Regulatory Reference Table
| Regulator | RBI |
|---|---|
| Circular / Notification No. | Illustrative compliance update |
| Date | 28/3/2026 |
| Regulation / Master Direction | RBI Digital Lending and outsourcing framework |
| Effective From | As applicable |
| Applicable Entities | NBFCs, Banks, Digital lending platforms, LSPs |
| Risk Rating | High |
What Has Changed
Digital lending entities should review KFS delivery, fund-flow controls, consent architecture, outsourcing contracts and customer grievance mechanisms.
The development should be read as a compliance action point rather than a passive circular. Regulated entities should identify applicability, assign internal responsibility and preserve evidence of implementation.
Where the circular affects customer protection, reporting, governance, risk management or inspection readiness, the compliance team should prepare a management note and review existing SOPs.
Key Changes Table
| Area | Earlier Position | Revised Position | Compliance Impact |
|---|---|---|---|
| Customer disclosure | Existing disclosure framework continued | Greater emphasis on traceable digital disclosures | KFS and consent records should be verifiable. |
| Outsourcing | Outsourcing controls required | Closer scrutiny of LSP arrangements | NBFCs should update contracts and monitoring records. |
Who Is Affected
Action Checklist
| Action Item | Responsibility | Suggested Timeline |
|---|---|---|
| Review digital lending journey | Product / Compliance | Day 7 |
| Update LSP monitoring checklist | Compliance Officer | Day 15 |
| Test KFS and consent evidence | Operations | Day 30 |
Implementation Timeline
| Timeline | Required Step |
|---|---|
| Day 1 | Review circular applicability and identify owner |
| Day 7 | Prepare internal action note and assign responsibility |
| Day 15 | Update policy, SOP or disclosure where required |
| Day 30 | Confirm implementation evidence and reporting |
| Ongoing | Monitor compliance and maintain records |
Common Compliance Risks
Risk of Non-Compliance
Non-compliance may result in penalty, inspection observation, audit remark, regulatory query, suspension risk, reputational risk or delayed renewal / approval depending on the nature of the requirement.
Regulatory Risk Rating
Risk Rating: High
Reason: This update affects regulatory operations, reporting discipline or inspection readiness. The exact risk depends on the entity's business model, regulator exposure and implementation evidence.
Board Level Note
This matter should be placed before the Board / Compliance Committee if it materially affects regulatory operations, customer protection, reporting, risk management or internal governance.
How Estabizz Can Support
Need Help Implementing This Regulatory Update?
Estabizz can help you understand applicability, prepare internal action notes, update policies and maintain compliance evidence.
This update is for general informational purposes only and should not be treated as legal, regulatory, tax, investment or financial advice. Regulatory requirements may change from time to time. Businesses should verify the latest circular, regulation and regulator guidance before taking any action.