Digital Loan Apps: Your Cooling-Off Exit and Anti-Harassment Rights Under RBI's Digital Lending Rules

A missed instalment on a 14-day app loan should not cost you your contact list, your dignity, or a call to your employer. Since 8 May 2025, when the Reserve Bank of India (Digital Lending) Directions, 2025 (RBI/2025-26/36, DOR.STR.REC.19/21.07.001/2025-26) came into force, borrowers on regulated digital-lending apps have a defined set of exit and anti-harassment rights that are legally enforceable against the lender, not merely the app on your phone. This playbook sets out where those rights sit in the rulebook, the exact procedure to use them, the defences available when recovery turns coercive, and the tribunal position as it stood on 4 November 2024.

The Statutory Position

The governing instrument is the Reserve Bank of India (Digital Lending) Directions, 2025, notified on 8 May 2025. Most provisions came into force immediately under para 2.ii; para 17 (reporting of all Digital Lending Apps on the RBI's CIMS portal) took effect on 15 June 2025, and para 6 took effect on 1 November 2025. The 2025 Directions consolidate and replace the earlier Guidelines on Digital Lending (RBI/2022-23/111, DOR.CRE.REC.66/21.07.001/2022-23) dated 2 September 2022.

The framework fixes accountability on the lender, not the app. Para 4.iii defines "digital lending" as a remote, automated lending process; para 4.iv defines a Digital Lending App (DLA); and para 4.v defines a Lending Service Provider (LSP) as an agent of a Regulated Entity carrying out functions such as customer acquisition, servicing, monitoring and recovery. Under para 3, the Directions apply to all Commercial Banks, Urban and Rural Co-operative Banks, NBFCs and All-India Financial Institutions, which the rules call Regulated Entities (REs).

The single most important line for a harassed borrower is para 5.vii: any outsourcing agreement between an RE and an LSP "shall in no manner dilute or absolve the RE of its obligations", and the RE "shall remain fully responsible and liable for all acts and omissions of the LSP". Para 5.vi reinforces that the RE must ensure every LSP and DLA it engages complies with the Directions. In plain terms, the bank or NBFC behind the app owns the recovery agent's conduct as of 8 May 2025 - you complain to it, and it is liable.

Because the RE remains liable, the disclosure duties bite. Para 8.iii requires that on execution of the loan the KFS, sanction letter, terms and conditions, account statements and the data privacy policy flow automatically to the borrower's registered email or SMS - so you should have a documentary trail from day one of the loan.

Procedure Step by Step

The rights above are only as good as the procedure you follow to invoke them. The sequence below tracks the Directions clause by clause, and holds whether your loan is a Rs 8,000 salary-advance or a Rs 5,00,000 personal loan.

1. Read the Key Fact Statement first. Under para 8.i, the RE must give you a standardised KFS built to the format in RBI circular DOR.STR.REC.13/13.03.00/2024-25 dated 15 April 2024, disclosing the all-inclusive Annual Percentage Rate. A charge that is not in the KFS cannot be levied. Model the number you are quoted before you accept it using the personal loan EMI calculator so the EMI you commit to is one you can actually service.
2. Exercise the cooling-off exit if you change your mind. Para 10.i gives you an explicit option to exit by repaying the principal plus the proportionate APR without any penalty. The window is fixed by the RE's Board in its loan policy but cannot be less than one day. Para 10.ii allows the RE to retain only a reasonable one-time processing fee, and only if that fee was disclosed upfront in the KFS.
3. Save the documents that auto-flow to you. Para 8.iii requires the signed KFS and loan papers to arrive on your registered email/SMS on execution. Keep them from the disbursal date, because they carry the APR and the grievance-officer contact you will need later.
4. Demand recovery-agent details before any agent calls. Para 8.v says that on default, or on any change of agent, the particulars of the recovery agent must be sent to you by email/SMS before that agent contacts you. An unannounced caller is already outside the rules.
5. Complain to the named nodal grievance officer. Para 11.i and 11.ii require both the RE and the borrower-facing LSP to designate nodal grievance redressal officers whose contact details are displayed on the RE and LSP websites, on the DLA, and in the KFS. Lodge the complaint in writing and note the date.
6. Escalate to the RBI Ombudsman after 30 days. Under para 11.iv, if the complaint is rejected wholly or partly, or you get no reply within 30 days, you may file on the RBI Complaint Management System (CMS) portal under the Reserve Bank-Integrated Ombudsman Scheme (RB-IOS).

The cooling-off arithmetic in step 2 is simple, and the table below works it through for an illustrative Rs 50,000 loan at a hypothetical 30% APR, exited on day 3. Substitute the APR from your own KFS.

Because the cooling-off exit repays principal in full, it behaves like an immediate foreclosure; if you are past the window and want to close the loan early anyway, the foreclosure calculator shows the interest you save by paying down the balance ahead of tenure.

Borrower Defences Available

Where recovery crosses into coercion, the Directions of 8 May 2025 supply the grounds; older Supreme Court law supplies the remedy. Three defences are worth knowing in detail.

Defence one - the app accessed data it was barred from touching. Para 12.i states that data collection must be need-based, with prior and explicit consent and an audit trail, and that DLAs "desist from accessing mobile phone resources like file and media, contact list, call logs, telephony functions". One-time access to camera, microphone or location is allowed only for onboarding or KYC, with consent. An app that harvested your contacts to shame you has breached para 12.i, and para 12.ii additionally gives you the right to revoke consent and require deletion of the data. Under para 13.iv, all data must be stored only on servers located within India, and if processed abroad it must be deleted overseas and brought back within 24 hours of processing; para 13.iii bars storage or collection of biometric data unless a statute allows it.

Defence two - the recovery contact was undisclosed or abusive. Para 8.v makes an unannounced recovery agent a rule breach in itself, and para 5.v obliges the RE to guide any LSP acting as a recovery agent to discharge its duties responsibly. Because para 5.vii keeps the RE fully liable for the agent's acts, threats, calls to your employer or contacts, or visits outside decent hours are attributable to the lender, not just the caller.

Defence three - charges beyond the KFS. Under para 8.i, any fee not set out in the KFS cannot be charged. If the outstanding you are being chased for includes charges that never appeared in the 15 April 2024-format KFS, that portion is not payable, and disputing it does not put you in default on the genuine balance.

The table below maps each grievance to the clause that grounds it and the practical deposit or action needed to press it.

None of these defences require a lawyer or a deposit to begin - the nodal-officer complaint under para 11.i is free, and the RB-IOS route under para 11.iv carries no fee. If several small app loans have stacked up, consolidating them into one serviceable EMI can be a cleaner fix than fighting each recovery separately; the debt consolidation calculator shows whether a single lower-rate loan reduces your total outflow.

Recent Tribunal/HC Position

The consumer forums have continued to enforce the older recovery-agent jurisprudence right up to 2024, which matters because the Directions of 8 May 2025 sit on top of that case law rather than replacing it. The controlling Supreme Court authority remains ICICI Bank Ltd v. Prakash Kaur (2007) 2 SCC 711 and Citicorp Maruti Finance Ltd v. S. Vijayalaxmi, decided on 14 November 2011, in which the Court held that "the practice of hiring recovery agents, who are musclemen, is deprecated and needs to be discouraged" and that banks "cannot employ goondas to take possession by force" (indiankanoon.org/doc/956414).

That principle was applied again on 4 November 2024 in Kotak Mahindra Bank Ltd v. Sher Singh, where the National Consumer Disputes Redressal Commission (NCDRC) dismissed the bank's revision petitions and upheld concurrent findings against forcible repossession (indiankanoon.org/doc/53317898). The borrower had financed a commercial truck for Rs 16,55,000 and defaulted; the vehicle was seized while in transit on 25 November 2012 and sold for Rs 12 lakh in March 2013. The lower forums awarded Rs 5,00,000 in compensation plus Rs 50,000 in litigation costs, holding that the bank had acted "according to its whim" and must "resort to procedure recognised by law", and the NCDRC found no illegality in those findings on 4 November 2024.

Read together, the 4 November 2024 NCDRC ruling and the 8 May 2025 Directions point the same way: a lender that recovers through force or intimidation is exposed both to a compensation order in the consumer forums and to a regulatory complaint under para 11.iv, and para 5.vii means it cannot hide behind the fintech app or the agency it hired. For borrowers on floating-rate app loans, the cost of the underlying credit still moves with the RBI repo rate, which the Monetary Policy Committee held at 5.25% on 5 August 2026 - a separate question from the conduct rules, but relevant to whether the debt was ever affordable.

FAQ

How long is the cooling-off period on a digital loan?

It is fixed by the Regulated Entity's Board in its loan policy but, under para 10.i of the RBI (Digital Lending) Directions, 2025, it cannot be less than one day. During the window you may exit by repaying only the principal plus the proportionate APR, with no penalty.

Can the app charge me a penalty for using the cooling-off exit?

No. Para 10.i of the 8 May 2025 Directions bars any penalty for exiting in the cooling-off period. Para 10.ii allows the lender to retain only a reasonable one-time processing fee, and only if that fee was disclosed to you upfront in the Key Fact Statement.

Is the loan app or the bank behind it responsible for harassment?

The Regulated Entity behind the app is responsible. Para 5.vii states that outsourcing to a Lending Service Provider does not dilute or absolve the RE, which "shall remain fully responsible and liable for all acts and omissions of the LSP". You complain to the RE, and it answers for the agent's conduct.

What if I never received the recovery agent's details?

That is itself a breach. Para 8.v requires the RE to send you the recovery agent's particulars by email or SMS before the agent contacts you, and again on any change of agent. An unannounced caller is outside the rules, and the forcible-recovery bar in Citicorp Maruti Finance v. S. Vijayalaxmi (14 November 2011) still applies.

Can a loan app legally access my phone contacts?

No. Para 12.i requires DLAs to desist from accessing your file and media, contact list, call logs and telephony functions. Only a one-time access to camera, microphone or location for onboarding or KYC is allowed, with your explicit consent, and para 12.ii lets you revoke consent and demand deletion of data already collected.

When can I approach the RBI Ombudsman?

Under para 11.iv, if the Regulated Entity or its LSP rejects your complaint wholly or partly, or does not reply within 30 days of receiving it, you may file on the RBI Complaint Management System portal under the Reserve Bank-Integrated Ombudsman Scheme (RB-IOS). Lodge the first complaint with the named nodal grievance officer required by para 11.i.

Do these rules cover loans I took before 8 May 2025?

The Directions took effect on 8 May 2025 and the conduct duties - recovery-agent disclosure, the grievance route and RE liability - apply to how a Regulated Entity behaves from that date, including on older loans still being serviced. The consumer-forum protection against forcible recovery, confirmed in the NCDRC's 4 November 2024 order, has applied throughout.