On 10 August 2022, the Reserve Bank of India released its Digital Lending Guidelines — one of the most significant regulatory interventions in Indian consumer finance in a decade. If you have ever borrowed from a digital lending app, these rules exist specifically to protect you. Here is what they actually say.
Who These Rules Apply To
The guidelines apply to all Regulated Entities (banks and NBFCs licensed by RBI) and their Lending Service Providers (LSPs) — the apps and fintech companies that partner with REs to originate loans. Illegal loan apps with no RE behind them are not covered, because they were already operating outside the law entirely.
The Key Fact Statement — Your Most Important Protection
Lenders must provide a Key Fact Statement before you accept a loan. The KFS must include: the Annual Percentage Rate (all-in cost including all fees), the total amount payable over the loan tenure, the cooling-off period, and contact details for the grievance officer. The APR must be expressed as a single annual percentage — no hiding costs in footnotes.
No Automatic Credit Limit Increases
Lenders cannot increase your credit limit without obtaining explicit consent from you. The practice of silently increasing credit limits on revolving credit products — which encourages over-borrowing — is now prohibited.
Recovery and Collection Rules
Digital lenders must follow the RBI's Fair Practices Code for collections. Harassment — calling at odd hours, threatening family members, accessing phone contacts — is explicitly prohibited and actionable under law. Each borrower must be provided with a direct complaint channel for collection grievances.
Data Deletion Rights
After loan closure, you can request that the lender and LSP delete all data collected during the loan process. The request must be fulfilled unless there is a legal or regulatory obligation to retain the data (which applies to KYC and financial records, but not, say, phone contacts or behavioural data).
What to Do If Your Rights Are Violated
Step 1: Raise a complaint with the Regulated Entity (not the app — the NBFC or bank). Step 2: If unresolved in 30 days, escalate to the RBI Integrated Ombudsman at cms.rbi.org.in. Step 3: For predatory or illegal apps, report to sachet.rbi.org.in and your local cyber crime cell. Document everything — screenshots, call logs, written communication.