Fintech Regulation
RBI's 2026 Digital Lending Guidelines: What Changed for Fintechs and NBFCs
RBI's March 2026 update tightens direct-disbursal rules, mandates standardised Key Fact Statements, and brings device locking into the regulatory perimeter for the first time.
India's digital lending sector entered 2026 under a materially tighter rulebook, building on the framework RBI first introduced in 2022.
What changed
RBI issued revised digital lending guidelines on March 1, 2026, applying immediately to all Regulated Entities — banks, co-operative banks, NBFCs, and Housing Finance Companies — along with their Lending Service Provider (LSP) partners. The core requirements: all loan disbursals and repayments must flow directly between the borrower's bank account and the regulated entity (no pass-through via the LSP), customers must receive a standardised Key Fact Statement before sanction, a cooling-off period is now mandatory, and data collection must be minimised, purpose-limited, and explicitly consented.
Digital Lending Guarantees, reversed partly
NBFCs can now factor Digital Lending Guarantees into their Expected Credit Loss calculations — a partial reversal of a May 2025 restriction RBI imposed after finding that DLG arrangements weren't accurately reflecting actual risk.
Data accountability is fully on the regulated entity
Under the 2026 rules, the bank or NBFC providing the funds is 100% responsible for customer data privacy and security — even when a third-party LSP app is the actual point of contact with the customer.
Device locking enters the regulatory perimeter
RBI's May 2026 draft on loan recovery conduct brings device locking (a common recovery tactic for digital loan defaults) directly under regulatory scrutiny for the first time, with compliance teams facing a deadline that's closer than it may appear.
Enforcement is already happening
RBI has been more active in enforcement since late 2024 — two mid-sized NBFCs had their co-lending arrangements suspended in Q4 2025 specifically for failing to meet the direct disbursal requirement.
Sources
Enterslice: RBI Eases DLG Rules in 2026, FinDoc: RBI Digital Lending Guidelines 2026, Tech Wonders: RBI's Digital Lending Guidelines and Device Locking.
Frequently asked questions
The Regulated Entity (the bank or NBFC providing the funds) is 100% responsible for customer data privacy and security under the 2026 guidelines, even if the breach occurs through a third-party Lending Service Provider app.
Yes — two mid-sized NBFCs had their co-lending arrangements suspended in Q4 2025 for non-compliance with the direct disbursal requirement, and RBI has been more active in enforcement since late 2024.