Instant Loan Apps: RBI Rules Every Borrower Should Know
RBI rules for instant loan apps under the Digital Lending Directions, 2025: KFS and APR, cooling-off period, data limits and how to spot illegal apps.
In this article
Instant loan apps are legal in India only when they lend on behalf of an RBI-regulated bank or NBFC and follow the Reserve Bank of India (Digital Lending) Directions, 2025. These rules require a Key Fact Statement with the full annual percentage rate (APR) before you sign, direct disbursal into your bank account, a cooling-off period to exit the loan, strict limits on accessing your phone data, and a named grievance officer. An app that breaks these rules is either non-compliant or outright illegal.
Who regulates loan apps?
The RBI does not license apps. It regulates the regulated entity (RE) — the bank or NBFC that actually lends the money. An app may be:
- The RE's own app (a bank or NBFC lending directly), or
- An app run by a lending service provider (LSP), a fintech that sources customers or collects repayments for one or more REs.
Either way, the RE is responsible for the app's conduct. The Digital Lending Directions, 2025, issued on 8 May 2025, consolidated the 2022 digital lending guidelines and later circulars into one set of rules.
Key RBI rules for digital loans
1. Key Fact Statement with APR
Before you sign, the lender must give you a Key Fact Statement (KFS) in a standard format showing the loan amount, tenure, interest rate, all fees and charges, the annual percentage rate (APR), the repayment schedule, the cooling-off period, recovery arrangements and grievance contacts. Any fee not in the KFS cannot be charged later.
2. Money flows only between you and the lender
Disbursement must go directly into your bank account from the RE, and repayment must go directly to the RE, not through an LSP's or anyone's personal account (except in limited cases RBI allows). Any request to pay EMIs into a personal UPI ID or a third party's account is a red flag.
3. Cooling-off period
You get a cooling-off period, set by the lender's board but not less than one day, to exit the loan by repaying the principal and proportionate interest without any penalty. The lender may keep a reasonable one-time processing fee only if this was disclosed in the KFS.
4. No automatic credit limit increases
The lender cannot raise your credit limit without your explicit consent.
5. Data and phone permissions
- Data can be collected only with your explicit, purpose-specific consent, and you can withdraw consent and ask for deletion.
- Apps must not access your contacts, call logs, files and media, or telephony functions. One-time access to the camera, microphone or location for onboarding/KYC is allowed with consent.
- Data must be stored on servers in India.
6. Multi-lender platforms
If an LSP shows offers from several lenders, it must display all matching offers with the lender name, amount, tenure, APR and EMI in an unbiased way, so you can compare.
7. Recovery conduct
The lender must tell you in advance the name of any recovery agent or LSP authorised to contact you. RBI's rules bar threats, abuse, calls at odd hours (before 8 am or after 7 pm) and contacting your friends or relatives to shame you. See loan recovery agent harassment rights.
8. Grievance redressal
Every app must display the name and contact of a grievance redressal officer. If your complaint is not resolved within 30 days, you can escalate to the RBI Integrated Ombudsman at cms.rbi.org.in.
How to check whether a loan app is genuine
- Check RBI's DLA list. On rbi.org.in, go to Citizen's Corner and open the list of "DLAs deployed by Regulated Entities". RBI publishes this list from lenders' own submissions, so it confirms the app's link to a regulated lender, not that it is risk-free.
- Verify the lender. The app and its website must name the bank or NBFC. Confirm the NBFC is registered on RBI's website.
- Look for the KFS. No KFS before signing, or a KFS without the APR, is a serious warning.
- Check permissions. An app demanding access to contacts or gallery is breaking RBI rules.
- Watch for upfront fees. A genuine lender deducts fees from the disbursed amount and shows them in the KFS; it never asks you to pay "insurance" or "GST" before releasing the loan.
- Check lookalike names. Fraud apps copy the names and logos of legitimate lenders.
You can also check entities and report unauthorised deposit-takers or lenders on RBI's Sachet portal (sachet.rbi.org.in).
Worked example: why APR matters
An app offers "₹10,000 for 30 days at just 2% a month". Read the KFS:
- Loan amount: ₹10,000
- Processing fee: ₹1,000 + 18% GST = ₹1,180, deducted upfront
- Interest: 2% for one month = ₹200
- Amount you actually receive: ₹10,000 − ₹1,180 = ₹8,820
- Amount you repay after 30 days: ₹10,200
Cost of credit = ₹10,200 − ₹8,820 = ₹1,380 on ₹8,820 for 30 days.
- Cost for the month = 1,380 ÷ 8,820 = 15.6%
- Annualised (simple) = 15.6% × 365 ÷ 30 ≈ 190% a year
The "2% a month" headline hides an effective cost close to 190% a year. That is why RBI requires the APR, including all fees, to be shown in the KFS. For a normal multi-month personal loan, compare the APR across lenders and check the EMI in our EMI calculator.
Legal app vs illegal app: quick comparison
| Feature | Compliant app | Illegal / non-compliant app |
|---|---|---|
| Lender named | Yes, a registered bank or NBFC | Vague or none |
| KFS with APR before signing | Yes | No, or fees revealed later |
| Disbursement | Direct to your bank account by the lender | From individuals or random accounts |
| Phone permissions | Camera/location for KYC only | Contacts, gallery, call logs |
| Tenure | Clearly stated | Often 7 days with heavy "extension fees" |
| Recovery | Named agents, regulated conduct | Threats, morphed photos, messages to contacts |
| Grievance officer | Named in app | None |
If you are already stuck with an illegal app
- Do not pay more to "settle" under threats; extortion rarely stops after payment.
- Save evidence: screenshots, call recordings, payment proofs, the app name and download link.
- Report at cybercrime.gov.in or call 1930, and file a police complaint for threats or morphed images.
- Uninstall the app after collecting evidence and revoke its permissions; inform your contacts that any messages are fraudulent.
Our step-by-step guide on fake loan app fraud and how to report it covers this in detail.
Key takeaways
- Loan apps are legal only when they lend on behalf of an RBI-regulated bank or NBFC under the Digital Lending Directions, 2025.
- You must get a Key Fact Statement with the full APR before signing, and money must move directly between your account and the lender's.
- A cooling-off period of at least one day lets you exit a digital loan without penalty.
- Apps cannot access contacts, call logs or media; harassment and shaming are prohibited.
- Check RBI's DLA list and the lender's registration, compare APRs, and report fraud on 1930 or cybercrime.gov.in.
Frequently asked questions
How do I know if a loan app is RBI approved?
RBI does not approve apps; it regulates the bank or NBFC behind them. Check the RBI website's list of digital lending apps deployed by regulated entities under Citizen's Corner, confirm the named lender is a registered bank or NBFC, and make sure the app's name and lender match.
Can a loan app access my contacts and photos?
No. Under RBI's digital lending rules, apps must not access phone resources such as contacts, call logs, files and media. Only one-time access to the camera, microphone or location for KYC is allowed, with your explicit consent.
What is the cooling-off period on a digital loan?
It is a window after taking a digital loan during which you can exit by repaying the principal and proportionate interest without any prepayment penalty. The lender's board decides the period, which cannot be less than one day.
Can a loan app send money through a third party account?
No. Disbursement must go directly from the regulated lender to your bank account, and repayments must go directly to the lender's account, except in a few situations specifically allowed by RBI. Paying into a personal or third-party account is a warning sign.
Where can I complain against a loan app?
First complain to the lender's grievance redressal officer, whose details must be shown in the app. If not resolved in 30 days, file with the RBI Integrated Ombudsman at cms.rbi.org.in. For harassment or fraud, call 1930 or report at cybercrime.gov.in.
This article is for general education and is not personalised financial, tax or legal advice. Rates and rules are as of 19 Oct 2026; confirm current terms with your lender, AMC or a qualified adviser.
