In short
The Reserve Bank of India (RBI) does not license software, but it controls how banks and NBFCs choose, run and test it. Three sets of rules matter most. The IT governance direction, in force since 1 April 2024, sets how a regulated entity manages IT risk. The outsourcing directions of 28 November 2025 make every material IT vendor accept audit rights, incident reporting and data rules through the contract. The digital lending rules, now part of the RBI’s consolidated Credit Facilities Directions, govern lending apps and the websites behind them. This article covers the RBI’s directions as published on 6 November 2026; payment system rules are in a separate article.
Who it applies to
- IT governance direction: commercial banks, NBFCs in the middle, upper and top layers, credit information companies, and five all-India financial institutions (EXIM Bank, NABARD, NaBFID, NHB and SIDBI). Local area banks and core investment companies are excluded. Branches of foreign banks may comply or explain.
- Outsourcing directions: issued separately for commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs and all-India financial institutions. The IT outsourcing chapter applies to NBFCs in the middle layer and above, and to Tier 3 and Tier 4 urban co-operative banks.
- Digital lending rules: commercial banks, co-operative banks, NBFCs including housing finance companies, and all-India financial institutions, for loans sourced through apps and websites.
- Vendors: software houses, cloud providers, data centres, managed security providers and lending service providers are not regulated directly. They are bound through the contracts the RBI requires.
What it means for your website
Digital lending disclosures
A lender must keep one prominent place on its own website that lists:
- its digital lending products and its digital lending apps;
- the lending service providers (LSPs) it uses, their apps and what each does;
- customer care and grievance redressal details;
- links to the RBI’s complaint management system and the Sachet portal; and
- its privacy policies.
Every lending app and LSP must link to this page. Contact details of the nodal grievance officer for digital lending must appear on the lender’s and LSP’s websites and in the app. They must also appear in the Key Fact Statement (KFS), the standard summary of loan costs. Borrowers must be able to lodge complaints on the app and the website. The lender and the LSP must also publish their data storage policy and a privacy policy that names any third parties collecting data through the app.
Loan offers on marketplaces
Where an LSP works with several lenders, its app must show every matching offer and name the lenders that did not match. Each offer shows the lender, amount, tenor, annual percentage rate (APR), monthly repayment and penal charges, with a link to the KFS. The display must not push one lender or use dark patterns. Borrowers get a cooling-off period of at least one day to exit a digital loan without penalty.
Other website duties
Under the outsourcing directions, a commercial bank must place its grievance redressal timeframes, of no more than 30 days, on its website. Under the RBI’s Digital Banking Channels Authorisation Directions, in force from 1 January 2026, banks need documented consent to register customers for internet and mobile banking. They must not force customers to take digital channels with other products.
What it means for your software
IT governance structure
The board sets IT strategy through an IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT experience. It meets at least every quarter. A senior IT Steering Committee also meets at least quarterly. The Chief Information Security Officer (CISO) must not report directly to the head of IT. The CISO briefs the board or its committee on cyber security at least every quarter. IT, security, business continuity and cyber policies are reviewed at least once a year.
Vendor software and source code
For critical applications, the regulated entity must obtain the source code or put it in escrow. Vendors must certify that their software is free of known vulnerabilities, malware and covert channels, including after material changes. Unsupported hardware and software should be avoided, and the entity must track end-of-support dates and plan replacements in advance.
Change, patch and data migration
The entity needs documented change and patch management, with impact assessment, approval and a way to recover from failed changes. Data migration needs a documented policy, sign-off by business and application owners at each stage, and an audit trail.
Access, logs and audit trails
Critical applications must have audit and logging capability, and logs must be monitored for unauthorised activity. The direction sets no log retention period; see the CERT-In directions for that. Privileged users of critical systems need multi-factor authentication, based on risk assessment.
Testing
For critical systems and internet-facing systems in the DMZ, vulnerability assessment is due at least every six months and penetration testing at least every 12 months. Trained, independent experts must do it, and findings must be fixed within set timelines. See our VAPT guide.
Business continuity
Disaster recovery drills for critical systems are due at least every six months. Each drill must run the DR site as the primary site for a full working day. The recovery point objective should be near zero. Configurations and security patches at the main and DR sites must be identical, and backups must be restored periodically to prove they work.
Incident reporting
The entity must notify CERT-In and the RBI of cyber incidents as the rules require. For outsourced IT, the vendor reports to the entity without undue delay. The entity then reports to the RBI within six hours of the vendor detecting the incident. CERT-In’s own 6-hour rule also applies.
IT outsourcing contracts
The outsourcing directions of 28 November 2025 repealed the RBI’s earlier instructions on outsourcing of financial and IT services for each entity type. Existing IT contracts must comply at renewal or by 10 April 2026, whichever is earlier; new contracts must comply from signing. For a material IT service, the contract must include:
- audit rights for the regulated entity, covering subcontractors;
- access to data, logs, alerts and premises for the entity, its auditors and the RBI;
- the types of incident the vendor must report, such as data breaches and outages;
- storage of data only in India, as applicable under existing rules;
- the RBI’s right to inspect the vendor and its subcontractors;
- termination rights and the ability to move the service to another provider;
- back-to-back arrangements with the original equipment makers; and
- non-disclosure terms.
The vendor needs the entity’s consent before using a subcontractor. At exit, the vendor must help with transition and remove or destroy data safely. The entity must also check concentration risk. It may not outsource to a vendor owned or controlled by its own directors or key managers without board approval and disclosure.
Cloud
Cloud use needs a documented policy covering the whole data lifecycle. Contracts are allowed only with providers in jurisdictions that uphold enforceability. Encryption keys and hardware security modules must stay under the entity’s control. Access needs multi-factor authentication and least privilege. Cloud logs must feed the entity’s security operations centre, and the exit plan must include a secure purge of data.
Digital lending apps
- Permissions: data collection must be need-based, with prior explicit consent and an audit trail. No access to files and media, contacts, call logs or telephony. Camera, microphone or location only once, for onboarding or KYC.
- Consent management: borrowers can give or deny consent for specific data, restrict sharing, revoke consent and ask for deletion.
- Storage: all data on servers in India. Data processed abroad must be deleted there and brought back within 24 hours. LSPs keep only basic data, such as name, address and contact details. No biometric data unless the law allows.
- Money flow: loans go straight to the borrower’s bank account and repayments straight to the lender’s, never through an LSP’s account.
- Documents: the KFS, sanction letter, terms, statements and privacy policies must reach the borrower automatically by email or SMS when the loan is signed.
- Reporting: every lending app must be reported on the RBI’s CIMS portal, and all digital loans reported to credit information companies.
These rules started as the Reserve Bank of India (Digital Lending) Directions, 2025 of 8 May 2025. For commercial banks they now sit in Chapter III of the Credit Facilities Directions, 2025, updated as on 1 October 2026. NBFCs and other lenders should check the equivalent direction for their category.
Checklist
- Confirm which RBI directions apply to your entity type and layer.
- Set up the IT Strategy Committee, IT Steering Committee and an independent CISO.
- List critical systems and schedule VA every six months and PT every year.
- Get source code or escrow, and a vulnerability-free certificate, for every critical application.
- Amend vendor contracts with audit, access, incident, data location and exit clauses before renewal.
- Make vendors report incidents fast enough for you to tell the RBI within six hours.
- Run DR drills every six months with the DR site live for a full working day.
- For digital lending, audit app permissions, data location and consent screens.
- Publish the digital lending page, grievance officer details and privacy policy on your website.
How Kreon helps
We can build ERP, CRM, collections and loan-management systems for financial businesses with RBI requirements designed in: consent records, data kept on Indian servers, role-based access with multi-factor authentication, and an audit trail of every change with before and after values. We hand over the source code for software we build for you when it is part of the agreed scope of work; if it is not, we can provide it later at an extra cost. Systems we have built have passed independent VAPT.