RBI Digital Lending Security Requirements: 6 Essential Rules | Osto<\/title>\n<meta name=\"description\" content=\"RBI digital lending security requirements explained: encryption, data localisation, VAPT, consent, LSP due diligence, and CIMS registration, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The RBI digital lending security requirements decide whether a digital lender can operate at all. This guide breaks down the security rules every regulated entity, lending service provider, and digital lending app must meet, and how a lean team can comply without a large security function.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The RBI digital lending security requirements make the regulated entity responsible for security across the whole lending stack. The core rules: encrypt borrower data, store it in India, run ongoing VAPT, collect data need-based with logged consent, vet partners, and register every digital lending app on the CIMS portal. Accountability never transfers to a partner.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the rules cover<\/a><\/li>\n <li><a href=\"#requirements\">The six security requirements<\/a><\/li>\n <li><a href=\"#data\">What data you can store<\/a><\/li>\n <li><a href=\"#roles\">Who is accountable<\/a><\/li>\n <li><a href=\"#cims\">Registration and blocking<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What the RBI digital lending security requirements cover<\/h2>\n <p>These requirements are set out in the Digital Lending Directions, 2025, a consolidated framework the <a href=\"https:\/\/www.rbi.org.in\/\" target=\"_blank\" rel=\"noopener\">Reserve Bank of India<\/a> issued to replace a scattered set of earlier circulars. The central idea behind the RBI digital lending security requirements is simple: the regulated entity, the licensed lender, is responsible for the security and privacy of borrower data across the whole lending chain, including any lending service provider and any digital lending app operating on its behalf. Every entity in that chain must meet RBI-specified technology and cybersecurity standards, and those standards are expected to evolve, so compliance is continuous rather than one-time.<\/p>\n\n <h2 class=\"sec\" id=\"requirements\">The six RBI digital lending security requirements that matter most<\/h2>\n <p>While the directions are broad, the rules come down to a recognisable set of security controls in day-to-day practice. These are the six that most often decide whether a digital lender passes scrutiny.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The requirements<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the rules actually demand<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">These security rules sit inside the Digital Lending Directions, 2025, which make the regulated entity responsible for security across the whole lending stack. Six requirements matter most in practice, and they apply whether you lend directly or through a partner.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core RBI digital lending security requirements\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core security requirements to meet<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Protect borrower data at rest<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">and in transit<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 21s7-6.2 7-11a7 7 0 0 0-14 0c0 4.8 7 11 7 11z\"\/><circle cx=\"12\" cy=\"10\" r=\"2.5\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data localisation<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Store all borrower data on<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">servers in India<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Ongoing VAPT<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Regular testing by experienced<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">professionals<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Consent and audit trail<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Need-based collection, logged<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">consent<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 11l2-2 3 3 2-2 3 3\"\/><path d=\"M3 8l4-2 5 3M21 8l-4-2-3 2\"\/><path d=\"M6 12l3 3M18 12l-3 3\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">LSP due diligence<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Vet partner security before<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">contracting<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"6\" y=\"4\" width=\"12\" height=\"17\" rx=\"2\"\/><path d=\"M9 4V3h6v1M9 11l2 2 4-4\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CIMS registration<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Register every DLA, certified as<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">accurate<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means encrypting borrower data at rest and in transit, storing all borrower data on servers located in India, running vulnerability assessment and penetration testing on an ongoing basis with experienced professionals, collecting data only on a need-based footing with prior explicit consent and an audit trail, conducting enhanced security due diligence on every lending service provider before contracting, and registering every digital lending app on the RBI CIMS portal. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the fastest way to demonstrate the testing leg of the RBI digital lending security requirements.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Security is now a precondition, not a nice-to-have<\/div>Under these rules, weak security is not just a risk, it is a compliance failure. The regulated entity must be able to show, with evidence, that these controls are actually in place across itself and its partners.<\/div>\n\n <h2 class=\"sec\" id=\"data\">What borrower data you can store<\/h2>\n <p>Data minimisation is a large part of the framework. Lending service providers may store only the minimal customer data necessary to run the loan, and there is an explicit privacy-policy obligation covering how long data is kept, how it is destroyed, and how breaches are handled.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Data rules<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What you may keep, and what you may not<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">A large part of the framework is about data minimisation. Lending service providers may hold only the minimal borrower data needed to run the loan, and sensitive identifiers are off limits on their own servers.<\/div>\n <svg viewBox=\"0 0 800 278\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"What borrower data digital lenders can and cannot store\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">What borrower data can be stored<\/text>\n <rect x=\"16\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"92\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Minimal data, allowed<\/text>\n <line x1=\"46\" y1=\"104\" x2=\"358\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <g transform=\"translate(46,112) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"126\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Name<\/text><g transform=\"translate(46,150) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"164\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Address<\/text><g transform=\"translate(46,188) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"202\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Contact details<\/text><g transform=\"translate(46,226) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"240\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Minimal data to run the loan<\/text>\n <rect x=\"412\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/>\n <text x=\"442\" y=\"92\" fill=\"#9a4a54\" font-size=\"14.5\" font-weight=\"800\">Prohibited on LSP servers<\/text>\n <line x1=\"442\" y1=\"104\" x2=\"754\" y2=\"104\" stroke=\"#ecd9d9\" stroke-width=\"1\"\/>\n <g transform=\"translate(442,112) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"126\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Aadhaar numbers<\/text><g transform=\"translate(442,150) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"164\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Bank passwords<\/text><g transform=\"translate(442,188) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"202\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Biometric data<\/text><g transform=\"translate(442,226) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"240\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Anything beyond need-based<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Crucially, lending service providers are prohibited from storing sensitive borrower data such as Aadhaar numbers or bank passwords on their own servers, they may hold only minimal data like name, address, and contact details. All of it must be stored in India, and it cannot be transferred outside the country without explicit RBI approval. Handling this correctly is one of the most scrutinised parts of these rules.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Localisation is a hard line<\/div>All borrower data must reside on servers in India, with no cross-border transfer without explicit RBI approval. For a digital lender built on global cloud infrastructure, this is an architecture decision to make early, not a setting to flip later.<\/div>\n\n <h2 class=\"sec\" id=\"roles\">Who is accountable for security<\/h2>\n <p>One point runs through the whole framework: accountability sits with the regulated entity and does not transfer to partners. The framework defines three roles, but the liability is not evenly shared.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Accountability<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">The regulated entity owns the risk<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The rules assign clear roles, but accountability does not transfer. The regulated entity remains responsible for security even when a lending service provider or a digital lending app does the customer-facing work.<\/div>\n <svg viewBox=\"0 0 800 230\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Who is accountable for security in digital lending\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Who is accountable for security<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"40\" y=\"96\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Regulated Entity<\/text>\n <line x1=\"40\" y1=\"108\" x2=\"232\" y2=\"108\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"40\" y=\"132\" fill=\"#c3c9ee\" font-size=\"11.5\">The lender of record.<\/text>\n <text x=\"40\" y=\"150\" fill=\"#c3c9ee\" font-size=\"11.5\">Remains fully accountable<\/text>\n <text x=\"40\" y=\"168\" fill=\"#c3c9ee\" font-size=\"11.5\">for data security, even<\/text>\n <text x=\"40\" y=\"186\" fill=\"#c3c9ee\" font-size=\"11.5\">when work is outsourced.<\/text>\n <rect x=\"280\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"304\" y=\"96\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Lending Service Provider<\/text>\n <line x1=\"304\" y1=\"108\" x2=\"496\" y2=\"108\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"304\" y=\"132\" fill=\"#4a5170\" font-size=\"11.5\">The partner or agent.<\/text>\n <text x=\"304\" y=\"150\" fill=\"#4a5170\" font-size=\"11.5\">Must meet security<\/text>\n <text x=\"304\" y=\"168\" fill=\"#4a5170\" font-size=\"11.5\">standards and store only<\/text>\n <text x=\"304\" y=\"186\" fill=\"#4a5170\" font-size=\"11.5\">minimal borrower data.<\/text>\n <rect x=\"544\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"568\" y=\"96\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Digital Lending App<\/text>\n <line x1=\"568\" y1=\"108\" x2=\"760\" y2=\"108\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"568\" y=\"132\" fill=\"#4a5170\" font-size=\"11.5\">The borrower interface.<\/text>\n <text x=\"568\" y=\"150\" fill=\"#4a5170\" font-size=\"11.5\">Must be registered on the<\/text>\n <text x=\"568\" y=\"168\" fill=\"#4a5170\" font-size=\"11.5\">CIMS portal and operate<\/text>\n <text x=\"568\" y=\"186\" fill=\"#4a5170\" font-size=\"11.5\">in a secure environment.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Within the RBI digital lending security requirements, the regulated entity is the lender of record and remains fully accountable for data security, even when a lending service provider or digital lending app performs the customer-facing work. That is why the directions require enhanced due diligence on partners, assessing technical capability, data-handling practices, and storage systems before any contract is signed, and reviewing that relationship periodically. Outsourcing the work never outsources the responsibility here.<\/p>\n\n <h2 class=\"sec\" id=\"cims\">Registration, whitelisting, and blocking<\/h2>\n <p>A distinctive feature of these rules is enforcement through visibility. Regulated entities must report every digital lending app, their own and their partners’, on the RBI CIMS portal, and a designated official must certify the accuracy of that data. The RBI publishes a whitelist of registered apps, and unregistered apps face blocking. An app that is not properly registered and compliant can be pushed out of the ecosystem, which makes registration and a demonstrable security posture inseparable. For vendors selling into this space, the pressure mirrors what startups face preparing for a <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 audit<\/a> before a first enterprise deal.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to meeting the requirements<\/h2>\n <p>Meeting all of this, encryption, localisation posture, ongoing VAPT, consent and audit trails, partner due diligence, and organised evidence, is a heavy lift for a lean digital-lending team without a dedicated security function. Assembling it from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean lending teams. It runs the VAPT cadence RBI expects, provides encryption and data-handling controls, gives cloud posture and localisation visibility, supports partner and vendor-risk assessment, and keeps organised, audit-ready evidence, mapped across the RBI expectations, DPDP, and 200+ frameworks on one platform. Meeting these requirements at a continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the RBI digital lending security requirements without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean lending teams. Run VAPT, secure and localise borrower data, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the RBI digital lending security requirements?<\/summary><p>They are the security and data-protection obligations in the Digital Lending Directions, 2025: encryption of borrower data, data localisation in India, ongoing VAPT, need-based collection with logged consent, enhanced due diligence on partners, and registration of every digital lending app on the RBI CIMS portal.<\/p><\/details>\n <details><summary>Does borrower data have to be stored in India?<\/summary><p>Yes. All borrower data must be stored on servers located within India, and it cannot be transferred outside the country without explicit RBI approval. Data localisation is one of the hardest lines in the requirements.<\/p><\/details>\n <details><summary>Can a lending service provider store Aadhaar or bank passwords?<\/summary><p>No. Lending service providers are prohibited from storing sensitive borrower data such as Aadhaar numbers or bank passwords on their own servers. They may hold only minimal data like name, address, and contact details needed to run the loan.<\/p><\/details>\n <details><summary>Is VAPT required for digital lending?<\/summary><p>Yes. RBI expects vulnerability assessment and penetration testing on an ongoing basis, conducted by experienced professionals, as part of the technology and cybersecurity standards that apply to regulated entities and their lending service providers.<\/p><\/details>\n <details><summary>Who is responsible if a partner mishandles borrower data?<\/summary><p>The regulated entity. It is the lender of record and remains fully accountable for security even when a lending service provider or digital lending app does the customer-facing work. That is why enhanced due diligence on partners is mandatory.<\/p><\/details>\n <details><summary>What happens if a digital lending app is not registered?<\/summary><p>Regulated entities must register every digital lending app on the RBI CIMS portal, with accuracy certified by a designated official. The RBI publishes a whitelist, and unregistered apps face blocking, so registration and a demonstrable security posture go together.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>RBI Digital Lending Security Requirements: 6 Essential Rules | Osto The RBI digital lending security requirements decide whether a digital\u2026<\/p>\n","protected":false},"author":8,"featured_media":1241,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[433,458],"class_list":["post-1240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-data-localisation","tag-rbi-digital-lending-security-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1240"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240\/revisions"}],"predecessor-version":[{"id":1242,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240\/revisions\/1242"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1241"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1240,"date":"2026-09-14T10:09:37","date_gmt":"2026-09-14T10:09:37","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1240"},"modified":"2026-09-14T10:09:37","modified_gmt":"2026-09-14T10:09:37","slug":"rbi-digital-lending-security","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/rbi-digital-lending-security\/","title":{"rendered":"RBI Digital Lending Security Requirements: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nRBI Digital Lending Security Requirements: 6 Essential Rules | Osto<\/title>\n<meta name=\"description\" content=\"RBI digital lending security requirements explained: encryption, data localisation, VAPT, consent, LSP due diligence, and CIMS registration, and how to comply.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The RBI digital lending security requirements decide whether a digital lender can operate at all. This guide breaks down the security rules every regulated entity, lending service provider, and digital lending app must meet, and how a lean team can comply without a large security function.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>RBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The RBI digital lending security requirements make the regulated entity responsible for security across the whole lending stack. The core rules: encrypt borrower data, store it in India, run ongoing VAPT, collect data need-based with logged consent, vet partners, and register every digital lending app on the CIMS portal. Accountability never transfers to a partner.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the rules cover<\/a><\/li>\n <li><a href=\"#requirements\">The six security requirements<\/a><\/li>\n <li><a href=\"#data\">What data you can store<\/a><\/li>\n <li><a href=\"#roles\">Who is accountable<\/a><\/li>\n <li><a href=\"#cims\">Registration and blocking<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What the RBI digital lending security requirements cover<\/h2>\n <p>These requirements are set out in the Digital Lending Directions, 2025, a consolidated framework the <a href=\"https:\/\/www.rbi.org.in\/\" target=\"_blank\" rel=\"noopener\">Reserve Bank of India<\/a> issued to replace a scattered set of earlier circulars. The central idea behind the RBI digital lending security requirements is simple: the regulated entity, the licensed lender, is responsible for the security and privacy of borrower data across the whole lending chain, including any lending service provider and any digital lending app operating on its behalf. Every entity in that chain must meet RBI-specified technology and cybersecurity standards, and those standards are expected to evolve, so compliance is continuous rather than one-time.<\/p>\n\n <h2 class=\"sec\" id=\"requirements\">The six RBI digital lending security requirements that matter most<\/h2>\n <p>While the directions are broad, the rules come down to a recognisable set of security controls in day-to-day practice. These are the six that most often decide whether a digital lender passes scrutiny.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The requirements<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the rules actually demand<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">These security rules sit inside the Digital Lending Directions, 2025, which make the regulated entity responsible for security across the whole lending stack. Six requirements matter most in practice, and they apply whether you lend directly or through a partner.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core RBI digital lending security requirements\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core security requirements to meet<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Protect borrower data at rest<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">and in transit<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M12 21s7-6.2 7-11a7 7 0 0 0-14 0c0 4.8 7 11 7 11z\"\/><circle cx=\"12\" cy=\"10\" r=\"2.5\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Data localisation<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Store all borrower data on<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">servers in India<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"7\"\/><path d=\"M12 2v4M12 18v4M2 12h4M18 12h4\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Ongoing VAPT<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Regular testing by experienced<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">professionals<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Consent and audit trail<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Need-based collection, logged<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">consent<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M8 11l2-2 3 3 2-2 3 3\"\/><path d=\"M3 8l4-2 5 3M21 8l-4-2-3 2\"\/><path d=\"M6 12l3 3M18 12l-3 3\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">LSP due diligence<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Vet partner security before<\/text><text x=\"394\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">contracting<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"6\" y=\"4\" width=\"12\" height=\"17\" rx=\"2\"\/><path d=\"M9 4V3h6v1M9 11l2 2 4-4\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">CIMS registration<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Register every DLA, certified as<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">accurate<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means encrypting borrower data at rest and in transit, storing all borrower data on servers located in India, running vulnerability assessment and penetration testing on an ongoing basis with experienced professionals, collecting data only on a need-based footing with prior explicit consent and an audit trail, conducting enhanced security due diligence on every lending service provider before contracting, and registering every digital lending app on the RBI CIMS portal. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> is usually the fastest way to demonstrate the testing leg of the RBI digital lending security requirements.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Security is now a precondition, not a nice-to-have<\/div>Under these rules, weak security is not just a risk, it is a compliance failure. The regulated entity must be able to show, with evidence, that these controls are actually in place across itself and its partners.<\/div>\n\n <h2 class=\"sec\" id=\"data\">What borrower data you can store<\/h2>\n <p>Data minimisation is a large part of the framework. Lending service providers may store only the minimal customer data necessary to run the loan, and there is an explicit privacy-policy obligation covering how long data is kept, how it is destroyed, and how breaches are handled.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Data rules<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What you may keep, and what you may not<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">A large part of the framework is about data minimisation. Lending service providers may hold only the minimal borrower data needed to run the loan, and sensitive identifiers are off limits on their own servers.<\/div>\n <svg viewBox=\"0 0 800 278\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"What borrower data digital lenders can and cannot store\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">What borrower data can be stored<\/text>\n <rect x=\"16\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"46\" y=\"92\" fill=\"#0a6558\" font-size=\"14.5\" font-weight=\"800\">Minimal data, allowed<\/text>\n <line x1=\"46\" y1=\"104\" x2=\"358\" y2=\"104\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <g transform=\"translate(46,112) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"126\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Name<\/text><g transform=\"translate(46,150) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"164\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Address<\/text><g transform=\"translate(46,188) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"202\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Contact details<\/text><g transform=\"translate(46,226) scale(0.708)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M5 12l5 5 9-11\"\/><\/g><text x=\"76\" y=\"240\" fill=\"#20463f\" font-size=\"13\" font-weight=\"600\" font-family=\"Inter,Arial,sans-serif\">Minimal data to run the loan<\/text>\n <rect x=\"412\" y=\"58\" width=\"372\" height=\"204\" rx=\"16\" fill=\"#f9f4f4\" stroke=\"#e6cfcf\" stroke-width=\"1.5\"\/>\n <text x=\"442\" y=\"92\" fill=\"#9a4a54\" font-size=\"14.5\" font-weight=\"800\">Prohibited on LSP servers<\/text>\n <line x1=\"442\" y1=\"104\" x2=\"754\" y2=\"104\" stroke=\"#ecd9d9\" stroke-width=\"1\"\/>\n <g transform=\"translate(442,112) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"126\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Aadhaar numbers<\/text><g transform=\"translate(442,150) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"164\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Bank passwords<\/text><g transform=\"translate(442,188) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"202\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Biometric data<\/text><g transform=\"translate(442,226) scale(0.708)\" fill=\"none\" stroke=\"#b03a4a\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 6l12 12M18 6L6 18\"\/><\/g><text x=\"472\" y=\"240\" fill=\"#7a5560\" font-size=\"13\" font-weight=\"400\" font-family=\"Inter,Arial,sans-serif\">Anything beyond need-based<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Crucially, lending service providers are prohibited from storing sensitive borrower data such as Aadhaar numbers or bank passwords on their own servers, they may hold only minimal data like name, address, and contact details. All of it must be stored in India, and it cannot be transferred outside the country without explicit RBI approval. Handling this correctly is one of the most scrutinised parts of these rules.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Localisation is a hard line<\/div>All borrower data must reside on servers in India, with no cross-border transfer without explicit RBI approval. For a digital lender built on global cloud infrastructure, this is an architecture decision to make early, not a setting to flip later.<\/div>\n\n <h2 class=\"sec\" id=\"roles\">Who is accountable for security<\/h2>\n <p>One point runs through the whole framework: accountability sits with the regulated entity and does not transfer to partners. The framework defines three roles, but the liability is not evenly shared.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Accountability<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">The regulated entity owns the risk<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The rules assign clear roles, but accountability does not transfer. The regulated entity remains responsible for security even when a lending service provider or a digital lending app does the customer-facing work.<\/div>\n <svg viewBox=\"0 0 800 230\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Who is accountable for security in digital lending\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Who is accountable for security<\/text>\n <rect x=\"16\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#1c267a\"\/>\n <text x=\"40\" y=\"96\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Regulated Entity<\/text>\n <line x1=\"40\" y1=\"108\" x2=\"232\" y2=\"108\" stroke=\"#39439a\" stroke-width=\"1\"\/>\n <text x=\"40\" y=\"132\" fill=\"#c3c9ee\" font-size=\"11.5\">The lender of record.<\/text>\n <text x=\"40\" y=\"150\" fill=\"#c3c9ee\" font-size=\"11.5\">Remains fully accountable<\/text>\n <text x=\"40\" y=\"168\" fill=\"#c3c9ee\" font-size=\"11.5\">for data security, even<\/text>\n <text x=\"40\" y=\"186\" fill=\"#c3c9ee\" font-size=\"11.5\">when work is outsourced.<\/text>\n <rect x=\"280\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"304\" y=\"96\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Lending Service Provider<\/text>\n <line x1=\"304\" y1=\"108\" x2=\"496\" y2=\"108\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"304\" y=\"132\" fill=\"#4a5170\" font-size=\"11.5\">The partner or agent.<\/text>\n <text x=\"304\" y=\"150\" fill=\"#4a5170\" font-size=\"11.5\">Must meet security<\/text>\n <text x=\"304\" y=\"168\" fill=\"#4a5170\" font-size=\"11.5\">standards and store only<\/text>\n <text x=\"304\" y=\"186\" fill=\"#4a5170\" font-size=\"11.5\">minimal borrower data.<\/text>\n <rect x=\"544\" y=\"60\" width=\"240\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"568\" y=\"96\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Digital Lending App<\/text>\n <line x1=\"568\" y1=\"108\" x2=\"760\" y2=\"108\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"568\" y=\"132\" fill=\"#4a5170\" font-size=\"11.5\">The borrower interface.<\/text>\n <text x=\"568\" y=\"150\" fill=\"#4a5170\" font-size=\"11.5\">Must be registered on the<\/text>\n <text x=\"568\" y=\"168\" fill=\"#4a5170\" font-size=\"11.5\">CIMS portal and operate<\/text>\n <text x=\"568\" y=\"186\" fill=\"#4a5170\" font-size=\"11.5\">in a secure environment.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Within the RBI digital lending security requirements, the regulated entity is the lender of record and remains fully accountable for data security, even when a lending service provider or digital lending app performs the customer-facing work. That is why the directions require enhanced due diligence on partners, assessing technical capability, data-handling practices, and storage systems before any contract is signed, and reviewing that relationship periodically. Outsourcing the work never outsources the responsibility here.<\/p>\n\n <h2 class=\"sec\" id=\"cims\">Registration, whitelisting, and blocking<\/h2>\n <p>A distinctive feature of these rules is enforcement through visibility. Regulated entities must report every digital lending app, their own and their partners’, on the RBI CIMS portal, and a designated official must certify the accuracy of that data. The RBI publishes a whitelist of registered apps, and unregistered apps face blocking. An app that is not properly registered and compliant can be pushed out of the ecosystem, which makes registration and a demonstrable security posture inseparable. For vendors selling into this space, the pressure mirrors what startups face preparing for a <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 audit<\/a> before a first enterprise deal.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to meeting the requirements<\/h2>\n <p>Meeting all of this, encryption, localisation posture, ongoing VAPT, consent and audit trails, partner due diligence, and organised evidence, is a heavy lift for a lean digital-lending team without a dedicated security function. Assembling it from separate tools and consultants is slow and hard to keep audit-ready. The efficient path is a single platform that runs the security work and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean lending teams. It runs the VAPT cadence RBI expects, provides encryption and data-handling controls, gives cloud posture and localisation visibility, supports partner and vendor-risk assessment, and keeps organised, audit-ready evidence, mapped across the RBI expectations, DPDP, and 200+ frameworks on one platform. Meeting these requirements at a continuously-evidenced standard, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the RBI digital lending security requirements without a big team.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean lending teams. Run VAPT, secure and localise borrower data, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the RBI digital lending security requirements?<\/summary><p>They are the security and data-protection obligations in the Digital Lending Directions, 2025: encryption of borrower data, data localisation in India, ongoing VAPT, need-based collection with logged consent, enhanced due diligence on partners, and registration of every digital lending app on the RBI CIMS portal.<\/p><\/details>\n <details><summary>Does borrower data have to be stored in India?<\/summary><p>Yes. All borrower data must be stored on servers located within India, and it cannot be transferred outside the country without explicit RBI approval. Data localisation is one of the hardest lines in the requirements.<\/p><\/details>\n <details><summary>Can a lending service provider store Aadhaar or bank passwords?<\/summary><p>No. Lending service providers are prohibited from storing sensitive borrower data such as Aadhaar numbers or bank passwords on their own servers. They may hold only minimal data like name, address, and contact details needed to run the loan.<\/p><\/details>\n <details><summary>Is VAPT required for digital lending?<\/summary><p>Yes. RBI expects vulnerability assessment and penetration testing on an ongoing basis, conducted by experienced professionals, as part of the technology and cybersecurity standards that apply to regulated entities and their lending service providers.<\/p><\/details>\n <details><summary>Who is responsible if a partner mishandles borrower data?<\/summary><p>The regulated entity. It is the lender of record and remains fully accountable for security even when a lending service provider or digital lending app does the customer-facing work. That is why enhanced due diligence on partners is mandatory.<\/p><\/details>\n <details><summary>What happens if a digital lending app is not registered?<\/summary><p>Regulated entities must register every digital lending app on the RBI CIMS portal, with accuracy certified by a designated official. The RBI publishes a whitelist, and unregistered apps face blocking, so registration and a demonstrable security posture go together.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>RBI Digital Lending Security Requirements: 6 Essential Rules | Osto The RBI digital lending security requirements decide whether a digital\u2026<\/p>\n","protected":false},"author":8,"featured_media":1241,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[433,458],"class_list":["post-1240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-data-localisation","tag-rbi-digital-lending-security-requirements"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1240"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240\/revisions"}],"predecessor-version":[{"id":1242,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1240\/revisions\/1242"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1241"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}