What Happened
- Predatory digital loan applications continue to operate in regulatory grey zones, exploiting gaps between formal banking regulation and the informal fintech ecosystem to trap vulnerable borrowers.
- These apps promise instant credit with minimal documentation, but deploy hidden fee structures, aggressive data harvesting (contact scraping), and coercive recovery practices — including harassment of borrowers' contacts.
- The RBI issued the Reserve Bank of India (Digital Lending) Directions, 2025 on May 8, 2025, marking a comprehensive regulatory overhaul of digital lending norms covering Regulated Entities (REs) and Lending Service Providers (LSPs).
- From July 1, 2025, RBI operationalised a public directory listing all Digital Lending Apps (DLAs) deployed by regulated entities — providing a verification tool for borrowers to distinguish authorised apps from predatory ones.
- Despite these steps, a large segment of the loan app market operates through unlicensed entities that are not directly regulated by RBI, and continue to evade accountability.
Static Topic Bridges
RBI's Regulatory Architecture for Digital Lending
The RBI regulates banks, NBFCs (Non-Banking Financial Companies), and other Regulated Entities (REs) through powers vested under the RBI Act, 1934 and the Banking Regulation Act, 1949. Fintech apps that merely provide a technology platform and source borrowers (Lending Service Providers / LSPs) are regulated indirectly — they must partner with a licensed RE and are not allowed to hold customer funds or make credit decisions independently.
- Digital Lending Directions, 2025 mandate that loan disbursals and repayments flow only between the borrower's bank account and the RE — LSPs cannot touch loan funds
- Key Fact Sheet (KFS): REs must provide borrowers a standardised one-page summary of all loan terms (Annual Percentage Rate, processing fee, etc.) before disbursal
- Recovery practices: Agents prohibited from contacting borrowers outside 8:00 AM – 7:00 PM window
- Data privacy: LSPs prohibited from storing sensitive borrower data (e.g., contact lists) on their own servers; "contact scraping" now a criminal offence under the Digital Personal Data Protection (DPDP) Act, 2023
- RBI's DLA directory (from July 1, 2025) lists only apps of regulated entities — any app not on this list is operating outside the regulatory perimeter
Connection to this news: The editorial's concern about predatory apps operating in a "regulatory dark area" stems from the structural gap: many such apps are neither banks nor NBFCs, and therefore fall outside RBI's direct jurisdiction. The 2025 Directions tighten requirements for partnered LSPs, but fully unregistered apps remain a law enforcement challenge.
Financial Inclusion vs. Predatory Credit — The Policy Dilemma
India's financial inclusion agenda, advanced through Jan Dhan–Aadhaar–Mobile (JAM Trinity), created a pipeline for digital credit delivery to previously unbanked populations. However, the same digital infrastructure — Aadhaar eKYC, UPI, mobile credit scoring — also lowered barriers for predatory lenders. The challenge is enabling legitimate fintech innovation while protecting financially inexperienced borrowers.
- PMJDY (Pradhan Mantri Jan Dhan Yojana, 2014): over 50 crore accounts opened; created the banking access layer that digital lenders now exploit
- Account Aggregator framework (RBI, 2021): allows regulated sharing of financial data with borrower consent — a legitimate alternative to data scraping
- Credit gap for informal sector: estimated at ₹25+ lakh crore, creating demand that formal banks do not fully meet
- The I4C (Indian Cyber Crime Coordination Centre) under MHA monitors and analyses predatory apps, and citizens can report incidents via the National Cybercrime Reporting Portal (cybercrime.gov.in) or helpline 1930
Connection to this news: The tension between expanding credit access and preventing exploitation is at the core of the predatory loan app problem. Regulatory intervention must address not just the apps themselves but also the debt distress and mental health consequences borne by vulnerable borrowers.
Consumer Protection and Grievance Redressal in Financial Services
The Consumer Protection Act, 2019 and the RBI Integrated Ombudsman Scheme, 2021 together provide a multi-layered redress framework. Under the Ombudsman scheme, complaints against RBI-regulated entities can be filed online at cms.rbi.org.in without fees, with a 30-day resolution timeline. However, unregulated apps fall outside this system, leaving borrowers of predatory apps largely without institutional recourse.
- RBI Ombudsman Scheme, 2021: consolidated three earlier schemes (Banking, NBFC, Digital Transactions Ombudsman) into a single, jurisdiction-free portal
- Section 66 of the IT Act, 2000: penalises fraudulent use of computer systems — applicable to apps that harvest data without consent
- Section 25 of the Payment and Settlement Systems Act, 2007: governs entities involved in payment processing — relevant for loan apps that collect EMIs via UPI
- DPDP Act, 2023 (Digital Personal Data Protection Act): places data minimisation and purpose limitation obligations on data fiduciaries — applicable to apps handling borrower personal data
Connection to this news: The absence of direct RBI regulation over loan apps that operate purely as unlicensed entities underscores why a separate legislative framework — or extension of DPDP Act enforcement to cover financial data practices — may be needed to plug the regulatory gap.
Key Facts & Data
- RBI (Digital Lending) Directions, 2025: issued May 8, 2025 — comprehensive overhaul of digital lending norms
- DLA Public Directory: operationalised July 1, 2025 — lists all apps of regulated entities
- Prohibition: LSPs cannot store sensitive borrower data; contact scraping is a criminal offence (DPDP Act, 2023)
- Recovery restriction: No contact outside 8:00 AM – 7:00 PM
- Grievance mechanism: RBI Integrated Ombudsman Scheme (cms.rbi.org.in); cybercrime helpline 1930
- Monitoring agency: I4C (Indian Cyber Crime Coordination Centre), Ministry of Home Affairs
- India's formal credit gap for informal/MSME sector: estimated ₹25+ lakh crore
- Key consumer protection legislation: Consumer Protection Act, 2019; DPDP Act, 2023; IT Act, 2000; Payment and Settlement Systems Act, 2007