RBI tightens rules for digital lending

The Reserve Bank of India on Wednesday issued guidelines for digital lending platforms to ensure orderly growth and protect borrowers following complaints that lending apps were charging usurious interest rates, pursuing aggressive recovery practices, and committing fraud and breach of data privacy.

The rules, applicable only to RBI-regulated entities and lending service providers, mandate them to disclose the all-inclusive cost of digital loans to borrowers and bar lenders from automatically increasing credit limits without the borrower’s consent.

In January 2021, RBI set up a working group on digital lending, including lending through online platforms and mobile apps, to regulate the entities. The new guidelines are based on the principle that lending business can be carried out only by entities that are either regulated by the central bank or entities permitted to do so under any other law.

According to the new rules, regulated entities must ensure that loan servicing and repayments are executed directly in their bank account without any third party’s pass-through or pool account. The disbursements also need to be made into the borrower’s bank account.

RBI also said any fees or charges payable to lending service providers should be paid directly by the regulated entity and not by the borrower.

Regulated entities will also have to provide a cooling-off period during which the borrowers can exit digital loans by paying the principal and the proportionate costs without any penalty. In addition, regulated entities must ensure all loan service providers engaged by them have a nodal grievance redressal officer to deal with digital lending-related complaints.

Fintech industry executives said the guidelines would not stifle fintech innovation. “From our initial observation, we believe the regulator is not trying to stifle fintech innovation, which is obviously great. However, certain guardrails are needed to protect consumer interest. In the past, unchecked innovation has led to disastrous results like fake apps. The onus of compliance is on regulated entities, as always,” said Kunal Varma, co-founder and CEO of fintech company Freo.

“The regulator is trying to ensure that money flows through legitimate KYC accounts, with clear audit trails. This will help curtail bad lending practices and help consumers build good credit habits as well,” he added.

RBI has also pushed for greater transparency and disclosures to borrowers.

It said a standardized ‘key fact statement’ must be provided to the borrower before the loan contract is executed.

All costs pertaining to the loan, including interest rates, fees, origination charges, discount points, and agency fees—the annual percentage rate (APR)—must be disclosed to the borrower.

Automatic increase in credit limit without explicit consent of the borrower is prohibited.

RBI also added that loan platforms need to provide a cooling-off or look-up period during which the borrowers can exit digital loans by paying the principal, and the proportionate APR without any penalty.

The new notification also emphasizes redressal mechanisms for consumers.

On technology and data requirements, RBI said lending applications should collect data on a need basis, with clear audit trails and with the prior explicit consent of the borrower.

Borrowers may be provided with the option to accept or deny the consent for the use of specific data, including the option to revoke previously granted consent.

The regulated entities must also ensure that any lending done through lending applications is reported to credit information bureaus irrespective of its nature/tenor.

Sugandh Saxena, chief executive of Fintech Association for Consumer Empowerment, said the new rules would boost consumer protection in the digital lending space.

“It is also important that with the guidelines coming into action, borrowers will now have the power to accept or deny consent for the use of any specific data, which also includes revoking previously-granted consent, which will empower customers to take charge of their data rights. Furthermore, the framework reiterates the need for a self-regulated organization and its role in supporting the digital lending sector on the right path, with consumer protection at its core,” he said.

While some recommendations of the panel have been accepted for immediate implementation, some have been accepted in principle and will require further deliberations. Some recommendations require wider engagement with the government and other stakeholders in view of the technical complexities, setting up of institutional mechanisms and legislative interventions.

The recommendation pertaining to the first loss default guarantee (FLDG) is under examination by RBI. Meanwhile, regulated entities shall ensure financial products involving contractual agreement, in which a third party guarantees to compensate up to a certain percentage of default in a loan portfolio of the regulated entities, shall adhere to the existing guidelines laid down in Master Directions of Securitisation of Standard Assets 2021.

Alongside the guidelines, RBI has also suggested some steps for the Union government to consider. It recommended the government restrict the use of balance sheet lending over apps to RBI-regulated entities, and to entities registered under any other law for specifically undertaking lending business. The government may consider framing legislation for the banning of unregulated lending activities, which would cover all entities not authorized by RBI, it said.

RBI also recommended that to ensure only authorized and trusted lending apps are used by consumers, an independent body styled as Digital India Trust Agency should be set up.

It also recommended setting up a national financial crime records bureau, like National Crime Records Bureau, with a data registry similar to crime and criminal tracking network and systems.