On this page · 9 sections
Summary. The Reserve Bank of India issued the RBI (Digital Lending) Directions, 2025 on 8 May 2025, and paragraph 13(iv) is the clause that reshapes a fintech build: all digital lending data must sit on servers in India, and anything processed abroad must be deleted from those foreign servers and brought back within 24 hours. Paragraph 9 bans disbursal into any third-party or pool account. Paragraph 12(i) stops your app from reading contacts, call logs and media at all. On the payments side, the RBI (Authentication mechanisms for digital payment transactions) Directions, 2025, dated 25 September 2025, had to be met by 1 April 2026, and cross-border card-not-present validation follows on 1 October 2026. The market these rules govern is not small: UPI processed 23.66 billion transactions worth ₹29.88 trillion in July 2026, up 22% year on year, and the Account Aggregator network carried 44.84 million new consents in the same month against a cumulative 326.30 million linked accounts. This page sets out the seven requirements that decide your architecture, and what each one costs in engineering time.
The seven rules, and where each one lands in the build
| RBI requirement | What it says | Where it lands in your build |
|---|---|---|
| Data residency, para 13(iv) | Data stored only on servers in India; anything processed abroad deleted there and returned within 24 hours | Rules out an offshore-only data plane; forces region pinning and a repatriation job |
| Fund flow, para 9 | Disbursal direct to the borrower account, repayment direct to the lender, no pass-through or pool account | Removes the escrow pattern most payment stacks default to |
| Credit limits, para 7(ii) | No automatic increase without an explicit, recorded borrower request | Limit changes become a consented, audited event, not a scoring output |
| App permissions, para 12(i) | No access to contacts, call logs, files or media; one-time camera, microphone or location for onboarding only | Rewrites the Android and iOS permission manifest |
| Key Fact Statement, para 8 | KFS per the 15 April 2024 circular, plus digitally signed documents auto-delivered on execution | A document generation and signing service, not a PDF template |
| Disclosure and reporting, paras 8(iv) and 17 | Public list of every digital lending app and lending service provider; every app reported on RBI's CIMS portal | A maintained public registry page and a reporting obligation your Chief Compliance Officer certifies |
| Authentication, 2025 Directions | Two distinct factors, at least one dynamically created for non-card-present transactions, from 1 April 2026 | Rebuilds the auth layer; the issuer compensates the customer in full where it is not met |
1. Data residency is an architecture decision, not a hosting preference
The 24-hour repatriation rule in paragraph 13(iv) is the single most build-relevant clause in the Digital Lending Directions. The requirement goes past keeping a copy in India. The data lives in India, and where a process abroad touches it, that foreign copy is deleted and the data comes back inside a day. The older payment-side rule points the same way: the RBI's Storage of Payment System Data directive of 6 April 2018 requires the full end-to-end transaction details to be stored in a system only in India, with the foreign leg of a cross-border transaction the sole carve-out. Together these mean your primary data plane, your analytics, and any model training that touches customer data have to be designed India-resident from the first sprint. Retrofitting this after a global platform decision is the most expensive rework in Indian fintech.
2. the fund flow rule removes a pattern most teams reach for by default
Paragraph 9 requires that disbursal goes directly into the borrower's bank account and repayment directly into the regulated entity's account, with no pass-through or pool account belonging to any third party, and no third-party control of the flow of funds even indirectly. There are narrow exceptions for statutory mandates, co-lending flows between regulated entities, specific-end-use disbursal to an end beneficiary, and cash recovery on delinquent loans. If your product design routes money through your own account for reconciliation convenience, it needs a different design.
3. the permission manifest is written for you
Paragraph 12(i) states that lending apps must not access mobile phone resources including file and media, contact list, call logs and telephony functions, and that a one-time access to camera, microphone or location may be taken only where it is necessary for onboarding or KYC, with the borrower's explicit consent. Paragraph 12(ii) requires consent to be per-purpose, revocable, and to support deletion. On Android and iOS this is a concrete change to what you declare, when you prompt, and what your consent store has to record and be able to undo.
4. Video KYC has published technical standards
The Master Direction on KYC, updated as on 14 August 2025, sets out what a compliant video onboarding flow must do. The infrastructure has to be hosted in the regulated entity's own premises and originate from its own secured network domain. The session is end-to-end encrypted. The application has to be capable of preventing connections from IP addresses outside India or from spoofed addresses. Recordings carry live GPS coordinates and a date-time stamp. Face liveness, spoof detection and face matching are required components, and the sequence or type of questions has to vary to prove the interaction is real-time rather than pre-recorded. Any prompting at the customer end forces rejection. Penetration testing and a security audit by a CERT-In empanelled auditor come before rollout, an Aadhaar XML or secure QR must be no more than three working days old, and accounts opened this way become operational only after concurrent audit. Where video onboarding is offered, it has to be presented as the customer's first option.
5. Aadhaar OTP onboarding has hard product limits
Accounts opened through Aadhaar OTP-based e-KYC in non-face-to-face mode are capped at ₹1 lakh of aggregate deposit balance and ₹2 lakh of aggregate annual credits, term loans are limited to ₹60,000 sanctioned per year, and the account must be converted through full KYC or video KYC within one year or be closed. If your growth model assumes an OTP-only funnel, those ceilings are your product ceilings, and the conversion path has to be built before you need it rather than after.
6. the authentication rebuild had a date, and the next one is coming
The Authentication Directions of 25 September 2025 required compliance by 1 April 2026 from all payment system providers and participants, bank and non-bank. The requirement is two distinct factors, and for all non-card-present transactions at least one factor must be dynamically created or proven, unique to that transaction, with the compromise of one factor not affecting the other. The enforcement teeth are in paragraph 9(2): where a loss arises from transactions effected without complying, the issuer compensates the customer for the loss in full without demur. The next date is 1 October 2026, by which card issuers must have a mechanism to validate non-recurring cross-border card-not-present transactions and register their BINs with the card networks. Recurring e-mandate transactions after the first remain outside the two-factor requirement, along with small-value contactless card payments, select prepaid instruments, NETC and small-value offline payments.
7. Consent is a data structure, and DPDP is the second clock
The Digital Personal Data Protection Rules were notified in November 2025 with an eighteen-month phased compliance period, putting the substantive obligations in May 2027. For a fintech build the relevant items are specific, itemised, plain-language consent, protection of stored data through encryption, obfuscation, masking or virtual tokens, systems that can detect unauthorised access, retention of logs and personal data for at least one year, and breach notification to affected users and to the Data Protection Board within 72 hours. Above five million Indian users the annual audit and data protection impact assessment obligations of a significant data fiduciary apply. Consent under the RBI rules and consent under DPDP are not the same object, and a build that models only one of them will be reworked.
Sanjay Malhotra, Governor of the Reserve Bank of India, described the regulatory posture in an address on 10 March 2025: "We have adopted a soft-touch approach to regulating the payments ecosystem and FinTechs. Through these regulations, the Reserve Bank attempts to balance these divergent set of expectations. Our approach has been to put in place regulatory guardrails within which all stakeholders are free to operate."
The 2026 dates worth putting on a plan
| Date | What changes | Who it hits |
|---|---|---|
| 1 April 2026 | Authentication Directions compliance due | All payment system providers and participants |
| 30 June 2026 | Low-risk customer KYC updation window closes on the later of due date or this date | Regulated entities with low-risk individual customers |
| 31 August 2026 | Google Play requires target API level 36 for new apps and all updates | Any live Android app, fintech included |
| 1 October 2026 | Cross-border card-not-present validation and BIN registration due | Card issuers |
| 31 December 2026 | NPCI's deferred 30% UPI market share cap for third-party apps | Third-party application providers on UPI |
| 14 May 2027 | DPDP substantive obligations take effect | Any app processing personal data of users in India |
What we build
eCorpIT builds regulated financial applications and the integrations underneath them: lending journeys designed around the Digital Lending Directions, payment flows on the UPI and card rails, video and Aadhaar onboarding, and Account Aggregator integration for consented financial data. Where the product is a lending build specifically, the RBI digital lending engineering checklist goes through the obligations clause by clause. For UPI-side constraints including the market share cap, the UPI 2026 builder guide has the detail, and the DPDP engineering playbook covers the privacy timeline. If you are still choosing a partner rather than a design, the India buyer guide sets out the checks to run first.
How delivery runs
- Regulatory mapping, one to two weeks. We list every rule that touches the product and turn each into an architectural constraint with an owner. This is where data residency, fund flow and the permission manifest get decided, because all three are cheap now and expensive later.
- Architecture and data model. Region-pinned storage, the consent object, the audit log, and the integration contracts for the bank, the payment aggregator and the Account Aggregator.
- Build in two-week increments against a working environment, with the compliance constraints expressed as tests rather than as a document.
- Security and audit readiness. Penetration testing, and preparation for the CERT-In empanelled audit where video onboarding is in scope, alongside store-readiness against the current API level.
- Launch and run, with monitoring, incident handling that can meet a 72-hour notification obligation, and a maintenance model agreed before go-live.
The stack
Swift and Kotlin for native onboarding and payment surfaces, Flutter or React Native where a shared codebase suits the product, and Node.js, Python or .NET on the backend with PostgreSQL. Hosting is region-pinned in Indian regions on AWS, Azure or Google Cloud, which is a compliance requirement here rather than a latency preference. We are partners with AWS, Microsoft, Google, Shopify and Kaspersky.
Why eCorpIT
eCorpIT is eCorp Information Technologies Private Limited, founded in 2021 and based in Gurugram, Haryana. We are assessed at CMMI Level 5, certified to ISO 27001:2022, and MSME registered. On regulated builds we design applications aligned with the relevant RBI and DPDP requirements and say plainly which certifications we hold and which we do not, because a partner who claims to make you compliant is describing something no vendor can sell.
FAQ
How eCorpIT can help
We design and build regulated fintech applications from Gurugram, with the RBI and DPDP constraints treated as architecture inputs rather than a compliance review at the end. If you have a product design already, we will review it against the seven requirements above and tell you which ones it currently breaks. Send us the product scope and the regulated entity you are building with at contact us.
References
- RBI (Digital Lending) Directions, 2025 — RBI/2025-26/36, 8 May 2025.
- RBI Storage of Payment System Data directive — 6 April 2018.
- RBI (Authentication mechanisms for digital payment transactions) Directions, 2025 — 25 September 2025, compliance due 1 April 2026.
- RBI Master Direction on Know Your Customer — updated as on 14 August 2025, including video KYC standards and Aadhaar OTP limits.
- Address by Sanjay Malhotra, Governor, Reserve Bank of India, Digital Payments Awareness Week 2025 — 10 March 2025.
- Sahamati Account Aggregator dashboard — monthly and cumulative consent and account-linking figures through July 2026.
- UPI transactions hit a record 23.66 billion in July 2026 — 1 August 2026.
- NPCI extends the 30% UPI market share cap deadline to December 2026 — 31 December 2024.
- DPDP Act rules notified: obligations, breach notification and audit duties — 14 November 2025.
- DPDP Rules 2025 notification and the phased compliance period — 17 November 2025.
- Target API level requirements for Google Play apps — API level 36 from 31 August 2026.
- Nasscom-Zinnov India GCC Landscape Report 2026 — data as of March 2026.
Last updated: 15 August 2026.
