Is a loan app legal? How to check if it's RBI-regulated
Last updated: 2026-07-11
A legal digital loan app in India is either run by an RBI-regulated lender — a bank or an NBFC (a non-banking finance company) — or it lends in partnership with one, and it must clearly tell you which regulated entity is actually lending you the money. If you cannot find that regulated-lender name anywhere, or the app hides who is really behind it, treat that as a serious warning sign. You can check the lender's identity, and you can verify or report an app, through the RBI's Sachet portal (sachet.rbi.org.in).
This page helps you tell a properly regulated lender from a red-flag app before you install it or give it access to anything. If an app is already harassing you, that harassment is illegal and not your fault — go straight to what to do about loan-app harassment.
What a legal digital lender looks like
Under the RBI's Digital Lending Guidelines, a legitimate app does not hide the lender. In plain terms, you should be able to see:
- Who the actual lender is — the name of the RBI-regulated bank or NBFC lending the money, stated clearly, not buried or missing.
- That relationship disclosed up front — if the app is a front-end for a regulated lender, it must say so, and name the regulated entity.
- Clear terms before you borrow — the interest, the fees, and the total cost shown honestly, not sprung on you after disbursal.
- A grievance channel — a way to complain, with a contact, rather than only aggressive collections.
The exact registration details and current requirements are set by the RBI. Check the linked RBI sources rather than relying on a figure quoted second-hand.
Legal lender vs red-flag app
| What you see | A legal, regulated lender | A red-flag / likely illegal app |
|---|---|---|
| Who is lending | Names the RBI-regulated bank or NBFC clearly, and discloses any partnership. | No clear lender identity; you cannot tell who is actually behind it. |
| Phone permissions | Asks only for what the loan reasonably needs. | Demands access to your full contacts, photos, or gallery — data it does not need to lend, and later uses to shame you. |
| Fees | Costs shown clearly before you borrow. | Asks for an upfront "processing fee" before any money reaches you, or hides huge charges behind a tiny loan. |
| Approval | Does some checks; the terms are clear. | Instant disbursal with almost no checks — the speed is the bait. |
| If there's a problem | Has a grievance channel you can use. | Collections that turn to threats, abuse, or messaging your contacts. |
Red flags, in one line each
- Excessive permissions — it wants your whole contact list, photos, or gallery. A loan does not need those. Granting them is exactly how an abusive app later contacts and shames people.
- No clear lender identity or RBI registration — you cannot find which regulated bank or NBFC is lending.
- Upfront "processing fee" — money asked from you before any loan is disbursed.
- Tiny loan, huge hidden charges — a small amount that balloons through fees you were not shown.
- Instant money, no checks — near-instant disbursal with no meaningful verification.
How to check, and how to report
- Look for the regulated-entity name. Find, in the app or its listing, the RBI-regulated bank or NBFC that is actually lending, and the disclosure of that relationship. If it is not there, that is your answer.
- Verify or report through RBI Sachet (sachet.rbi.org.in) — the RBI portal for checking and reporting unregistered or suspicious lending apps and entities.
- If you have already been harassed or threatened, that is illegal — see what to do right now, and note that threats or extortion are a crime to report at cybercrime.gov.in or 1930.
If you are not sure
When an app's lender identity is unclear, the safe move is not to install it and not to grant it access to your contacts or gallery. RBI sets the specifics of who may lend and how — the current requirements are on the linked RBI sources, so check them there. The rules on how a lender or its recovery agents may treat you are in the recovery-agent rules and how to complain.
Was this helpful? (anonymous — no sign-up, nothing stored about you)
Official sources (verify everything here — and you can act directly through them)
- RBI (rbi.org.in) — Digital Lending Guidelines: a regulated entity must be identified and disclosed
- RBI Sachet (sachet.rbi.org.in) — verify or report an unregistered lending app/entity
- cybercrime.gov.in — National Cyber Crime Reporting Portal (for threats or extortion)
- National Consumer Helpline (1915) — consumerhelpline.gov.in