Digital Lending App Compliance Checklist for India (2026)

Building an instant loan app in India is mostly a compliance project with a mobile app on top. The regulator, the app store and the payment rails each have rules that decide screens, permissions, data models and money flows. Miss one and the app is either pulled from Google Play or flagged by the lender's auditors.

This is the checklist our team works through when we build lending apps for NBFCs and lending fintechs. It is written for product and engineering teams, not as legal advice: your lender's compliance team has the final say. Rules are as published on 28 October 2026.

Which rules apply in 2026

RBI's 2022 guidelines on digital lending were replaced by the Reserve Bank of India (Digital Lending) Directions, 2025 in May 2025. On 28 November 2025 RBI consolidated its rules into entity-wise Master Directions. For NBFCs, digital lending now sits in Chapter III of the RBI (Non-Banking Financial Companies – Credit Facilities) Directions, 2025. Banks have their own equivalent directions. The substance carried over, so the checklist below holds for both.

Three other rule sets matter for an app: Google Play's personal loan policy, RBI's KYC directions and the e-mandate framework for repayments. The DPDP Act sits on top for personal data.

1. Loan terms and disclosure

• Key Fact Statement before signing. Show a KFS with the all-in annual percentage rate (APR) before the loan contract is executed. Store the version the borrower saw against the loan.
• No fees outside the KFS. Any charge not in the KFS cannot be levied later without the borrower's explicit consent. Make your fee engine read from the same product configuration that generates the KFS.
• Cooling-off period. The lender's Board sets it, and it must be at least one day. A borrower who exits pays back the principal and the proportionate APR, with no penalty. Only a reasonable one-time processing fee may be kept, and only if the KFS disclosed it.
• No automatic credit-limit increases. A limit can rise only on the borrower's explicit request. Build an opt-in flow with a consent log, not a silent upgrade.
• Loan documents in the app. The signed agreement, KFS, sanction letter and repayment schedule should be downloadable by the borrower at any time.

2. Money flow

• Direct disbursal. Funds go straight from the lender's account to the borrower's verified bank account.
• Direct repayment. Repayments go straight into the lender's account. No pool or pass-through account run by the app or a loan service provider.
• Know the exceptions. Co-lending, statutory disbursals, end-use loans paid to the beneficiary and employer-repaid salary advances are carved out. Cash recovery of overdue loans must reach the borrower's account the same day.
• The lender pays the service provider. A loan service provider's fee cannot be charged to the borrower.

3. Data, consent and device permissions

• Need-based collection with explicit consent. Ask for each data point only when the journey needs it, and keep an audit trail of every consent.
• No access to files, media, contacts, call logs or telephony. Camera, microphone and location are allowed once, for onboarding or KYC, with consent.
• Store data in India. If any processing happens abroad, the data must be deleted there and brought back within 24 hours.
• Let borrowers withdraw consent and ask for their data to be deleted, within the limits of what the lender must retain.
• Plan for the DPDP Rules. They were notified in November 2025. Consent-notice, security and breach-notification duties start around May 2027, and a breach then needs a detailed report to the Data Protection Board within 72 hours. Building the consent and logging layer now saves a rebuild.

4. Onboarding and KYC

• Pick the KYC route per product. OTP-based Aadhaar e-KYC without a face-to-face check is limited to term loans of at most Rs 60,000 sanctioned per year, valid for one year unless full KYC follows. Video KYC (V-CIP) counts as face-to-face, so larger or revolving products need it or full KYC.
• PAN verification and a credit bureau pull with consent recorded before the request.
• Keep KYC artefacts with the loan record so audits do not depend on a vendor's dashboard.

5. Grievances and transparency

• Grievance officers. The lender and any loan service provider must name nodal grievance officers, with contact details in the app, on the website and in the KFS.
• The RBI Ombudsman route. If a complaint is rejected or unanswered after 30 days, the borrower can go to the RBI Integrated Ombudsman through cms.rbi.org.in. Tell them how.
• Name the lender. Every screen that shows an offer should say which regulated lender is making it.
• Multi-lender marketplaces. A loan service provider showing several lenders must list every matching offer with lender name, amount, tenor, APR, monthly repayment and penal charges, plus a KFS link. Name the lenders that did not match too. No dark patterns, and ranking only on a publicly disclosed metric.

6. Reporting the app to RBI

• Report every digital lending app on RBI's CIMS portal. The lender reports each app it uses, including those run by partners.
• Check the public directory. Since 1 July 2025 RBI publishes the reported apps under "DLAs deployed by Regulated Entities" in the Citizen's Corner of its website. Listing is not an endorsement, but Google Play checks it.

7. Google Play

Most loan apps are rejected for store reasons, not RBI ones. For India:

• Financial features declaration. Complete it in Play Console with supporting documents, and list every partner NBFC or bank in the app description.
• On RBI's list first. New personal loan apps must appear in RBI's DLA directory, a rule in force since 30 October 2025. Existing apps had until 28 January 2026.
• Remove banned permissions. Personal loan apps cannot request contacts, photos and videos, external storage, precise location, phone numbers or the full list of installed apps. Check what your SDKs pull in, not only your own manifest.
• No repayment in 60 days or less. Google does not allow personal loans that must be repaid in full within 60 days. This applies in India, so pure payday products need a different structure.
• Show loan terms in the listing: maximum APR, minimum and maximum repayment period, and a representative example of the total cost.

8. Repayments and collections

• Choose the mandate by EMI size. Under RBI's 2026 e-mandate framework, recurring debits on UPI and cards skip extra authentication only up to Rs 15,000 per transaction for loan EMIs. Above that, each debit needs the borrower to authenticate, so e-NACH usually suits larger instalments.
• Pre-debit notice at least 24 hours before each recurring debit.
• Reminders without harassment. EMI reminders over SMS, WhatsApp, email and push are fine. Collection agents must follow the lender's fair-practices code, and the app must never message a borrower's contacts.
• Default loss guarantees. If a partner provides one, cover is capped at 5% of the portfolio disbursed, must be invoked within 120 days overdue, and is not allowed on revolving credit.

How to use this checklist

Go through it with your lender's credit and compliance teams before screens are designed, not after the build. Most items become a field, a screen or a log entry, and they are far cheaper to add in week two than in a Play Store rejection.

Mindrops builds loan apps and digital lending platforms with e-KYC, credit bureau checks, e-sign, e-NACH and loan administration already integrated. See our fintech engineering work or tell us about your loan product below.