Digital lending has changed the way individuals and businesses access credit in India. Today, borrowers can apply for a loan, complete KYC, receive approval, sign documents, and receive funds without visiting a physical branch. This convenience has created significant opportunities for fintech startups, NBFCs, banks, technology companies, and financial marketplaces. However, launching a digital lending business is not simply a matter of incorporating a company and developing a mobile application. Lending is a regulated financial activity, and the legal structure of the business depends primarily on who actually provides the loan, whose money is being lent, who bears the credit risk, and what role the technology platform performs.

The Reserve Bank of India (RBI) has substantially strengthened the regulatory framework through the Reserve Bank of India (Digital Lending) Directions, 2025, issued on May 8, 2025. These Directions consolidate earlier digital-lending rules and regulate matters such as Lending Service Providers (LSPs), Digital Lending Apps (DLAs), borrower protection, loan disclosures, data collection, fund flows, grievance redressal, credit reporting and Default Loss Guarantee arrangements. Therefore, selecting the right legal structure is one of the most important decisions for anyone planning to start a digital lending business in India.

In this article, CA Manish Mishra talks about Legal Structure for Starting a Digital Lending Business.

What Is a Digital Lending Business?

Digital lending refers to a lending process conducted substantially through digital technology. The RBI describes it as a remote and automated lending process that largely uses digital technologies for activities such as customer acquisition, credit assessment, loan approval, disbursement, recovery and customer service.

A digital lending business may therefore involve activities such as online personal loans, MSME loans, consumer finance, merchant credit, invoice-based financing, embedded credit, buy-now-pay-later type credit structures, loan marketplaces or lending platforms. The important legal question is not whether the business operates through an app or website. The important question is:

Who is actually lending the money?

The answer determines the appropriate regulatory structure.

Major Legal Structures for a Digital Lending Business

Broadly, a digital lending startup in India can operate through one of the following models:

Each model has very different capital, compliance, risk and operational requirements.

Starting a Digital Lending Business as an NBFC

For entrepreneurs who want to lend their own funds directly to customers, an NBFC structure is generally the most relevant model. A lending-focused entity will usually operate as an NBFC-Investment and Credit Company (NBFC-ICC), depending on its precise activities. An NBFC is a company incorporated under the Companies Act that carries on financial activities as its principal business and is registered with the RBI.

The RBI applies the commonly known principal-business test under which financial assets and financial income are considered for determining whether financial activity constitutes the principal business of the company. For a startup that intends to provide loans directly to customers, the legal entity will normally need to be a company incorporated under the Companies Act, 2013, followed by an application to RBI for a Certificate of Registration. A normal LLP, partnership or proprietorship is therefore not an appropriate substitute for an RBI-registered NBFC where the business itself intends to operate as a regulated lender.

Minimum Net Owned Fund

Capital is one of the biggest barriers to starting an NBFC lending business. Under RBI's scale-based regulatory, a new NBFC-ICC that will have a customer interface or access public funds is generally subject to a minimum Net Owned Fund requirement of ₹10 crore. RBI's regulatory handbook similarly identifies ₹10 crore as the current NOF requirement for a customer-facing NBFC-ICC.

This capital requirement should not be confused with the amount of money the company intends to lend. Net Owned Fund is calculated according to RBI regulations and certain deductions and adjustments may apply. Therefore, promoters should carefully structure initial capital before submitting the RBI application.

RBI Certificate of Registration

Simply incorporating a private limited company with lending mentioned in its objects does not authorise the company to start an NBFC lending business. The company must obtain the appropriate Certificate of Registration from RBI before commencing regulated NBFC operations. RBI assesses several matters during the registration process, including the financial strength of the promoters, ownership structure, source of capital, directors' background, proposed business model, governance arrangements, technology infrastructure, risk-management systems and regulatory readiness.

At least one director of an NBFC is also expected to have relevant experience in banking or the NBFC sector under the scale-based regulatory. For founders who have sufficient capital and want complete control over underwriting, pricing, credit risk and the loan book, the NBFC route can provide a strong long-term structure.

Starting as a Lending Service Provider (LSP)

For many fintech startups, obtaining an NBFC licence at the beginning is commercially difficult because of the regulatory capital and compliance requirements. An alternative is to establish the startup as a technology company and partner with an existing bank or RBI-registered NBFC. In this structure, the fintech operates as a Lending Service Provider or LSP.

Under the RBI Digital Lending Directions, an LSP is an agent of a Regulated Entity that carries out one or more digital-lending functions, including customer acquisition, underwriting or pricing support, servicing, monitoring or recovery of loans on behalf of the regulated lender. The actual loan remains on the books of the bank or NBFC. For example, suppose ABC Fintech Private Limited develops an instant personal-loan application. Customers apply through ABC's mobile app, but XYZ NBFC evaluates and sanctions the loan and ultimately lends the money. ABC Fintech may operate as the LSP while XYZ NBFC remains the regulated lender.

Is RBI Registration Required for an LSP?

There is no standalone RBI "LSP licence" comparable to an NBFC Certificate of Registration merely because a technology company acts as an LSP. However, this does not mean that an LSP operates without regulatory controls. The regulated bank or NBFC must conduct enhanced due diligence before appointing an LSP. RBI requires the regulated lender to examine matters such as the LSP's technical capability, data-privacy framework, storage systems, treatment of borrowers, regulatory compliance capability and previous conduct.

The arrangement must also be governed by a contractual agreement clearly defining the rights, responsibilities and obligations of the parties. Importantly, outsourcing does not remove the regulated lender's responsibility: RBI states that the RE remains responsible and liable for the acts and omissions of its LSP. Consequently, banks and NBFCs generally perform extensive legal, compliance, cybersecurity and operational due diligence before onboarding fintech partners.

Best Entity Structure for an LSP

A private limited company is generally the most practical structure for a serious digital-lending fintech. It offers limited liability, allows institutional investment, supports ESOPs, facilitates contractual partnerships with banks/NBFCs, and provides a governance structure that financial institutions are accustomed to evaluating.

A company structure becomes particularly important where the fintech intends to provide a Default Loss Guarantee because RBI expressly requires an LSP providing a DLG to be incorporated as a company under the Companies Act, 2013.

Digital Lending App or DLA Structure

A mobile application or web platform facilitating digital lending may qualify as a Digital Lending App or Digital Lending Platform (DLA) under RBI regulations. A DLA may belong directly to a bank/NBFC or may be owned and operated by its LSP. One significant regulatory development is RBI's DLA reporting. Regulated entities must report their own DLAs and the DLAs of LSPs engaged by them through RBI's Centralised Information Management System. RBI subsequently makes this information available through its public DLA directory to help customers verify whether an application claiming association with an RBI-regulated lender is actually reported by such lender.

However, appearing in the directory does not mean that RBI has independently licensed or endorsed the fintech application. RBI specifically requires regulated entities to ensure that inclusion in the directory is not represented as an RBI registration, authorisation or endorsement. Therefore, marketing statements such as "RBI-approved loan app" should not be used merely because a fintech is working with an RBI-regulated NBFC.

NBFC-P2P Lending Platform

A completely different business structure exists for companies that want to connect lenders directly with borrowers through an online marketplace. Such platforms may fall under the NBFC-P2P Lending Platform. An NBFC-P2P does not normally lend money from its own balance sheet. Instead, it acts as an intermediary between participating lenders and borrowers.

RBI expressly provides that only a company can undertake the business of a P2P lending platform and that it must obtain an RBI Certificate of Registration. The minimum Net Owned Fund for an NBFC-P2P is presently ₹2 crore. An NBFC-P2P cannot function like an ordinary NBFC lender. It cannot lend on its own, guarantee repayment or provide credit enhancement. The lending risk remains with participating lenders. P2P platforms are also required to follow the prescribed escrow mechanism for movement of funds. Therefore, founders should not choose an NBFC-P2P licence simply because they want to operate an online lending application. The licence is intended for a specific marketplace model.

Co-Lending Structure

A digital lending business may also participate in a co-lending arrangement. Under co-lending, two regulated financial entities jointly fund a portfolio of loans according to an agreed proportion and share associated risks and revenues. RBI issued the Reserve Bank of India (Co-Lending Arrangements) Directions, 2025, with the framework applying to eligible regulated entities. Digital co-lending arrangements must additionally comply with the RBI Digital Lending Directions, 2025.

This means that a normal unregulated fintech cannot simply become a co-lender merely because it has developed the technology platform. It would ordinarily participate as an LSP or technology provider unless it separately qualifies as a regulated lending entity.

Borrower Protection Requirements

Regardless of how sophisticated the technology is, digital lending must remain transparent to borrowers. RBI requires regulated lenders to assess the borrower's creditworthiness before granting a loan and to obtain information regarding the borrower's economic profile, including at least age, occupation and income details. Automatic increases in a credit limit are also prohibited unless the borrower explicitly requests the increase and the lender evaluates that request.

One of the most important borrower documents is the Key Facts Statement (KFS). The KFS provides important information concerning the loan and its cost, including the Annual Percentage Rate and other relevant charges. Digital loan documents such as the KFS, sanction letter, terms and conditions, account statements and relevant privacy policies must be provided electronically to the borrower as prescribed by RBI. This is important because a fintech cannot attract customers with one headline interest rate while hiding mandatory charges elsewhere in the loan journey.

Rules Regarding Loan Disbursement and Repayment

The structure of money movement is another critical compliance issue. Under the RBI Digital Lending Directions, loan disbursement must generally be made directly by the regulated lender into the bank account of the borrower, subject to specified exceptions. The loan should not first enter the fintech or LSP's pool account before reaching the borrower.

Similarly, servicing and repayment must generally take place directly between the borrower's bank account and the regulated lender's bank account without using an LSP's pass-through or pool account. Fees payable to the LSP must also generally be paid by the regulated entity. An LSP should not separately collect its own charges from borrowers in circumvention of the regulated structure. These requirements must be considered while designing payment architecture and loan-management systems.

Cooling-Off Period

Digital lenders must provide borrowers with an opportunity to reconsider the loan. RBI requires an explicit option allowing the borrower to exit a digital loan during an initial cooling-off period by paying the principal and proportionate APR without penalty.

The regulated lender's board determines the cooling-off period under its lending policy, but it cannot be less than one day. A reasonable one-time processing fee may be retained where permitted, provided that this has been disclosed upfront in the KFS.

Data Privacy and Digital Lending

Digital lending companies process highly sensitive commercial and personal information, including identity information, financial data, bank details, credit information, income information and behavioural information. RBI therefore places strict restrictions on data collection. Data collection by a DLA must be need-based and undertaken with the borrower's prior and explicit consent, supported by an audit trail. Digital lending applications should not access mobile-phone resources such as contact lists, call logs, files, media or telephony functions merely for lending purposes.

Limited one-time access to features such as camera, microphone or location may be used where necessary for onboarding or KYC, subject to explicit consent. Borrowers must also receive meaningful choices concerning consent, sharing, retention and deletion of their data. RBI additionally requires digital-lending data to be stored on servers located in India. Where processing takes place outside India, the Digital Lending Directions prescribe requirements for bringing the data back to India and deleting it from servers outside India within the stipulated timeframe.

KYC and Anti-Money Laundering Compliance

Where the lender is an RBI-regulated entity, customer onboarding must comply with applicable KYC and anti-money-laundering requirements. The regulatory operates alongside the Prevention of Money Laundering Act, 2002, the rules made under it and RBI's Master Direction on KYC, as amended from time to time. RBI issued further amendments to its KYC Directions in June 2025.

Consequently, digital lending systems must be designed to support compliant customer identification, verification, record keeping, risk classification and ongoing monitoring. A fintech acting as an LSP may perform specified onboarding functions for the regulated lender, but responsibility for regulatory compliance ultimately remains with the regulated entity.

Credit Bureau Reporting

Digital loans are not outside the formal credit-reporting system merely because they are short-term or offered through an application. Under the Digital Lending Directions, regulated entities must report lending conducted through their own DLAs or their LSPs' DLAs to Credit Information Companies irrespective of the loan's nature or tenor.

Certain structured digital-credit and deferred-payment products are also subject to credit-information reporting requirements. Therefore, a business model based on numerous small digital loans cannot assume that such lending will remain outside traditional bureau reporting.

Default Loss Guarantee or DLG

Many bank-fintech and NBFC-fintech partnerships involve the fintech sharing a limited amount of credit risk. Such arrangements are regulated as Default Loss Guarantees (DLGs). A DLG is an arrangement under which the provider agrees to compensate the regulated lender for losses caused by defaults up to a predetermined amount. RBI permits DLG structures subject to strict conditions.

The LSP providing DLG must be a company, the agreement must be explicit and legally enforceable, and the DLG must generally be maintained in prescribed forms such as cash deposited with the regulated entity, a lien-marked fixed deposit with a scheduled commercial bank or an eligible bank guarantee. Most importantly, the total DLG cover on an identified portfolio cannot exceed 5% of the amount disbursed from that portfolio at any given time.

A DLG cannot substitute for proper underwriting. RBI expressly requires the regulated lender to maintain robust credit-appraisal standards regardless of the protection offered by the LSP. DLG arrangements are also prohibited for certain categories, including loans facilitated through NBFC-P2P platforms.

Grievance Redressal Requirements

Customer support cannot be treated merely as an operational function. Both the regulated lender and an LSP having an interface with customers must have appropriate grievance-redressal arrangements. The relevant nodal grievance officer's details must be prominently disclosed through the prescribed channels.

Where a borrower does not receive an appropriate response within the regulatory, eligible complaints may ultimately be escalated through RBI's Complaint Management System under the RBI Integrated Ombudsman. A digital lending startup should therefore design complaint-management processes before commercial launch rather than implementing them after customer complaints begin.

Multi-Lender Loan Marketplace

A fintech may partner with several banks and NBFCs simultaneously. Under the 2025 Digital Lending Directions, where an LSP has arrangements with multiple regulated lenders, the platform must provide the borrower with a digital view of matching loan offers. Relevant information includes the lender's identity, loan amount, tenor, APR, repayment obligation and applicable penal charges, together with access to the relevant KFS.

The platform must apply a consistent matching methodology for similarly situated borrowers and should not use deceptive or manipulative design patterns to push borrowers toward a particular lender. Ranking may be permitted when it is based on a publicly disclosed metric. Consequently, loan-comparison platforms must now treat algorithm design and user-interface design as regulatory compliance issues.

Which Legal Structure Should You Choose?

The appropriate structure depends primarily on the commercial objective. If the business wants to lend its own capital and maintain loans on its own balance sheet, an RBI-regulated NBFC structure is normally the appropriate route. If the startup primarily has technology, customer-acquisition capabilities or an underwriting platform but does not want to maintain the lending book itself, an LSP partnership with one or more banks/NBFCs may be more practical.

If the objective is to connect independent lenders and borrowers without lending from the company's own balance sheet, an NBFC-P2P structure may be considered. If the business wants to participate directly in a formal risk-sharing co-lending arrangement, it will ordinarily need to qualify as an eligible regulated lending entity rather than merely being a technology startup. The regulatory structure should therefore be decided before the app and financial model are finalised.

Why a Private Limited Company Is Usually Preferred

For most fintech founders, incorporating a private limited company is a practical starting point. It provides a recognised corporate structure, limited liability, easier equity investment, ESOP capability and a framework suitable for agreements with regulated banks and NBFCs. It also keeps open the possibility of developing the organisation toward an NBFC structure, subject to satisfying RBI requirements.

However, company incorporation itself does not provide permission to undertake regulated lending. A company should not start lending to the public merely because its Memorandum of Association contains financing objects. Where the activity constitutes regulated NBFC business, the appropriate RBI authorisation must be obtained before commencing such operations.

Important Legal Documents for a Digital Lending Business

A properly structured digital lender or fintech typically requires a comprehensive legal-documentation framework covering its relationship with the lender, borrowers, technology providers and other service providers.

Depending on the business model, this may include the LSP agreement, loan documentation, privacy policy, website/app terms, consent framework, KFS workflow, outsourcing agreements, recovery arrangements, information-security policies, grievance policy, data-retention policy, DLG documentation where applicable and internal compliance policies. These documents should reflect the actual technology and money flow of the business rather than being copied from another lending platform.

Common Mistakes While Starting a Digital Lending Business

The most common mistake is assuming that incorporating a fintech company automatically permits the company to lend money. Another major error is allowing customer funds to flow through the fintech's bank account even though the fintech is only an LSP.

Businesses also create unnecessary regulatory risk when they obtain excessive mobile permissions, collect contact lists or call logs, advertise themselves as "RBI approved", conceal charges from borrowers, provide misleading claims regarding instant or guaranteed loans, use aggressive recovery practices or create DLG structures exceeding regulatory limits. A strong digital lending business therefore needs legal and compliance architecture from the beginning not after the app has already gone live.

Conclusion

Starting a digital lending business in India requires much more than technology and access to customers. The first and most important step is deciding the correct legal and regulatory structure. A business lending from its own balance sheet may need to operate as an RBI-registered NBFC. A fintech that originates or services loans for banks and NBFCs may operate as an LSP. A true peer-to-peer marketplace requires an NBFC-P2P registration, while formal co-lending is primarily an arrangement between eligible regulated entities.

Once the model has been selected, founders must address company incorporation, RBI requirements, capital structure, KYC, credit reporting, borrower disclosures, fund flows, data protection, cybersecurity, grievance redressal, recovery practices and contractual arrangements. With the RBI (Digital Lending) Directions, 2025 now forming the core regulatory framework for digital lending, compliance needs to be built into the product from the first stage of development rather than added later. For entrepreneurs planning to enter this sector, determining whether the company will function as a lender, LSP, DLA operator, P2P platform or technology provider should therefore come before raising lending capital, signing NBFC partnerships or launching the application.

Frequently Asked Questions (FAQs)

Q1. What is the best legal structure for starting a digital lending business in India?

Ans. The appropriate structure depends on whether the business will lend its own money or only facilitate loans. Direct lending generally requires an RBI-regulated NBFC structure, while technology-driven platforms may operate as LSPs by partnering with banks or registered NBFCs.

Q2. Can a private limited company start giving digital loans in India?

Ans. A private limited company cannot automatically undertake regulated lending merely because lending activities are mentioned in its Memorandum of Association. If lending becomes its principal financial business, the company may need registration as an NBFC and must satisfy applicable RBI requirements.

Q3. Is an RBI licence required for a digital lending business?

Ans. An RBI licence is generally required where the entity itself intends to operate as a regulated lender or NBFC. However, a fintech functioning only as an LSP for an RBI-regulated bank or NBFC does not ordinarily require a separate NBFC licence.

Q4. What is an LSP in digital lending?

Ans. A Lending Service Provider, or LSP, is an entity that performs functions such as customer acquisition, loan servicing, underwriting support, pricing support, monitoring or recovery on behalf of a regulated lender such as a bank or NBFC.

Q5. Can an LSP lend its own money to customers?

Ans. An LSP cannot treat its status as a service provider as permission to undertake regulated lending from its own balance sheet. If the company intends to become the actual lender, it must evaluate whether an appropriate RBI-regulated NBFC structure is required.

Q6. What is the minimum capital required for an NBFC digital lending business?

Ans. For a customer-facing NBFC-ICC, the current minimum Net Owned Fund requirement is generally ₹10 crore, subject to the applicable RBI regulatory framework and exact NBFC category. Promoters must satisfy the prescribed capital requirements before commencing regulated operations.

Q7. What is an NBFC-P2P lending platform?

Ans. An NBFC-P2P is an RBI-regulated platform that connects eligible lenders with borrowers through an online marketplace. It generally does not lend its own funds and must obtain a Certificate of Registration from RBI before commencing P2P lending activities.

Q8. What is the minimum Net Owned Fund required for an NBFC-P2P?

Ans. A company seeking registration as an NBFC-P2P is currently required to maintain a minimum Net Owned Fund of ₹2 crore, or a higher amount if prescribed by RBI. The capital must be infused before issuance of the Certificate of Registration.

Q9. Can an LLP start a digital lending business?

Ans. An LLP may provide certain technology or support services depending upon its activities, but it cannot substitute for an RBI-registered NBFC where regulated lending is proposed. NBFC registration and NBFC-P2P registration are company-based regulatory structures.

Q10. What are the RBI Digital Lending Directions, 2025?

Ans. The RBI Digital Lending Directions, 2025 establish the regulatory framework for digital lending by regulated entities and their LSPs. They address borrower disclosures, data collection, fund flows, grievance redressal, credit reporting, DLAs, multi-lender platforms and Default Loss Guarantees.