The Reserve Bank of India has issued guidelines to all lenders including banks to protect data of borrowers using digital lending apps from being misused.

As per the guidelines issued by the RBI, the regulated entities cannot store borrowers’ data except some basic minimal information. As per the guidelines, a lender can store information such as name, address, contact details of the customer etc. that are required to process and disburse the loan and repayment of it.

• The guidelines explicitly state that digital lending apps cannot access mobile phone resources such as file and media, contact lists, call logs, telephone functions, etc. One-time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/ KYC requirements only, with the explicit consent of the borrower.
• The borrowers must be informed about the storage of customer data including the type of data that can be stored, the length of time for which data can be stored, restrictions on the use of data, data destruction protocol, standards for handling security breach, etc. The information must be provided on their website and the apps at all times.
• At the time of disbursing the loans using digital apps, a key Fact Statement (KFS) to the borrower before the execution of the contract in a standardized format for all digital lending products.
• The borrower must be informed about the all-inclusive cost of digital loans and should also be a part of the Key Fact Statement.
• The penal interest/charges levied, if any, on the borrowers shall be based on the outstanding amount of the loan. Further, the rate of such penal charges shall be disclosed upfront on an annualized basis to the borrower in the Key Fact Statement.
• The regulated entities shall ensure that all loan servicing, repayment, etc., shall be executed by the borrower directly in the regulated entities’ bank account without any pass-through account/ pool account of any third party. The disbursements shall always be made into the bank account of the borrower except for disbursals covered exclusively under statutory or regulatory mandate (of RBI or of any other regulator), flow of money between regulated entities for co-lending transactions and disbursals for specific end use, provided the loan is disbursed directly into the bank account of the end-beneficiary. Regulated entities shall ensure that in no case, disbursal is made to a third-party account, including the accounts of Lending Service Providers and their Digital Lending Apps, except as provided for in these guidelines.
• Any fees charges etc. payable to lending service providers must be paid by the regulated entities and they are not charged from the borrowers.
• The Key fact statement should contain the details of annual percentage rate, the recovery mechanism, details of grievance redressal officer designated specifically to deal with digital lending/ FinTech related matter and the cooling-off/ look-up period. The cooling-ff/look-up period is the amount of time given to the borrower for exiting digital loans, in case a borrower decides not to continue with the loan.
• Any charges that are not mentioned in the Key Fact Statement are not chargeable to borrowers at any stage during the loan term.
• The information shall be sent to the borrowers on their verified email/SMS on the successful execution of loan contract/transaction. The information must be sent on the letter head of bank and must contain Key Fact statement, summary of loan product, sanction letter, terms and conditions, account statements, privacy policies of the LSPs/DLAs with respect to borrowers data, etc.
• At the time of sign-up/on-boarding stage, information related to product features, loan limit and cost, etc.,must be informed to the borrowers.
• The banks, NBFCs must publish the list of their digital lending apps, lending service providers, engaged by them on their websites.