The LSP That Owns the Customer, the Money and the Data
QuickRupee, a lending service provider with 6 million app installs, originates personal loans of ₹5,000–₹60,000 through a small NBFC, Anandi Finserve. In the current flow: the borrower e-signs the agreement inside QuickRupee's app; ₹99 is deducted as a 'platform fee' from the disbursed amount before it leaves QuickRupee's escrow arrangement with a payments bank; the Key Fact Statement is emailed only after disbursal; bank statements and the phone's contact list are uploaded to QuickRupee's server in Singapore; recovery calls come from individual mobile numbers and mention 'the QuickRupee legal team'; QuickRupee provides a default loss guarantee equal to 9% of the loan book; a partner bank funds 80% under a co-lending arrangement. 62% of borrowers are first-time credit users and 34% of loans are rolled over within 45 days. Anandi's board note describes the model as 'a pure sourcing arrangement'. Internal audit has asked compliance for a red-flag list.
1. List the regulatory breaches in this arrangement and rank them by severity, explaining the reasoning for the ranking.
Read the worked answer
Highest severity - money flow and cost disclosure:
- Disbursal must go directly into the borrower's bank account. Routing through QuickRupee's escrow with a ₹99 deduction on the way breaches the Digital Lending Guidelines and puts the borrower's money in the LSP's control.
- The Key Fact Statement must be given before execution, with the all-inclusive cost, APR and recovery mechanism. Emailing it after disbursal defeats the purpose entirely - the borrower has already signed an agreement they cannot compare.
- Deducting an undisclosed platform fee from principal also inflates the effective rate, which is a fair-practices issue, not a formatting one.
High severity - data and conduct:
- Storing customer data on a Singapore server breaches the requirement that digital lending data reside in India.
- Uploading the phone's contact list has no lawful basis and captures data of people who are not customers at all.
- Recovery in the LSP's name, from personal numbers, breaches the rule that the lender is the face of recovery; personal numbers defeat call recording and supervision.
High severity - risk transfer: DLG at 9% exceeds the 5% ceiling and makes QuickRupee a de facto risk-taker, which contradicts 'pure sourcing'.
Medium - rollover: 34% rollover within 45 days suggests cooling-off and exit options are not being offered and credit limits are being increased without fresh consent. Anandi is the lender; it owns every one of these failures.
2. Redesign the disbursal and disclosure flow end to end. What does the corrected journey look like?
Read the worked answer
Corrected journey, in order:
- Offer generation on the NBFC's terms. Anandi's policy engine sets the offer, cut-off and limit; the LSP displays it with the lender's name prominently, alongside disclosure of all lending partners on the app and website as required by the 2025 aggregation-transparency directions.
- KFS before signature. Generated by Anandi, not the LSP, showing amount, tenure, all-inclusive APR, every fee including the ₹99, penal charges, cooling-off period and grievance contact. Delivered in-app, downloadable, and available in the languages the borrower uses.
- E-sign with an audit trail, followed by a mandatory cooling-off window with a visible exit that costs only the proportionate interest.
- Direct disbursal from Anandi's account into the borrower's verified bank account. The ₹99 is collected separately by a consented e-mandate, never by deduction from principal.
- Data stays in India. The LSP acts as a data processor under a written contract with purpose limitation, security obligations and no contact-list collection. Bank statements are fetched by an account-aggregator, not by upload.
- Recovery by Anandi or its appointed agency, identified as such, from recorded lines.
- Servicing dashboard inside the app: outstanding, next EMI, charges, complaint link.
Every step must leave an auditable record, because the point of the redesign is that Anandi can prove who disclosed what, when.
3. How should the default loss guarantee and the co-lending leg be restructured?
Read the worked answer
Default loss guarantee. Nine per cent exceeds the permitted ceiling of 5% of the loan portfolio and must be brought down within it. Beyond the number, the structure matters: the DLG must be a documented, legally enforceable guarantee from QuickRupee, with defined invocation events, no implicit guarantee language in marketing, and proper accounting and disclosure in Anandi's books. The revised arrangement must leave Anandi holding genuine credit risk and genuine underwriting discretion - if the guarantee is priced and invoked so that QuickRupee absorbs effectively all losses, the arrangement looks like a synthetic balance-sheet transfer and invites scrutiny of who is really lending. Also review whether the guarantee is being used to smooth over an underwriting gap: a 4.1%-type loss rate cannot be papered over by a guarantee.
Co-lending leg. If the partner bank funds 80%, that is a co-lending arrangement only if it complies with the co-lending scheme - the NBFC must retain a minimum 20% share, both parties must apply their own credit policies with independent credit sanction, and the arrangement needs a board-approved policy and a documented agreement. If the bank is simply funding 80% of whatever QuickRupee sources with Anandi holding no independent underwriting, it is not co-lending, it is a funding line dressed up as one.
Recommendation: pause new originations in the affected flow until the money flow, KFS and DLG cap are corrected; the other fixes can follow within 60 days with a board-approved plan.