RBI Rules Every Loan DSA Must Follow in 2026

The lender is responsible for you

RBI's outsourcing and digital lending frameworks make the regulated entity, the bank or NBFC, fully accountable for the conduct of its Lending Service Providers, which includes DSAs, platforms and their sub-agents. Lenders must publish the list of their LSPs and can be penalised for their agents' misconduct.

The practical consequence is that lenders and platforms now audit agents, terminate codes quickly and share blacklists. Compliance is not optional paperwork; it is the condition of staying in the business.

Funds flow only between lender and borrower

The Digital Lending Directions require that disbursals go directly to the borrower's bank account (or to a named payee such as a builder or dealer) and repayments go directly to the lender. No agent, platform or pool account may hold or route loan money. Collecting a processing fee, insurance premium or any other amount from a borrower is a breach, and the most common form of loan fraud.

Disclosure before signing: the Key Fact Statement

Every retail and MSME borrower must receive a standardised Key Fact Statement showing the loan amount, rate, APR, all charges, EMI schedule and prepayment terms before the agreement is signed, with a validity period to consider it. Digital loans also carry a cooling-off period. Agents must not misstate any term that the KFS will later contradict, and must not push a borrower to sign without reading it.

Contact hours and conduct: the 2026 draft directions

In February 2026 the RBI issued draft amendment directions on advertising, marketing and sales of financial products. Among the proposals aimed squarely at DSAs and DMAs: customer calls and visits only between 9:00 am and 6:00 pm, no misleading or high-pressure sales tactics, clear identification of the agent and the lender, and tighter accountability of the regulated entity for advertisements made on its behalf.

Even as drafts, these are the standard lenders now expect, and they are written into the LoansPartner code of conduct.

• Identify yourself and the lender at the start of every conversation.
• No calls or visits outside 9 am to 6 pm; respect do-not-disturb requests immediately.
• No claims of guaranteed approval, no comparison with competitors using false information.
• No contact with a borrower's family, employer or references except as the lender's process requires.

Data protection under the DPDP Act

The Digital Personal Data Protection Act, 2023 and its rules require consent-based, purpose-limited collection of personal data, security safeguards, and deletion when the purpose is served. For an agent this means: collect only the documents the application needs, share them only with the lender the borrower chooses, store them securely, and delete them after the application closes. Forwarding a borrower's PAN and bank statements over an open WhatsApp group to see which lender bites is exactly what the law prohibits.

How LoansPartner applies these rules

Our partner programme is built around the regulations rather than around them:

• Documents are uploaded to the partner portal, not messaged, and are shared only with the lender the borrower selects.
• The credit desk, not the partner, communicates lender terms, so the KFS is never contradicted.
• Contact-hour and conduct rules are part of onboarding, and complaints are investigated.
• Payouts are on lender statements; no borrower ever pays us or a partner.