30-second checklist: is this loan app legal?

Before you accept any disbursal, run this checklist. Takes less time than reading the T&Cs.

✅ Green flags

• App lists a lender legal name in the Play Store description (e.g. "in partnership with XYZ NBFC Ltd")
• That entity appears on RBI's list of NBFCs (rbi.org.in → Regulated Entities)
• App requests only camera, mic, location at install — not contacts, gallery, SMS
• A Key Fact Statement is shown before you accept the loan
• Grievance officer name + email + phone visible in the app

🚩 Red flags

• "Lender" name missing or vague ("partner NBFCs")
• Permissions request includes contacts, gallery, SMS, call log
• APR not disclosed — only "EMI per ₹1,000" or "flat rate"
• Disbursal goes through a wallet (not your bank)
• No grievance officer

How to verify the NBFC in 60 seconds

Open rbi.org.in → "Regulated Entities" → "List of NBFCs". Search the lender's exact legal name (not the brand name). If the entity is missing, marked "cancelled", or only shows up as a "service provider", the app is operating outside RBI's Digital Lending Guidelines and you have no real recourse if things go wrong.

If the app insists on being called a "fintech partner" without naming the underlying RBI-regulated lender, treat that as a hard stop. The 2022 Digital Lending Guidelines make the regulated entity — bank or NBFC — solely responsible for every disbursal, every recovery call, and every rupee of interest. No name on the disclosure = no accountability.

What to do if you already took the loan

If you accepted a disbursal from an unregulated app, you still have rights. The lender may be illegal, but the harassment, data leaks, and bullying are crimes under the IT Act and IPC regardless of whether the loan itself is enforceable.

• Read the step-by-step RBI Sachet complaint guide and file within 24 hours
• If recovery agents are calling family or contacts, follow the harassment first-response checklist
• If you cannot pay the EMI, know your legal rights before agreeing to anything

If 2+ red flags fire — uninstall

The 5 minutes you save by ignoring this checklist will cost you 5 months of harassment. Uninstall, revoke the permissions, and look at reviewed instant loan apps before you try another one.

FAQ — Loan app legality

Q: How do I check if a lender is on RBI's NBFC list? Go to rbi.org.in → Regulated Entities → List of NBFCs. Search the lender's exact legal name (not the brand name on the Play Store). If it is missing or marked "Cancelled", the app is operating outside RBI's framework and has no real enforcement power.

Q: The app says "partnered with RBI-registered NBFC" — is that enough? No. The actual NBFC name must appear on the loan agreement, KFS, and grievance page. Vague phrases like "leading NBFC partners" without naming the entity is a Digital Lending Guidelines violation. Treat it as a hard stop.

Q: I already took a loan from an unregulated app — am I legally bound to repay? The contract is on shaky ground because the lender lacks RBI authorisation. That said, defaulting can trigger harassment and even unregistered civil suits. Best path: file Sachet, send a registered legal notice, and pay principal only (no penalty, no interest) via traceable bank transfer with a written settlement.

Q: What permissions are legally allowed? Camera, mic, and one-time location for KYC. That is it. Contacts, gallery, SMS, call log access is banned under the 2022 Digital Lending Guidelines. Apps that demand more should be uninstalled immediately.

Q: Can I report the app for takedown? Yes — Google Play Store has a "Report" option under each app listing. Cite "violation of RBI Digital Lending Guidelines" with screenshots. Google has removed 4,000+ apps using this channel since 2022.