Fintech and digital lending

Identify who performs each regulated activity

Record who sanctions credit, owns the loan, sets pricing, disburses money, collects repayments and handles complaints. A software company, lending service provider and regulated lender do not have interchangeable responsibilities. Describe the actual activity rather than relying on the label fintech.

Assess payments, lending, account aggregation and other product features separately. A partnership with one regulated institution does not establish permission for every service the platform might later add.

Use the rules applicable to the actual lender

RBI’s regulatory material addresses digital lending, borrower disclosures, outsourcing and related conduct. Identify the current directions governing the particular lender category and arrangement, including amendments and superseding instruments. Do not reuse an old digital-lending checklist without checking its current status.

Translate applicable requirements into product acceptance criteria: customer disclosures, consent records, complaints, data access, funds flow and partner oversight should have named owners and retained evidence.

The Ministry of Finance’s 21 July 2026 explanation describes RBI’s digital-lending-app directory as a way for customers to check an app’s claimed association with a regulated entity. Use that association check alongside the actual lender and partner documents; it is not a substitute for assessing the product’s regulatory requirements.

Document the customer and money journey

• Lender and partner identities shown consistently in contracts and the customer interface.
• Approved disclosures, customer acceptance and version history for each product.
• Disbursement and repayment paths reconciled to loan and bank records.
• Fee arrangements, refunds and partner invoices separated from loan principal.
• Complaint escalation, recovery responsibilities and access to customer records.

Control data and partner changes

Maintain a purpose-based inventory of information collected through the application and its vendors. Record permissions, access roles, retention decisions and incident escalation. Changes to a data source, collection feature or recovery vendor should enter the partner’s compliance assessment before release.

Where a commercial arrangement includes credit support or loss sharing, obtain a specific assessment of its regulatory treatment and record the approved terms. Do not treat it as an ordinary marketing rebate merely because the contract uses that description.

Example: adding a second lending partner

A platform adding another lender needs to review offer presentation, customer consent, data sharing, complaints and transaction reconciliation for both arrangements. It should preserve which lender and terms the customer accepted, rather than keeping only a generic platform signup record.

Set a practical support scope

Kosha can support corporate records, financial controls, tax accounting and contract documentation. Regulatory eligibility, lending permissions and product compliance require specialist assessment with the regulated partner. This page does not imply that company incorporation authorises lending.