Summary: RBI report on regulating digital lending and curbing the menace of predatory lending apps

Over the last year, hundreds of unauthorised digital lending apps have popped up on Google’s Play Store targeting vulnerable Indian borrowers, charging them exorbitant interest rates, and resorting to extortion and blackmail tactics to collect payments. In more than a few cases, these practices have resulted in borrowers committing suicide.

Generally, third-party loan marketplaces and apps which work with regulated banks and non-bank lenders have to follow strict guidelines on interest rates and collection practices, but many of the predatory lending apps that have emerged in the last year either work with small non-bank lenders, which are licensed by the RBI, or they work outside any rules or regulatory framework.

Against this backdrop, the Reserve Bank of India constituted a Working Group (WG) in January to study all aspects of digital lending so that an appropriate regulatory approach can be put in place.

Legal and Regulatory Recommendations

Enhancing the regulatory framework

1. Lending apps must be verified by an independent nodal agency: An independent nodal agency styled as Digital India Trust Agency (DIGITA) should be set up to ensure that only authorised and trusted DLAs are used by consumers. This agency will be responsible for verifying digital lending and fintech apps before such apps are publicly distributed and will maintain a public register of all verified apps. (Recommendation)
2. A self-regulatory organization (SRO) should be set up for digital lending: Given the need for certain standards and protocols to be followed by the entire partner ecosystem, the working group recommends that a self-regulatory organization (SRO) covering DLAs/ LSPs in the digital lending ecosystem may be set up.  (Recommendation)
3. RBI may develop a separate framework for customer-facing activities: Going by the increasing trend of business models leveraging the use of agents and third parties including LSPs, RBI may develop a separate framework styled as Agency Financial Service Regulation (AFSR) for all customer-facing, fully outsourced activities of REs including the services provided by LSPs. (Suggestion)
4. The government can implement separate legislation for non regulated entities involved in lending: Similar to the Banning of Unregulated Deposit Scheme Act, 2019, the government may consider implementing the Banning of Unregulated Lending Activities (BULA) Act, which would cover all entities not regulated and authorized by RBI for undertaking lending business or entities not registered under any other law for specifically undertaking public lending business. (Recommendation)
5. A separate regulation for consumer protection pertaining to financial services may be implemented: Although the Consumer Protection Act, 2019 covers banking, financing, insurance as services under its ambit, the nature of a financial consumer and consumer of other goods and services differ vastly. To provide adequate recourse to financial consumers including that of digital lending, a separate National Financial Consumer Protection Regulation under the above Act may be developed. (Suggestion)
6. Short Term Consumer Credit (STCC) may be defined to include digital lending: Short Term Consumer Credit (STCC) may be defined to include digital lending as is done in certain jurisdictions and appropriate regulations, on similar lines as that for microfinance institutions (MFIs) can be framed. (Suggestion)

Reinforcing digital lending oversight

1. REs should not be allowed to extend any arrangements like First Loan Default Guarantee: To prevent loan origination by unregulated entities, REs should not be allowed to extend any arrangement involving a synthetic structure, such as the First Loan Default Guarantee (FLDG) to such entities. REs should not allow their balance sheets to be used by unregulated entities in any form to assume credit risk. (Recommendation)
2. SLCC mechanism should cover digital financial space: The State Level Coordination Committee (SLCC) formed in all states to facilitate information sharing among different regulators should additionally cover issues in the digital financial space.
   • Reports on unauthorized apps: SLCC should cover reports on unauthorized apps in the market involved in digital lending or illegal recovery and other types of activities associated with suspected fraud. A centralized and fully digitalized data repository may be created for all issues in order to provide a country-wide view of market intelligence (MI) in real-time. (Recommendation)
   • TRAI should be part of SLCC: Given the increasingly critical role played by mobile phones and mobile network operators (MNOs) in the financial system, TRAI should be inducted as a member or need-based invitee of SLCC. (Recommendation)
   • KYC for new/replacement SIM cards should be strengthened: Since SIM cards are a major vector for frauds in digital lending products, the KYC rigor for issuance of new and replacement SIM cards should be strengthened. (Suggestion)
   • Inactive participants must be reviewed: To pre-empt unscrupulous practices such as “rent-a-license” by inactive NBFCs, those who have been granted certificate of registration (CoR) with provision of digital lending but have not carried out such activity for a reasonably long period should be reviewed with an appropriate supervisory follow-up. (Recommendation)
   • Registrar of Companies can step up efforts in identifying shell companies: The Registrar of Companies (RoC) may consider enhancing the use of digital technology and multiple data sources for early identification of shell finance companies and finance companies and make arrangements for real time data sharing with RBI on the de-listing of such companies. (Suggestion)
3. Rules for OTPs and alerts must be refined: The payment system regulation should refine “travel rules” for narration of One Time Password (OTP) and SMS or e-mail alerts sent to users to, at minimum, display certain details such as transaction amount, available balance, name of the receiver/ beneficiary as returned by the receiver’s bank or PPI issuer. (Recommendation)
4. Relevant inputs on unscrupulous lenders should be made available: Relevant inputs from proposed Digital Intelligence Unit of Government, existing Telecom Analytics for Fraud Management and Consumer Protection (TAFCOP), and Telecom Commercial Communications Customer Preference Regulations (TCCCPR) 2018 should be made available to respective regulators. (Suggestion)
5. A National Financial Crime Record Bureau (NFCRB) may be considered: Similar to the National Crime Records Bureau (NCRB), a National Financial Crime Record Bureau (NFCRB) with a data registry similar to CCTNS (Crime and Criminal Tracking Network and Systems) may be considered by the government. (Suggestion)
6. Law enforcement must proactively ensure no unauthorized call centers operate: The local law enforcement and police agencies must proactively surveil that no unauthorized call center operates from sites under their jurisdictions. (Suggestion)
7. Non-traditional market monitoring needs to be strengthened: Non-traditional market monitoring needs to strengthened through social media monitoring and web-scraping to identify the conduct issues associated with digital lending apps. All kinds of publicity material and direct advertisement over the web of unverified digital lending apps may be continuously monitored and appropriate action taken. (Recommendation)
8. Bank account operated from overseas need to be monitored: Bank accounts regularly operated from a different or overseas IP address, not consistent with KYC profile of the account holder, need to be monitored by banks for suspicious activities. (Recommendation)

Data governance

1. Data Protection Authority proposed in PDP Bill could oversee financial apps as well: The Data Protection Authority, proposed in the Personal Data Protection (PDP) Bill, could serve as the regulatory body to oversee financial apps as well in the future. (Suggestion)
2. Until PDP Bill is passed, regulatory guidance may cover: 
   • Clarity on how data is processed: As multiple players have access to sensitive consumer and financial data, there must be clarity on issues like, the type of data that can be held, the length of time data can be held, restrictions on the use of data, data destruction protocols etc. (Recommendation)
   • DLA of REs must have a comprehensive and compliant privacy policy available publicly and details of any third parties, that are allowed to collect personal information via DLA, have also to be disclosed. It is desirable that privacy practices of the DLAs are disclosed on the app at every stage, i.e., before requesting user permission to use personal data, during account sign up or login page, payment page, etc. Users will also have the facility to request more details on the information that is collected. (Recommendation)
   • Data should be collected with prior informed and explicit consent of the borrower which can be audited, if required. User Interface should not facilitate ‘trick consent’. The borrower should be provided with an option to revoke consent granted if required, make the app forget the data. After uninstallation of the app, there should not be any trace of access permission from the phone. Consumers should be able to give or deny consent for the use of specific data, its use, disclosure to outside entities (private, public or legal), and its retention and destruction. Consumers should be able to issue separate consent for each type of data that LSPs are accessing. Codifying consent practices and recourse should be available in the case of data misuse. (Recommendation)
   • Privacy breaches must be notified: DLAs of REs should be required to notify consumers about detection of any privacy breaches that may leave their data vulnerable and suggest ways for consumers to respond to those breaches. (Recommendation)
   • Phone permissions must be need-based: Permission to DLAs for using phone sensors and data like contacts should be subject to need-based and stage-based requirements. (Recommendation)
   • Biometric data should don’t be collected or stored by DLA: If functionalities of any utilities like the Aadhaar infrastructure, e-KYC, UPI etc. are used, no biometric data should be stored or collected in the systems associated with the DLA of REs. (Recommendation)
3. Data privacy and security measures of SMS service providers should be ensured by REs or DLAs before onboarding them. (Suggestion)

Fair and respectful treatment of borrowers

1. There is a need to develop responsible borrowing culture in the digital lending landscape as much as responsible lending. This exercise of developing a positive financial behavior and attitude has to be taken up both by the industry as well as by regulators and government. (Recommendation)
2. Customer harassment needs to be defined by SRO: Fair treatment of borrowers in financial difficulty includes the lender’s obligation to detect consumers going into repayment difficulties; engage with those consumers at an early stage to identify the causes for those difficulties and provide necessary information; help the borrower to address temporary financial difficulties and return to normal situation. Customer harassment needs to be suitably defined by the SRO in consultation with RBI. Disclosure of the type of debt that can be collected by LSP on behalf of an RE, the person who can collect such debt and the manner in which such debt can be collected, should be specified in the loan agreement with the borrower. (Recommendation)
3. Since Partnership with consumer-facing LSPs is a dominant model in digital lending:
   • REs must conduct enhanced due diligence before entering into a partnership with an LSP. RBI should incorporate appropriate provisions in the proposed Agency Financial Services Regulations. (Recommendation)
   • REs should be required to put in place detailed fair collection policies and procedures on their website. In view of increasing significance and reach of DLAs and consequent concerns over unethical recovery practices, there is a need to standardize the code of conduct for recovery to be framed by the proposed SRO in consultation with RBI. In the event, a debt collector needs to contact any third party about a borrower’s debt, such arrangements need to be explicitly factored in the loan agreement. REs should ensure that LSPs are prohibited from employing abusive debt-collection practices including the use of false statements, practices akin to or constituting harassment, or giving of false or unauthorized credit information to third parties. (Recommendation)
   • REs are required to display the names of entities they have deployed for recovery operations on their website with adequate details. It may be mandated that the lender communicates to the borrower, at the time of sanction of the loan, the details of any LSP who can approach the customer for recovery. (Recommendation)
   • Recover agency must undergo adequate training: The recovery agents, both off-site and onsite, should be required to undergo adequate training and accreditation to discharge their responsibilities with care and sensitivity. The institutional mechanism for accreditation can be worked out by the broader industry in consultation with RBI. (Recommendation)
   • The lenders should carry out periodic review of the conduct of the LSPs engaged in recovery and scan for their name in any ‘negative’ list or report its name to ‘negative’ list if there is significant breach of any code. In order to check the activities of dubious LSPs, an easier mechanism should be made available to lodge complaints about harsh treatment by such entities. The ‘negative list’ of LSPs to be maintained by the SRO should be meticulously followed for compliance. (Recommendation)
4. Formally disputed repayments should be indicated in the credit report along with the disputed amount vis-à-vis default or repaid amount. Certain types of updates or inquiries with credit information companies about credit history of the borrower by any entity should be intimated to the borrower by SMS or email to avoid any misreporting or unsolicited enquiries. Reasonable free access to the borrower for own data should also be considered by CICs. (Recommendation)

Comments from stakeholders

Gaurav Chopra, Founder and CEO, IndiaLends and Founding member of Digital Lending Association of India (DLAI):

“We believe that recommendations such as on auditable logs for every action that a user performs on the app, will be a game changer for India’s digital lending industry. It will demolish many existing loan sharks and curb unfair practises. Moreover, the recommendation for digital lenders to provide a key fact statement in a standardised format including the Annual Percentage Rate will give a better perspective to borrowers about the high percentage rate they are willing to bear.”

Ankit Rata, Co-founder and CEO, Signzy:

“Currently, the industry is seeing many unregulated digital lenders operating in the space, who do not even have basic KYC checks in place. We believe that if the recommendations are passed, it will not only help protect consumers but also restrict breaches of data privacy while curbing fraudulent transactions.”

Lalit Mehta, Co-founder and CEO, Decimal Technologies:

“Digital lending innovation is crucial for the country as it has the potential to address the credit gap, especially among MSMEs and the population living in underbanked areas. Integrating protection of consumers and transparency into the digital lending landscape will significantly increase the number of people with access to formal banking and sources of credit, eliminating the informal players. Another important point to note is the report’s focus on encouraging innovations – this can lead to growth for products that address the specific needs of the underserved that do not always have the documentation required by traditional financial institutions for a loan application.”