Digital Lending / Fintech Partnership Audit Checklist
DIGITAL LENDING / FINTECH PARTNERSHIP AUDIT CHECKLIST
Regulated entity (RE): {{client_name}} · Branch/digital-lending unit: {{branch_name}} · Period: {{period_end}}
Purpose: to test a regulated entity's (bank/NBFC's) arrangement with a Lending Service Provider (LSP) or digital-lending fintech for compliance with the RBI Digital Lending Guidelines — first loss default guarantee (FLDG) structuring and cap, direct-to-borrower disbursement/recovery flow, data privacy/consent, and recovery-agent conduct.
A. Credit Decision & Disbursement Flow
- Credit sanction decision remains with the regulated entity (RE) — the LSP's role is limited to sourcing, credit-scoring inputs and servicing, not the underwriting decision itself.
- Loan disbursement flows directly from the RE's account to the borrower's bank account, without passing through the LSP's pooling account (a core Digital Lending Guidelines requirement to prevent co-mingling of the RE's and LSP's funds).
- Similarly, all loan repayments/collections flow directly to the RE's account, not through the LSP, except for RE-permitted collection arrangements documented in the agreement.
B. First Loss Default Guarantee (FLDG) Compliance
- FLDG (if the arrangement has one) is capped at the RBI-prescribed ceiling of the outstanding loan portfolio covered (commonly cited as up to 5%) — verify against the current circular in force, since this cap has been introduced and clarified progressively.
- FLDG structure (cash deposit, fixed deposit lien, or bank guarantee) meets the permitted forms specified by the guidelines — an unrecognised or off-guideline FLDG structure is a compliance exception.
- RE's own books recognise the FLDG-covered exposure and any invocation correctly — FLDG invocation is not used to defer or avoid NPA recognition on the underlying loan.
C. Data Privacy, Consent & Disclosure
- Borrower's explicit consent obtained before sharing data with the LSP or any other party; data collected is limited to what the loan product genuinely requires (no blanket access to unrelated phone/contact data).
- Key Fact Statement (KFS) — all-in cost of credit (APR), tenure, and other RBI-mandated disclosures — provided to the borrower before loan execution, in a standardised, comprehensible format.
- Cooling-off / look-up period (during which the borrower may exit the loan by paying principal and proportionate APR, without penalty) is honoured where applicable.
D. Recovery Agent Conduct
- Recovery agents engaged by the LSP (or its sub-contractors) operate under the RE's recovery-agent code of conduct — no harassment, no contact outside permitted hours, no misrepresentation of authority.
- Grievance-redressal mechanism (RE's own, not solely the LSP's) is disclosed to the borrower and functioning — nodal grievance officer details published per guidelines.
Overall conclusion on the digital lending / fintech partnership: ____________________________________________
Prepared by: ____________________ Reviewed by: ____________________
Date: 30 July 2026
