Digital lending in India is undergoing a structural transformation driven by Aadhaar-based identity verification, real-time payment rails, and the Account Aggregator framework. The Reserve Bank of India’s Digital Lending Directions, 2025 now mandate direct disbursement into borrower bank accounts, cap default loss guarantee arrangements at five per cent of the portfolio, and require all digital lending apps to report to Credit Information Companies under the Credit Information Companies (Regulation) Act, 2005.
Also Read – CDSCO Registration Process, Regulatory Framework & Compliance
Quick Summary
- Aadhaar authentication for accessing CIBIL credit reports is now permitted on a voluntary basis under the Aadhaar Authentication for Good Governance Rules, 2020, as notified on February 25, 2026.
- The RBI Digital Lending Directions, 2025 consolidate earlier circulars and introduce new compliance requirements for Lending Service Providers partnering with multiple regulated entities.
- All loan disbursements must go directly into the borrower’s bank account, with narrow exceptions for co-lending and specific end-use cases.
- The Income-tax Act, 2025 and Income-tax Rules, 2026 both came into force on April 1, 2026, replacing the 1961 Act and 1962 Rules respectively, for Tax Year 2026-27 (Assessment Year 2027-28) onwards.
How is Aadhaar authentication reshaping credit access for Indian borrowers?
The Ministry of Finance notified on February 25, 2026, that TransUnion CIBIL Limited may use Aadhaar authentication to establish user identity when providing access to credit information reports. This notification, issued under the Aadhaar Authentication for Good Governance Rules, 2020 read with the Aadhaar Act, 2016, permits authentication through Yes/No and eKYC modes solely for identity verification during registration and login.
Crucially, the authentication remains voluntary. The agency must inform users of alternate identification means including PAN card, passport, voter ID, driving license, and ration card. No service can be denied to a user who refuses or is unable to undergo Aadhaar authentication. This framework aims to streamline credit report access while preserving consumer choice.
For income tax purposes, the convergence of Aadhaar with financial reporting continues to deepen. The Income-tax Act, 2025, effective from April 1, 2026, maintains Aadhaar-PAN linking as a foundational compliance requirement for Tax Year 2026-27 (Assessment Year 2027-28) onwards. Taxpayers filing ITR-3 for Assessment Year 2027-28 must furnish their Aadhaar number in the return form, unless specifically exempted (as per Section 139AA of the Income-tax Act, 1961, which is expected to be carried forward into the Income-tax Act, 2025).
What are the RBI Digital Lending Directions, 2025 and how do they affect borrowers?
The Reserve Bank of India issued the Digital Lending Directions, 2025 (dated May 08, 2025) to address concerns around unbridled third-party engagement, mis-selling, data privacy breaches, unfair business conduct, exorbitant interest rates, and unethical recovery practices. These directions apply to all regulated entities and their arrangements with Lending Service Providers, particularly in multi-lender models.
A core safeguard is the disbursement rule. Loan amounts must be credited directly into the borrower’s bank account, with exceptions only for statutory mandates, co-lending flows between regulated entities, and specific end-use disbursements paid directly to the end-beneficiary. Regulated entities must ensure that no disbursement is made to any third-party account, including accounts of Lending Service Providers.
The Directions also impose reporting obligations. All lending through digital lending apps must be reported to Credit Information Companies regardless of nature or tenor, under the Credit Information Companies (Regulation) Act, 2005. Regulated entities must further report all deployed digital lending apps on the RBI’s Centralised Information Management System portal in the prescribed format.
How do Default Loss Guarantee arrangements protect lenders and what are the caps?
The RBI Digital Lending Directions, 2025 (dated May 08, 2025) introduce a structured framework for Default Loss Guarantee (DLG) arrangements, where a regulated entity or Lending Service Provider guarantees to compensate the lender for a portion of the loss if the borrower defaults. These arrangements are now subject to Board-approved policies that must specify eligibility criteria, nature and extent of cover, monitoring processes, and fee details payable to the DLG provider.
The critical cap is on the total guarantee exposure. The DLG cover on any outstanding portfolio cannot exceed five per cent of the total amount disbursed from that loan portfolio at any given time. In multi-lender arrangements, the DLG provider shall not bear performance risk of more than five per cent of the underlying loan portfolio equivalent amount. This ensures that skin-in-the-game remains meaningful and lenders cannot offload entire credit risk to third parties.
| Aspect | Regulatory Requirement under RBI Digital Lending Directions, 2025 |
|---|---|
| Maximum DLG Cover on Portfolio | 5% of total amount disbursed from the loan portfolio at any given time |
| Multi-Lender DLG Exposure Cap | DLG provider shall not bear performance risk exceeding 5% of underlying loan portfolio |
| Policy Requirement | Board-approved policy mandatory before entering any DLG arrangement |
| Disbursement Rule | Loan must be credited directly to borrower’s bank account; no third-party accounts permitted |
| Credit Reporting | All DLA-based lending must be reported to CICs under the Credit Information Companies Act |
Practical Example: Consider a digital lending portfolio where a regulated entity has disbursed ₹10 crore across 5,000 borrowers through a Lending Service Provider’s app. Under the DLG cap, the maximum guarantee cover the Lending Service Provider can offer is ₹50 lakh (5% of ₹10 crore). If the portfolio has ₹8 crore outstanding at any point, the DLG cover still remains capped at ₹50 lakh based on the original disbursed amount. This ensures the lender retains at least 95% of the credit risk on its books, preventing excessive risk transfer.
How must regulated entities report digital lending data to credit information companies?
Under the RBI Digital Lending Directions, 2025 (dated May 08, 2025), every regulated entity must report all lending conducted through digital lending apps to Credit Information Companies irrespective of the nature or tenor of the loan. This mandate flows from the Credit Information Companies (Regulation) Act, 2005 and the rules and regulations framed thereunder. The reporting obligation covers both the regulated entity’s own digital lending apps and those operated by Lending Service Providers.
The reporting format requires granular data capture. Credit information companies have prescribed uniform credit reporting formats that capture multiple data segments including Member/Consumer details, Address, and Account information. The Member/Consumer Segment captures identification numbers including Aadhaar (UID), Voter’s ID, PAN, Ration Card, and NREGA Card number. The Account Segment records the loan purpose, account status, sanctioned amount, disbursed amount, repayment frequency, and days past due. Account status codes range from S01 (Loan Submitted) through S15 (Cancelled), with specific codes for restructured accounts and post-write-off settlements.
Regulated entities must also report structured digital lending products extended over merchant platforms, including short-term unsecured credits and deferred payment facilities. The regulated entity bears the responsibility of ensuring that any Lending Service Provider associated with such deferred payment products complies with the outsourcing guidelines and these Directions. Additionally, all deployed digital lending apps must be reported on the RBI’s Centralised Information Management System portal in the format prescribed in Annex-I to the Directions.
What are the tax reporting obligations for digital lending transactions under the Income-tax Act, 2025?
The Income-tax Act, 2025, effective from April 1, 2026, governs the tax treatment of income arising from digital lending activities for Tax Year 2026-27 (Assessment Year 2027-28) onwards. Lenders and digital lending platforms must navigate this revised compliance architecture. The Income-tax Rules, 2026, made under the Income-tax Act, 2025, also came into force on April 1, 2026, and introduce updated deduction limits and reporting provisions.
Taxpayers filing ITR-3 for business income from digital lending operations are required to furnish their Aadhaar number in the return, unless specifically exempted (as per Section 139AA of the Income-tax Act, 1961, expected to be retained in the Income-tax Act, 2025). The due date for filing ITR-3 and ITR-4 for non-audit taxpayers has been extended to August 31, effective from Assessment Year 2026-27 (as per Finance Act 2026) and is expected to apply for Assessment Year 2027-28 as well.
For Tax Collected at Source (TCS) on transactions facilitated through digital lending platforms, revised rates apply from April 2026. The TCS rate on sale of scrap, sale of minerals being coal or lignite or iron ore, and sale of alcoholic liquor for human consumption has been adjusted to 2% from the earlier 1% (as per Finance Act 2026, effective April 1, 2026). Remittance under the Liberalised Remittance Scheme for education and medical treatment now attracts TCS at 2% instead of the previous 5%, with a threshold of ₹10 lakh (as per Finance Act 2026, effective April 1, 2026). The due date for filing revised returns has been extended to March 31st of the relevant assessment year, with an additional fee of ₹5,000 payable for revisions filed on or after January 1st of the assessment year.
What compliance pitfalls arise in multi-lender digital lending arrangements?
Para 6 of the RBI Digital Lending Directions, 2025 (dated May 08, 2025), which governs arrangements where a Lending Service Provider partners with multiple regulated entities, came into effect from November 1, 2025. This provision addresses the most complex segment of the digital lending ecosystem, where a single Lending Service Provider’s platform interfaces with several banks and NBFCs simultaneously. Regulated entities must now conduct thorough due diligence on Lending Service Providers before onboarding them, assessing their technological capabilities, data security protocols, and grievance redressal mechanisms.
A critical pitfall is the disclosure requirement. Every borrower must be clearly informed about the regulated entity acting as the lender on the platform. The borrower must know which entity’s balance sheet the loan sits on, who is responsible for recovery, and which ombudsman handles complaints. Failure to make these disclosures in a transparent manner can attract supervisory action from the Reserve Bank. The Directions also mandate that the regulated entity’s name and the Lending Service Provider’s name be prominently displayed on every digital lending app interface.
Para 17 of the Directions, which mandates the creation of a directory of digital lending apps, came into force on June 15, 2025. Regulated entities must report all deployed digital lending apps, whether their own or those of Lending Service Providers, on the RBI’s Centralised Information Management System portal. This directory serves as a public-facing verification tool, allowing borrowers to confirm whether a lending app is genuinely associated with a regulated entity. For lenders, the compliance burden includes continuous updates whenever a new app is deployed or an existing one is withdrawn from the market.
| Compliance Requirement | Effective Date | Consequence of Non-Compliance |
|---|---|---|
| Multi-lender arrangement rules (Para 6) | November 1, 2025 | Supervisory action by RBI; potential restriction on digital lending operations |
| Digital lending app directory (Para 17) | June 15, 2025 | Apps not in directory treated as unverified; reputational and regulatory risk |
| Credit reporting to CICs | Immediate | Penalties under Credit Information Companies (Regulation) Act, 2005 |
| DLG policy and cap compliance | Immediate | Guarantee arrangements exceeding 5% cap deemed non-compliant |
The Income-tax Act, 2025 read with the Income-tax Rules, 2026, both effective from April 1, 2026, introduce a restructured reporting framework that directly affects digital lending platforms and their users. Form 26AS, the annual credit statement familiar to every taxpayer, now co-exists with the more comprehensive Annual Information Statement (AIS) and Taxpayer Information Summary (TIS). These statements consolidate TDS, TCS, and other financial transaction data credited to the taxpayer’s account. Digital lending platforms must ensure that any tax deducted on interest payments or commissions flows correctly into these statements for accurate reporting and credit to the taxpayer.
For non-audit taxpayers filing ITR-3, the due date has shifted to August 31 from the earlier July 31, effective from Financial Year 2026-27 (AY 2027-28). This extension provides additional time for individuals earning income through digital lending platforms, peer-to-peer lending, or fintech partnerships to compile their data. However, the advance tax obligation remains unchanged, and taxpayers whose annual tax liability exceeds ₹10,000 must pay advance tax in instalments by June 15, September 15, December 15, and March 15 to avoid interest under the relevant sections of the Act.
Digital lending platforms acting as Lending Service Providers must also navigate the TCS framework. From April 1, 2026, as per the Union Budget 2026 and subsequent amendments to Section 206C(1G) of the Income-tax Act, 2025:
- The TCS rate on remittances under the Liberalised Remittance Scheme (LRS) for education and medical treatment has been reduced to 2% on amounts exceeding ₹10 lakh in a financial year. (For education funded by a loan from a financial institution, the TCS rate remains 0.5% on amounts exceeding ₹10 lakh).
- For overseas tour packages, a flat 2% TCS now applies on the entire amount, without any threshold.
Platforms facilitating cross-border digital lending or processing international payment flows must configure their systems to collect TCS at these revised rates and deposit them using the appropriate challan.
Worked Example — TCS on LRS Remittance via Digital Lending Platform: An individual uses a digital lending platform to remit ₹15 lakh for an overseas tour package. As per Section 206C(1G) of the Income-tax Act, 2025, a flat 2% TCS applies to overseas tour packages on the entire amount. The platform must collect ₹30,000 (2% of ₹15 lakh) at the time of remittance or debit, whichever is earlier. This TCS amount gets reflected in the individual’s Annual Information Statement (AIS) and Taxpayer Information Summary (TIS) and can be claimed as a credit against their tax liability while filing their income tax return. The platform must deposit this TCS using Challan 281 by the seventh day of the following month, failing which interest and penalty provisions apply.
For individual borrowers, the convergence of Aadhaar with credit reporting under the February 25, 2026 notification means that every digital loan now leaves a traceable footprint in the credit information ecosystem. When a borrower accesses their CIBIL report using Aadhaar authentication, the report reflects all digital lending app loans reported under the Credit Information Companies (Regulation) Act, 2005. This data feeds into the borrower’s overall credit profile, influencing future loan eligibility and interest rates. Borrowers should verify that their digital loan accounts are accurately reflected in their credit report, as discrepancies can be rectified through the grievance mechanism prescribed under the Credit Information Companies Regulations, 2006.
What Key Actions Should You Take Regarding Digital Lending?
- Verify that any digital lending app you use disburses loan amounts directly into your bank account, not into any third-party account including the Lending Service Provider’s account.
- Check your CIBIL credit report regularly. You may now use voluntary Aadhaar authentication for faster access, but alternate identification means such as PAN, passport, voter ID, driving license, or ration card remain available.
- If you represent a regulated entity, ensure a Board-approved Default Loss Guarantee policy is in place before entering any guarantee arrangement, with clear eligibility criteria and monitoring processes documented.
- Report all digital lending apps deployed or joined, whether your own or those of Lending Service Providers, on the RBI’s Centralised Information Management System portal in the prescribed format.
- Review your credit reporting processes to confirm that all lending through digital lending apps is being reported to Credit Information Companies regardless of loan tenor or ticket size.
- Update your data privacy policy to comply with restrictions on collection, sharing, and storage of borrower data as mandated under the Digital Lending Directions, 2025.
- If you are filing ITR-3 for AY 2027-28, ensure your Aadhaar number is furnished in the return form, noting that an opt-out mechanism is available if you choose not to provide it.
Frequently Asked Questions
Is Aadhaar authentication mandatory for accessing my CIBIL credit report?
No. The Ministry of Finance notification dated February 25, 2026 permits Aadhaar authentication on a voluntary basis only. TransUnion CIBIL Limited must inform users of alternate identification means including PAN card, passport, voter ID, driving license, and ration card. The agency cannot deny service to any user who refuses or is unable to undergo Aadhaar authentication.
Can a lender disburse my loan to a third-party account for convenience?
No. Under the RBI Digital Lending Directions, 2025, loan disbursement must always be made directly into the borrower’s bank account. Exceptions apply only for statutory or regulatory mandates, co-lending flows between regulated entities, and specific end-use disbursements paid directly to the end-beneficiary. Third-party accounts, including accounts of Lending Service Providers, are expressly prohibited.
What is the maximum Default Loss Guarantee cover allowed on a digital lending portfolio?
The DLG cover cannot exceed five per cent of the total amount disbursed from that loan portfolio at any given time. In multi-lender arrangements, the DLG provider shall not bear performance risk exceeding five per cent of the underlying loan portfolio equivalent amount. This cap ensures that regulated entities retain meaningful skin-in-the-game and cannot offload entire credit risk to third parties.
Do small-ticket or short-term loans through digital apps need to be reported to credit information companies?
Yes. Under the RBI Digital Lending Directions, 2025, all lending conducted through digital lending apps must be reported to Credit Information Companies irrespective of the nature or tenor of the loan. This mandate flows from the Credit Information Companies (Regulation) Act, 2005 and applies to both the regulated entity’s own apps and those operated by Lending Service Providers.
How does interest income from digital lending platforms get taxed under the Income-tax Act, 2025?
Interest earned through peer-to-peer lending or digital lending platforms is taxable under the head ‘Income from Other Sources’ for individual investors. The Income-tax Act, 2025, which came into force on April 1, 2026, does not create a separate head for digital lending returns. Taxpayers must report such income in their ITR and pay tax at applicable slab rates.
What TCS obligations apply when investing through digital lending apps?
As per the revised TCS rates effective from April 1, 2026, under Section 206C(1G) of the Income-tax Act, 2025: remittances under the Liberalised Remittance Scheme for education and medical treatment attract TCS at 2% on amounts exceeding ₹10 lakh in a financial year. For overseas tour packages, a flat 2% TCS applies on the entire amount. When you deploy funds through digital lending platforms that route money abroad or involve foreign exchange transactions, these TCS provisions may apply.
Can a regulated entity claim a Default Loss Guarantee payout as a business deduction?
Yes, a regulated entity that receives a DLG payout under the RBI Digital Lending Directions, 2025 framework can treat it as a business receipt. Conversely, the DLG provider making the payout may claim it as a business expense, provided the arrangement is backed by a Board-approved policy as mandated under the Directions. For income tax purposes, both parties must maintain documentation of the DLG agreement to substantiate the claim during assessment proceedings.
How do I verify that my digital lending transactions appear correctly in tax records?
Under the Income-tax Rules, 2026, Form 26AS co-exists with the more comprehensive Annual Information Statement (AIS) and Taxpayer Information Summary (TIS). All TDS, TCS, and specified financial transactions including digital lending interest income are reflected in AIS/TIS. You can access AIS/TIS on the incometax.gov.in portal. Discrepancies should be reconciled before filing your ITR to avoid notices under section 143(1) for mismatches.
Sources
- TaxGuru — Reserve Bank of India Digital Lending Directions, 2025
- Income Tax India — Notified Income-tax Rules, 2026
- TaxGuru — Aadhaar Authentication for Credit Reports on Voluntary Basis
- Income Tax India — Income-tax Act, 2025 as amended by Finance Act, 2026
- Income Tax India — Income-tax Act, 2025
- TaxGuru — RBI Framework on Uniform Credit Reporting by ARCs
- Income Tax Portal — Notification No. 47/2026
Take action today: Review your CIBIL report using the new Aadhaar-based authentication facility, reconcile your digital lending interest income with your Annual Information Statement (AIS) and Taxpayer Information Summary (TIS), and ensure your ITR for AY 2027-28 reflects all platform-based earnings accurately before the due date.
Article Information
Published: July 23, 2026
Last Reviewed: July 23, 2026
Category: Fintech, Banking & Tax Compliance
Regulatory Bodies: Reserve Bank of India (RBI) & Central Board of Direct Taxes (CBDT)
Written by C.K. Gupta, M.Com & Tax Editor at TaxGST.in — helping entities navigate RBI fintech compliance, IT notices, and corporate taxation since 2009.
Official Resources
Disclaimer: This article is for informational purposes only. Fintech regulations and tax laws are subject to rapid change. Always refer to the original source documents and circulars issued by the RBI and CBDT for authoritative information.
Discover more from TaxGst.in
Subscribe to get the latest posts sent to your email.
