RBI cancels X10 Financial NBFC licence over lending outsourcing

What the Record Shows

The Reserve Bank of India cancelled the Certificate of Registration of X10 Financial Services Limited, a Mumbai-based non-banking financial company formerly known as Abhishek Securities Limited. The action was announced in an RBI press release dated 21 January 2025, titled "RBI cancels Certificate of Registration of X10 Financial Services Limited due to irregular lending practices". With the cancellation, the company can no longer transact the business of a non-banking financial institution.

The RBI acted under Section 45-IA(6) of the Reserve Bank of India Act, 1934. The company had held Certificate of Registration No. B-13.01712 since 2 June 2015. The order records the standard consequence in plain terms: the company "shall not, hereinafter, transact the business of a Non-Banking Financial Institution (NBFI), as defined in clause (a) of Section 45-I of the RBI Act, 1934".

The RBI's stated ground was that the company had breached the regulator's guidelines on the code of conduct in outsourcing of financial services in its digital-lending operations. No individual was named in the order; the regulated entity itself was the subject. This is a regulatory order, not a criminal finding, and it does not by itself pronounce on the validity of any individual loan the company facilitated. The record indicates the company ran its lending through a network of mobile applications and service providers rather than through a lending operation it controlled directly.

How It Worked

The RBI found that X10 Financial Services had outsourced its core decision-making functions in digital lending - credit appraisal, the fixing of the rate of interest, and the Know Your Customer (KYC) verification process - to a service provider. Under the outsourcing code of conduct, those are precisely the functions a registered NBFC is expected to own and control. Handing them to an outside partner is the structural defect the regulator has repeatedly warned against, because it leaves the licensed entity as little more than a name on the regulatory register while someone else runs the lending.

The RBI further found that the company had failed to conduct due diligence on the service providers it relied on. Diligence of that kind is what tells a regulated lender who its partner really is, whether that partner is competent and secure, who ultimately owns and controls it, and how it handles borrower data. On the RBI's findings, that diligence had not been done.

The pattern is, on the RBI's findings, essentially identical to the one behind the cancellation of Zavron Finance's licence weeks earlier: the regulated balance sheet was, in effect, rented to a technology partner that performed the underwriting, the pricing and the identity checks. What distinguishes the two is only the detail of which functions each order pins down. In X10's case the RBI centred its findings on credit appraisal, interest-rate setting and KYC.

That the RBI reached for cancellation, rather than a monetary penalty, is itself telling. Cancellation is the regulator's judgement that the failure went to the company's fitness to hold the licence at all, not to a discrete lapse that a fine could address. Where the licensee does not itself decide who gets a loan, at what price, and after what identity check, the RBI treats the registration as no longer serving its purpose.

Who Lost Money

The cancellation order does not quantify any loss, and it should not be read as a finding that borrowers were cheated of a particular sum. It is a finding about how the company ran a regulated business. The people in the frame are the digital borrowers onboarded through the service provider's platform.

Their exposure is the one the outsourcing rules exist to prevent. When credit appraisal, pricing and KYC are performed by an outside partner the licensed NBFC has not vetted, a borrower cannot easily know who is really assessing them, who set the interest rate they are paying, or who now holds their identity documents and personal data. The licence lends an appearance of regulatory oversight to an operation that, on the RBI's findings, the licensee was not actually running.

As with similar cases in this category, the harm is informational rather than a single headline figure. There is no confirmed theft to point to in the order, but there is a real gap between what a borrower would reasonably assume - that an RBI-registered lender was deciding and pricing their loan - and what the RBI found had actually happened.

Where It Stands Now

As of today the cancellation stands. It was not framed as an interim or ex-parte measure; it is a cancellation order under Section 45-IA(6). A company whose Certificate of Registration is cancelled has a right of appeal to the Appellate Authority under the RBI Act, so the order is capable of being contested. The public record reviewed for this report shows no order restoring the company's registration.

The practical effect is immediate: an NBFC that loses its Certificate of Registration cannot carry on the business of a non-banking financial institution. That is a heavier consequence than the monetary penalties the RBI more commonly imposes, and it places X10 alongside Zavron Finance as cases where the regulator deregistered, rather than merely fined, a lender for surrendering core functions to an app partner.

Read together with the RBI's monetary penalties on P2P operators such as Faircent and three other platforms, these cancellations show the regulator enforcing the same underlying principle - that a licensed lender must actually control its lending - at different levels of severity, from a small fine to the loss of the licence. The full run of these actions sits in Oquilia's enforcement archive.

What It Means

For a borrower, the practical lesson is the same one the RBI's Digital Lending Guidelines are built around: the brand on a lending app is not necessarily the entity that holds the licence, and you are entitled to know which RBI-registered lender is actually extending your loan. An app that will not, or cannot, name its regulated lender is asking you to borrow without knowing who is behind the money.

Two concrete checks follow. First, a borrower should receive a key facts statement setting out the annual interest rate and all charges, and the loan agreement, before drawing the loan; a lender that skips this is not following the framework the RBI enforces. Second, anyone can verify whether a lender is a registered NBFC on the RBI website's list of registered entities, and check that the name the app discloses matches it.

If a loan turns predatory, or recovery conduct crosses the line, borrowers can document the terms and escalate. Oquilia's loan-defence guide sets out how to respond to aggressive recovery and unregulated lending apps. This is reporting on a regulatory action, not advice to use or avoid any particular lender.

FAQ

What exactly did the RBI do?

By a press release dated 21 January 2025, the Reserve Bank cancelled the Certificate of Registration of X10 Financial Services Limited (formerly Abhishek Securities Limited) under Section 45-IA(6) of the RBI Act, 1934. The company can no longer carry on the business of a non-banking financial institution.

Why was the licence cancelled?

The RBI found that the company had outsourced its core decision-making functions in digital lending - credit appraisal, fixing of the rate of interest and KYC verification - to a service provider, and had failed to conduct due diligence on that service provider, in breach of the outsourcing code of conduct.

Did the RBI find that the company committed fraud?

No. Cancellation of a Certificate of Registration is a licence-level regulatory finding about how the company ran its NBFC business, not a criminal conviction, and no individual was named in the order. It does not by itself pronounce on the validity of any loan the company facilitated.

Can X10 Financial Services appeal?

Yes. A company whose registration is cancelled under Section 45-IA(6) has a right of appeal to the Appellate Authority under the RBI Act. The public record reviewed for this report shows no order restoring the company's registration, so the cancellation stands as of today.

Is this connected to the Zavron Finance case?

They are separate orders against separate companies, but the RBI's findings rest on the same rule: both were cancelled for outsourcing core lending decisions to an app or service partner without adequate due diligence. Together they show the regulator applying the outsourcing code of conduct consistently.

How do I check whether an app's lender is a registered NBFC?

The RBI publishes a list of registered NBFCs on its website. Before borrowing through a lending app, you can confirm which RBI-registered entity is extending the loan, which the app is required to disclose, and cross-check that name against the RBI's list.

This report is based on the Reserve Bank of India press release dated 21 January 2025 cancelling the Certificate of Registration of X10 Financial Services Limited, reviewed on 31 July 2026.