What AI governance obligations do RBI Digital Lending Guidelines 2022 impose on Lending Service Providers?

RBI's September 2022 Digital Lending Guidelines (circular DGBA.GBD.No.S567/42-01-127/2022-23) impose several AI governance obligations on Lending Service Providers (LSPs). Para 8 requires that the Regulated Entity (bank or NBFC) retain full accountability for credit decisions even when using LSP-provided algorithmic underwriting — the LSP cannot contractually receive credit accountability from the RE. Para 11 requires that LSPs collecting alternative data for credit assessment use only data the borrower has explicitly consented to, and that the data types and purpose are disclosed in the Key Fact Statement. The August 2023 FAQ clarifies that AI/ML models used by LSPs for credit scoring must be auditable by the Regulated Entity and that algorithmic scoring explanations must be available to the borrower on request. These obligations extend MRMF's model validation requirements to the LSP relationship: the RE must independently validate the LSP's AI model, not accept the LSP's own model assessment.

What data can Digital Lending Apps legally collect and use for AI credit scoring under RBI guidelines?

RBI's Digital Lending Guidelines Para 10 restricts Digital Lending App (DLA) data collection to data that is: (a) necessary for the credit product, (b) explicitly disclosed and consented to in the loan agreement, and (c) proportionate to the credit assessment purpose. The guidelines specifically prohibit DLAs from accessing phone book contacts, camera, microphone, location history, and call logs unless a specific exemption applies (location for KYC verification, camera for document capture). AI models that use social graph data (contacts network analysis), behavioral metadata (app usage patterns, typing velocity), or location frequency analysis for credit scoring must have a documented lawful basis under both the DL Guidelines and DPDP Act 2023. The August 2023 FAQ reinforces that alternative data used in AI credit scoring must be disclosed to the borrower — a DLA that uses phone behavioral data without disclosure in the KFS and loan agreement is non-compliant regardless of the predictive power of the feature.

What is the AI obligation for the Key Fact Statement in digital lending?

The Key Fact Statement (KFS) mandated under RBI's Digital Lending Guidelines must accurately reflect the terms and costs of the loan — and when those terms are determined by an AI model, the KFS accuracy obligation creates an AI governance requirement. Specifically: (a) interest rate: if the AI model determines a borrower-specific rate, the KFS must state the actual rate determined for that borrower, not a range or indicative rate; (b) credit limit: if AI determines the credit limit, the KFS must state the actual limit approved; (c) data used: any alternative data used in the credit decision must be disclosed. An AI system that generates or pre-fills KFS content must be tested to ensure the values it produces are accurate against the underlying loan product parameters — a KFS produced by an AI system that rounds rates, uses stale product parameters, or applies incorrect fee calculations is a regulatory liability for the Regulated Entity. KFS accuracy is monitored by RBI in digital lending examinations, and AI-generated inaccuracies are attributed to the RE regardless of whether the KFS was generated by an LSP's system.

How does RBI MRMF interact with the Digital Lending Guidelines for AI credit models?

RBI MRMF June 2026 applies to all AI models used by Regulated Entities (REs) in material decisions, and AI credit scoring used in digital lending clearly meets this threshold. The interaction between MRMF and the Digital Lending Guidelines creates a layered obligation: MRMF Section 3 requires independent validation of the AI credit model — for digital lending, this validation must cover the model as deployed through the LSP, not just in isolation. MRMF Section 4 requires instance-level explainability — for digital lending, this explainability must be deliverable to the borrower on request (as required by the DL Guidelines FAQ). MRMF Section 5 data management applies to the alternative data the DLA collects for the model — the data governance obligations in MRMF reinforce and extend the DL Guidelines data collection restrictions. A Regulated Entity using an LSP's AI model must ensure both MRMF compliance (their responsibility for model governance) and DL Guidelines compliance (their responsibility for the lending relationship) are satisfied simultaneously.

AI Governance · RBI Digital Lending · LSP · DLA · India BFSI

RBI Digital Lending Guidelines 2022 AI Governance: LSP Algorithmic Audit, DLA Data Restrictions, and Credit Scoring Disclosure Obligations

India has 2,000+ RBI-regulated digital lenders. RBI's September 2022 Digital Lending Guidelines (and August 2023 FAQ) impose specific AI governance obligations that go well beyond the FLDG sub-topic: LSP algorithmic audit requirements, DLA data collection restrictions for AI features, AI-generated KFS accuracy, and automated credit scoring disclosure. No global AI governance vendor has mapped any of this.

Zytra Research Team · September 2022 · 13 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's digital lending ecosystem is large, fast-moving, and now heavily governed. Over 2,000 entities — banks, NBFCs, and the Lending Service Providers (LSPs) and Digital Lending Apps (DLAs) they engage — operate under RBI's September 2, 2022 Digital Lending Guidelines (circular DGBA.GBD.No.S567/42-01-127/2022-23). Almost all of them use AI at some point in the lending workflow: alternative data scoring, algorithmic underwriting, automated KFS generation, behavioral credit models, AI-powered collections prioritization.

The AI governance obligations embedded in the DL Guidelines are specific and largely unanalyzed in the governance literature. The discussion has focused on FLDG, co-lending structures, and digital lending app registration — all important, but not the full picture of what RBI requires for AI in digital lending. This post maps the AI-specific obligations from the DL Guidelines and the August 2023 FAQ to the governance framework digital lenders must build.

The Three-Party Structure and Who Owns AI Accountability

RBI's DL Guidelines create a three-party structure: the Regulated Entity (RE — a bank or NBFC with an RBI license), the Lending Service Provider (LSP — the technology platform that provides origination, underwriting, and servicing infrastructure), and the Digital Lending App (DLA — the customer-facing application through which loans are originated).

AI governance accountability in this structure follows the same principle as FREE-AI Sutra 5: the RE is accountable. Para 8 of the DL Guidelines makes this explicit — the RE is responsible for the credit decisions made through LSP and DLA channels, and cannot contractually transfer that responsibility to the LSP. This means:

The RE must have governance oversight of every AI model the LSP uses in the credit workflow — including models the LSP developed and considers proprietary
The RE must be able to produce, in an RBI examination, documentation of the LSP's AI model: its validation status, performance metrics, data inputs, and explainability approach
Independent validation of the LSP's AI model is required — vendor assurance (the LSP's own assessment of its model) is not sufficient
If the LSP's AI model fails (incorrect credit decisions, discriminatory outcomes, data governance violations), the RE bears the regulatory consequence

This creates a due diligence obligation for RE-LSP relationships that most current agreements do not fully satisfy. An RE that signed a standard technology outsourcing agreement with its LSP before 2022 — or even after 2022, without specific AI governance provisions — has a gap that MRMF and the DL Guidelines together require filling.

DLA Data Collection Restrictions for AI Features

Para 10 of the DL Guidelines contains the most operationally specific AI governance provision: the data DLAs can legally collect and use for credit assessment. The relevant restrictions:

Permitted data collection with consent: financial data the borrower provides (income, existing obligations), credit bureau data (CIBIL, Experian, CRIF), KYC documents (Aadhaar, PAN), bank statement data (if borrower provides access through Account Aggregator framework), and device-level data necessary for KYC (camera for document capture, location for address verification).

Restricted data collection: phone contacts, call logs, SMS history, camera or microphone beyond KYC function, location history beyond address verification, and social media connections — these may not be accessed by DLAs for credit scoring purposes. AI models that use features derived from these data sources (social graph centrality, communication frequency scores, location visit frequency) are non-compliant with the DL Guidelines regardless of their predictive accuracy.

The August 2023 FAQ extends this: alternative data used in AI credit scoring must be disclosed in the KFS and the loan agreement. A model that uses behavioral metadata features not disclosed to the borrower — even data types the DL Guidelines technically permit — creates a transparency violation under the FAQ guidance.

Governance implication for AI feature engineering

Every feature in a digital lending AI model must be traceable to a disclosed, permitted data source. The model documentation (MRMF model card) should include a feature registry: for each feature, the data source, whether that source is permitted under DL Guidelines, and whether it is disclosed in the KFS/loan agreement. A feature that fails either test should be removed from the model or the disclosure should be updated before the model is deployed in production.

This is operationally significant because feature engineering in credit models often involves derived features that are not obviously traceable to their source data: a "digital engagement score" derived from app usage frequency, a "network stability score" derived from SIM card swap history, a "payment reliability score" derived from utility payment patterns pulled from SMS. Each of these requires the underlying data source to be disclosed and permitted.

Algorithmic Credit Scoring Disclosure: What Borrowers Are Entitled to Know

Para 15 of the DL Guidelines and the August 2023 FAQ together establish that borrowers have a right to know the basis for credit decisions made using algorithmic scoring. The obligation has two dimensions:

KFS disclosure of scoring approach: the KFS must disclose that an algorithmic credit assessment is used, the types of data considered, and that the borrower may request an explanation. This is a pre-decision disclosure — it must appear in the KFS before the borrower accepts the loan.

Post-decision explanation on request: if a borrower requests an explanation of why their application was declined or why a specific credit limit was assigned, the RE must provide a meaningful explanation. "Algorithmic scoring" is not sufficient — the explanation must describe the factors that influenced the decision in terms the borrower can understand.

This maps directly to MRMF Section 4's instance-level explainability requirement — the AI model must produce an explanation for each credit decision at inference time, and that explanation must be stored and retrievable. For digital lending, MRMF's explainability is not just a governance internal; it is a customer-facing regulatory obligation.

Practical implementation

A compliant explainability system for digital lending AI must:

Generate an explanation for every credit decision at the time of the decision (not retrospectively)
Store the explanation in the loan record, linked to the decision
Translate SHAP values or other technical attribution outputs into plain-language adverse action language — the top 3-5 factors that most affected the decision, in terms a borrower who is not a data scientist can understand
Make the explanation accessible to the borrower on request within the complaint resolution timeline (Para 19 of DL Guidelines requires grievance resolution within 30 days)

Automated Cooling-Off Period Enforcement

RBI's DL Guidelines require a mandatory cooling-off period during which a borrower can exit a digital loan without penalty. Para 17 specifies that the cooling-off period must be disclosed in the KFS and that the system must automatically enforce it — no early repayment penalty or interest charge for loans repaid within the cooling-off window.

For AI-powered lending platforms, this creates a testing obligation: the automated systems that calculate repayment terms, apply interest, and process early repayments must be tested to confirm they correctly handle cooling-off period cases. An AI-powered loan management system that incorrectly charges penalty interest to a borrower who repays within the cooling-off period because of a model logic error or a feature flag misconfiguration is in violation of the DL Guidelines — and the RE is accountable.

This is not a credit risk AI governance issue — it is an operational AI governance issue. The obligation applies to any automated system (rules-based or AI-based) that enforces repayment terms. The governance documentation should include test cases specifically for cooling-off period scenarios.

LSP Contract Provisions Required for AI Governance

An RE-LSP agreement that satisfies the DL Guidelines and MRMF requirements for AI governance must include:

Model documentation access: the LSP must provide the RE with model documentation sufficient for the RE to conduct independent validation — training data description, feature registry, validation results, performance metrics
Model change notification: the LSP must notify the RE before any material change to the AI model — changed features, retrained model, new model version — with sufficient notice for the RE to conduct validation before the new version is deployed
Explainability output: the LSP's AI system must generate and store explanation outputs for every credit decision that are accessible to the RE for regulatory examination and customer response
DL Guidelines data compliance: the LSP's DLA must comply with the data collection restrictions in Para 10 — the contract should explicitly prohibit collection of restricted data categories for AI features
Audit right: the RE must have the contractual right to audit the LSP's AI systems and data governance practices on reasonable notice
RE accountability acknowledgment: the contract should explicitly acknowledge that the RE retains full accountability for credit decisions made using LSP AI systems — this protects the RE from LSP claims that the accountability was contractually assigned

RBI Digital Lending AI Governance Checklist

☐ RE-LSP agreement: AI governance provisions reviewed; model documentation access, change notification, explainability output, data compliance, audit right, RE accountability acknowledgment — all present
☐ LSP AI model in RE's MRMF model inventory: model card complete; validation status documented
☐ Independent validation of LSP AI model: conducted by RE or RE-engaged validator; validation report in RE's records
☐ Feature registry: all model features documented with data source, DL Guidelines permitted status, KFS/loan agreement disclosure status
☐ Restricted data sources excluded: phone contacts, call logs, SMS history, location history, social media — confirmed absent from AI feature set
☐ KFS accuracy testing: AI-generated or AI-populated KFS values tested against actual loan product parameters; rate, limit, fee accuracy verified
☐ KFS algorithmic scoring disclosure: DLA uses algorithmic scoring disclosed; data types used disclosed; request for explanation pathway disclosed
☐ Inference-time explainability: explanation generated and stored for every credit decision; SHAP/attribution values translated to plain-language adverse action language
☐ Explanation response process: mechanism for delivering explanations to borrowers within 30-day grievance resolution window
☐ Cooling-off period testing: automated repayment system tested for cooling-off period cases; no incorrect penalty charges confirmed
☐ DPDP Act alignment: data collection lawful basis documented for all alternative data; data minimization assessment; borrower consent for each data category
☐ AI grievance classification: AI-related complaints (incorrect credit decision, unexplained decline, incorrect KFS) classified and tracked separately; RBI reporting triggers defined
☐ Model change governance: process for RE review and revalidation before LSP model updates deploy to production

The DL Guidelines' AI governance obligations are distributed across multiple paragraphs and are easy to address partially — a compliance team can satisfy the KFS disclosure requirement without addressing the explainability-on-request requirement, or address the data collection restrictions without governing the LSP's model documentation access. A complete AI governance framework for digital lending must address all of these layers simultaneously, treating the DL Guidelines and MRMF as complementary rather than alternative frameworks — both apply, and both impose distinct obligations.