Fintech, digital lending and regulatory innovation

Detail

1. What is Fintech?

• Fintech (financial technology) means using technology to give financial services more cheaply and to more people. The main tools are:
• mobile apps: banking, payments and loans on a phone
• data analytics: studying a person's phone bills, transaction history and similar data to judge whether they can repay a loan
• APIs (application programming interfaces): software "connectors" that let a bank's system talk to an app's system

• blockchain: a shared digital record book (see Section 4)

• Why it matters for India:

• UPI (2016) made cheap digital payments normal.
• Each digital payment leaves a data trail, a record of how a person earns and spends.
• Lenders can use this trail to judge people who have no credit history, such as street vendors, gig workers and small shops.

• This helps financial inclusion, meaning bringing poor and rural people into the formal banking system.

• The other side: the same speed and reach also brings new risks, such as illegal loan apps, misuse of personal data and hidden charges. Much of RBI's regulation in this area responds to these risks.

2. Digital-lending models

2.1 Peer-to-peer (P2P) lending

• Definition: online platforms connect individual lenders (people with spare money) directly with borrowers, without a bank in between.
• Regulator: the RBI has regulated these platforms as NBFC-P2Ps since 2017. An NBFC is a Non-Banking Financial Company. It lends money but cannot take ordinary current-account deposits like a bank.
• Legal definition: a P2P lending platform is "an intermediary providing services of loan facilitation via online medium or otherwise" [3].
• Place in RBI's rules: an NBFC-P2P always stays in the Base Layer of RBI's Scale-Based Regulation for NBFCs, which is the lightest-regulated layer [3].
• Minimum capital: its Net Owned Fund (the company's own money after losses and intangible assets are deducted) must be at least ₹2 crore [3].
• Exposure caps (limits on how much any one person can lend or borrow) [3]:

Limit	Amount
Total that one lender can lend across all P2P platforms	₹50 lakh
Lender putting in more than ₹10 lakh	Must give a CA certificate showing net worth of at least ₹50 lakh
Total that one borrower can borrow across all P2P platforms	₹10 lakh
One lender to one borrower	₹50,000
Longest loan period	36 months

• Worked example: Ravi wants to lend ₹3 lakh on a P2P platform.
• He can give at most ₹50,000 to any one borrower.
• So his money must be spread over at least 6 borrowers (₹3,00,000 ÷ ₹50,000 = 6).

• Spreading money like this lowers the damage if one borrower defaults.

• 2024 tightening (amendments of August and September 2024):

• The platform takes no credit risk. It "shall not assume any credit risk, either directly or indirectly." It must tell lenders clearly that the entire loss of principal or interest, or both, is borne by the lender [3].
  • So no credit enhancement (any promise that makes the loan look safer than it is) and no guarantees.
• It cannot be sold as an investment product. Platforms must not promote P2P lending with features like "tenure linked assured minimum returns, liquidity options" [3].
  • So no promised fixed returns and no promised quick exit.
  • Lenders must sign a declaration that they understand the risks [3].
• No cross-selling of any product that works as credit enhancement or a credit guarantee [3].
• Money must move fast. Funds cannot stay in the escrow account for more than T+1 day (one day after the transaction), effective 15 November 2024 [3].
  • An escrow account is a separate account held by a bank trustee. Lender and borrower money passes through it.

• Honest reporting. Platforms must publish their NPA share every month, along with all losses borne by lenders [3]. An NPA (non-performing asset) is a loan whose repayments have stopped for 90 days.

• Why RBI tightened the rules: some platforms had started to work like deposit-taking banks without a banking licence. They promised fixed returns and quick withdrawal while quietly carrying lending risk themselves. The 2024 rules push them back to being pure intermediaries (middlemen who only connect the two sides).

2.2 Buy Now Pay Later (BNPL)

• Definition: short-term credit offered at checkout when you buy something. The buyer pays in instalments, often interest-free if repaid on time. Late fees and penalties bring in the lender's money.
• 2022 RBI curb: RBI barred loading PPIs from credit lines.
• A PPI (Prepaid Payment Instrument) is a wallet or prepaid card that you load with money in advance.
• Some fintechs had been loading loan money into these wallets. That created a card-less credit product that sat outside the rules for credit cards.

• The ban hit card-less BNPL models that ran through wallets.

• Credit bureau reporting: under the 2025 Directions, lending on merchant platforms that involves short-term credit or deferred payments (the BNPL type) must be reported to Credit Information Companies (CICs) by the regulated lender [2].

• CICs are credit bureaus such as CIBIL.
• Because of this rule, BNPL borrowing now shows up in a person's credit score, so borrowers cannot quietly pile up many small loans.

2.3 Digital lending apps: RBI Digital Lending Guidelines (September 2022)

• Origin: these guidelines come from the recommendations of RBI's Working Group on Digital Lending (2021).
• Key terms:
• Regulated Entity (RE): a bank or NBFC licensed by the RBI. Only an RE can actually lend.
• Lending Service Provider (LSP): a fintech partner that finds customers, collects documents or recovers dues for the RE.

• Digital Lending App (DLA): the app through which the loan is offered.

• Who is covered [2]:

• all commercial banks
• urban, state and central co-operative banks
• NBFCs, including Housing Finance Companies

• All-India Financial Institutions (such as NABARD and SIDBI)

• Core rules (the 2022 rules, as now written in the 2025 Directions):

• Direct money flow.
  • Loans are paid out only into the borrower's own bank account.
  • All repayments go directly into the lender's (RE's) bank account, "without any pass-through account" [2].
  • There are no third-party pool accounts controlled by the app. This stops apps from holding or diverting borrowers' money.
• Key Fact Statement (KFS).
  • This is a standard one-page summary given to the borrower before signing.
  • It must show the all-inclusive APR, following RBI's KFS circular of 15 April 2024 [2].
• Cooling-off period.
  • The borrower can exit the loan without penalty during this period.
  • They repay only the principal plus the proportionate APR for the days used.
  • The minimum period is one day [2].
• Default Loss Guarantee (DLG).
  • A DLG is a promise by the fintech partner to cover the lender's losses up to a limit.
  • It is capped at 5% of the loan portfolio. The exact wording is "5 per cent of the total amount disbursed out of that loan portfolio" [2].
  • It may be given only as a cash deposit, a fixed deposit with a lien (a bank's legal hold on it) for the lender, or a bank guarantee [2].
  • Separate DLG guidelines were first issued on 8 June 2023 [5].
• Grievance redressal.
  • Lenders and LSPs must appoint grievance redressal officers.
  • Their contact details must be clearly shown on the RE website, the LSP website and the app [2].
  • If a complaint is not resolved within 30 days, the borrower can go to RBI's Complaint Management System or the RBI Ombudsman (the RBI's free complaint officer) [2].

• Data protection.

  • Apps may collect data only when needed and only with prior and explicit consent [2].
  • LSPs may store only "basic minimal data" [2].
  • All data must be kept on servers located in India. If data is processed abroad, it must be deleted from those foreign servers within 24 hours [2].

• Worked example: why the APR matters

• An app lends ₹10,000 for 30 days. It charges a ₹200 "processing fee" and ₹150 interest.
• Total cost = ₹350, which is 3.5% for one month.
• APR (simple, yearly) ≈ 3.5% × (365 ÷ 30) ≈ 42.6% a year.

• The advert may say "only 1.5% interest", but the KFS must show about 42.6%. Hidden fees can no longer hide the real cost.

• Default Loss Guarantee (DLG) worked example:

• A fintech's partner NBFC pays out loans worth ₹100 crore in one portfolio.
• The most the fintech can promise to cover is 5% × ₹100 crore = ₹5 crore.
• If losses exceed ₹5 crore, the NBFC bears the rest. So the real lender keeps real risk, and it has a reason to check borrowers carefully.

2.4 Consolidation: Digital Lending Directions, 2025

• Confirmed: RBI issued the Reserve Bank of India (Digital Lending) Directions, 2025 on 8 May 2025 (RBI/2025-26/36). They combine all earlier digital-lending circulars into one Master Direction, and those earlier circulars are repealed (cancelled) [2]. (NCERT scaffold: "consolidated into Digital Lending Directions (2025) (verify)". This is now verified.)
• New additions:
• Rules for apps that show loans from many lenders, effective 1 November 2025 [2]:
  • An LSP showing loan offers from several lenders must show, for each offer:
  • the lender's name
  • the loan amount and tenor
  • the APR
  • the monthly repayment
  • the penal charges
  • The display must be "unbiased, objective". Dark patterns (tricky app designs that push users into a choice) are not allowed [2].
• Reporting of apps:
  • Every RE must report all its DLAs on RBI's CIMS (Centralised Information Management System) portal, due by 15 June 2025 [2].
  • RBI publishes this list on its website, but RBI does not verify the data submitted [2].
  • This gives the public a way to check whether an app is linked to a real, regulated lender.

2.5 Illegal loan apps

• Definition: unregistered apps that are not linked to any bank or NBFC. They typically:
• charge predatory (very high, exploitative) interest
• misuse the phone's contacts and photos

• use harassment and public shaming to recover dues

• How the rules fight them:

• direct money flow (no pool accounts)
• the public list of legitimate apps (CIMS)
• data-consent rules

• grievance officers

• Limit of these rules: they bind regulated lenders. An unregistered app is outside RBI's reach. It has to be handled by police, MeitY (app blocking) and app stores.

3. Regulatory innovation: the regulatory sandbox

• Definition: a regulatory sandbox is a controlled setting in which new financial products are tested live:
• with a limited number of real customers
• under relaxed rules

• under close supervision by the regulator

• It works like a trial run. The regulator learns about the new idea before writing final rules.

• RBI Enabling Framework for Regulatory Sandbox (2019). RBI runs themed cohorts (batches of firms tested together):

Cohort	Theme
1st	Retail payments
2nd	Cross-border payments
3rd	MSME lending
4th	Prevention and mitigation of financial frauds
5th onward	Theme-neutral

• Fifth cohort: announced on 5 September 2022 as theme-neutral. Any new product across RBI's regulatory area could apply [4].
• "On tap" window: the second cohort (cross-border payments) was opened for "on tap" applications, meaning firms can apply at any time instead of waiting for a fixed window [4].
• Other sandboxes: SEBI (securities markets), IRDAI (insurance) and IFSCA (GIFT City's international financial centre) each run their own.
• Benefits and limits:
• Benefit: it lowers the cost and risk of new ideas, and the regulator learns before making rules.
• Limit: it is small in scale, and a product that works in a sandbox may still fail at full scale.

4. Blockchain

• Definition: a decentralised, tamper-resistant digital ledger. "Decentralised" means no single owner. "Tamper-resistant" means very hard to change secretly.
• Transactions are grouped into blocks.
• Each block is linked to the one before it, forming a chain.

• Copies of the whole chain are kept on many computers.

• Why it is hard to cheat:

• To change one old record, you would have to change that block and every later block.
• You would also have to do this on most of the copies at the same time.

• So any secret change is easy to catch.

• Uses:

• trade finance: letters of credit shared between exporter, importer and banks
• cross-border payments
• land records

• CBDC (Central Bank Digital Currency, i.e. the digital rupee) pilots

• Cross-references: crypto-assets and stablecoins are covered in financial-markets-instruments. CBDC design is covered in banking-monetary-policy.

Prelims Hooks

• NBFC-P2P is regulated by the RBI (since 2017). It must have a minimum Net Owned Fund of ₹2 crore and always sits in the Base Layer.
• P2P caps:
• ₹50 lakh total per lender across all platforms
• ₹10 lakh total per borrower
• ₹50,000 from one lender to one borrower

• a longest loan period of 36 months

• Trap: after the 2024 rules, a P2P platform cannot guarantee returns or offer liquidity options. Losses fall entirely on the lender.

• Digital Lending Guidelines (September 2022) came from the Working Group on Digital Lending (2021). They were consolidated into the Digital Lending Directions, 2025 (8 May 2025).
• Default Loss Guarantee (DLG) cap = 5% of the amount disbursed in the portfolio. Allowed forms: cash deposit, fixed deposit with lien, or bank guarantee.
• Key Fact Statement must show the all-inclusive APR. The cooling-off period lets a borrower exit a digital loan without penalty, and it is at least one day.
• CIMS portal: lenders report their digital lending apps on it, and RBI publishes the list without verifying it.
• Digital-lending data must be stored only on servers in India.
• RBI sandbox cohort themes in order: retail payments → cross-border payments → MSME lending → fraud prevention → theme-neutral (fifth cohort, 2022).
• Blockchain = a decentralised ledger of linked blocks copied on many computers. Trap: a blockchain is not the same as a cryptocurrency. Crypto is only one use of it.

Mains Points

• Innovation vs. consumer protection:
• Fintech lending reaches people with no credit history and so widens financial inclusion.
• But predatory apps, hidden fees and data misuse hurt the poorest borrowers most.
• RBI's answer is to regulate the activity, not the technology:
  • direct money flow
  • a Key Fact Statement with APR
  • a cooling-off period
  • data stored in India

• This keeps innovation alive while making sure responsibility stays with a licensed lender.

• Keeping risk with the real lender:

• Caps on DLG (5%) and the 2024 ban on credit enhancement by P2P platforms follow one idea: whoever carries the lending risk must be a regulated entity with enough capital.

• Otherwise lightly regulated fintechs start to work like "shadow banks" (lenders that act like banks without bank-level rules), and that builds up hidden risk to the financial system.

• Regulatory sandbox as a model for regulation:

• The regulator learns first and then writes the rules. This suits fast-changing areas such as payments, cross-border transfers, fraud detection and CBDC.

• Several regulators (RBI, SEBI, IRDAI, IFSCA) run sandboxes. This supports the case for better inter-regulator coordination, since fintech products often cut across banking, securities and insurance.

• Where the rules stop:

• RBI's rules bind only regulated entities, so illegal loan apps need a whole-of-government response:
  • MeitY blocking of apps
  • police action
  • app-store checks
  • the Digital Personal Data Protection Act, 2023
  • financial literacy
• This links GS-III (economy, cyber security) with GS-II (governance).