Applying for a loan through an app or website is convenient, but it also brings new questions: who is actually lending, who sees your data, and what can you do if something goes wrong? The RBI answered these first in its digital lending guidelines of 2022 and then consolidated them in the Reserve Bank of India (Digital Lending) Directions, 2025, issued in May 2025.
Who's who in a digital loan
- Regulated Entity (RE) — the bank or NBFC that actually lends to you.
- Lending Service Provider (LSP) — a company that helps the lender with sourcing, onboarding, servicing or collection. A loan facilitation platform is an LSP.
- Digital Lending App or platform (DLA) — the app or website through which you apply.
The lender remains responsible for what its LSPs do.
Your key rights and protections
1. You must know who your lender is
The lender's name must be disclosed upfront, and the sanction letter, Key Fact Statement and agreement come from it.
2. Money flows only between you and the lender
Loan disbursals and repayments must go directly between your bank account and the lender's, not through the account of an LSP or any third party, except in cases the RBI allows.
3. A Key Fact Statement before you sign
You get a standardised Key Fact Statement showing the APR, all fees and the repayment schedule. Charges not disclosed in it cannot be levied without your explicit consent.
4. A cooling-off period
For digital loans you can exit within a cooling-off (look-up) period set by the lender's board by paying the principal and the proportionate APR, without a penalty.
5. Your data, your consent
- Data is collected only with your explicit consent, and only what is needed.
- Apps cannot access your contacts, photos or media files — the main tool fake apps used to harass borrowers — except limited one-time access for KYC where needed.
- You can deny consent, revoke it, and ask for your data to be deleted, subject to legal requirements.
6. No automatic increase in credit limits
Your credit limit cannot be raised without your explicit consent.
7. Fair recovery
Recovery agents must follow the RBI's fair practices — no threats, abuse or calls at odd hours — and the lender must tell you who may contact you about recovery.
8. A named grievance officer
The lender and the LSP must each have a grievance redressal officer whose details are displayed. If your complaint is not resolved within 30 days, you can approach the RBI Ombudsman under the Integrated Ombudsman Scheme (cms.rbi.org.in).
How Oxon Fintech follows this
Oxon Fintech is a loan facilitation platform. Loans are sanctioned and disbursed by our lending partners — banks and NBFCs — directly into your bank account. Your bank statements are shared only through the consent-based Account Aggregator framework, and we never ask for your contacts, photos, OTP or passwords. Read our privacy policy and grievance redressal process.
Red flags in a lending app
- It doesn't name the bank or NBFC lending to you.
- It asks for access to contacts or photos.
- It asks you to pay a fee to a personal account before disbursal.
- There is no KFS and no grievance contact.
If you see these, stop, check whether the app is RBI registered and read how to avoid loan fraud.
This guide is general information, not financial advice. Interest rates, fees, eligibility and other terms are set by each lender and can change; the figures in examples are illustrative only. Oxon Fintech is a loan facilitation platform, not a lender — loans are sanctioned and disbursed by our lending partners.