In 2019, my phone started getting the same kind of message that thousands of other Indians were getting. A friend, at the time working long hours at a startup in Bangalore, had taken a small loan through an app to cover rent between paychecks. Within days, the calls started. Not just to him. To his manager. To his college roommate from four years earlier, whose number he had listed as an emergency contact when he installed the app and barely noticed doing so.
He paid the loan back within two weeks. The calls did not stop for another month.
That was the era of the Chinese instant-loan apps, dozens of them, most operating without any real license, harvesting a borrower’s entire contact list at installation and using it as a collections weapon. The RBI eventually moved. Google removed hundreds of these apps from the Play Store. Enforcement agencies raided operations linked to Chinese ownership structures. For a moment, it looked like the worst chapter of Indian digital lending was closing.
The uncomfortable finding in The Ken’s recent investigation is that the same rates, and in some cases the same collections behaviour, have returned. Except now they come from RBI-licensed NBFCs, fully within the law.
To understand how this happened, and where user-first lending genuinely could take root, it helps to walk through how we got here.
Before any of this, India’s lending story for the poor and the underbanked was largely informal. A local moneylender, a chit fund, sometimes a pawnbroker. Interest rates were often brutal, but at least the human relationship carried some accountability, everyone knew who the lender was and where they lived.
NBFCs existed to formalise this. Give small, unsecured credit a regulated, licensed structure. Bring interest rates into a documented, if not capped, framework. For a long time, this worked reasonably well for the segment it served, small businesses, self-employed borrowers, people the banking system had no interest in serving profitably.
Smartphones and cheap data changed the physical constraint. A lender no longer needed a branch, an agent, or even a phone call. An app could originate, underwrite, and disburse a loan in minutes, all without a human ever meeting the borrower.
This was, on its own merits, a genuine improvement. Faster access to credit for people the formal banking system ignored. Lower operational cost per loan, which in theory could translate to lower rates for borrowers.
In theory.
Somewhere between 2018 and 2020, the model curdled. Dozens of loan apps, many with opaque or entirely undisclosed ownership tracing back to entities in China, flooded the market. Rates were exorbitant, often disguised behind processing fees and daily compounding. Collections were not just aggressive, they were designed around humiliation, contacting a borrower’s entire phone contact list, sending doctored images to family members, threats calibrated to produce shame rather than repayment ability.
The human cost was severe enough that it made national news. Suicides linked to loan app harassment were reported across multiple cities. The RBI’s Working Group on Digital Lending, formed in 2021, produced findings that led to the Digital Lending Guidelines of 2022, still the foundational document governing this space today.
The guidelines were a real step forward. They required loans to be disbursed directly into a borrower’s bank account, not routed through a lending service provider’s pooled account, closing an easy fraud vector. They mandated a Key Fact Statement, a plain-language summary of the total cost of the loan, meant to end the practice of burying the real APR in fine print. They restricted data access, an app could no longer harvest a user’s contacts, photos, or call logs without genuine necessity.
Here is where the story gets uncomfortable rather than resolved.
The 2022 guidelines fixed process. They said, disclose the rate, get proper consent, do not harvest excessive data, use only RBI-regulated entities to disburse. What they did not fix was outcome. Nothing in the guidelines caps how high an interest rate can actually be. Nothing requires a lender to assess whether a borrower can genuinely afford to repay before sanctioning the loan.
This is precisely the gap the current wave of NBFCs found. Set up entirely within the rules, disclose the rate exactly as required, in writing, in a Key Fact Statement that borrowers rarely read closely, and lend at 500 to 900 percent APR without breaking a single guideline. The Ken’s reporting shows this is not a loophole being quietly exploited. It is a business model, openly discussed, board-approved, replicated across dozens of NBFCs buying old licenses specifically to run this playbook.
The collections behaviour has softened somewhat since the worst days of 2019, mass contact-list harassment is harder now under the new data restrictions. But the fundamental incentive, structure a loan so high-risk borrowers will struggle to repay on time, then offer them a second loan to cover the first, has simply migrated into a fully licensed wrapper.
Look across these four eras and one thread runs through all of them. Regulation in India’s digital lending has always been reactive, responding to the last visible harm, rather than structural, designed to prevent the next one.
The Chinese app crackdown fixed data harvesting and disbursal fraud, real problems, genuinely fixed. It did not touch pricing or affordability, because that was not the crisis making headlines at the time. Today’s crisis is pricing. Whatever regulation eventually responds to it will likely fix pricing disclosure and enforcement gaps. It may still leave the next unaddressed dimension open for the next cycle of extraction.
This is not a criticism of the RBI’s competence. Financial regulation genuinely is a game of catching up to innovation that moves faster than policy can. But it does mean that waiting for the next regulatory cycle is not a strategy. Whoever wants to build lending that is trustworthy today cannot simply wait for the rules to force it. It has to be a choice.
Two things stand out from this history that shape everything else in this series.
First, every era of Indian lending has been defined by information asymmetry between lender and borrower, an informal moneylender’s opacity, an app’s contact-list harvesting, today’s rate ambiguity buried in a document nobody reads. The technology changes. The asymmetry does not, unless someone deliberately designs it away.
Second, every regulatory fix so far has targeted process, not outcome. Disclosure requirements, data restrictions, licensing rules. None of them ask the more basic question, is this loan actually good for this borrower. That question has never been anyone’s job. Not the lender’s, whose incentive is origination, not the DSA’s, who is paid per disbursal, not even fully the regulator’s, whose tools are procedural rather than protective of individual outcomes.
That is the gap. Not a compliance gap. A responsibility gap. Nobody in the current system is actually incentivised to ask whether a specific loan, for a specific person, at a specific moment, is a good idea.
The next article in this series steps back from the systems and the history, and goes directly to the people this affects, what a borrower’s actual experience feels like, and what they say they need instead.
Onwards.
Previous in the series: The 600% Problem: What Legal Lending in India Actually Looks Like
Next in the series: The User Nobody Asks: What Borrowers Actually Experience
In 2019, my phone started getting the same kind of message that thousands of other Indians were getting. A friend, at the time working long hours at a startup in Bangalore, had taken a small loan through an app to cover rent between paychecks. Within days, the calls started. Not just to him. To his manager. To his college roommate from four years earlier, whose number he had listed as an emergency contact when he installed the app and barely noticed doing so.
He paid the loan back within two weeks. The calls did not stop for another month.
That was the era of the Chinese instant-loan apps, dozens of them, most operating without any real license, harvesting a borrower’s entire contact list at installation and using it as a collections weapon. The RBI eventually moved. Google removed hundreds of these apps from the Play Store. Enforcement agencies raided operations linked to Chinese ownership structures. For a moment, it looked like the worst chapter of Indian digital lending was closing.
The uncomfortable finding in The Ken’s recent investigation is that the same rates, and in some cases the same collections behaviour, have returned. Except now they come from RBI-licensed NBFCs, fully within the law.
To understand how this happened, and where user-first lending genuinely could take root, it helps to walk through how we got here.
Before any of this, India’s lending story for the poor and the underbanked was largely informal. A local moneylender, a chit fund, sometimes a pawnbroker. Interest rates were often brutal, but at least the human relationship carried some accountability, everyone knew who the lender was and where they lived.
NBFCs existed to formalise this. Give small, unsecured credit a regulated, licensed structure. Bring interest rates into a documented, if not capped, framework. For a long time, this worked reasonably well for the segment it served, small businesses, self-employed borrowers, people the banking system had no interest in serving profitably.
Smartphones and cheap data changed the physical constraint. A lender no longer needed a branch, an agent, or even a phone call. An app could originate, underwrite, and disburse a loan in minutes, all without a human ever meeting the borrower.
This was, on its own merits, a genuine improvement. Faster access to credit for people the formal banking system ignored. Lower operational cost per loan, which in theory could translate to lower rates for borrowers.
In theory.
Somewhere between 2018 and 2020, the model curdled. Dozens of loan apps, many with opaque or entirely undisclosed ownership tracing back to entities in China, flooded the market. Rates were exorbitant, often disguised behind processing fees and daily compounding. Collections were not just aggressive, they were designed around humiliation, contacting a borrower’s entire phone contact list, sending doctored images to family members, threats calibrated to produce shame rather than repayment ability.
The human cost was severe enough that it made national news. Suicides linked to loan app harassment were reported across multiple cities. The RBI’s Working Group on Digital Lending, formed in 2021, produced findings that led to the Digital Lending Guidelines of 2022, still the foundational document governing this space today.
The guidelines were a real step forward. They required loans to be disbursed directly into a borrower’s bank account, not routed through a lending service provider’s pooled account, closing an easy fraud vector. They mandated a Key Fact Statement, a plain-language summary of the total cost of the loan, meant to end the practice of burying the real APR in fine print. They restricted data access, an app could no longer harvest a user’s contacts, photos, or call logs without genuine necessity.
Here is where the story gets uncomfortable rather than resolved.
The 2022 guidelines fixed process. They said, disclose the rate, get proper consent, do not harvest excessive data, use only RBI-regulated entities to disburse. What they did not fix was outcome. Nothing in the guidelines caps how high an interest rate can actually be. Nothing requires a lender to assess whether a borrower can genuinely afford to repay before sanctioning the loan.
This is precisely the gap the current wave of NBFCs found. Set up entirely within the rules, disclose the rate exactly as required, in writing, in a Key Fact Statement that borrowers rarely read closely, and lend at 500 to 900 percent APR without breaking a single guideline. The Ken’s reporting shows this is not a loophole being quietly exploited. It is a business model, openly discussed, board-approved, replicated across dozens of NBFCs buying old licenses specifically to run this playbook.
The collections behaviour has softened somewhat since the worst days of 2019, mass contact-list harassment is harder now under the new data restrictions. But the fundamental incentive, structure a loan so high-risk borrowers will struggle to repay on time, then offer them a second loan to cover the first, has simply migrated into a fully licensed wrapper.
Look across these four eras and one thread runs through all of them. Regulation in India’s digital lending has always been reactive, responding to the last visible harm, rather than structural, designed to prevent the next one.
The Chinese app crackdown fixed data harvesting and disbursal fraud, real problems, genuinely fixed. It did not touch pricing or affordability, because that was not the crisis making headlines at the time. Today’s crisis is pricing. Whatever regulation eventually responds to it will likely fix pricing disclosure and enforcement gaps. It may still leave the next unaddressed dimension open for the next cycle of extraction.
This is not a criticism of the RBI’s competence. Financial regulation genuinely is a game of catching up to innovation that moves faster than policy can. But it does mean that waiting for the next regulatory cycle is not a strategy. Whoever wants to build lending that is trustworthy today cannot simply wait for the rules to force it. It has to be a choice.
Two things stand out from this history that shape everything else in this series.
First, every era of Indian lending has been defined by information asymmetry between lender and borrower, an informal moneylender’s opacity, an app’s contact-list harvesting, today’s rate ambiguity buried in a document nobody reads. The technology changes. The asymmetry does not, unless someone deliberately designs it away.
Second, every regulatory fix so far has targeted process, not outcome. Disclosure requirements, data restrictions, licensing rules. None of them ask the more basic question, is this loan actually good for this borrower. That question has never been anyone’s job. Not the lender’s, whose incentive is origination, not the DSA’s, who is paid per disbursal, not even fully the regulator’s, whose tools are procedural rather than protective of individual outcomes.
That is the gap. Not a compliance gap. A responsibility gap. Nobody in the current system is actually incentivised to ask whether a specific loan, for a specific person, at a specific moment, is a good idea.
The next article in this series steps back from the systems and the history, and goes directly to the people this affects, what a borrower’s actual experience feels like, and what they say they need instead.
Onwards.
Previous in the series: The 600% Problem: What Legal Lending in India Actually Looks Like
Next in the series: The User Nobody Asks: What Borrowers Actually Experience
