How to check if a loan app is RBI-regulated

RBI does not approve loan apps. It regulates the lender behind the app, which is either a bank or a non-banking finance company (NBFC) registered with RBI. So the useful question is who is actually lending to you, and whether RBI regulates them. Take Imran, a 26-year-old delivery executive in Hyderabad. He needs ₹30,000 for a hospital bill, and sees an ad for "instant cash, no CIBIL" (TransUnion CIBIL is one of the four credit bureaus registered with RBI). He does not know whether the app is safe. This is what he, or you, can check before tapping accept.

Does RBI approve loan apps?

No. A legal loan app is only a front for a lender that RBI regulates: a bank or a registered NBFC. An NBFC is a lender that is not a bank but is registered with RBI.

"RBI-approved app" is a loose phrase, not RBI's own. RBI's rules say that an app appearing on its published list does not confer "any form of registration, authorization, or endorsement". More on that list below.

A digital lending app is any app through which a lender runs its loans, from finding the customer to collecting repayment. A lending service provider (LSP) is a company that runs the app or finds borrowers for a lender, acting as that lender's agent.

The lender stays fully responsible for what its LSP does, according to RBI's directions. That also answers whether loan apps are legal in India. RBI's rules for lending through apps, set out below, say what such an app must and must not do. An app with no regulated lender behind it is outside those rules.

How do you find out who is really lending to you?

The app must name the lender, and the lender's own website must list every app it works with. RBI's directions require the lender to show, at one prominent place on its website:

• details of all its digital lending products and the apps it uses;
• the LSPs it has engaged, their apps and what they do for the lender;
• how to complain, including a link to RBI's complaint system and its Sachet portal.

The apps and LSPs must link back to that website. If one app shows offers from several lenders, it must name each lender. Each offer needs the amount, tenor, APR, monthly repayment and penal charges, and a link to that lender's Key Facts Statement (KFS). The loan agreement and the KFS name the lender too. If no bank or registered NBFC is named anywhere, that is the answer. There is no regulated lender to check.

How do you check a lender on the RBI lists?

Check the app first, then the lender, and then the lender's own website. Here is the order.

1. Look for the app on the list RBI publishes of lending apps. RBI's home page links to it as "DLA's deployed by Regulated Entities" (DLA means digital lending app).
2. Treat that list with care. Lenders report their apps to RBI, and RBI publishes the data as submitted. RBI says it does not verify or validate it, and that inclusion is not registration, authorisation or endorsement.
3. Check the lender itself. For an NBFC, RBI's website carries a list of NBFCs registered with it and a separate list of cancelled certificates of registration. Both are on RBI's website.
4. Open the lender's own website and look for the app on its list of apps and LSPs.

RBI's rules also say the lender itself deals with every customer complaint about its apps. An app on the list but missing from its lender's own website is a reason to stop and ask.

What must a legal loan app show you before you accept?

A Key Facts Statement, in a language you understand, before you sign the loan contract. RBI requires it for all new retail term loans from 1 October 2024. It carries the APR (annual percentage rate, the yearly cost of the loan with every charge included) and a computation sheet for it. It also lists every fee and the repayment schedule.

You can accept on those terms for at least three working days if the loan runs seven days or more. For a shorter loan it is at least one working day. A fee that is not in the KFS cannot be charged later without your explicit consent. Return to Imran, and suppose the KFS looked like this. These numbers are assumed, not any app's terms.

• Loan: ₹30,000 for one year at an assumed 24% a year, repaid in 12 EMIs (equated monthly instalments, the fixed amount paid each month that covers interest and part of the loan).
• EMI: ₹2,837. Total repaid: ₹34,044, so interest of ₹4,044.
• An assumed processing fee of ₹1,500 is deducted first, so he receives ₹28,500.
• Cost of the loan: ₹5,544 on ₹28,500 actually received.
• APR by RBI's method: about 34.16% a year.

RBI's method takes the monthly rate that equates the net amount received with the instalments, then multiplies it by 12. Here the monthly rate is 2.8465%, so 34.16% is the APR, well above the 24% headline. That gap is why the APR line matters. You can try other figures in the personal loan calculator.

For a digital loan, the money must go from the lender straight into your own bank account, and you repay straight to the lender. An app that asks you to pay into a personal account, a wallet or the app company's account is not following RBI's rules. LSP fees are paid by the lender, so the app company cannot charge you its own fee on top.

Every digital loan also has a cooling-off period, an initial window to exit the loan, of at least one day, set by the lender. Within it you can return the loan by paying back the principal plus the proportionate interest and charges, with no penalty. The lender may keep a reasonable one-time processing fee if the KFS said so. Once you sign, the KFS, sanction letter and terms must reach you by email or SMS.

Can a loan app read your contacts and photos?

No. RBI's rules bar a lending app from your contact list, files and media, call logs and phone functions. Data must be collected only as needed, with your explicit consent.

You have rights here too. You can give or refuse consent for particular data and restrict what is shared with third parties. You can withdraw consent you gave earlier, and ask the lender or LSP to delete your data. An app that insists on contacts or photos before it will lend is asking for something RBI's rules do not allow.

What can a lender do if you miss a payment?

It can charge the late-payment fee written in your KFS and report the missed payment to the credit bureaus. It can also chase the money through its agents, within RBI's rules. A credit bureau is a company registered with RBI that keeps credit records and produces your credit report and score. A recovery agent is a person or firm the lender appoints to collect overdue money.

RBI's rules call it a penal charge: it is charged on the overdue amount, disclosed in your loan agreement and KFS, and is not extra interest on your rate.

The lender and its agents may not threaten, abuse or shame you. They may not contact your family, friends or references to embarrass you, or send humiliating messages to you or them. Anonymous or threatening calls are barred, and so are calls before 8 am or after 7 pm. For digital loans, the agent's details must reach you by email or SMS before the agent contacts you. Agents must carry the lender's authorisation letter and an identity card.

RBI's words are that the bank, as principal, is responsible for the actions of its agents. A loan overdue by more than 90 days becomes a non-performing asset (NPA) in the lender's books, and that shows in your report too. The credit score guide explains how reports work. If you cannot pay, read 5 steps to get out of a debt trap.

Where can you complain about a loan app?

Start with the lender's grievance officer. That is the nodal officer the lender must name, with contact details on its website, in the app and in the KFS. You can lodge the complaint on the app itself.

If the lender rejects the complaint, does not reply within 30 days, or you are not satisfied, you can go to the RBI Ombudsman. This is RBI's free complaint service. File at cms.rbi.org.in, by email to crpc@rbi.org.in, or by post to the CRPC, RBI, Chandigarh. The toll-free number 14448 guides you but cannot take complaints. The scheme covers commercial banks, most NBFCs above a size test and credit bureaus. The Ombudsman decides the complaint, and compensation can go up to ₹30 lakh, plus up to ₹3 lakh for time, expenses and harassment.

Housing finance companies are not covered. If your lender is one, approach it first and go to the National Housing Bank's GRIDS portal after one month.

To report an app or company lending or taking money without RBI permission, use RBI's Sachet portal at sachet.rbi.org.in. Anyone can file a complaint there, and you can report anonymously.

For threats, extortion or morphed photos, call the cybercrime helpline 1930 or report at cybercrime.gov.in. Complaints there go to state police. For other kinds of fraud, see how to protect yourself from financial fraud.

Why is "no CIBIL check" a warning sign?

Because a regulated lender must report every app loan to the credit bureaus, whatever its size or term. A promise to skip your credit record therefore says more about the offer than about the loan. Find out who is lending.

Here is a checklist of warning signs, each tied to a rule above.

• No bank or registered NBFC is named in the app, the agreement or the KFS.
• No KFS reaches you before you accept.
• A fee is asked before the loan is paid out, or you are told to pay into a personal account or wallet.
• The app asks for your contacts, photos or files.
• Recovery messages threaten you, or calls come before 8 am or after 7 pm.
• You are asked to install the app from a link rather than an app store. This is a caution, not an RBI rule.

If your credit record is weak, how to get a personal loan for a low CIBIL score covers regulated options. For the basics of borrowing, see how to get a personal loan, and for why applications fail, common reasons for personal loan rejection.