Digital Lending Through an LSP: Who Is Responsible?

The arrangement breaches several conduct and outsourcing requirements:

1. Disbursement and repayment flow: digital loans must be disbursed directly into the borrower's bank account, and repayments must flow directly to the regulated entity. Routing disbursement through PayFast's prepaid wallet and repayments through PayFast's nodal account creates pooling and delay. This is a breach because it obscures the lender-borrower relationship and exposes customer funds to LSP failure.
2. Lender of record: the loan agreement names PayFast as 'lender partner' and QuickCash as 'capital partner'. The RBI-regulated entity must be clearly shown as the lender. The LSP is a service provider, not the lender.
3. Key Facts Statement: the KFS must be in a language the borrower understands and must disclose the annualised percentage rate, all fees, recovery mechanism, grievance redressal, and cooling-off. An English-only screen without APR fails this test.
4. Cooling-off period: a cooling-off period must be provided during which the borrower can exit the digital loan by repaying principal and proportionate interest without penalty. No cooling-off period is offered.
5. Data access: the app's access to the borrower's contact list is excessive. Digital lending guidelines prohibit access to phone resources beyond what is necessary for the loan.
6. Recovery conduct: recovery calls at 9:30 pm breach the Fair Practices Code timing restriction; recovery agents must not contact borrowers before 8 am or after 7 pm.
7. Board oversight and outsourcing: the board approved a 'technology pilot' without vendor risk assessment. Outsourcing does not transfer regulatory responsibility.

The board should not allow 'business as usual' while a remediation plan is prepared.

Immediate priority: stop ongoing customer harm. Suspend new disbursements until the recovery conduct and contact-list access are stopped. Direct that recovery be halted or re-contracted to a compliant agency, and that the app's data permissions be reduced to the minimum necessary.

Next: fix the money flow and legal documentation. Require direct disbursement to the borrower's bank account and direct repayment to QuickCash. Amend the LSP agreement and the loan agreement so QuickCash is clearly the lender. Remove nodal pooling.

Then: fix disclosure and exit rights. Issue a compliant KFS in the borrower's language with APR, fees, grievance redressal, and cooling-off. Implement the cooling-off period and refund any penalty charged for exit.

Then: governance and remediation. Conduct vendor due diligence and an outsourcing risk assessment; audit the 1,200 loans already written; set up a grievance redressal and remediation process for the 38 complainants; report the position to the board and consider whether any regulatory notification is required. The board should also fix accountability for approving a pilot without risk assessment.

QuickCash should reject the argument. Under the digital lending framework and RBI's outsourcing principles, the regulated entity remains accountable for the loan, KYC, pricing, customer conduct, grievance redressal, and recovery, irrespective of who owns the app or the front-end relationship.

The LSP is a service provider. It cannot become the lender by branding, and it cannot take over regulatory responsibilities by contract. QuickCash must therefore retain:

• clear disclosure of itself as lender in the loan agreement and KFS;
• ownership of, or at least unrestricted access to, customer data needed for KYC, servicing, and grievance redressal;
• audit rights over the LSP and its recovery agents;
• control over recovery conduct and complaint handling;
• a business continuity and exit plan if the LSP fails or the agreement ends.

A contract clause saying PayFast 'owns the customer' does not bind the regulator. It may also mislead borrowers about who their counterparty is, which is itself a fair-practices problem.