RBI holds Indian lenders responsible for their digital lending partners, so compliance teams use AI agents to reconcile key fact statements with charges, test direct fund flows, audit lending apps' permissions and review recovery calls. People keep every finding and action against a partner. RBI's digital lending, fair practices and outsourcing rules and the DPDP Act 2023 apply.
What does consumer lending compliance look like in India?
Digital lending has reshaped the work. Banks and non-bank lenders partner with lending service providers and lending apps that find borrowers, run onboarding and sometimes collect repayments. RBI holds the regulated lender responsible for all of that, so compliance spends much of its time watching partners it does not employ.
The rules are specific. Borrowers must receive a key fact statement showing the all-in annual cost before signing. Disbursements go directly into the borrower's account and repayments directly to the lender, without passing through a partner's pool account. Borrowers get a cooling-off period to exit by repaying principal and proportionate cost. Lending apps must not take broad access to phone contacts or media.
Collections conduct is the persistent risk. Recovery agents must not harass, threaten or contact borrowers at unreasonable hours. Complaints arrive through the lender, its partners, and RBI's ombudsman scheme, in many languages. Credit information reporting, and checks that partners' apps match the list the lender publishes, complete the week.
Which tasks can an agent take on?
| Use | What the agent does | Depth |
|---|---|---|
| Key fact statement reconciliation | Compares the annual cost and fees in each key fact statement with what the loan system actually charged | 1 |
| Fund flow testing | Checks that disbursement and repayment records show direct transfers, with no partner pool accounts in between | 1 |
| App permission audit | Reviews each partner app's declared and observed permissions against what RBI allows | 1 |
| Recovery call review | Reviews call recordings and messages in English, Hindi and regional languages for timing, tone, threats and contact with third parties | 1 |
| Complaint drafting | Classifies complaints and drafts responses for the grievance redressal officer | 2 |
Recovery call review is where an agent changes coverage most. Compliance teams can listen to a small sample of calls; an agent can review all of them and surface the handful that cross the line, in whichever language they were made.
Which decisions stay with people?
Action against a lending partner, from a warning to ending the relationship, stays with named people. It has commercial consequences and may need to be reported. The lender, not the agent, is accountable to RBI for its partners.
Borrower remediation stays human. When reconciliation finds charges above the key fact statement, deciding refunds and how to contact borrowers is a judgement the lender must own. So does any decision on a recovery agent found to have harassed a borrower.
The grievance redressal officer's responses stay with that officer, who is named publicly. An agent drafts; the officer sends. This is the stance in AI compliance agents: second line, never the last word.
Which rules apply in India?
RBI regulates banks and non-bank lenders and sets rules on digital lending, including key fact statements, direct fund flows, cooling-off periods, lending app conduct, data collection limits, and the lender's responsibility for its lending service providers. RBI's fair practices expectations cover transparency and collections conduct, its outsourcing rules apply to partners and suppliers, and its ombudsman scheme handles unresolved complaints. Lenders also report to credit information companies.
The Digital Personal Data Protection Act 2023 applies to borrowers' personal data held by the lender and processed by partners and agents. The lender is the data fiduciary and must limit processing to the stated purpose, secure the data, and respond to borrowers' rights. Recovery practices that expose a borrower's debt to their contacts raise both conduct and data protection concerns.
There is no AI-specific statute. For contrast, our explainer on what the FCA Consumer Duty is shows how the UK frames outcome-based oversight, and our piece on the CFPB and AI agents in consumer finance covers the US.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Weeks one to four: run key fact statement reconciliation and fund flow testing at depth 1 across loans from each partner. These are precise tests with clear answers, and they often find issues in one or two partners first.
Weeks five to eight: run the app permission audit for every partner app listed on your website, and add any apps you find in the market using your name that are not listed.
Weeks nine to twelve: start recovery call review at depth 1 across all languages your agents use, and share partner-level results with the business. Consider complaint drafting at depth 2 once the review is stable.
Questions people ask
Can an AI agent block a lending partner's app?
It can flag breaches and draft a recommendation, but suspending or ending a partner relationship is a decision for named people in the lender, given its commercial and regulatory consequences.
Can AI agents make collections calls in India?
That is a different use, outside compliance, and carries high conduct risk. If used, the lender remains responsible, and calls should be reviewed as carefully as human ones.
How does India compare with France for consumer lending compliance?
France adds the EU AI Act's high-risk rules on credit scoring and a usury threshold. See our brief on compliance agents in French consumer lending.