Last updated 12 Nov 2026
Check two things before you share any document or pay anything: that the lender is a bank or NBFC on an RBI list, and that the app or website you are using belongs to that lender or to a service provider the lender names. The RBI publishes both lists. A lender that cannot be found, or an app whose lender will not name itself, is a reason to stop.
This matters because in India only regulated entities, such as banks and NBFCs, may lend as a business. Many fake apps copy a real lender's name and logo. A few minutes on official pages protects your money and your phone data.
Two different things to verify
A digital loan has two parties. The lender (the "regulated entity") sanctions and funds the loan. A lending service provider (LSP) is a company that connects you to the lender, runs the app or website, or collects documents for it. The RBI Digital Lending Directions, 2025 treat them differently, and you should check both.
Lender and lending service provider compared
| Point | Lender (bank or NBFC) | Lending service provider (LSP) |
|---|---|---|
| What it does | Decides, prices, sanctions and pays out the loan | Shows offers, runs the app or collects papers for a lender |
| Where to check | RBI lists of banks and NBFCs | The lender's own published list of its LSPs, and RBI's digital lending apps directory |
| Who pays the LSP | The lender pays the LSP's fees directly | The LSP may not collect such fees from you |
| Who answers your complaint | The lender's nodal grievance officer | The LSP's nodal grievance officer, if it deals with you |
Step 1: Check the lender on RBI's lists
Use three official pages. For banks, open the RBI list of scheduled commercial banks, grouped by public sector, private sector, small finance, payments and foreign banks. For NBFCs, open the RBI NBFC page, which carries the list of NBFCs and ARCs registered with the RBI in Excel and PDF, and a separate list of entities whose registration was cancelled. For other regulated entities, use the RBI regulated entities index. Then apply the checks below.
- Match the full legal name, not a brand. Loan apps often use a trade name that differs from the registered company name. The sanction letter and Key Fact Statement must show the lender's legal name.
- Check the cancelled list too. A company that once held registration may no longer hold it.
Registration with the RBI shows that a company is permitted to operate as an NBFC. It does not mean the RBI has rated its loans or fixed its charges, and you should still compare offers.
Step 2: Check the app in RBI's directory of digital lending apps
Since 1 July 2025 the RBI has run a public directory of digital lending apps (DLAs) used by the entities it regulates. Banks and NBFCs must report every DLA they use, including apps run by service providers, under paragraph 17 of the Digital Lending Directions. Open the directory from the link "DLA's deployed by Regulated Entities" on the RBI homepage, or go straight to the directory.
Search for the app name. The entry should show which regulated entity deploys it. If the app is missing, or lists a lender other than the one it names to you, do not proceed. A listing shows that a lender has reported the app to the RBI. It is not a rating of the lender or a promise about its terms, so still read the loan agreement.
Step 3: Ask for the lender's own list of LSPs
The Directions require the lender to disclose, on its website, the LSPs it works with and the digital lending apps involved. Look for a page titled something like "Digital lending partners" or "Our LSPs" on the lender's official website, which you reach by typing its address yourself. If the platform in front of you is not named there, ask the lender in writing whether it is an authorised LSP.
LOANZ 360 is a lending service provider working with partner banks and NBFCs. Which lenders partner with LOANZ 360 is shown live on the lending partners page, and the digital lending disclosures page explains what we disclose. Every loan is decided, priced, sanctioned and paid out by the lender, into your own bank account.
Step 4: Read the Key Fact Statement before you accept
Before you sign, the lender must give you a Key Fact Statement (KFS) in a standard format, showing the amount, the all-in cost as an annual percentage rate, the charges and the grievance contacts. If an app says "details after approval" or will not give you a KFS, treat that as a warning. Read our guide to the Key Fact Statement and APR.
Red flags that mean stop
Red flags and what to do
| Red flag | Why it matters | What to do |
|---|---|---|
| A person asks you to pay a fee before the loan is disbursed | Under the Directions, the lender pays an LSP's fees. Legitimate charges appear in the KFS and are deducted or billed by the lender | Do not pay. Ask for the charge in writing in the KFS |
| No Key Fact Statement | You cannot compare cost without it | Ask for it in writing, or walk away |
| The app asks for your contacts, photos, files or call logs | The Directions tell apps not to access files, media, contacts or call logs. One-time access to camera, microphone or location for KYC, with your consent, is different | Deny the permission, or uninstall the app |
| Payment to a personal account or a wallet | Loans are repaid to the lender's account named in the agreement | Pay only to the account in your loan agreement |
| Very short deadlines and pressure to act now | Real lenders give you time and a cooling-off option | Pause and verify using steps 1 to 3 |
| Disbursal to a third party, not your own account | Loans are paid into the borrower's own bank account | Refuse, and report it |
| The lender will not give its legal name or grievance officer | The Directions require grievance officer details on the website, the app and the KFS | Do not share documents |
A worked example
A self-employed shopkeeper in Nashik sees an advertisement for a loan app. The app names a lender in small print. He types the lender's legal name into the RBI NBFC list and finds it. He then searches the RBI directory for the app name and finds no entry under that lender. He phones the lender's published customer line, not the number in the advertisement, and is told the company has no such app. He uninstalls it and files a report. The whole check took about ten minutes.
Where to report a suspected fake lender or app
Report to the police cyber-crime channel and the RBI. The RBI runs the Sachet portal for reporting unauthorised deposit-taking and lending activity, and complaints about a regulated lender go through the RBI Integrated Ombudsman. If you have already paid, tell your bank at once, because speed helps. Keep screenshots, chat messages, call numbers and payment receipts. See digital lending safety and the grievance page.
Frequently asked questions
How do I know if a bank or NBFC is genuine?
Find its full legal name on the RBI list of scheduled commercial banks or the RBI list of NBFCs and ARCs. Match the name on the sanction letter and Key Fact Statement. Also check the RBI cancelled list, because a registration can be withdrawn.
Is every app in the RBI digital lending apps directory safe?
Not automatically. Lenders report their apps to the RBI, so a listing shows an app belongs to a regulated lender. It does not rate the lender or its terms. Read the loan agreement and Key Fact Statement before you accept.
Is it normal to pay a fee to a loan agent first?
No. Under the RBI Digital Lending Directions, fees of a lending service provider are paid by the lender and not collected from you. Charges that are genuinely yours appear in the Key Fact Statement, set by the lender. Do not pay anyone to "release" a loan.
Can a loan app ask for my contact list?
The Directions say apps should not access your files, media, contacts or call logs. One-time access to camera, microphone or location for KYC, with your consent, is allowed. An app that demands contacts is a red flag.
What is the difference between a lender and an LSP?
The lender is the bank or NBFC that lends. The LSP is the company that runs the platform or collects documents for it. The lender stays responsible for the loan and must name its LSPs. Check both.
What should I do if I have already paid a fee or shared documents?
Tell your bank immediately and block the card or account if needed. Change passwords, report to the police cyber-crime channel and the RBI, and keep all evidence. Watch your credit report for loans you did not take.
Related reading: Digital lending safety, Key Fact Statement and APR, Borrower rights and grievance, Home loan fraud prevention, Bank versus NBFC for business loans, NBFC glossary entry, Key fact statement glossary entry, Cooling-off period, Lending partners.