RBI cancels Zavron Finance NBFC licence over lending outsourcing

What the Record Shows

The Reserve Bank of India cancelled the Certificate of Registration of Zavron Finance Private Limited, a non-banking financial company based in Nagpur, Maharashtra. The action was announced in an RBI press release dated 2 December 2024, titled "Reserve Bank cancels Certificate of Registration (CoR) of Zavron Finance Private Limited due to irregular lending practices". With the cancellation, the company can no longer transact the business of a non-banking financial institution.

The RBI exercised its power under Section 45-IA(6) of the Reserve Bank of India Act, 1934, the provision that lets the regulator cancel a registration it had earlier granted. Zavron Finance had held its Certificate of Registration since 3 August 2018. The cancellation is a licence-level regulatory finding: it removes the company's authorisation to operate as an NBFC, and the release states plainly that the company "shall not, hereinafter, transact the business of a Non-Banking Financial Institution".

The RBI's stated ground was that the company's digital-lending operations breached the regulator's guidelines on the code of conduct in outsourcing of financial services, together with the Fair Practices Code. No individual was named in the cancellation order; the regulated entity itself was the subject. This is a regulatory order rather than a criminal finding, and it does not, by itself, pronounce on the validity of any individual loan the company facilitated.

How It Worked

At the centre of the RBI's findings is a pattern the regulator has repeatedly warned against in digital lending: an entity that holds the licence while a technology partner runs the lending. The RBI found that Zavron Finance had outsourced its core decision-making functions - credit appraisal, loan disbursal, fixing of the rate of interest and the KYC verification process - to its app partners. Under the outsourcing code of conduct, those are precisely the functions a registered NBFC is expected to own and control, not hand over.

The RBI further found that the company had failed to conduct due diligence on its Lending Service Providers (LSPs). Per the order, that diligence should have covered the LSPs' competence, financial and operational capability, security and internal controls, their ultimate beneficial owners, and their nationality and shareholding pattern. The regulator found this had not been done. It also found that the company had failed to carry out periodic review of the security practices and control processes the LSPs deployed to protect customer data.

A further finding concerned the Fair Practices Code. The RBI found that the company did not provide customers with a copy of the loan agreement and the sanction letter in the vernacular language, a requirement designed to ensure that a borrower can actually read and understand the terms of the loan they are signing.

Read together, the findings describe a licence being used as a front. The registered NBFC supplied the regulatory permission, while an app partner made the substantive calls - who receives a loan, at what interest rate, and who the customer is - with, on the RBI's findings, no diligence on who ultimately owned or controlled that partner and no oversight of what it did with borrower data. Cancellation, rather than a monetary penalty, reflects that the RBI treated the failure as going to the company's fitness to hold the licence at all.

Who Lost Money

The cancellation order does not quantify any loss, and it should not be read as a finding that borrowers were cheated of a specific sum; it is a finding about how the company ran a regulated business. The people in the frame are the digital borrowers onboarded through the company's app partners.

Those borrowers are exposed in two concrete ways the order identifies. First, they dealt with a lending operation whose credit, pricing and identity checks were run by a partner the licensed NBFC had not vetted, and whose handling of their personal data the NBFC was not reviewing. Second, they received loan documents they may not have been able to read: the RBI found the loan agreement and sanction letter were not supplied in the vernacular language, which is the single document a borrower most needs to understand before agreeing to an interest rate and a repayment schedule.

The wider harm in this category of case is informational rather than a headline theft figure. When core functions sit with an unvetted app partner, a borrower cannot easily tell who they are really transacting with, what their data is being used for, or whether the rate they are paying was set within any regulated framework. That opacity is the loss the outsourcing rules exist to prevent.

Where It Stands Now

As of today the cancellation stands. It was not framed as an interim or ex-parte measure; it is a cancellation order under Section 45-IA(6). A company whose Certificate of Registration is cancelled has a right of appeal to the Appellate Authority under the RBI Act, and the cancellation is therefore capable of being contested. The public record reviewed for this report shows no order restoring the company's registration.

The practical effect is immediate and severe: an NBFC that loses its Certificate of Registration cannot carry on the business of a non-banking financial institution. That is a heavier consequence than the monetary penalties the RBI more commonly imposes for compliance lapses, and it signals that the regulator viewed the outsourcing of core lending decisions as a fundamental failure rather than a technical one.

The action sits within a broader RBI drive to clean up digital lending. The regulator has penalised and, in cases like this, deregistered entities whose apps operated ahead of the rulebook, and it tightened the framework through its 2022 Digital Lending Guidelines and the subsequent Directions. Recent enforcement in the same space includes penalties on P2P operators such as Faircent and three other platforms and on the operators of LiquiLoans; the full run of these actions sits in Oquilia's enforcement archive.

What It Means

For a borrower, the lesson is that the brand on a lending app is not always the entity that holds the licence, and the RBI's Digital Lending Guidelines were written precisely so that this cannot be hidden. A regulated lender must disclose, up front, which RBI-registered entity is actually extending the loan. Where an app is coy about that, or cannot name its regulated lender, the borrower is being asked to take on debt without knowing who is really behind it.

Two concrete checks follow from this order. First, a borrower is entitled to receive the loan agreement and the key facts statement, including the annual interest rate and all charges, in a language they understand; a lender that will not provide this is not following the Fair Practices Code the RBI enforced here. Second, anyone can verify whether a lender is a registered NBFC on the RBI website's list of registered entities before borrowing through an app.

If a loan turns predatory or the recovery conduct crosses the line, borrowers can document the terms and escalate. Oquilia's loan-defence guide sets out how to respond to aggressive recovery and unregulated lending apps. This is reporting on a regulatory action, not advice to use or avoid any particular lender.

FAQ

What exactly did the RBI do?

By a press release dated 2 December 2024, the Reserve Bank cancelled the Certificate of Registration of Zavron Finance Private Limited under Section 45-IA(6) of the RBI Act, 1934. The company can no longer carry on the business of a non-banking financial institution.

Why was the licence cancelled?

The RBI found that the company had outsourced core decision-making functions - credit appraisal, loan disbursal, fixing of the interest rate and KYC verification - to its app partners, had not conducted due diligence on those Lending Service Providers, and had breached the Fair Practices Code by not providing loan documents in the vernacular language.

Did the RBI find that the company committed fraud?

No. Cancellation of a Certificate of Registration is a licence-level regulatory finding about how the company ran its NBFC business, not a criminal conviction, and no individual was named in the order. It does not by itself pronounce on the validity of any loan the company facilitated.

Can Zavron Finance appeal?

Yes. A company whose registration is cancelled under Section 45-IA(6) has a right of appeal to the Appellate Authority under the RBI Act. The public record reviewed for this report shows no order restoring the company's registration, so the cancellation stands as of today.

What happens to borrowers who already took loans through its apps?

The order does not extinguish or invalidate existing loans; it stops the company operating as an NBFC going forward. Borrowers should keep their loan documents and continue to service valid dues, while being alert to any change in who is collecting the loan.

How do I check whether an app's lender is a registered NBFC?

The RBI publishes a list of registered NBFCs on its website. Before borrowing through a lending app, you can confirm which RBI-registered entity is extending the loan, which the app is required to disclose, and cross-check that name against the RBI's list.

This report is based on the Reserve Bank of India press release dated 2 December 2024 cancelling the Certificate of Registration of Zavron Finance Private Limited, reviewed on 31 July 2026.