{"id":990,"date":"2026-08-24T16:13:32","date_gmt":"2026-08-24T16:13:32","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=990"},"modified":"2026-08-24T16:13:32","modified_gmt":"2026-08-24T16:13:32","slug":"resources-glossary-digital-lending-app-lsp","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/resources-glossary-digital-lending-app-lsp\/","title":{"rendered":"Digital Lending App (DLA) and LSP: Meaning and RBI Requirements"},"content":{"rendered":"\n<!-- OSTO GLOSSARY: DLA \/ LSP. Paste into one Custom HTML block. No H1. -->\n<style>\n.og{--navy:#1c267a;--text:#0f1538;--muted:#0f1538;--border:#e7e9f2;--divider:#eceef5;--white:#fff;--peri-50:#f4f5fd;--peri-100:#e9ecfa;--peri-200:#cfd5f2;--peri-700:#4a52a8;--sage-50:#f2f8f5;--sage-100:#e3f0e9;--sage-200:#c3ddce;--sage-700:#3a6f5d;--apri-50:#fdf6f0;--apri-100:#fbe9dc;--apri-200:#f2cdb2;--apri-700:#a2603a;--plum-50:#f8f3f9;--plum-100:#f0e6f3;--plum-200:#dcc6e2;--plum-700:#6b4576;--sky-50:#f1f7fb;--sky-100:#e2eff7;--sky-200:#bfd9e9;--sky-700:#2f6a89;--shadow:0 6px 22px rgba(15,21,56,.05);--font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;font-family:var(--font);font-size:17px;line-height:1.75;color:var(--text)}\n.og p{margin:0 0 22px}.og h2{font:700 clamp(25px,3vw,31px)\/1.25 var(--font);letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}.og h2:after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}.og h2.c-sage:after{background:var(--sage-200)}.og h2.c-apri:after{background:var(--apri-200)}.og h2.c-plum:after{background:var(--plum-200)}.og h2.c-sky:after{background:var(--sky-200)}.og h3{font:700 20px\/1.4 var(--font);color:var(--navy);margin:28px 0 8px}.og ul,.og ol{padding-left:22px;margin:0 0 24px}.og li{margin-bottom:9px}.og strong{font-weight:600}.og a{color:var(--navy);text-underline-offset:3px}\n.og .dek{font-size:20px;line-height:1.6;margin:0 0 18px}.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}.og .tags li{margin:0}.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}.og .t-peri{background:var(--peri-100);color:var(--peri-700)}.og .t-sage{background:var(--sage-100);color:var(--sage-700)}.og .t-apri{background:var(--apri-100);color:var(--apri-700)}\n.og .short{background:linear-gradient(135deg,var(--peri-100),var(--sage-100));border-radius:22px;padding:28px 32px;margin:0 0 30px}.og .short .k,.og .toc .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}.og .short p{font-size:19px;line-height:1.65;margin:0}.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}.og .toc a{text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}.og .callout p:last-child{margin-bottom:0}.og .callout.c-plum,.og .callout.c-apri{border:none;border-radius:20px}.og .callout.c-plum{background:var(--plum-50)}.og .callout.c-plum .k{color:var(--plum-700)}.og .callout.c-apri{background:var(--apri-50)}.og .callout.c-apri .k{color:var(--apri-700)}\n.og figure{margin:0 0 30px}.og .sx{overflow-x:auto;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}.og .sx svg{display:block;width:100%;height:auto;min-width:600px}.og figcaption{font-size:14px;line-height:1.6;margin-top:12px}.og .swipe{display:none}\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}.og tr:last-child td{border-bottom:none}.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}.og .h-apri th{background:var(--apri-100);color:var(--apri-700)}\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}.og .tcard{border-radius:18px;padding:20px 22px}.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}.og .tcard p{font-size:14px;line-height:1.55;margin:0}.og .tcard.a{background:var(--sky-50)}.og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}.og .tcard.b{background:var(--sage-50)}.og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}.og .tcard.c{background:var(--plum-50)}.og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}.og .p-re{background:var(--peri-100);color:var(--peri-700)}.og .p-both{background:var(--plum-100);color:var(--plum-700)}\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px}.og summary::-webkit-details-marker{display:none}.og summary:after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700)}.og details[open] summary:after{content:\"\\2013\"}.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}.og .related{font-size:15px;border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n@media(max-width:700px){.og{font-size:16px}.og .dek{font-size:18px}.og .short p{font-size:17px}.og .short,.og .toc,.og .callout{padding:22px 20px}.og .toc ol{columns:1}.og .trio{grid-template-columns:1fr}.og .swipe{display:inline;font-weight:600;color:var(--peri-700)}.og table{font-size:14px}.og th,.og td{padding:11px 12px}}\n<\/style>\n\n<div class=\"og\">\n<p class=\"dek\">A Digital Lending App is the borrower-facing interface for a digital loan. A Lending Service Provider performs one or more lending functions for the RBI-regulated lender behind it.<\/p>\n<ul class=\"tags\"><li><span class=\"tag t-peri\">Glossary<\/span><\/li><li><span class=\"tag t-sage\">Digital lending<\/span><\/li><li><span class=\"tag t-apri\">RBI compliance<\/span><\/li><\/ul>\n<div class=\"short\"><p class=\"k\">The short answer<\/p><p>A <strong>Digital Lending App (DLA)<\/strong> is a mobile or web application that facilitates digital lending. A <strong>Lending Service Provider (LSP)<\/strong> is an agent that performs one or more digital lending functions for a regulated entity, such as customer acquisition, underwriting support, servicing, monitoring or recovery. The LSP may run the app, but the regulated entity remains the lender and remains responsible for compliance.<\/p><\/div>\n<p>A borrower may interact entirely with an app carrying the LSP&#8217;s brand while the credit is actually sanctioned and disbursed by a bank or NBFC. RBI&#8217;s rules are designed to keep the lender visible, the money trail direct and the use of borrower data controlled.<\/p>\n<div class=\"toc\"><p class=\"k\">On this page<\/p><ol><li><a href=\"#meaning\">DLA, LSP and RE explained<\/a><\/li><li><a href=\"#flow\">How the arrangement works<\/a><\/li><li><a href=\"#difference\">DLA or LSP?<\/a><\/li><li><a href=\"#rules\">What RBI requires<\/a><\/li><li><a href=\"#data\">Data and cybersecurity rules<\/a><\/li><li><a href=\"#checklist\">Operational checklist<\/a><\/li><li><a href=\"#osto\">How Osto supports readiness<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ol><\/div>\n\n<h2 id=\"meaning\">DLA, LSP and RE explained<\/h2>\n<div class=\"trio\"><div class=\"tcard a\"><p class=\"n\">Digital Lending App<\/p><p class=\"g\">The interface<\/p><p>A mobile or web application, standalone or part of a wider app, that facilitates digital lending services.<\/p><\/div><div class=\"tcard b\"><p class=\"n\">Lending Service Provider<\/p><p class=\"g\">The service agent<\/p><p>An agent performing one or more digital lending functions, or part of them, for a regulated entity.<\/p><\/div><div class=\"tcard c\"><p class=\"n\">Regulated Entity<\/p><p class=\"g\">The lender<\/p><p>The RBI-regulated bank, co-operative bank, NBFC, housing finance company or all-India financial institution extending the credit.<\/p><\/div><\/div>\n<p>A DLA describes technology; an LSP describes a commercial and operational role. An LSP can operate a DLA, an RE can operate its own DLA, and one DLA may display loan offers from more than one RE.<\/p>\n\n<h2 id=\"flow\" class=\"c-sage\">How a DLA\u2013LSP\u2013RE arrangement works<\/h2>\n<figure><div class=\"sx\"><svg viewBox=\"0 0 760 330\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Digital lending relationship showing the borrower, DLA, LSP and regulated entity.\"><defs><marker id=\"arr\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0 0L9 4.5 0 9Z\" fill=\"#4a52a8\"\/><\/marker><\/defs><rect x=\"22\" y=\"112\" width=\"142\" height=\"88\" rx=\"16\" fill=\"#e2eff7\"\/><text x=\"93\" y=\"148\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"15\" font-weight=\"700\" fill=\"#2f6a89\">Borrower<\/text><text x=\"93\" y=\"174\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"11.5\" fill=\"#0f1538\">requests the loan<\/text><line x1=\"164\" y1=\"156\" x2=\"224\" y2=\"156\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#arr)\"\/><rect x=\"236\" y=\"88\" width=\"160\" height=\"136\" rx=\"20\" fill=\"#1c267a\"\/><rect x=\"292\" y=\"102\" width=\"48\" height=\"6\" rx=\"3\" fill=\"#cfd5f2\"\/><text x=\"316\" y=\"150\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"18\" font-weight=\"700\" fill=\"#fff\">DLA<\/text><text x=\"316\" y=\"177\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"11.5\" fill=\"#cfd5f2\">borrower interface<\/text><line x1=\"396\" y1=\"124\" x2=\"458\" y2=\"90\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#arr)\"\/><line x1=\"396\" y1=\"190\" x2=\"458\" y2=\"224\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#arr)\"\/><rect x=\"470\" y=\"36\" width=\"258\" height=\"104\" rx=\"17\" fill=\"#e3f0e9\"\/><text x=\"599\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"15\" font-weight=\"700\" fill=\"#3a6f5d\">Lending Service Provider<\/text><text x=\"599\" y=\"100\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"11.5\" fill=\"#0f1538\">acquisition \u00b7 servicing \u00b7 recovery<\/text><rect x=\"470\" y=\"172\" width=\"258\" height=\"104\" rx=\"17\" fill=\"#f0e6f3\"\/><text x=\"599\" y=\"208\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"15\" font-weight=\"700\" fill=\"#6b4576\">Regulated Entity<\/text><text x=\"599\" y=\"233\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"11.5\" fill=\"#0f1538\">sanctions and disburses credit<\/text><text x=\"599\" y=\"253\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"11.5\" fill=\"#0f1538\">remains responsible<\/text><line x1=\"599\" y1=\"140\" x2=\"599\" y2=\"166\" stroke=\"#6b4576\" stroke-width=\"2\" marker-end=\"url(#arr)\"\/><text x=\"380\" y=\"310\" text-anchor=\"middle\" font-family=\"Inter\" font-size=\"12.5\" fill=\"#0f1538\">The service may be outsourced. Regulatory responsibility is not.<\/text><\/svg><\/div><figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>The borrower may see the DLA and LSP first, but the RE remains responsible for the loan and outsourced activity.<\/figcaption><\/figure>\n<div class=\"callout\"><p class=\"k\">Follow the money, not only the app<\/p><p>Disbursal must ordinarily move directly from the RE to the borrower&#8217;s bank account, and repayment must move directly from the borrower to the RE. An LSP&#8217;s pass-through or pool account cannot ordinarily sit between them.<\/p><\/div>\n\n<h2 id=\"difference\" class=\"c-plum\">DLA or LSP? The practical difference<\/h2>\n<table class=\"h-plum\"><thead><tr><th>Question<\/th><th>DLA<\/th><th>LSP<\/th><\/tr><\/thead><tbody><tr><td><strong>What is it?<\/strong><\/td><td>An application or platform.<\/td><td>An entity acting as the RE&#8217;s service agent.<\/td><\/tr><tr><td><strong>Can an RE own it?<\/strong><\/td><td>Yes. An RE&#8217;s own app is also a DLA.<\/td><td>An RE may act as an LSP for another RE.<\/td><\/tr><tr><td><strong>Can it face the borrower?<\/strong><\/td><td>Yes\u2014that is its core purpose.<\/td><td>Yes, when its assigned services include a borrower interface.<\/td><\/tr><tr><td><strong>Can it sanction the loan?<\/strong><\/td><td>An interface does not sanction credit by itself.<\/td><td>Not merely because it is an LSP; the RE extends the credit.<\/td><\/tr><tr><td><strong>Who remains accountable?<\/strong><\/td><td colspan=\"2\">The RE remains responsible for compliance by its DLA and engaged LSP.<\/td><\/tr><\/tbody><\/table>\n\n<h2 id=\"rules\" class=\"c-apri\">What RBI requires<\/h2>\n<p>The Reserve Bank of India (Digital Lending) Directions, 2025 consolidate the conduct, disclosure, data and reporting requirements for digital lending by regulated entities.<\/p>\n<table class=\"h-apri\"><thead><tr><th>Requirement<\/th><th>What it means in practice<\/th><th>Owner<\/th><\/tr><\/thead><tbody><tr><td><strong>Written RE\u2013LSP agreement<\/strong><\/td><td>Clearly define roles, rights and obligations.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><tr><td><strong>Enhanced due diligence<\/strong><\/td><td>Review technical capability, privacy and storage, borrower conduct, compliance ability and past record before appointment.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><tr><td><strong>Periodic monitoring<\/strong><\/td><td>Review LSP conduct and portfolios originated with its support; act on deviations.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><tr><td><strong>Key Facts Statement<\/strong><\/td><td>Provide the KFS, including APR and charges, before execution.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><tr><td><strong>Signed documents<\/strong><\/td><td>KFS, sanction letter, terms, statements and relevant privacy policies must automatically reach the borrower.<\/td><td><span class=\"pill p-both\">Both<\/span><\/td><\/tr><tr><td><strong>Grievance officer<\/strong><\/td><td>The RE and borrower-facing LSP must prominently display a nodal grievance contact.<\/td><td><span class=\"pill p-both\">Both<\/span><\/td><\/tr><tr><td><strong>Direct fund flow<\/strong><\/td><td>No LSP pool or pass-through account for ordinary disbursal or repayment.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><tr><td><strong>DLA reporting<\/strong><\/td><td>Report and update every owned or joined DLA on RBI&#8217;s CIMS portal, with compliance certification.<\/td><td><span class=\"pill p-re\">RE<\/span><\/td><\/tr><\/tbody><\/table>\n<h3>When one LSP works with multiple lenders<\/h3><p>The DLA must show all matching offers and disclose unmatched lenders. Each matching offer must identify the RE and show the amount, tenor, APR, monthly repayment obligation, penal charges and a link to its KFS.<\/p>\n<div class=\"callout c-plum\"><p class=\"k\">No dark patterns<\/p><p>The matching method must be consistent for similarly placed borrowers and products. The view must be unbiased and cannot push a particular lender through deceptive design. Ranking is permitted when the ranking metric is publicly disclosed in advance.<\/p><\/div>\n\n<h2 id=\"data\" class=\"c-sky\">Data privacy and cybersecurity rules<\/h2>\n<table class=\"h-sage\"><thead><tr><th>Control area<\/th><th>What the Directions require<\/th><\/tr><\/thead><tbody><tr><td><strong>Collection<\/strong><\/td><td>Need-based data only, with prior explicit consent and an audit trail.<\/td><\/tr><tr><td><strong>Phone permissions<\/strong><\/td><td>No access to contact lists, call logs, telephony functions, files or media. One-time access to camera, microphone or location is permitted only when necessary for onboarding or KYC and explicitly consented to.<\/td><\/tr><tr><td><strong>Borrower choice<\/strong><\/td><td>Let the borrower deny specific consent, restrict third-party disclosure, revoke consent and request deletion where required.<\/td><\/tr><tr><td><strong>LSP retention<\/strong><\/td><td>An LSP should retain only limited basic data necessary to perform the contracted service.<\/td><\/tr><tr><td><strong>Biometrics<\/strong><\/td><td>Do not collect or store biometric data unless an applicable statutory framework permits it.<\/td><\/tr><tr><td><strong>Data location<\/strong><\/td><td>Store data in India. If processed outside India, delete it there and bring it back to India within 24 hours.<\/td><\/tr><tr><td><strong>Privacy policy<\/strong><\/td><td>Publish rules for collection, storage, retention, use, sharing, destruction and breach handling, including relevant third parties. These controls also sit alongside India&#8217;s wider <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">DPDP Act requirements<\/a>.<\/td><\/tr><tr><td><strong>Technology standards<\/strong><\/td><td>The RE and its LSPs must comply with cybersecurity requirements stipulated by RBI and other relevant agencies.<\/td><\/tr><\/tbody><\/table>\n<div class=\"callout c-apri\"><p class=\"k\">Privacy compliance still needs security evidence<\/p><p>A privacy policy says what should happen. Access logs, encryption settings, API tests, vulnerability reports, consent records, deletion logs and vendor reviews show whether it actually happens.<\/p><\/div>\n\n<h2 id=\"checklist\">Operational readiness checklist<\/h2>\n<ol><li><strong>Inventory every DLA.<\/strong> Record its owner, associated REs and LSPs, URL, app-store links, activities and current CIMS status.<\/li><li><strong>Map the borrower journey.<\/strong> Trace acquisition, KYC, assessment, offer display, KFS, sanction, disbursal, servicing, repayment and recovery.<\/li><li><strong>Map the data journey.<\/strong> Record each field, permission, API, SDK, third party, storage location, retention period and deletion path.<\/li><li><strong>Test consent.<\/strong> Verify purpose-specific consent, audit trails, withdrawal, sharing restrictions and deletion.<\/li><li><strong>Secure the application.<\/strong> Run <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sast\/\">SAST<\/a>, dependency and secret scanning, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API security testing<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dast\/\">DAST<\/a>, mobile testing and <a href=\"https:\/\/www.osto.one\/resources\/blog\/what-is-vapt\/\">VAPT<\/a> before launch and after material changes.<\/li><li><strong>Secure the environment.<\/strong> Enforce MFA, least privilege, encryption, logging, monitoring, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture checks<\/a>, backups and incident response.<\/li><li><strong>Test borrower disclosures.<\/strong> Verify lender identity, KFS, APR, signed-document delivery, grievance contacts and recovery notices.<\/li><li><strong>Review LSPs.<\/strong> Track security posture, privacy controls, incidents, complaints, contract compliance and remediation evidence.<\/li><li><strong>Prepare certification evidence.<\/strong> Keep inventory, review records and control evidence ready for the official responsible for CIMS certification.<\/li><\/ol>\n\n<h2 id=\"osto\" class=\"c-sage\">How Osto supports DLA and LSP readiness<\/h2>\n<p>Osto brings the security controls around a DLA into one operating view: <a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API security<\/a>, mobile application assessment, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sast\/\">code scanning<\/a>, dependency scanning, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture management<\/a>, vulnerability testing, endpoint controls and continuous compliance evidence. That lets an RE or LSP connect a regulatory requirement to the control implementing it and the evidence showing that the control is running.<\/p>\n<p>For LSP oversight, the same evidence supports vendor due diligence and periodic review. For the DLA, findings from code, APIs, cloud and VAPT can be tracked through remediation instead of being left in separate reports.<\/p>\n<p class=\"related\"><strong>Primary source:<\/strong> <a href=\"https:\/\/www.rbi.org.in\/scripts\/NotificationUser.aspx?Id=12848&amp;Mode=0\" target=\"_blank\" rel=\"noopener\">Reserve Bank of India (Digital Lending) Directions, 2025<\/a>, issued 8 May 2025. This glossary is an operational overview, not legal advice.<\/p>\n\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\"><p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#fff;font:700 11px Inter,sans-serif;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p><p style=\"color:#fff;font:700 26px\/1.3 Inter,sans-serif;letter-spacing:-.4px;margin:0 0 12px;\">Know whether your DLA controls will stand up to review<\/p><p style=\"color:#cfd3ea;font:16px\/1.65 Inter,sans-serif;margin:0 auto 26px;max-width:520px;\">Map RBI requirements to the security controls, vendor reviews and operating evidence behind your digital lending environment.<\/p><a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#fff;color:#1c267a;font:700 16px Inter,sans-serif;text-decoration:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\">Get a free security assessment<\/a><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#fff;font:600 16px Inter,sans-serif;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\">Book a platform walkthrough<\/a><p style=\"color:#b3b8d8;font:13px Inter,sans-serif;margin:14px 0 0;\">Application security \u00b7 Compliance evidence \u00b7 One platform, everything<\/p><\/div>\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<details><summary>What is a Digital Lending App?<\/summary><p>A DLA is a mobile or web application with a user interface that facilitates digital lending. It may be operated by a regulated entity or an LSP engaged by that entity.<\/p><\/details><details><summary>What is an LSP in digital lending?<\/summary><p>An LSP is an agent of a regulated entity that performs one or more digital lending functions, such as customer acquisition, underwriting support, servicing, monitoring or recovery.<\/p><\/details><details><summary>Is an LSP the same as the lender?<\/summary><p>No. The RBI-regulated entity extends the credit and remains responsible for the outsourced activity. The borrower should be able to identify the actual lender behind each offer.<\/p><\/details><details><summary>Can an LSP operate a DLA?<\/summary><p>Yes. RBI&#8217;s definition includes DLAs operated by LSPs engaged by an RE as well as apps operated by the RE itself.<\/p><\/details><details><summary>Can an LSP work with multiple lenders?<\/summary><p>Yes. The DLA must display matching offers objectively, disclose unmatched lenders, use a consistent documented matching method and avoid dark patterns.<\/p><\/details><details><summary>Can a DLA access contacts and call logs?<\/summary><p>No. DLAs should not access contact lists, call logs, telephony functions, files or media. Limited one-time access to certain device facilities is allowed only when necessary for onboarding or KYC and with explicit consent.<\/p><\/details><details><summary>Where must digital lending data be stored?<\/summary><p>Data must be stored on servers in India. If processed outside India, it must be deleted from the overseas server and brought back to India within 24 hours.<\/p><\/details><details><summary>Do DLAs have to be reported to RBI?<\/summary><p>Yes. The RE must report all DLAs it deploys or joins, including LSP-operated DLAs, on RBI&#8217;s CIMS portal and keep the list updated.<\/p><\/details><details><summary>Who is responsible if the LSP breaches a requirement?<\/summary><p>The regulated entity remains fully responsible and liable for the acts and omissions of the LSP. Outsourcing does not dilute the RE&#8217;s obligations.<\/p><\/details>\n<p class=\"related\"><strong>Continue reading:<\/strong> <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">DPDP Act<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API Security<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/glossary\/sast\/\">SAST<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dast\/\">DAST<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">CSPM<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/blog\/what-is-vapt\/\">What Is VAPT?<\/a> \u00b7 <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">Types of VAPT<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A Digital Lending App is the borrower-facing interface for a digital loan. A Lending Service Provider performs one or more\u2026<\/p>\n","protected":false},"author":8,"featured_media":991,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[443,444,442],"class_list":["post-990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-digital-lending-app","tag-dla","tag-lending-service-provider"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=990"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/990\/revisions"}],"predecessor-version":[{"id":992,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/990\/revisions\/992"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/991"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}