RBI digital lending directions 2025: what still applies to LSPs, recovery and calls

Why RBI regulates digital lending, and where the rules sit now

Much of India's digital lending runs through loan apps and online platforms, and often through third parties rather than the lender itself. RBI set up a working group on the subject on 13 January 2021. Announcing its response on 10 August 2022, RBI said the concerns "primarily relate to unbridled engagement of third parties, mis-selling, breach of data privacy". It also named unfair business conduct, exorbitant interest rates and unethical recovery practices (RBI press release 2022-2023/689).

The answer RBI chose was to hold the regulated lender responsible for everything done in its name. Lending may be carried out only by entities RBI regulates or that another law permits to lend, and the apps and agents around them are treated as the lender's agents. The Guidelines on Digital Lending of 2 September 2022 put that into practice, and the RBI (Digital Lending) Directions, 2025 of 8 May 2025 replaced them with a fuller text.

Digital lending, in RBI's definition, is a remote and automated lending process, covering customer acquisition, credit assessment, disbursement, recovery and customer service (NBFC Credit Facilities Directions, para 4(1)(ix)). That breadth matters for calling teams, because a reminder or recovery call about a digital loan is part of the regulated process, not something outside it.

Lending service providers, and why the lender answers for them

The whole framework is built around one relationship: the lender and the firms it uses to run digital loans. A lending service provider (LSP) is an agent of the lender that carries out one or more of its digital lending functions on its behalf. Those functions include customer acquisition, help with underwriting and pricing, servicing, monitoring and recovery. Another lender can also act as an LSP (para 4(1)(xix)).

Read that definition beside the definition of digital lending and a call centre or voice-agent vendor that calls borrowers about a digital loan is very likely doing an LSP function. That is our inference from the text. RBI has not said anything specific about calling vendors, but nothing in the definition depends on whether the work is done by people, software or both.

The consequence is liability. Outsourcing to an LSP does not dilute the lender's obligations, and the lender "shall remain fully responsible and liable for all acts and omissions of the LSP" (para 6(7)). If a vendor's caller misleads a borrower, threatens them or mishandles their data, the regulator looks to the lender, not to the vendor's contract.

Because the lender carries that risk, the rules also tell it how to manage it. It must sign a contract that sets out each side's role, carry out enhanced due diligence before signing, and review the LSP's conduct regularly (paras 6(1) to 6(3)). The due diligence must cover the LSP's past conduct and its "fairness in conduct with borrowers", which for a calling vendor would sensibly include its scripts, escalation rules and complaint history.

Two further duties link this chapter to RBI's other rulebooks. Where an LSP acts as a recovery agent, the lender must guide it and make sure it follows RBI's Responsible Business Conduct Directions (para 6(5)). The lender must also keep applying RBI's outsourcing directions to its LSPs (para 6(6)). Those bring their own due-diligence, audit and data duties, explained in the guide to RBI outsourcing rules for recovery agencies and AI vendors. A vendor due-diligence questionnaire is one way to collect the evidence.

What borrowers must be told, and when

Liability runs alongside transparency. The rules require the lender to name every firm acting for it and to send the borrower the key documents without being asked. Both respond to the "unbridled engagement of third parties" that RBI named as its first concern in 2022.

Borrower data: no contact lists, minimal storage, servers in India

The data rules answer two of the concerns RBI named in 2022, breach of data privacy and unethical recovery practices. Collection of data by the lending apps of the lender and its LSPs must be need-based and made with the borrower's prior and explicit consent, with an audit trail (para 13(1)).

The same paragraph tells those apps to "desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions". One-time access to the camera, microphone or location is allowed only for onboarding or KYC (know your customer) checks, again with explicit consent. The borrower can refuse or revoke consent for particular uses and ask for their data to be deleted (para 13(2)). Personal information may be shared with a third party only with explicit consent, unless a law requires the sharing (para 13(4)).

The limits extend to what LSPs keep. They may store only basic minimal data, such as name, address and contact details, needed for their work (para 14(1)). All data must sit on servers in India, and data processed abroad must be deleted there and brought back within 24 hours (para 14(4)). No biometric data may be collected or stored unless a law allows it (para 14(3)).

A separate rule closes the loop on recovery. From 1 January 2027, recovery staff and agents may discuss dues only with the borrower or guarantor (NBFC Responsible Business Conduct Directions, para 100Y(1)). Together, the contact-list ban and that rule keep the borrower's contacts out of recovery altogether. India's general privacy law adds its own duties on top, covered in the guide to the DPDP Act for voice AI.

What changes for calls through LSPs on 1 January 2027

The digital lending chapter itself is stable, but two sets of amendments to RBI's conduct rules start on 1 January 2027 and change how LSPs may call. The recovery amendments of 6 August 2026 widen who counts as a recovery agency. Any outside party engaged to help recover a defaulting borrower's dues counts, "irrespective of the contractual designation / nomenclature used" (NBFC direction RBI/2026-27/230, para 6(11A)). In our reading, an LSP doing recovery work falls inside that definition.

If so, recovery calls through an LSP follow the new recovery rules. The lender must record the calls, keep the recordings for six months and log the time and number of calls (para 100P). Contact is allowed only between 08:00 and 19:00 unless the borrower asks otherwise (para 100Y(4)). The list of recovery agencies on the website must be updated within seven calendar days of a change (para 100K), and every recovery communication must name the grievance officer (para 100AA). The guide to RBI recovery agent rules from 1 January 2027 explains each duty, and how long to keep call recordings in India sets the six months beside other retention periods.

The sales amendments of 15 June 2026 cover direct selling and marketing agents (RBI/2026-27/123). Anyone other than the lender's own staff who is engaged to sell or market its products is such an agent, whatever the contract says. The text gives LSPs as an example (NBFC RBC Directions, para 6(2B)). An LSP that makes sales calls therefore also comes under RBI's sales and marketing rules from 1 January 2027.

Where AI voice agents fit

None of these rules was written with automated callers in mind. Neither the digital lending chapter nor the recovery amendments mention automated, IVR (interactive voice response) or AI calls. They speak of LSPs, recovery agencies and recovery agents, words drafted with firms and people in mind.

Nothing in them exempts software either. Because the lender is fully liable for its LSP's acts, the practical reading is to hold an AI caller to the same disclosure, contact, data and recording rules as a human agent. RBI has not confirmed this, so it is a cautious interpretation rather than a stated requirement.

Many of the duties become settings rather than training. On Sonex, for example, outbound campaigns carry calling windows, time zones and retry limits, and calls are kept as recordings and transcripts, which is the approach behind AI collections calls for banks and lenders. The pre-contact notice, the LSP listing and the data limits still depend on the lender's own processes.

One rule needs checking before any voice feature is switched on. The lender and LSP must not collect or store biometric data unless a law allows it (para 14(3)), and the directions do not define the term. A voiceprint used to recognise a caller may well count, so ask counsel before using one; the guide on whether a voiceprint is biometric data sets out how other laws treat it.

Key dates