RBI DLA Directory: What Lenders Must Report
The RBI DLA directory is a reporting list, not a licence register. See what banks and NBFCs must report, how Google Play uses it, and how to check an app.
The RBI's digital lending apps directory is a reporting list, not a licence register. Banks and NBFCs file details of every lending app they run, or that their lending partners run, on the RBI's reporting portal, the Centralised Information Management System (CIMS). The RBI said it would publish that data, without checking it, on its website under Citizen's Corner. A listing shows that a lender reported the app. It does not show that the RBI approved it.
Where things stand (19 October 2026)
What is the RBI DLA directory?
It is the RBI's public list of lending apps, titled "DLAs deployed by Regulated Entities", built from what lenders report. A DLA (digital lending app or platform) is any mobile or web app with a user interface that facilitates digital lending. It covers apps the lender runs itself and apps run by its LSPs, the lending service providers that act as the lender's agents for tasks such as finding customers, underwriting support, servicing and recovery. This is under the Digital Lending Directions, 2025, which apply to commercial banks, certain co-operative banks, NBFCs (including housing finance companies) and All-India Financial Institutions.
"Whitelist" and "registered loan apps" are search phrases, not the RBI's name for the list. The Directions say that appearing on the list does not imply RBI registration, authorisation or endorsement, and a lender may not present it that way in marketing. The RBI's press release on the Directions says the list is built from lenders' submissions "as is basis, without any further validation check by the Reserve Bank". Its stated purpose is to help customers check whether an app is linked to a regulated lender.
What must a bank or NBFC report?
The lender must report every app it deploys or has joined, its own or its LSP's, to the RBI's Centralised Information Management System (CIMS), in the RBI's prescribed format. The same applies to apps it has joined as a participant in someone else's platform.
Four further points follow from the Directions:
- •Updates: the lender updates CIMS when an app is added or an engagement ends.
- •Certification: the Chief Compliance Officer, or an official the Board designates, certifies that the submitted data is correct. The certification also covers website links, grievance officers for LSP-owned apps, the data rules and the website disclosures described below.
- •Deadline: the initial upload was due by 15 June 2025. The press release says CIMS opened on or before 13 May 2025.
- •Responsibility: the RBI does not verify the data, and the lender handles all customer issues about its apps.
What else do the Directions require of lenders and LSPs?
The lender stays fully responsible for everything its LSP does. Before engaging an LSP, the lender must carry out enhanced due diligence on its technical capability, data privacy and fairness to borrowers. The table summarises some of those duties.
| Area | What the Directions say |
|---|---|
| Lender's website | Lists digital lending products, LSP details, the LSPs' apps and what they do, grievance mechanisms and privacy policies. Apps and LSPs must link to it. |
| Fund flow | Loans are disbursed into the borrower's own bank account, with limited exceptions. Repayments go straight to the lender's account. Pass-through or pool accounts of third parties are not allowed. The lender pays LSP fees directly; LSPs may not collect them from borrowers. |
| Cash recovery of overdue loans | Allowed, but the amount must show in the borrower's account the same day, and LSPs may not deduct their fees from it. |
| Data | Collection must be need-based, with prior explicit consent and an audit trail. Apps may not access contact lists, call logs, media or phone files. One-time camera, microphone or location access is allowed for onboarding or KYC, with consent. Data must be stored on servers in India. |
| Grievances | The lender and any borrower-facing LSP appoint nodal grievance officers, shown on their websites, in the app and in the Key Fact Statement (the standard cost-of-loan summary). If a complaint is rejected, unresolved or unanswered within 30 days, the borrower can go to the RBI's complaint portal under the Integrated Ombudsman Scheme. |
| Cooling-off | Borrowers can exit a digital loan early in a cooling-off period by repaying principal plus proportionate interest, with no penalty. The lender's Board sets the length, with a minimum of one day. |
| Multi-lender platforms | From 1 November 2025, an LSP must show all loan offers matching the borrower's request, with unbiased content. Ranking on a disclosed public metric is allowed. |
The Key Fact Statement includes the annual percentage rate. The lender must send the signed Key Fact Statement and sanction letter to the borrower's verified email or SMS when the contract is executed. For how these data limits sit alongside Aadhaar and video KYC limits, see KYCKART's piece on digital lending KYC verification.
How does Google Play use the list?
Google Play ties app access to the list. Its India personal loan policy says personal loan apps must hold a valid RBI financial services licence and must have submitted their details to the RBI list titled "DLAs deployed by Regulated Entities". New personal loan apps had to be on the list from 30 October 2025. Existing apps had to be on it by 28 January 2026 to stay on Google Play.
Facilitator apps must also be listed and must name every registered NBFC and bank in the app description. If a licensed app is not listed, Google says the developer should contact the RBI. Google's separate personal loans policy also restricts access to sensitive data such as photos and contacts. That sits next to the RBI's data rules and does not replace them. Apple's App Store rules are outside this article.
How do you check an app?
Anyone can check the app's name against the RBI list, but a match is only a first step. For the enforcement record and the warning signs of fake lending apps, see KYCKART's piece on fake loan apps and deepfake lending scams.
What this means for you
This section is KYCKART's reading of the rules above.
If you run a lender. The Chief Compliance Officer certification, the lender's liability for its LSPs and the website disclosure point the same way, so the lender answers for the app list. The practical implication is to check that an LSP's new app or ended engagement reaches whoever updates CIMS, because the Directions require updates when apps are added or engagements end.
If you are an LSP. Read together, the lender's website disclosure and CIMS reporting mean your lender reports every app you run for it, so ask: is each of our apps on CIMS, does the website name us and describe our activities, and who certifies the entry?
If you advise a borrower or partner. The RBI's own wording says the list is unvalidated. Treat a listing as a prompt for further checks, such as the grievance officer named in the app.
If you ship a personal loan app. On Google Play, the list is a condition of staying available: new personal loan apps needed a listing from 30 October 2025, and existing ones by 28 January 2026.
Frequently Asked Questions
Sources & References
Author: Bhanujeet Choudhary, Head of Compliance, KYCKART.
Regulatory Disclaimer: This article is published for institutional compliance education and industry analysis. It does not constitute formal legal, regulatory, or technical advisory. Banking and NBFC institutions must reference primary circulars from the Reserve Bank of India and PMLA regulations.
KYCKART Intelligence
Verify lending apps and partners before disbursal
Talk to KYCKART about real-time CIMS compliance, LSP due diligence, and automated KYC verification for digital lending.
Talk to our teamarrow_forward