For an NBFC, digital lending is not just about faster approvals. It is about managing technology, partners, customer data, credit risk and compliance as one connected system.
In digital lending, a small trader may apply for a 40,000 loan on a weekday evening. He downloads an app, enters his details, gives consent and accepts the offer. Within minutes, the money is in his bank account.
For the customer, it feels effortless.
But behind that screen sits a whole chain of businesses. One company owns the app. Another provides the credit-scoring technology. A third stores the customer’s data. A lending partner may have found the customer, and another agency may handle collections.
The customer sees one lender. The RBI sees the entire chain.
A loan may be approved in minutes, but the NBFC stays accountable for that decision for years: through a customer complaint, an RBI inspection, a cyber incident, a data breach, or a slow deterioration in the loan book.
Digital lending, therefore, is not just a technology story. It is a test of institutional control.
In a branch, managers can see the customers, documents and process. In digital lending, this is not possible. So, controls must be built into the digital process itself.
The growth is real. So is the risk.
According to the RBI’s Financial Stability Report, June 2026, fintech firms held 56.8% of small personal loans below 50,000 as of March 2026. Their lending in this segment grew 41.6%, against 20.1% for the segment overall.
But there is another side. The delinquency rate on these loans, meaning the share falling behind on repayment, stood at 6.4%, and about 70.5% were unsecured. The RBI has flagged the possible risk to asset quality.
This does not make digital lending a problem. It shows why speed must be backed by strong credit and compliance controls. The opportunity is significant: digital platforms reach gig workers, first-time borrowers and small traders who may never walk into a branch, and bank statements and transaction data help assess them faster. The challenge is making sure growth never moves faster than control.
Where can things go wrong?
1. The partner can be outsourced. The responsibility is not.
An NBFC may outsource customer acquisition, technology, underwriting support or collections, but it cannot outsource accountability. Under the RBI framework, the NBFC is responsible for the acts and omissions of its lending partners. Checks therefore cannot stop at signing the agreement. The NBFC must know who the partner is, what it is doing, what data it can access, what customers are being told, and whether the agreed process is actually being followed.
2. A credit decision should not become a black box.
Automated tools now influence many lending decisions. Imagine a borrower asking, “Why was my loan rejected?” If nobody inside the NBFC can explain, the technology has created a governance problem. The RBI also sets clear limits on what lending apps may access: contacts, files and call records are off limits, and customers must be able to give, refuse or withdraw consent. The practical test: can we explain what data was used, why it was used and how it is protected?
3. Technology vendor can be NBFCs weakest link.
In the RBI’s cyber survey of 33 banks and 10 large NBFCs, 93% depended, partly or substantially, on outside vendors for cybersecurity functions. Three-fourths reported moderate to very high dependence on third-party technology for critical applications, and attacks aided by artificial intelligence were seen as the leading near-term concern. The reality is uncomfortable: the NBFC may own the loan, but someone else may own the technology that processes it. Vendor risk is business risk, not just an IT issue.
4. A guarantee is not a substitute for good underwriting.
A partner may guarantee some of the losses, but only within limits. The cover is capped at 5% of the loans disbursed, must be held as cash, a bank-locked deposit or a bank guarantee, and must be claimed within 120 days of the loan becoming overdue. It can never replace the NBFC’s own credit assessment. And when selling is unfair or recovery is harsh, this is where all these risks finally reach the customer.
What should an NBFC compliance team actually do?
Compliance works best when it is part of the lending process, not a checklist completed afterwards.
- Know every digital lending arrangement. Keep a complete and accurate record of every lending app and partner arrangement, report it to the RBI as required, and show the details on your website. The officer who certifies the list should have actually reviewed the apps.
- Monitor partners after onboarding. Due diligence does not end with the agreement. Review customer communication, sourcing practices, data access, underwriting, collections and complaints regularly. A partner that was compliant six months ago may not be compliant today.
- Walk through the journey like a customer. Use your own app. Can a borrower easily find the Key Fact Statement (the one-page loan summary), the true yearly cost, the cooling-off period of at least one day, and the grievance details?
- Minimise data, maximise control. Take only the data the loan needs, with clear and recorded consent that the borrower can refuse or withdraw. Partners should hold only minimal data, and data should be stored in India.
- Make documentation automatic. The Key Fact Statement, sanction letter, terms and account statements should reach the borrower digitally, without the customer having to ask repeatedly.
- Follow the money. Disburse directly into the borrower’s bank account and take repayments directly into the NBFC’s account, with no partner-controlled pool account in between. Partner fees should be paid by the NBFC, not collected from borrowers.
- Track guarantees and credit reporting. Report every digital loan to the credit bureaus. For guarantees, obtain the partner’s auditor-certified statement at the start and at each renewal, stay within the limit, and track the 120-day period.
- Treat grievances as an early warning. Publish the grievance officer’s details. If a complaint is rejected or left unanswered for 30 days, the borrower may approach the RBI. Tell borrowers who the recovery agent is before contact, and watch complaints partner by partner, because a rising count often signals trouble ahead.
A question for Management
Boards and management should ask not only how quickly a loan can be approved, but whether the institution can show the customer, the auditor and the regulator how each step was carried out and who was responsible for it. Speed is what the customer sees. Accountability is what the regulator sees. The strength of the whole chain is what the balance sheet eventually reflects.
In digital lending, technology can be borrowed. Accountability cannot.
Sources
1. Reserve Bank of India, Financial Stability Report, June 2026
2. Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025
The article is written by Mr. Ashok Pathak