Key areas of regulation

In the fintech bulletin, the RBI noted that most external jurisdictions have no specialized regulatory frameworks for fintech lending. In India, all digital lending products involve the actual lending being done by a bank or NBFC, with intermediaries adding value. Credit and data analysis, the creation of new customer distribution channels, the management of the technology platform and post-disbursement servicing are often performed by intermediaries. In the fair practices circular, the RBI emphasized the importance of transparency when delivering digital lending products, and required banks and NBFCs to have in place systems to oversee the working of intermediaries with whom they partner.

Instead of directly regulating intermediaries, any new digital lending regulatory framework should ideally follow the same model, that is to require the licensed lending entity (bank or NBFC) to broadly supervise partner technology platforms, where such platforms assist with credit scoring and loan disbursement or collection. Areas of digital lending not currently covered by existing bricks and mortar lending rules that may see greater regulation include disclosure around the role and functionality of intermediaries; a comprehensive framework for data collection and processing, and a fair practices code in respect of digital loan recovery tools.

The Personal Data Protection Bill, 2019 (PDP bill), once enacted will put in place a much needed comprehensive framework for data privacy and protection that regulates the access, use, processing and storage of the personal data of individuals. Customers must be made aware of, and must clearly consent to the nature of the data collected by a bank, NBFC or financial services provider; the purpose for which such data has been collected and will be processed; the period for which such data will be stored, and the third parties with whom this data may be shared.

Achieving a fine balance

Digital lenders have played a key role in providing credit to traditionally underbanked sectors and segments, such as micro, small and medium enterprises and retail customers that may not have a strong credit history. It is important for any new regulation to strike a balance between protecting consumers and allowing digital lenders to innovate, partner with technology platforms that enable wider access to credit and, most critically, access and analyze data that result in customized financial solutions.

Once enacted, the framework in the PDP bill will be a useful tool to regulate and control access to data by lending platforms. For instance, the PDP bill proposes awarding a data trust score, that is a score given to a data-handling platform by an independent data auditor. This will represent the degree of compliance with the requirements of the PDP bill by the platform. The regulator may consider linking the access to Aadhaar-based [the national personal identification system] e-KYC and other sensitive data by digital lending platforms to such a score. This will not only protect customer data but will also incentivize lending platforms to implement strong data protection systems and controls.

Digital lenders have played a critical role in widening the reach of credit products and lowering the cost of borrowing for many segments, a particularly important goal in an economy struggling with the stresses of COVID-19. An enabling regulatory framework can help the sector enter its next phase of growth.

This article was originally published in India Business Law Journal on 24 February 2021 Co-written by: Shilpa Mankar Ahluwalia, Partner; Vrinda Pareek, Associate. Click here for original article

Read Less-