Loans
How to judge a low CIBIL score loan app before you borrow from it
No app is RBI-approved, and we shortlist none. The permissions, money flows and paperwork that show whether a low CIBIL score loan app is compliant.
No loan app is approved by the Reserve Bank, and no listing in any RBI directory makes one legitimate: inclusion confers no registration, authorisation or endorsement, and RBI does not verify what lenders submit. What you can check, from your own phone, is which regulated lender sits behind the app and whether it obeys a handful of rules testable in ten minutes.
You will not find a shortlist of apps below, and the omission is deliberate: RBI approves none of them, and the lender behind any given app can change without notice, so a list published today is a recommendation we could not stand behind next month. The six checks are the durable part: they work on an app launched after this page was written, and on one that quietly changes lender after you install it.
The check matters more at a low score, because the offers that reach you are the ones you are least able to walk away from. The route back runs through what a low score costs on a personal loan and repairing the file; this is the safety check for the meantime.
The digital lending rulebook changed in November 2025
Nearly every page competing here cites law that no longer exists. On 28 November 2025 RBI repealed 9,445 circulars with immediate effect and re-issued the substance as 244 Master Directions, organised by class of regulated entity. The standalone Reserve Bank of India (Digital Lending) Directions, 2025 were withdrawn that day, along with the April 2024 Key Fact Statement circular and the August 2022 recovery-agents circular. The September 2022 digital lending guidelines, still the most-cited source in Indian writing on loan apps, were already dead — those 2025 Directions had repealed them. RBI puts no withdrawal banner on any of these pages, so they still read as current.
The live instrument is the digital lending chapter of the Credit Facilities Directions, 2025, issued per class of lender. For an NBFC that is Chapter III of the Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025, RBI/DOR/2025-26/347, dated 28 November 2025 and updated as on 15 July 2026; the Key Fact Statement and recovery-conduct rules sit in the parallel Responsible Business Conduct Directions, 2025. Everything below — the rules as well as the paragraph numbers — is the NBFC version; other classes of lender have their own instruments, whose wording and numbering we did not check. The borrower-facing substance barely moved; the coverage did. Each class now has its own instrument with its own exclusions, so the old blanket “this binds every bank and every NBFC” no longer holds.
“RBI approved” is a marketing claim, not a status
RBI registers lenders, not apps. The NBFC Directions require the lender to report the apps it deploys or engages on RBI’s Centralised Information Management System, to keep that list current, and say the data submitted will be published on RBI’s website in an automated manner.
Two lines decide how much weight that listing can bear: the lender “shall ensure the correctness and timeliness” of what it submits, and RBI “shall not verify/ validate the data submitted on CIMS” — the lender’s Chief Compliance Officer certifies it, not the regulator. Inclusion confers no registration, authorisation or endorsement, and lenders must stop that being misrepresented in marketing. An app calling itself “RBI approved” is claiming the one thing its own lender is obliged to prevent it from claiming.
The listing therefore means only that a regulated lender told RBI this app is theirs. We could not open the published report, so do not build your check around it: read an app’s absence as a reason to look harder at the lender, not proof it is illegal.
Check the lender, not the app
The app is a shopfront; the obligations run to the regulated entity behind it. Its legal name must appear on the documents the lender sends you, so if the app shows only a brand name, look there. If no regulated lender is named anywhere, stop: an app with no RBI-regulated lender behind it sits outside these conduct rules entirely, and the remedy is criminal, not regulatory.
Two cross-checks:
RBI’s own registers. RBI publishes a list of NBFCs and ARCs holding a valid certificate of registration, and a separate list of cancelled registrations. Check both: entities persist in stale copies of the registered list long after cancellation.
The lender’s own website. The lender must display on its website the details of all its digital lending products and apps, its lending service providers and their apps, its customer care and internal grievance particulars, links to RBI’s Complaint Management System and the Sachet portal, and its privacy policies. The test is symmetrical: the app names the lender, and the lender’s site must name the app.
The permissions test
A digital lending app must “desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions, etc.” Collection must be need-based, consented to in advance and backed by an audit trail.
| Permission the app requests | Position under the Directions |
|---|---|
| Contacts, call logs, files and media, telephony functions | Not permitted at all |
| Camera, microphone, location | One-time only, for onboarding or KYC, with explicit consent |
An app that will not proceed until you grant contacts access has told you what it plans to do with them.
You must also be able to deny consent for specific data, restrict disclosure to third parties, revoke consent already given and require deletion. Data must sit on servers in India, though not absolutely: processing abroad is allowed if the data is deleted offshore and brought back within 24 hours.
Where the money must go in, and out
Money must move between you and the regulated lender with nobody in the middle. Disbursement goes into your bank account; repayment and servicing must be executed by you directly into the lender’s own account “without any pass-through account/ pool account”, and the flow of funds between the two “shall not be controlled either directly or indirectly by a third-party”. If an app asks you to repay a wallet, a personal UPI ID or a “collection partner”, the arrangement fails on its face.
The exceptions are narrow: statutory or regulatory mandates, co-lending flows between regulated lenders, specified end-use disbursals paid straight to the beneficiary, and salary advances, where repayment properly comes from the employer’s account. Do not run the flat test over a salary advance and conclude the lender is crooked.
Any fee or reimbursement payable to a lending service provider must be paid by the lender, not collected from you. A platform fee charged by the app rather than the lender is not a grey area.
If the app is a marketplace, it owes you the whole shelf: every offer matching your request, naming the lender behind each, with the amount, tenor, annual percentage rate, monthly repayment, penal charges and a link to each Key Fact Statement — plus the lenders that did not match. Design that steers you to one product is a prohibited dark pattern.
The paperwork a compliant lender must send you
The price of the loan lives in one document, and it is not the interest rate. The annual percentage rate is defined as “the annual cost of credit to the borrower which includes interest rate and all other charges associated with the credit facility”, and the Key Fact Statement must carry a computation sheet for that figure plus the amortisation schedule over the loan tenor. At very short tenors the APR is far larger than a modest-sounding fee suggests; the arithmetic, with RBI’s own illustration, is on seven-day loan apps.
Once the loan contract is executed, digitally signed documents on the lender’s letterhead — the KFS, a summary of the loan product, the sanction letter, the terms and conditions, account statements and privacy policies — must flow to you automatically on your registered and verified email or SMS. Nothing arriving is both a breach and the evidence a complaint needs, so screenshot every screen you agreed to before closing the app. One scope limit: the KFS rules cover retail and MSME term loans, and credit card receivables are expressly exempted, so do not expect one on a card.
What the app may not do after you have borrowed
No silent limit increases. There must be “no automatic increase in credit limit unless an explicit request is received, evaluated and kept on record from the borrower”. Tapping a push notification offering you more is not that.
Recovery agents must be announced before they call. Where an agent is deployed or changed, the particulars of the agent authorised to approach you must reach you by email or SMS first.
Calling hours. The lender and its recovery agents may not call you before 8 a.m. or after 7 p.m. That rule sits at para 100 of the NBFC Responsible Business Conduct Directions, 2025 — not in the digital lending rules, where most readers go looking for it — and it expressly does not cover microfinance loans, which are governed separately. The carve-out matters, because a small collateral-free loan to a low-income household may legally be a microfinance loan. A replacement recovery-conduct regime issued on 6 August 2026 takes effect on 1 January 2027; it is not today’s law.
Where to complain, and who has no Ombudsman route
Complain to the lender first. Both the lender and any customer-facing service provider must designate nodal grievance redressal officers and publish their contact details, and the app must carry a complaint facility. You can then escalate to RBI on any one of three triggers, and they are alternatives rather than stages:
- the complaint is rejected wholly or partly; or
- you are not satisfied with the reply you were given; or
- no reply reaches you within 30 days of the lender receiving the complaint.
Every second page treats the 30-day wait as a precondition. It is only the third trigger: if you have already been refused, or answered unsatisfactorily, go on immediately. Escalation is free, through the Complaint Management System at cms.rbi.org.in under RB-IOS 2026, which replaced the 2021 scheme on 1 July 2026. Do not sit on it: the complaint must reach the Ombudsman within 90 days of that 30-day deadline expiring or of the lender’s last communication, whichever is later.
The scheme does not reach every lender, and this is the part worth working out before you need it. It covers NBFCs registered with RBI, and excludes housing finance companies along with several other categories outright.
| The lender behind the app | Ombudsman route under RB-IOS 2026 |
|---|---|
| RBI-registered NBFC that accepts deposits | Yes |
| RBI-registered NBFC with customer interface, assets ₹100 crore and above | Yes |
| RBI-registered NBFC below ₹100 crore, not deposit-taking | No |
| Housing finance company | No — excluded from the scheme |
| No RBI-regulated lender at all | No, and no conduct rule above binds it either |
Below the line RBI’s own FAQ says the complaint is not maintainable, and may go instead to its other grievance arrangements, including its Consumer Education and Protection Cells. Asset size is the check almost nobody runs, and it decides whether check six below can be satisfied at all.
Two channels sit outside all of this. Threats, extortion and public shaming are criminal conduct: cybercrime.gov.in or the 1930 helpline, not a service-deficiency complaint. And sachet.rbi.org.in, which lenders must link to and which readers assume is a lending-licence lookup, was launched in August 2016 around unauthorised collection of deposits, not lending conduct. We could not read the portal to confirm what it does today, so treat it as a deposit-fraud channel rather than a licence check.
The six checks to run on any low CIBIL score loan app
Run these before you accept an offer.
- Name the lender. Find the regulated entity in the app. No name, no loan.
- Verify it both ways. For an NBFC, check RBI’s registered and cancelled lists, then check the lender’s own site names this app.
- Read the permissions. Contacts, call logs, files and media or telephony means walk away, whatever reason is given.
- Trace the money. Into your account, back into the lender’s — no wallet, no pool account, no fee collected by the app.
- Read the APR, not the interest rate. Check the KFS computation sheet and amortisation schedule, and that every charge you were told about appears there.
- Confirm you have a route out. Work out which side of the Ombudsman perimeter your lender sits on, and keep every signed document that arrives by email or SMS.
Fail any of the first four and affordability does not arise. Pass all six and you have established only that the arrangement is lawful, nothing about whether the loan is a good idea. Work that out on the personal loan EMI calculator against your existing EMIs. If the answer is uncomfortable, borrowing at a low score is the expensive way round a problem that rebuilding the file fixes at the root — slowly, and with nobody charging a fee for it.
Common questions
Is an app listed by RBI an RBI-approved loan app?
No, and RBI says so in terms. Lenders must ensure that inclusion of an app in the list they report "shall not be construed by the DLAs or any associated entity as conferring any form of registration, authorization, or endorsement by the Reserve Bank", and they must stop that inclusion being misrepresented in marketing material. RBI also states plainly that it does not verify or validate the data lenders submit — the lender's own Chief Compliance Officer certifies it. So a listing means one thing only: a regulated lender told RBI this app is theirs.
Can a loan app ask for my contacts or call logs?
No. A digital lending app must desist from accessing mobile phone resources like file and media, the contact list, call logs and telephony functions. One-time access to the camera, microphone or location is allowed, but only where it is needed for onboarding or KYC and only with your explicit consent. Anything beyond that is a breach of RBI's conduct rules, not merely poor manners — which is what makes contact-list scraping and shaming a regulatory matter and not just an unpleasant surprise.
Where should the money go when I repay a digital loan?
Directly into the regulated lender's own bank account. RBI requires disbursement into the borrower's bank account and repayment executed by the borrower straight to the lender, with no pass-through or pool account in between, and the flow of funds must not be controlled directly or indirectly by a third party. A request to repay a wallet, a personal UPI ID or a "collection partner" is non-compliant on its face. The disbursal rule carries narrow exceptions — statutory or regulatory mandates, co-lending flows between regulated lenders, and specified end-use payments — and there is a separate proviso for salary advances, where repayment properly comes from the employer.
Can I cancel a digital loan after I have taken it?
There is an explicit cooling-off right: you may exit by repaying the principal and the proportionate annual percentage rate, without penalty. It is not free, though. The lender may retain a reasonable one-time processing fee if that fee was disclosed upfront in the Key Fact Statement. There is also no single national cooling-off period — the lender sets it in its own credit policy, subject to an RBI floor of not less than one day. Read the KFS for the actual number before you assume you have three days.
What must arrive in writing after I take a loan through an app?
Digitally signed documents on the lender's letterhead must flow to you automatically, on your registered and verified email or SMS, once the loan contract is executed: the Key Fact Statement, a summary of the loan product, the sanction letter, the terms and conditions, account statements and privacy policies. The KFS itself must carry a computation sheet for the annual percentage rate and the amortisation schedule over the loan tenor. Nothing arriving is both a breach and the evidence you will need for a complaint.
Can every loan-app borrower complain to the RBI Ombudsman?
No, and this is the gap most pages miss. RB-IOS 2026 covers NBFCs registered with RBI — excluding housing finance companies and several other categories — only where they accept deposits or have customer interface with asset size of ₹100 crore and above. A borrower of a smaller NBFC, or of a housing finance company, has no Ombudsman route; RBI says such complaints are not maintainable and may instead be dealt with under its other grievance arrangements, including its Consumer Education and Protection Cells. Check the lender's size before you rely on the Ombudsman as your backstop.
Sources
Rates and rules on this page were read directly from the following sources on the dates shown. Figures change — if you are about to act on one, confirm it at the source.
- Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025
- Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025
- Consolidation of Regulations – Withdrawal of circulars (RBI/2025-26/100, 28 November 2025)
- FAQs — Reserve Bank - Integrated Ombudsman Scheme, 2026
- Reserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) Third Amendment Directions, 2026
- Non Banking Financial Companies (NBFCs) — registered and cancelled lists
- RBI launches Sachet portal (press release)