How do the RBI Digital Lending Directions 2025 differ from the 2022 Digital Lending Guidelines in AI governance obligations?

RBI's Digital Lending Directions 2025 (RBI/2025-26/36 DOR.STR.REC.19/21.07.001/2025-26, issued May 8, 2025) supersede and replace the September 2022 Digital Lending Guidelines. The 2022 Guidelines established high-level principles for algorithmic credit scoring — non-discriminatory training data, explainability of credit decisions, accountability of the Regulated Entity (RE) for Lending Service Provider (LSP) actions. The 2025 Directions are a complete regulatory overhaul that converts those principles into operationally specific, enforceable compliance obligations with new provisions that did not exist in 2022: (1) Feature-level consent audit trail: the 2022 Guidelines required 'consent' for data collection in general terms. The 2025 Directions require purpose-specific, field-level consent for each data element that an AI credit scoring model consumes as a feature — with a documented, auditable reconciliation between the AI model's feature list and the borrower's consent schedule. This is a fundamentally different compliance obligation; (2) DLA registration with CIMS: every Digital Lending Application — including AI-powered apps — must be registered with RBI's Centralized Information Management System. No equivalent obligation existed in 2022. This creates a live registry of all AI-driven lending interfaces in India; (3) CCO certification of AI workflows: the Chief Compliance Officer must certify compliance of all digital lending AI workflows. The 2022 Guidelines placed accountability on the board and senior management — the 2025 Directions name the CCO as the certifying individual for AI lending compliance; (4) Anti-dark-pattern rules for algorithmic lending marketplaces: the 2025 Directions explicitly ban dark patterns, opaque exclusions, and manipulative ranking in AI-powered multi-lender matching platforms. The 2022 Guidelines did not address multi-lender AI platform ethics at this level of specificity; (5) Collections AI governance: the 2025 Directions require lenders to maintain deviation management mechanisms for AI-powered recovery agents, creating governance obligations for collections AI that the 2022 Guidelines did not address.

What is the feature-level consent audit trail obligation under RBI Digital Lending Directions 2025 and how does it govern AI credit scoring?

The feature-level consent audit trail is the most technically demanding AI governance obligation in the RBI Digital Lending Directions 2025. Chapter IV — Technology and Data — requires that every data element consumed by an AI credit scoring model as an input feature must have a documented chain of borrower consent: purpose-specific (the borrower consented to use of that data element for credit assessment), field-level (each data element or feature is individually identified, not bundled in a generic consent), and auditable (the consent record is linkable to the feature list the AI model uses). Four practical implementation requirements: (1) Feature documentation: the NBFC or bank must maintain current documentation of every feature the AI credit scoring model uses — both the model's feature set and the feature importance or contribution to credit decisions. Features that appear in the model but are not in the consent schedule are a compliance gap; (2) Consent-feature reconciliation: the consent schedule presented to borrowers must be reconciled against the AI model's feature list. A model updated to include new data sources (telecom data, e-commerce data, social footprint data) requires corresponding consent schedule updates before the new data can be used; (3) Audit trail linkage: the consent record must be traceable to the individual credit decision — in a post-hoc audit or regulatory examination, the RE must be able to show that for a specific borrower's credit assessment, each data feature consumed by the AI model was consented to; (4) Inference feature limitation: if the AI model derives inferred features (credit bureau inquiries imply current credit-seeking behaviour; social data implies income tier), the consent obligation applies to the inference as well as the raw input. A model that derives inferred features beyond what the consent schedule covers is non-compliant. The practical implication: most NBFCs and banks with AI credit scoring models have not maintained feature-level consent documentation. Retroactively building the consent-feature reconciliation infrastructure is one of the most significant near-term AI governance investments in the digital lending sector.

What LSP AI liability obligations do RBI's Digital Lending Directions 2025 create for banks and NBFCs?

The 2025 Directions formalize and strengthen the 2022 Guidelines' non-delegation principle for LSP AI liability. Three specific LSP AI accountability provisions: (1) Non-delegable RE accountability for all LSP AI acts and omissions: the Regulated Entity (bank or NBFC) remains fully and personally responsible for every decision made by an LSP's AI system. Outsourcing the credit scoring model, fraud detection algorithm, or borrower matching engine to a FinTech LSP does not transfer AI governance liability to the LSP. When the LSP's AI model produces a biased credit decision, an incorrect fraud classification, or a manipulative matching outcome, the accountability sits with the RE; (2) Enhanced LSP AI due diligence: before engaging any LSP whose activities include AI or ML-based credit assessment, the RE must conduct enhanced due diligence covering: technical security of the AI system, data privacy compliance (DPDP Act 2023), past conduct of the LSP's AI systems (incident history, regulatory action), and the LSP's own AI governance framework. The 2025 Directions require this due diligence to be documented and reviewed periodically; (3) Algorithmic matching disclosure for multi-lender platforms: where one LSP operates a platform that matches borrowers across multiple lender REs, the matching algorithm must be consistent (the same borrower must receive consistent lender recommendations), documented (the criteria for matching decisions are written down and reviewable), and disclosed (borrowers have access to the basis of their matching outcome). Opaque exclusions — a lender excluded from a borrower's matching results for undisclosed commercial reasons — are prohibited. The practical impact on the FinTech ecosystem: approximately 1,500 registered DLAs include FinTech-operated multi-lender platforms where AI-based borrower-lender matching is the core product. Every such platform must now document its matching algorithm and ensure consistency, disclosure, and non-manipulative design.

What is the DLA CIMS registration obligation and how does it govern AI-powered digital lending applications?

The 2025 Directions require every Digital Lending Application — defined broadly to include any mobile or web-based interface through which credit is originated or managed — to be registered with RBI's Centralized Information Management System (CIMS). This registration obligation applies regardless of whether the DLA is operated by a bank, NBFC, or FinTech LSP. Five implications for AI governance in digital lending: (1) AI-powered apps within scope: a DLA that uses AI for credit scoring, document verification, income assessment, or borrower communication is within the registration scope. Registration creates a regulatory record of the DLA's existence and the RE accountable for it; (2) Registered interface = auditable AI: once registered, a DLA is subject to RBI supervisory oversight. CIMS registration data enables RBI to identify which AI-powered lending interfaces are operating, who is accountable, and which REs to target in examinations; (3) Unregistered DLAs = unauthorized digital lending: a Digital Lending Application operating without CIMS registration after the Directions' effective date is operating outside the regulatory framework — a significant enforcement risk for both the DLA operator (LSP) and the RE accountable for it; (4) AI interface version control: as DLAs are updated — new AI features, new data integrations, changed credit algorithms — the registration must reflect material changes. A DLA that integrates a new AI scoring model without updating its CIMS registration is non-compliant; (5) Cross-LSP accountability: when one RE operates across multiple DLAs through multiple LSPs, CIMS registration requires the RE to maintain visibility of every DLA in its digital lending ecosystem — closing the 'shadow DLA' gap where REs lost track of AI-powered interfaces they had contractually authorized but no longer actively monitored.

AI Governance · RBI · Digital Lending · NBFCs · LSP AI · Feature Consent · India BFSI

RBI Digital Lending Directions 2025 AI Governance: Feature-Level Consent Audit Trail, LSP AI Non-Delegable Liability, Algorithmic Matching Disclosure, DLA CIMS Registry and CCO Certification for 10,000+ NBFCs India

RBI Digital Lending Directions 2025 (RBI/2025-26/36 DOR.STR.REC.19/21.07.001/2025-26, May 8, 2025) supersede the 2022 Digital Lending Guidelines and create a new AI compliance architecture. Feature-level, purpose-specific consent audit trail linking each AI credit scoring model feature to individual borrower consent — a field-by-field reconciliation obligation that did not exist in 2022. Non-delegable Regulated Entity liability for all LSP AI acts and omissions. Anti-dark-pattern rules for AI-powered multi-lender matching platforms. Mandatory DLA registration with CIMS creating a live RBI registry of all AI-driven lending interfaces. CCO certification of AI lending workflows. Applies to all 10,000+ registered NBFCs, all banks, and ~1,500 Digital Lending Applications. Zero global competitor coverage.

Zytra Research Team · May 2025 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

The 2022 Digital Lending Guidelines established a principle: algorithmic credit decisions must be explainable, training data non-discriminatory, and the Regulated Entity accountable for its LSP's AI. Three years of FinTech growth revealed the gap between principle and practice. The 2025 Digital Lending Directions are the operational response — converting those principles into specific, auditable compliance obligations with named accountable individuals and live regulatory registries.

The feature-level consent audit trail is the sharpest new obligation. Most NBFC credit scoring models consume data from multiple sources — credit bureau, banking transaction data, telecom, e-commerce. Each of those data categories, and each feature derived from them, must now have a field-level consent chain linking back to the individual borrower. For NBFCs that updated their AI models without updating their consent schedules, the 2025 Directions create an immediate remediation requirement.

The Feature-Feature Consent Gap

India's digital lending ecosystem runs on feature-rich AI credit scoring. Models for small-ticket personal loans and buy-now-pay-later products commonly use 200–800 features derived from mobile device data, transaction patterns, and network behaviour. Most consent schedules presented to borrowers describe data categories (transaction data, device data) not specific features (average monthly credit card spend, nighttime device activity, app install patterns). The 2025 Directions require the reconciliation to go to the feature level — not just the data category level. That reconciliation is both a legal compliance obligation and an AI governance forcing function: it requires NBFCs to document exactly what their AI models use and why.

RBI Digital Lending Directions 2025 AI Compliance Checklist

☐ Feature-level consent audit trail: AI credit scoring model feature list documented; each feature mapped to consent schedule entry; consent-feature reconciliation maintained; audit trail links consent records to individual credit decisions
☐ Consent schedule current: model updates trigger consent schedule review; new data sources or features require updated consent before use; borrower re-consent mechanism defined for material model changes
☐ LSP AI due diligence: enhanced due diligence documented for each LSP operating AI/ML systems; periodic review cadence defined; LSP AI incident history assessed
☐ Algorithmic matching disclosure: multi-lender platforms document matching algorithm criteria; consistency requirement satisfied; borrower disclosure mechanism in place; dark pattern audit conducted
☐ DLA CIMS registration: all Digital Lending Applications registered with CIMS; RE maintains registry of all DLAs in its ecosystem; material changes notified to CIMS
☐ CCO certification: CCO certification scope covers all digital lending AI workflows; certification process defined; certification records maintained
☐ Collections AI governance: deviation management mechanism in place for AI-powered recovery agents; monitoring of LSP collections AI
☐ RBI examination readiness: feature-consent documentation, LSP due diligence records, DLA registry, CCO certification evidence — packaged for RBI digital lending examination