Implementation
The Reserve Bank of India (RBI) vide a press release dated 10 August 2022 has set out its regulatory stand with respect to the recommendations of a working group constituted on ‘digital lending including lending through online platforms and mobile apps’. These recommendations were a part of the November 2021 report of the working group.
The report includes recommendations with respect to the following entities: (a) lending entities regulated by RBI (REs); (b) agents of REs who perform services for a fee, i.e., Lending Service Providers (LSPs); (c) mobile and web-based applications of REs providing a user interface for lending, i.e., digital lending apps (DLAs); and (iv) DLAs of LSPs engaged by REs.
The press release categories the recommendations of the working group into 3 categories, i.e., (a) recommendations accepted for immediate implementation; (b) recommendations which are accepted in-principle but require further examination; and (c) recommendations which require wider engagement with the government and other stakeholders.
A. The key recommendations that have been accepted by the RBI for immediate implementation include:
1. REs must ensure that the flow of money between the borrower and the RE, including in the form of loan disbursements, servicing, or repayments, shall take place directly between the bank accounts of the borrower and the RE.
2. Any fees payable to the LSPs must be paid directly by the REs, and no fees are to be charged by the LSPs to the borrowers.
3. The REs must disclose to the borrowers the all-inclusive cost of digital loans as an annual percentage rate (APR), upfront and prior to disbursal.
4. REs must ensure that LSPs engaged by them have appointed a nodal grievance redressal officer to deal with complaints or issues raised by a borrower.
5. Prior to execution of contracts for digital lending products, REs must provide a key fact statement to the borrowers which contains details of the APR, terms of the recovery mechanism, details of the grievance redressal officer, and other necessary information.
6. REs must ensure that there is no automatic increase in the credit limit of a borrower, without the borrowers’ explicit consent.
7. REs must publish a list of LSPs and DLAs engaged by them on their website and provide details of the activities for which the LSPs and DLAs have been engaged.
8. REs may capture the economic profile of a borrower before extending any loans over DLAs, to assess the creditworthiness of a borrower in an auditable manner.
9. REs must carry out an enhanced due diligence before partnering with a LSP to analyse the LSP’s technical abilities, data privacy policies and storage systems, fairness in conduct with borrowers, and ability to comply with applicable laws.
10. LSPs may only store minimal personal information of a borrower, that may be needed to carry out their services, and the REs shall be responsible for the security and privacy of the borrower’s data.
11. Data collection by the DLAs should be need-based and explicit consent of the borrower must be obtained before collecting information. Further, the borrowers must have the right to either give consent or deny the use or disclosure of their data. The borrowers must also have the right revoke their consent once provided.
12. REs must ensure that all data pertaining to a borrower must be stored in servers located within India.
Although the recommendations under paragraph A above have been identified as recommendations that are required to be implemented immediately, the press release mentions that detailed instructions for the same will be issued separately, and the REs are advised to be guided by the regulatory position as covered in the press release. Further, the onus of ensuring implementation of these requirements by the LSPs and the DLAs have been vested with the REs associated with such LSPs and DLAs.
B. The second set of recommendations that have been accepted by RBI in principle, but require further examination include:
1. The recommendation related to discontinuance of contractual arrangements between REs and LSPs or other fintech entities, such as ‘First Loss Default Guarantee’ is proposed to be further examined. In the meantime, boards of REs must ensure that such arrangements comply with RBI’s Master Direction on Securitisation of Standard Assets Directions, 2021.
2. DLAs must maintain baseline technology standards prescribed by RBI in relation to technical specifications for ensuring application security, maintaining auditable logs of actions performed by a user, and monitoring transactions undertaken by the DLAs.
3. REs must ensure that the algorithm being used for underwriting is based on extensive, accurate and diverse data, and the algorithm should be auditable to ascertain minimum underwriting standards and potential discriminating factors.
4. A regulatory framework is proposed to be framed for web-aggregators of loan products.
C. Apart from the above, the following recommendations of the working group have been identified for further extensive deliberations with the government:
1. Only REs to be permitted to carry out balance sheet lending using DLAs.
2. Framing of a legislation for the purpose of banning unregulated lending activities to cover all entities not regulated by RBI or under any other law for public lending.
The press release is a part of RBI’s mandate to regulate the Indian credit system, and to address concerns that may emanate from the participation of third-party unregulated entities in the digital lending space, with RBI’s key focus being on the protection of retail consumers. Please click here to read RBI’s press release.
Authors: Souvik Ganguly, Aman Bagaria and Karan Vin
The information contained in this document is not legal advice or legal opinion. The contents recorded in the said document are for informational purposes only and should not be used for commercial purposes. Acuity Law LLP disclaims all liability to any person for any loss or damage caused by errors or omissions, whether arising from negligence, accident, or any other cause.