The RBI has emphasized that a borrower must be made aware of whom the lender is (i.e. whether the digital lending platform itself or another partner bank or NBFC) and the terms of the loan should be disclosed via a sanction letter on the letter-head of the actual lender.

Many digital lenders have moved to a digital customer onboarding and loan document execution process and may now need to update disbursement procedures to include the specific sanction letter requirement of the RBI.

The RBI has made it clear that the bank / NBFC is ultimately responsible for monitoring compliance with the Fair Practices Code and applicable law.

When NBFCs or banks engage digital lending platforms as agents for customer sourcing, the RBI states that the regulated entity must ensure that: (i) the names of any digital lending platforms engaged as agents is disclosed to the borrower; (ii) terms of the loan are disclosed; (iii) there is effective oversight and monitoring over the digital lending platform; and (iv) customers are made aware of grievance redressal mechanisms.

The RBI Fair Practices Code seeks to establish standards for transparency and adequate disclosure for lending by digital lenders – both of which are welcome.

However, a key issue that remains to be addressed is the unauthorized use of personal data. Digital lenders rely on non-conventional models to analyze credit risk often using big data analytics and artificial intelligence.

Many digital lenders use mobile or web-based platforms to onboard customers and disburse loans. As a result, they have access to many more personal data sets of a borrower that a more traditional bank or NBFC lender may not have typically had. There is an urgent need for a comprehensive framework that regulates the access, use, processing and storage of personal data of individuals.

Borrowers must be made aware of and must consent to the (i) the kinds of data collected by a lender; (ii) the purpose for which such data has been collected and will be processed; (ii) the period for which such data will be stored.

The recent “bad” practices of a few digital lenders have only highlighted the need for a personal data privacy law. The Personal Data Protection Bill 2019 is pending final Parliament approval, and once enacted, will provide a useful framework within which digital lenders (and all lenders) must operate.

There have been efforts by the digital lending community to develop a detailed self-regulating voluntary code of conduct that will set out best practices for digital lenders to adopt in connection with onboarding customers, disclosing loan terms, use of personal data and loan recovery practices.

Until the Personal Data Protection Bill is passed, a digital lender community-led initiative will likely be most effective in identifying best practices and evolving a code of conduct that addresses the problems unique to lending digitally.

Read Less-