India must be deleted from foreign servers and repatriated to India within 24 hours. Vendors or cloud infrastructure processing borrower data offshore need updated contractual timelines to reflect this requirement.
2. Mandatory cooling-off period
Borrowers now have a formal statutory right to exit a digital loan within a prescribed period after disbursement, subject to repayment of principal and proportionate interest. This protection did not exist in the 2022 framework.
3. Multi-lender LSP neutral presentation (effective 1 November 2025)
Aggregator platforms and loan marketplaces must present offers from all lenders that participated in a borrower’s application, including those that declined. Biased or deceptive UI design favouring one lender is prohibited.
4. DLA CIMS portal registration (deadline 15 June 2025)
Every regulated entity must register its digital lending apps on RBI’s Centralised Information Management System portal, creating a public directory. Unregistered apps cannot legally operate. Lenders who missed this deadline should confirm their DLA registration status as a matter of priority.
5. DLG formalised
The Default Loss Guarantee structure, previously a separate circular, is now absorbed into the main framework with defined caps, NPA recognition rules, and eligibility criteria. Lenders offering DLG arrangements need to verify their existing structures against the 2025 provisions.
2022 vs. 2025 at a glance: what changed for lenders and borrowers
| Provision | 2022 Rules | 2025 Directions |
|---|---|---|
| Data storage rule | Must be stored in India | Overseas-processed data repatriated within 24 hours |
| Cooling-off period | Not required | Mandatory post-disbursement |
| Multi-lender presentation | Not addressed | Neutral presentation required from 1 Nov 2025 |
| DLG structuring | Separate 2023 circular | Absorbed into main framework with defined caps |
| DLA registration | Not required | Mandatory CIMS portal reporting by 15 Jun 2025 |
| AI governance | Not addressed | FREE-AI framework signals regulatory direction (non-binding) |
The 2022 framework was primarily disclosure-era regulation: it required what information lenders must share and what data they could collect. The 2025 Directions are structural: they shape how digital lending workflows must be designed and operated.
What does RBI’s new FREE-AI framework mean for AI-driven lending tools like automated bank statement analysis?
In August 2025, RBI’s FREE-AI Committee published its report: the financial sector’s first RBI-commissioned framework addressing AI-driven decisioning in financial services. The report sets seven guiding principles (called “sutras”) and 26 recommendations across six governance pillars: Infrastructure, Policy, Capacity, Governance, Protection, and Assurance. The full report is available from the RBI FREE-AI Committee, 13 August 2025.
One clarification is critical: the FREE-AI report is a recommendations framework, not binding Directions. Its 26 recommendations carry no immediate legal force equivalent to the May 2025 Directions. Regulated entities are not currently required to comply with these recommendations as a matter of law. However, the ASSOCHAM BFSI E-Bulletin, February 2025 documented RBI’s broader shift toward principle-based, risk-proportionate oversight of digital financial services, including the consolidation of digital lending rules and the AA framework under India’s layered regulatory infrastructure. The FREE-AI report is the clearest signal yet of where RBI intends to go next on the AI governance layer.
The relevance for automated bank statement analysis is direct. When a lender uses Precisa’s platform to process a borrower’s transaction history and generate a creditworthiness signal, it is operating exactly the kind of AI-driven financial decisioning the FREE-AI framework addresses. A 2025 BCG study cited by CNBC-TV18 found that 54% of Indian companies cite regulatory challenges as a barrier to AI implementation. For lenders using AI-driven bank statement analysis, the practical posture is to build AI governance documentation now, while it is voluntary, rather than after it becomes mandatory.
The account aggregator framework and its implications for lenders provides a practical reference for how auditable, consent-based data flows are already documented under current AA rules: the same documentation discipline applies to AI governance readiness.
What should lenders, NBFCs, and DSAs do differently under the 2025 rules?
Several of the 2025 Directions’ provisions had hard deadlines. The DLA CIMS portal registration deadline passed on 15 June 2025. Multi-lender neutral-presentation rules for LSPs and aggregators took effect on 1 November 2025. For compliance teams reviewing their position now, the action list runs as follows.
1. Review all LSP agreements
Contracts drafted against the 2022 guidelines need revision to reflect the 24-hour data repatriation requirement, the neutral-presentation obligation for aggregator platforms, and the formal cooling-off mechanics.
2. Verify DLA registration on the CIMS portal
Every digital lending app a regulated entity operates must appear in the registry. Non-registration after the 15 June 2025 deadline is a compliance exposure that requires immediate resolution.
3. Audit overseas data processing arrangements
Vendors or cloud infrastructure that process borrower data outside India must guarantee deletion and repatriation within 24 hours. Contracts that predate May 2025 almost certainly do not include this clause.
4. Build an AI governance documentation baseline
The FREE-AI framework is advisory today. Documenting the inputs, outputs, and override procedures for AI-driven tools like automated bank statement analysis creates a defensible record for when that changes. How Precisa Safeguards Sensitive Financial Data describes the data governance architecture Precisa applies, which provides a template for this kind of documentation.
Review compliance-facing content on the lender’s own site: Any marketing pages, FAQ sections, or blog posts that cite the 2022 guidelines as current compliance guidance should be updated or annotated. The Unified Lending Interface and its relationship to the digital lending compliance framework provides additional context on adjacent regulatory infrastructure under the current 2025 framework.
Frequently Asked Questions
1. Do instant personal loan apps in India actually have to follow RBI guidelines?
Yes. Any lending app operating on behalf of a bank or NBFC qualifies as a Digital Lending App (DLA) under the 2025 Directions and must be registered on the CIMS portal by the regulated entity it serves. The bank or NBFC is fully responsible for ensuring its DLAs comply. An app that is not registered cannot legally facilitate loans through a regulated lender.
2. What happens if a lender doesn’t comply with RBI’s digital lending guidelines?
RBI has imposed financial penalties for non-compliance with digital lending guidelines in prior enforcement actions, including against large NBFCs. Under the 2025 Directions, violations can attract monetary penalties under the RBI Act and cancellation of DLA registration. The public CIMS registry also creates reputational exposure: borrowers and partners can check whether a lender’s apps are registered.
3. How can a borrower complain to RBI about a digital lending app?
Borrowers can raise complaints through the RBI Integrated Ombudsman Scheme if a grievance is not resolved by the regulated lender within 30 days. The CIMS portal also enables borrowers to verify whether an app is registered with RBI before agreeing to a loan, giving them a verification step before they transact.
4. What is the DLA CIMS portal and why do lenders need to register?
The Centralised Information Management System (CIMS) portal is RBI’s public registry of authorised digital lending apps. Regulated entities must report every DLA they operate, including name, platform details, and the lender on whose behalf it operates. Registration creates transparency for borrowers and gives RBI real-time visibility into the digital lending ecosystem for targeted oversight.
5. Does RBI’s FREE-AI framework apply to all NBFC lending tools?
The FREE-AI Committee report (August 2025) is a recommendations framework, not a binding regulatory instrument. Its 26 recommendations address AI tools used in financial decisioning broadly, including automated bank statement analysis. Regulated entities are not currently required to comply with these recommendations. The framework signals the direction RBI is moving on AI governance in financial services, and lenders that document AI governance practices now will be better positioned if and when the recommendations translate into formal requirements.
Compliance frameworks written in 2022 do not automatically age into 2025. The RBI (Digital Lending) Directions, 2025 are the operative regulatory instrument, and their specific requirements, a 24-hour data repatriation deadline, mandatory cooling-off periods, DLA registration, and the structural shift in multi-lender presentation rules, require active review rather than assumed continuity. Precisa’s bank statement analysis platform is designed to help lenders maintain alignment with RBI’s current requirements as the regulatory framework evolves. Compliance and lending operations teams can connect with Precisa to discuss how their workflows map to the 2025 Directions.
