Check If A Loan App Is RBI-Registered — citizen guide 2026

Before you tap “Get loan in 5 minutes”, spend three minutes proving the app is legal. As of 1 July 2025 the Reserve Bank of India runs a public Digital Lending Apps (DLAs) directory on rbi.org.in, and from 28 January 2026 Google Play removes any India personal-loan app not on the RBI list. This guide shows the exact three checks — the RBI DLA directory, the Sachet portal and the NBFC list — that tell you, before you borrow, whether the app behind the loan is a genuine RBI-regulated lender or an illegal one.

An app itself is not “registered” — the lender behind it must be regulated. Under the Reserve Bank of India (Digital Lending) Directions, 2025, lending is allowed only by a Regulated Entity (RE) — a bank or an RBI-registered NBFC — or by a Lending Service Provider (LSP) acting as that RE's agent. If no regulated bank or NBFC stands behind the app, the loan is illegal. That single test settles most safety questions.

The governing instrument is the Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025, which consolidate and replace the earlier Guidelines on Digital Lending, 2022 and the 2023 Default Loss Guarantee (FLDG) framework into one rulebook. Three citizen-facing protections matter:

• Only REs or their LSPs may lend. A genuine app must name the bank or NBFC funding the loan. (RBI Digital Lending Directions, 2025.)
• Key Fact Statement (KFS) is mandatory. The RE must give you a KFS — stating the loan amount, the Annual Percentage Rate (APR), all fees and the cooling-off period — before you accept the loan, per the RBI KFS circular of April 2024. No KFS is a red flag.
• Direct disbursal, no pass-through pool. Loan money must move directly between your bank account and the RE's; fees cannot be skimmed by a middle app.

The regulator is the Reserve Bank of India (rbi.org.in), the Department of Regulation. The Sachet portal is run under RBI's State Level Coordination Committee mechanism, covering RBI, SEBI, IRDAI, PFRDA, NHB and CRCS. On the policy intent, see the Supreme Court's recognition of informational privacy in K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 — the basis for the Directions' ban on harvesting your contacts and gallery.

1. Find the lender's name first. Open the app's Play Store description and the in-app “About”/loan terms. A legal app names the regulated bank or NBFC funding the loan and shows that RE's RBI Certificate of Registration (CoR). No named RE? Stop here.
2. Check the RBI Digital Lending Apps (DLAs) directory. Go to rbi.org.in and open the Digital Lending Apps (DLAs) directory (live since 1 July 2025). It lists every DLA that regulated entities have reported to RBI through its CIMS system. If the app and its claimed RE appear linked there, the association is genuine. The data is filed by the REs themselves; RBI does not vouch for any app — absence or mismatch is your warning.
3. Verify the NBFC on the RBI list. Open the RBI NBFC list at rbi.org.in/Scripts/BS_NBFCList.aspx. Confirm the lender appears in the active list — and is not in the cancelled-CoR list. Match the exact legal name and CoR number, not a similar-sounding brand.
4. Cross-check on Sachet. On sachet.rbi.org.in use “List of registered entities” to confirm the lender is registered, and scan “What's New” for public notices against fraudulent entities. Sachet is free and available in 13 languages.
5. Demand the Key Fact Statement (KFS). Before accepting, insist on the KFS showing the APR and every charge. A genuine RE shows it up front; an illegal app hides total cost behind “processing”, “GST” and “insurance” fees.
6. Read the permissions. A compliant app asks only for camera (KYC) and one-time access; it cannot demand your full contact list, gallery or SMS. Blanket contacts/gallery access is itself a violation of the Directions.

• Upfront fees before disbursal — “processing”, “GST”, “insurance” or “clearing” paid before the loan arrives. Genuine NBFCs deduct charges from the disbursed amount, never in advance. (RBI Digital Lending Directions, 2025.)
• No named regulated entity and no CoR number shown anywhere in the app.
• No Key Fact Statement / no APR disclosed before you accept.
• Demands full contacts, gallery, SMS or photo access — prohibited under the Directions.
• No physical address or grievance officer in the app or its policy.
• Not in the RBI DLA directory and not on the NBFC list — yet claims an “RBI partnership”.

Verification failed and you already borrowed or installed the app? Move fast:

• Stop paying further “fees” and save every screenshot.
• Report on Sachet (sachet.rbi.org.in) as an unregulated lending entity.
• Call 1930 and file at cybercrime.gov.in if money was taken.
• Flag the Play Store listing as harmful, and revoke the app's permissions.
• For threats, contact-shaming or recovery harassment, follow the dedicated guides below.

For the recovery playbooks, see Loan App Harassment India, Loan App Threatening Your Contacts and Fake Loan Approval Scam. For wrongful penal charges, see Loan Penal Charges RBI Refund.

You may read that DIGITA (Digital India Trust Agency) will vet loan apps and stamp a “verified” mark. As of 2026 DIGITA is still a proposed body, not operational — do not rely on a “DIGITA verified” badge yet. The working, live tool is the RBI Digital Lending Apps directory.

• Trusting a logo or “RBI approved” text in the app — anyone can paste it. Only the RBI DLA directory and NBFC list count. (RBI Digital Lending Directions, 2025.)
• Confusing the brand with the lender. The app brand may differ from the regulated NBFC; verify the NBFC's legal name and CoR.
• Skipping the KFS. Without the KFS you cannot see the real APR; missing KFS is itself non-compliance with the April 2024 RBI rule.
• Assuming Play Store presence equals legal. From 28 January 2026 apps must be on the RBI list to remain on Google Play — but until enforcement is complete, presence alone is not proof. Verify on rbi.org.in.

If a public authority (RBI, MeitY or your State cyber cell) has acted or holds records on a suspect app, you can seek the file under the RTI Act, 2005.

To: The Central Public Information Officer (CPIO)
    Reserve Bank of India / Ministry of Electronics and IT

Subject: Information under the Right to Information Act, 2005

Under Section 6(1) of the RTI Act, 2005, please provide:
  1. Whether [App name / entity name] is recorded in the RBI
     Digital Lending Apps (DLAs) directory and, if so, the
     Regulated Entity it is linked to.
  2. Whether [entity] holds a valid RBI Certificate of Registration
     as an NBFC, with CoR number and status.
  3. Any complaints / action recorded against [entity] on the
     Sachet portal.
  4. Action taken on my representation dated [date], if any.

I am an Indian citizen. Per Section 7(1), please respond within 30
days. If part of the information is held by another authority,
transfer that part under Section 6(3). The fee of Rs 10 is
enclosed; per Section 7(5) I claim BPL exemption if applicable.
If access is refused, please cite the exemption under Section 8
or 9 and inform me of my first-appeal right under Section 19(1).

[Name, address, signature, date]

Draft it in minutes with the AI RTI Drafter, and if the reply is evasive use the PIO Reply Checker and First Appeal Builder.

Find the bank or NBFC named as the lender, then verify it in three places before borrowing: the RBI Digital Lending Apps (DLAs) directory on rbi.org.in (live since 1 July 2025), the RBI NBFC list at rbi.org.in/Scripts/BS_NBFCList.aspx, and the Sachet portal at sachet.rbi.org.in. If the app names no regulated entity and appears in none of these, treat it as illegal and do not borrow.

It is a public list on rbi.org.in, operational since 1 July 2025, of every Digital Lending App that a regulated bank or NBFC has reported to RBI through its CIMS system. Its purpose is to let you verify that an app's claimed link to a regulated entity is genuine. The data is filed by the lenders themselves and RBI does not certify the apps, so a missing or mismatched entry is a warning sign.

Not automatically, though this is tightening. Under Google Play policy, India personal-loan apps must be on the RBI list, and existing apps have until 28 January 2026 to be included or be removed. Until enforcement is complete, Play Store presence alone is not proof — always confirm the lender on the RBI DLA directory and NBFC list.

The Key Fact Statement (KFS) is a one-page disclosure the regulated lender must give you before you accept the loan, showing the loan amount, the Annual Percentage Rate (APR), all fees and the cooling-off period. It became mandatory under the RBI circular of April 2024. A legal app shows it up front; an app that hides total cost behind separate “processing” or “insurance” charges is breaking the rules.

Upfront fees demanded before the loan is disbursed, no named regulated bank or NBFC, no Certificate of Registration, no Key Fact Statement or APR shown, demands for your full contact list, gallery or SMS, and no physical address or grievance officer. Any one of these is enough to walk away.

No. The RBI (Digital Lending) Directions, 2025 bar lending apps from harvesting your phone book, gallery or files. A compliant app may ask only for limited, purpose-specific access such as the camera for KYC. A demand for blanket contacts or gallery access is itself a violation and a sign the app is illegal.

The NBFC (or bank) is the Regulated Entity that actually lends the money and holds the RBI licence. A Lending Service Provider (LSP) is an agent that runs the app or sources customers on the RE's behalf. An LSP cannot lend on its own — it must always name the regulated entity funding your loan. If only an LSP or app brand is visible and no RE is named, do not borrow.

Stop paying, save screenshots, and report the entity on the Sachet portal as an unregulated lender. If money was taken, call 1930 and file at cybercrime.gov.in. Flag the Play Store listing and revoke the app's permissions. For harassment or contact-shaming, follow the dedicated recovery guides linked in this article.

Yes, for records held by public authorities. Under the RTI Act, 2005 you can ask RBI or MeitY whether an entity is in the DLA directory, holds a valid NBFC Certificate of Registration, or has complaints recorded against it on Sachet, and what action was taken. Use the sample letter above with the AI RTI Drafter.

No. DIGITA (Digital India Trust Agency) is a proposed body meant to vet loan apps, but as of 2026 it is not operational. Do not rely on any “DIGITA verified” badge. The live, working tool is the RBI Digital Lending Apps directory on rbi.org.in.

1. Reserve Bank of India (Digital Lending) Directions, 2025 — issued 8 May 2025 (consolidating Guidelines on Digital Lending 2022 + Default Loss Guarantee 2023).
2. RBI — operationalisation of the public Digital Lending Apps (DLAs) directory, effective 1 July 2025 (RE reporting via CIMS).
3. RBI circular on Key Fact Statement (KFS), April 2024.
4. RBI NBFC list — rbi.org.in/Scripts/BS_NBFCList.aspx.
5. Sachet portal — sachet.rbi.org.in (State Level Coordination Committee).
6. Google Play — Personal loans in India policy (RBI-list requirement; 28 January 2026 deadline).
7. K.S. Puttaswamy v. Union of India (2017) 10 SCC 1.

• Loan App Harassment India
• Loan App Threatening Your Contacts
• Fake Loan Approval Scam
• Loan Penal Charges RBI Refund Complaint
• RBI Complaint Against a Bank
• Golden Hour Zero-Liability Cyber Fraud
• Which Regulator to Complain To
• The RTI Playbook