Is Your Loan App RBI-Regulated? How to Check Before Borrowing

Before you tap “Apply” on any loan app, check one thing: is the app linked to a bank or NBFC that the Reserve Bank of India regulates? Since 1 July 2025, RBI publishes a public directory of Digital Lending Apps (DLAs) on its website, so you can verify this in minutes. This guide shows you the warning signs of an illegal app and the exact checks to run first.

At a glance: red flags of an illegal loan app

• The app does not name a specific bank or NBFC as the lender, only a brand or company name.
• It demands access to your phone contacts, gallery, or call logs before approving the loan.
• Money is offered instantly with no Key Fact Statement and no written loan agreement.
• It asks you to repay into a personal account or UPI ID, not the lender of record.
• There is no grievance officer name, phone number, or email anywhere in the app.
• It uses a deep discount or processing fee deducted upfront, so you receive far less than the sanctioned amount.

To check if a loan app is safe, find the name of the bank or NBFC behind it, then confirm that lender has listed the app in RBI's public Digital Lending Apps directory on rbi.org.in. No named regulated lender, or an app missing from the directory, means do not borrow.

Most predatory loan apps are not registered with RBI. They pose as legitimate lenders, harvest your phone data, then use it to shame and threaten you for recovery. The Reserve Bank of India (Digital Lending) Directions, 2025 (RBI/2025-26/36, dated 8 May 2025) tackled this by ordering every Regulated Entity, meaning banks and NBFCs, to report each Digital Lending App they or their Lending Service Providers use on RBI's Centralised Information Management System (CIMS) portal. Reporting was due by 15 June 2025. RBI then operationalised a public DLA directory on its website with effect from 1 July 2025 so that you, the borrower, can verify whether an app is genuinely tied to a regulated lender.

Important honesty note: being listed in the directory is not an RBI endorsement, registration, or approval of the app. RBI has clearly stated that inclusion only reflects what banks and NBFCs reported, and must not be read as RBI conferring any authorisation. So the directory is a verification tool, not a seal of approval. But the reverse is a strong signal: if an app is absent from the directory, treat that as a red flag.

Run these three checks in order before you share any document.

Check 1: Is the lender named and RBI-regulated? Open the app and find who the actual lender is. A genuine app discloses the bank or NBFC that lends the money, not just the app brand. If you only see an app name and no regulated lender, stop here.

Check 2: Is the app listed by that lender? Go to the RBI Digital Lending Apps directory on rbi.org.in. Find the named bank or NBFC, and confirm this specific app appears under that entity. You can also check the lender's own website, because the 2025 Directions require regulated entities to publish the list of DLAs they use. If the app is on neither list, do not proceed.

Check 3: Does the app follow the 2025 Directions? A compliant app gives you a Key Fact Statement before you borrow, disburses money straight to your bank account, does not demand your contacts or gallery, offers a cooling-off period, and shows a grievance officer's details. Missing any of these is a sign the app is cutting corners or is outright fake.

The RBI (Digital Lending) Directions, 2025 give every digital borrower these protections.

• Key Fact Statement: you must get a clear, standardised statement showing the Annual Percentage Rate, all fees, and total cost before you accept the loan.
• No harvesting of phone data: apps cannot access your contacts, photo gallery, call logs, or files. They may use only need-based data with one-time, specific consent.
• Cooling-off period: you can exit the loan within the cooling-off window, fixed by the lender's board and disclosed to you, by repaying principal and proportionate cost, without penalty.
• Direct disbursal: loan money must go straight into your own bank account, never through the app's or a Lending Service Provider's account.
• Grievance officer: the lender must name a nodal grievance redressal officer and display the contact details in the app, on its website, and in the Key Fact Statement. Complaints unresolved in 30 days can go to the RBI Ombudsman.

For a deeper look at default loss guarantee rules and how these borrower protections work, see our guide on digital lending DLG and borrower rights.

If an unlisted app has already lent to you and is threatening you, act fast.

1. Stop sharing data and do not pay into personal accounts. Note the app name, package ID, and who contacted you.
2. Save evidence: screenshots of threats, call recordings, messages, and the loan terms shown.
3. File a complaint on the RBI complaint portal (cms.rbi.org.in) against the regulated lender if one is named, and lodge a grievance with the app's grievance officer.
4. Report cyber harassment at the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930.
5. Use an RTI to ask a public authority, for example a police cyber cell, about the action taken on your complaint. The The RTI Playbook explains how to frame such requests.

Because fraudsters often clone official sites, also confirm you are on the genuine RBI page using our guide on how to verify a genuine government website.

No. The directory only shows what banks and NBFCs reported. RBI has expressly said inclusion is not registration, authorisation, or endorsement. It confirms a link to a regulated lender, which is necessary, but you must still check the loan terms.

Treat absence as a serious red flag. A genuine app run by or for a regulated lender should appear in the directory and on the lender's own website. If it is missing from both, do not borrow.

It is on the official RBI website, rbi.org.in, operational since 1 July 2025. Search for “Digital Lending Apps directory” on the site. Always confirm the address ends in rbi.org.in to avoid fake copycat pages.

No. Under the 2025 Directions, apps cannot access your phone contacts, gallery, call logs, or files. They may collect only need-based data with your specific, one-time consent. Demanding blanket access is a violation.

Complain to the named lender's grievance officer, then to the RBI complaint portal (cms.rbi.org.in) if unresolved in 30 days. For threats and harassment, report at cybercrime.gov.in or call the helpline 1930.

No. RBI separately publishes a list of registered NBFCs. The DLA directory maps which loan apps each regulated entity uses. Use both: confirm the lender is a registered bank or NBFC, then confirm the app is listed under it.

Before borrowing from any loan app, save this quick checklist: named regulated lender, app listed in RBI directory and on the lender's site, Key Fact Statement shown upfront, money to your own account, no contacts or gallery access, and a visible grievance officer. If you hit a wall getting information from a public authority about a fraud complaint, the reasoned-order and written follow-up approach in our guide to rejected claims shows how to push back in writing.